Unfortunately agreed. Browser sandboxing is usually quite a lot better than apps. The table they provide is rather biased though, many of the things they show in PWA's favor are only true in the most trivial sense, and are easily worked around, both technically and widely used in practice.
Also browsers can use extensions to modify pages, and that opens up SO many possibilities. And bookmarks. And history. And tabs. And search. Most apps never implement any of these, much less all.
I do wish we had a more widely supported system for push notifications though. WebPush exists and broadly works quite well, but provides nowhere near the control, reliability, and observability that native apps do. ...which is a good thing when you don't want them, but crippling when you do, and it contributes to the general "few sites do it at all" problem. E.g. Slack doesn't use it, nor does Zulip (particularly painful because their mobile web UI is much better than their app), nor most chat apps in general even though they're an ideal scenario.
For me as a user, not having notifications or having a way to easily block them is a boon. No site is sending me right now notifications, and I have yet to meet one where I'd even consider allowing them.
I have not seen good web apps like native apps on Mac OS X of period let's say up to Mavericks. Web apps often forced single rectangle. I can group my chats in iChat and Adium into different windows as I want, but WhatsApp and WeChat force all chats into single rectangle.
There is a program for Windows called StarDock Groupy, it can group windows into tabs. It could be useful, but not as much because of horrible rectangular design. I cannot extract several WhatsApp chats from rectangle, to group them with office document we discuss. There are multiple desktops in Windows, but rectangular programs do not permit sorting different chats to different desktops.
If web app permits opening in several windows at once, then drag-n-drop does not work between windows as good as it works in native apps like iChat and Adium.
I often see that applications pretending to be native, are in fact based on browser, and inherited all constraints, and are forcibly rectangular. Such quasiapplications, of course, no much benefit to install natively on desktop.
Good native apps exist, although rare and getting more so, and for a lot of workflows are better than websites.
That said, all the privacy reasons listed apply just as much to websites as they do apps.
I have to disable noscript a lot when it comes time to fill out what is glorified <input type=“text” /> for a lot of day to day transactions. Especially anything involving a credit card these days.
I think you'll find native apps have significantly more access to your devices than websites.
Just the simplest example, apps can intercept web requests. On iphone if you get a link to amazon.com through text message/email/browser, the amazon app can intercept and handle those requests.
or camera, microphone, location, bluetooth, nearby interactions (uwb), push notifications, background services, photo roll, contacts, calendar, local network, etc...
Any popular website, barring this one & lobsters, run a number of trackers. Likely not even needing direct device access to figure out all the things you think are private.
Some hotkeys are hard or unusable (e.g. some of the ones that conflict with the browser itself, like esc and ctrl-l and ctrl-t/w/q). Plenty work just fine.
I love using the Twitter web app over the native app. And whenever I think of a product, I think of how I can build a fully usable web app (even when primary access is via phone).
This article is over-stating the capabilities of mobile apps at least on iOS.
Mobile apps can't run on device startup on iOS.
They can't modify or delete device storage outside of your sandbox.
Same with Access contacts, call logs, SMS. Contact yes, but you have to give explicit permission and you can't access call logs or SMS.
I just stopped reading this because whoever is writing is overstating their case. Maybe the case is different on Android, but last I saw Android is slowly moving toward the granular permission model that iOS does with their data.
I dunno what’s worse: having no data footprint when you apply to rent from this landlord who is doing bulk data purchases and de-anonymizing it to screen you, or having the wrong data footprint.
Native applications should be insisted upon. Web applications are not under the control of the users in any form and what they do can be changed without the users input even as the user is in the middle of a session of using the software. Website applications can also just dissapear and often do. Additionally any given website 'app' will be loading unknown executable code from random arbitrary sites. Usually spyware. This kind of thing is far more easily detected and justifiably blocked when you run a native application. A native application installed on a computer is yours to use as is till you decide to change it or allow it to change.
- Write emails to companies that provide desired services that way suggesting they make an actual application.
- Revoke all JS execution permissions from all domains that are not verifiably in control of only the company running that web app.
- Audit your use cases and try to find native applications that can fulfill them instead of web apps.
- Try not to use web apps on domains that you have no control of.
- Treat every domain trying to get you to execute random code like you would receiving a .exe in the email from a similarly unknown person or address.
The idea that most native applications collect more information than web apps is false. It is only true in the very restricted domain of smartphones. It is obvious to everyone in practice and in law that users of smartphones do not own them or control them and will not be allowed to. The problem is the smartphone, not native applications. Giving up even more control and ceding everything to a remote web service, will make this worse, not better.
And yes, copying this article's structure for my response is intentional parody.
I get the feeling this article is just about mobile apps, which you clearly think is an irremediable platform for some reason. Given ths choice between native mobile apps, locked down by two massive tech companies and web apps, I'll take the latter.
I think both you and OP miss the fact that there isn't a single best answer, and that it depends on what each user cares more about as to which solution makes the most sense.
Unfortunately agreed. Browser sandboxing is usually quite a lot better than apps. The table they provide is rather biased though, many of the things they show in PWA's favor are only true in the most trivial sense, and are easily worked around, both technically and widely used in practice.
Also browsers can use extensions to modify pages, and that opens up SO many possibilities. And bookmarks. And history. And tabs. And search. Most apps never implement any of these, much less all.
I do wish we had a more widely supported system for push notifications though. WebPush exists and broadly works quite well, but provides nowhere near the control, reliability, and observability that native apps do. ...which is a good thing when you don't want them, but crippling when you do, and it contributes to the general "few sites do it at all" problem. E.g. Slack doesn't use it, nor does Zulip (particularly painful because their mobile web UI is much better than their app), nor most chat apps in general even though they're an ideal scenario.
For me as a user, not having notifications or having a way to easily block them is a boon. No site is sending me right now notifications, and I have yet to meet one where I'd even consider allowing them.
You don't want notifications from any chat apps?
Nope, those are the worse.
I have not seen good web apps like native apps on Mac OS X of period let's say up to Mavericks. Web apps often forced single rectangle. I can group my chats in iChat and Adium into different windows as I want, but WhatsApp and WeChat force all chats into single rectangle.
There is a program for Windows called StarDock Groupy, it can group windows into tabs. It could be useful, but not as much because of horrible rectangular design. I cannot extract several WhatsApp chats from rectangle, to group them with office document we discuss. There are multiple desktops in Windows, but rectangular programs do not permit sorting different chats to different desktops.
If web app permits opening in several windows at once, then drag-n-drop does not work between windows as good as it works in native apps like iChat and Adium.
I often see that applications pretending to be native, are in fact based on browser, and inherited all constraints, and are forcibly rectangular. Such quasiapplications, of course, no much benefit to install natively on desktop.
Most of those arguments make a very strong case for native apps obtained from F-Droid.
I appreciate you putting you're opinion out there.
Fully disagree though
Care to explain why?
Good native apps exist, although rare and getting more so, and for a lot of workflows are better than websites.
That said, all the privacy reasons listed apply just as much to websites as they do apps.
I have to disable noscript a lot when it comes time to fill out what is glorified <input type=“text” /> for a lot of day to day transactions. Especially anything involving a credit card these days.
I think you'll find native apps have significantly more access to your devices than websites.
Just the simplest example, apps can intercept web requests. On iphone if you get a link to amazon.com through text message/email/browser, the amazon app can intercept and handle those requests.
or camera, microphone, location, bluetooth, nearby interactions (uwb), push notifications, background services, photo roll, contacts, calendar, local network, etc...
Of course.
Any popular website, barring this one & lobsters, run a number of trackers. Likely not even needing direct device access to figure out all the things you think are private.
I thought hotkeys were hard to do right in a web app too? Yet the article completely misses that.
Some hotkeys are hard or unusable (e.g. some of the ones that conflict with the browser itself, like esc and ctrl-l and ctrl-t/w/q). Plenty work just fine.
This article is about mobile apps.
Oh, you're right.
sad that its true, because people have so little control over their devices that it's more reasonable to use a system off your device.
but if your really want control over your data you might want to use self-hosted systems...
I love using the Twitter web app over the native app. And whenever I think of a product, I think of how I can build a fully usable web app (even when primary access is via phone).
With my hypnotic power, I predict you’re are an Android user
This article is over-stating the capabilities of mobile apps at least on iOS.
Mobile apps can't run on device startup on iOS. They can't modify or delete device storage outside of your sandbox. Same with Access contacts, call logs, SMS. Contact yes, but you have to give explicit permission and you can't access call logs or SMS.
I just stopped reading this because whoever is writing is overstating their case. Maybe the case is different on Android, but last I saw Android is slowly moving toward the granular permission model that iOS does with their data.
Given eu regulators will likely kill pwa with the dma I doubt there is any future there
I dunno what’s worse: having no data footprint when you apply to rent from this landlord who is doing bulk data purchases and de-anonymizing it to screen you, or having the wrong data footprint.
Users want simplicity. Derive conclusions from that.
Why this got flagged? So weird
Native applications should be insisted upon. Web applications are not under the control of the users in any form and what they do can be changed without the users input even as the user is in the middle of a session of using the software. Website applications can also just dissapear and often do. Additionally any given website 'app' will be loading unknown executable code from random arbitrary sites. Usually spyware. This kind of thing is far more easily detected and justifiably blocked when you run a native application. A native application installed on a computer is yours to use as is till you decide to change it or allow it to change.
- Write emails to companies that provide desired services that way suggesting they make an actual application.
- Revoke all JS execution permissions from all domains that are not verifiably in control of only the company running that web app.
- Audit your use cases and try to find native applications that can fulfill them instead of web apps.
- Try not to use web apps on domains that you have no control of.
- Treat every domain trying to get you to execute random code like you would receiving a .exe in the email from a similarly unknown person or address.
The idea that most native applications collect more information than web apps is false. It is only true in the very restricted domain of smartphones. It is obvious to everyone in practice and in law that users of smartphones do not own them or control them and will not be allowed to. The problem is the smartphone, not native applications. Giving up even more control and ceding everything to a remote web service, will make this worse, not better.
And yes, copying this article's structure for my response is intentional parody.
I get the feeling this article is just about mobile apps, which you clearly think is an irremediable platform for some reason. Given ths choice between native mobile apps, locked down by two massive tech companies and web apps, I'll take the latter.
I think both you and OP miss the fact that there isn't a single best answer, and that it depends on what each user cares more about as to which solution makes the most sense.
> Apple requires apps to submit a privacy manifest disclosing what data they collect. The White House app declared an empty array.
Doesn't make sense to have an honor system for it. Rather grant access to device capabilities based in what an application declares