undefined

points

[-]

> it's just that the web browser never chose to provide that.

Yes, this exactly. If we wanted ‘verifiable’ app distribution via browser, then we’d need browsers to implement some way to cross check the code downloaded vs a publicly published list somewhere - similar to certificate transparency or what WhatsApp is trying to do with an extension [1]. Without that, web apps are left working with a weaker threat model.

[1] https://engineering.fb.com/2022/03/10/security/code-verify

by palata4 hours ago|

parent|

[-]

Yep! Just nitpicking here, but...

> or what WhatsApp is trying to do with an extension

I remember looking into it, and while it is interesting, I think what it allows to verify is that the intermediary (Cloudflare, I believe) didn't tamper with the code being served. Which in the end allows the user to verify that the code they run comes... from the server they trust.

And even that is not super practical, I find.

by g-b-r3 hours ago|

parent|

prev|

[-]

It would already be a huge improvement if browsers warned you when a web app has been modified, and gave you its hash

by palata3 hours ago|

parent|

[-]

It would, but at this point, do you need a browser really? Like the big advantage of the web is that users load the latest version of whatever you serve, and they don't have to care about updates. In many cases that's desirable. But it fundamentally doesn't work for E2EE.

I am not trying to say "browsers should not exist, everything should be a desktop app". I guess I am more defending "some use-cases work better in a browser, others work better as desktop apps". And I have the strong feeling that over the last years (decades?) there has been a very strong push by web people to say "everything should run in the browser".

by g-b-r2 hours ago|

parent|

[-]

I wouldn't really say that the advantage of the web is that users load the latest version, there's plenty other real advantages of the web.

A browser allows you to run an app on any device (to a degree), so it definetely seems useful to me.

I'm actually not a fan of web apps, JavaScript and anything that came after XHTML, but it sure is/would be convenient to be able to run the same software on every device, without even having to recompile it.

The single reason I dislike browser "apps" is what we've been discussing here, that you can't check what you're running (well, also that it's hard to control their internet access).

by palata1 hours ago|

parent|

[-]

> I'm actually not a fan of web apps

Same here, I personally like to load "websites" in my browser, and to download "apps"... like as "desktop apps".

> but it sure is/would be convenient to be able to run the same software on every device

Oh yeah that's for sure. I can't help but to think that with a fraction of the resources that went into supporting webapps in browsers, it could have improved native systems a lot.

But even then, Kotlin MultiPlatform (KMP) is making me optimistic. With Compose MultiPlatform (CMP) I am hoping that it will make its way to desktop apps, too.

> without even having to recompile it.

If recompiling is the price to pay to have diversity, I'm fine with it. If 100% of the computers ran the exact same OS, it would simplify many things, but that one OS would certainly not be what I want to run.

> The single reason I dislike browser "apps" is what we've been discussing here, that you can't check what you're running (well, also that it's hard to control their internet access).

I dislike the fact that they force me to have a modern browser at all. I like having control over my OS, it's not for being forced to run everything in Google Chrome.

by g-b-r1 hours ago|

parent|

[-]

> I dislike the fact that they force me to have a modern browser at all

Yeah that's true

> But even then, Kotlin MultiPlatform (KMP) is making me optimistic. With Compose MultiPlatform (CMP) I am hoping that it will make its way to desktop apps, too

I personally hate Kotlin, but yeah it's one more option ;)