Hacker News Reader

Comment by _sdegutis | Hacker News Reader

I'm not one to be super paranoid about security and privacy on websites, but the other day I was working on a PWA for the first time for a new client, and when I clicked "show service workers from other domains" in Chrome, I see community.aseprite.org, discourse.gohugo.io, vuejs.org, forums.dotnetfoundation.org, lodash.com, www.cnet.com, www.meetup.com, www.google.com/maps, www.pinterest.com, www.wired.com, and xhr.spec.whatwg.org. I get why half of these sites think they need it (the news websites and web 3.0 forums, so they can update themselves in the background maybe?) but service workers for the lodash, whatwg, vuejs sites? This seems just plain unnecessary.

View on HN

Those other sites do it so that they're available offline. Service Workers give you control over network caching so you can return an cached/offline copy of the content.

I remember when this was actually a feature of web browsers. In the File menu you could just click "Offline mode" when you were offline, and it would return everything from cache. And then one day that menu option was just gone. Now the web has an opt-in way for sites to do this themselves. It feels pretty convoluted. Then again Web 3.0 feels pretty convoluted in general. It's as if the iPhone SDK came out and suddenly set the standard on how convoluted development ought to be, and every other platform followed suit.

Firefox has it. Menu > More > Work Offline.

Safari has a similar ability called "Reading List". And even saving pages as a webarchive. The problem with both are that modern websites depend so heavily on XHR that caching the initial page assets is essentially absent of the content desired, and thats what service workers can help fix.

It's like that functionality has just been forgotten and then this generation's hip coders thought it up again in their convoluted "everything is dynamic and JavaScript" mindset. Like with 200 other things regarding web browsers.

Exactly my same feeling. And what's worse, is that I don't really know what those entries (.js files) can do. Can they exec code whenever they want? Or every hour? Or every minute? Can they see what I do? Can they call home (and know my IP even if I'm not visiting those websites)? Why do I have to read a technical spec to learn about this?

To my knowledge they can only execute code in response to a network event. Usually this means you need to take some action to trigger an outgoing network request, like returning to the site that installed the service worker. Code execution can also be triggered by incoming network events such as push notifications but these would require you to have allowed push notifications from that site.

Reply on news.ycombinator.com