Ask HN: Is WebDav still relevant? | Hacker News Reader

Ask HN: Is WebDav still relevant?

80 pointsdevj55 comments

Has it been abandoned totally?

It would be really helpful if anybody who has used WebDav can actually share their experience on what worked and what didn't work for them?

View on HN

The short answer is Yes.

WebDAV provides a foundation that many things are built on. As others have noted there is CalDAV and CardDAV that many use all the time.

But, it goes beyond that. WebDAV has many of the features we regularly use in object storage. Yet, object storage provides often have their own proprietary API or clone someone elses proprietary API. WebDAV is an open spec.

Because WebDAV has been around for so long, there are integration's with just so many things which make it easy to get something going out of the gate. For example, all the major OS support working with it.

Not only is it relevant for this but with all the discussions on reviving more of the open web... this is a piece worth looking at.

One thing I find funny is that Windows does support CalDAV and CardDAV, but only via the fact that they support iCloud. Getting my FastMail contacts into a Windows 10 device required that I create a fake iCloud account, and then edit the server address to point at FastMail and put in the correct credentials.

This is an interesting take, I've talked previously about using SVN as the underlying backing store for a versioned object store (using the auto versioning feature to allow plain webdav writes), and of course plain webdav is the 'unversioned' companion service for that.

The Subversion HTTP protocol is WebDaV, so it is most certainly a living standard. Microsoft Office (used to?) support WebDAV URLs in its open dialog, I imagine that's still the case. I'm pretty sure it sees wide use in Microsoft stuff come to think of it. FrontPage used to use it, Sharepoint uses it(?). I suspect some more of their non-Office authoring tools

Oh - hell - yes, and Microsoft IIS. That was a big user back in the day, again for FrontPage integration, but you could use it generically too

And of course, Windows and OS X still support mounting WebDAV URLs as drives.

edit: it ain't going anywhere: https://www.ics.uci.edu/~ejw/authoring/implementation.html

there's also the httpd module https://httpd.apache.org/docs/2.4/mod/mod_dav.html

and the tomcat module https://wiki.apache.org/tomcat/Tomcat/WebDav

however, each and almost every of them speak its own dialect, so client compatibility will be spotty.

IIRC all Windows open dialogs support WebDAV browsing and opening.

It's actually pretty neat.

Windows will download the file to a temporary location (while blocking the UI thread for this!) and then pass the path of that temporary file to the application. It works but is far from perfect - I won’t be surprised if it drops support for that little trick in a near release of Windows. I still want to know why Windows supports this yet still doesn’t ship with a native command-like equivalent to curl or wget (PowerShell doesn’t count)

Why wouldn't PowerShell count? It's the standard scripting and command environment for modern versions of Windows.

As of Windows 10, Microsoft has even phased out cmd.exe from the menus and for shortcuts like Win+X. It's still possible to get the legacy environment back, but it's exactly that: a legacy environment.

Windows ships with native curl(.exe) now [1]. (Though PowerShell is great, and I think it counts, personally.)

[1] https://blogs.technet.microsoft.com/virtualization/2017/12/1...

Curl has had a Windows version for a while but they used to alias curl to Invoke-WebRequest which was super irritating. I just use curl via WSL now.

Yes, I have used it to mount document servers as remote drives via WebDAV, and then use standard Unix one-liners to do queries and updates. Much more convenient than working with custom APIs.

I also once integrated an open-source WebDAV server into my own code, in order to expose parts of an SQL database as a remotely mountable filesystem. This would have taken much more effort without the existing WebDAV infrastructure.

CalDAV, which is an extension of WebDAV, is widely used for read-write access to a remote calendar. I don't know of any other protocol which is replacing this, although there are bound to be some that technically could. Google, Apple and open source projects like the 'Lightning' Thunderbird extension support CalDAV, at least in part.

iCloud contacts & calendars are still CardDAV/CalDAV under the hood.

> I don't know of any other protocol which is replacing this

JMAP: https://jmap.io/spec.html.

The core and mail specifications are where the focus is, and they’re what’s currently approaching standardisation in the IETF, but there are also the calendar and contact specifications in progress, which are designed to replace CalDAV and CardDAV. I don’t think they’re getting a great deal of attention now, while core and mail are finalised, but once those are done I expect more attention will come to them. (In the mean time, I believe we’ll be speaking the calendar and contact JMAP drafts in FastMail when we switch over to JMAP.)

The ability to do everything over one protocol instead of at least four—IMAP, SMTP, CalDAV and CardDAV—is one of the nice things about JMAP.

Out of curiosity, have any of the major providers stepped up and talked about supporting JMAP yet, or demonstrated interest? As someone well out there in third party client land, I can't very well expect to find many JMAP clients out there for my random-given-platform if your Googles, Microsofts and Oaths(Yahoo/AOL) aren't on board. (Obligatory <3 FastMail)

We have been speaking with engineers at most of the large mailbox providers and server developers for many years, and made changes to the JMAP spec based on their feedback to make sure it can work for them. You will also find feedback and contributions on the IETF mailing list from some of them. We can’t speak for another company’s product plans however.

Apparently, according to this thread, WebDAV is alive and thriving.

CalDAV and CardDAV are certainly alive, but I think they're in a pretty horrible place.

I run a Radicale server, which seems very nice, but configuring clients is a nightmare. Every client seems to require different settings, and work to differing degrees.

The native Contacts/Calendar apps on OS X were the worst. They connect, work for a few hours or days, and then permanently break. I have to delete and re-add the accounts over and over again until eventually the same settings suddenly work, and they work for some hours or days, and then break again.

Thunderbird consistently works, as does Android's DAVdroid, but other clients I've tried have been almost-hit-or-completely-miss.

emacs –– EMACS –– has terrible support. This might not sounds like much, what with it being a text editor and all, but this is exactly the sort of place where it usually has 15 different implementations, 2 or 3 of which are really nice. Instead, it's riddled with XML parsing errors, the biggest CalDAV client deletes all of your TODO entries, and there doesn't seem to be a single CardDAV library. I take this as a sign that those protocols are not being widely embraced.

That said, when they work they are truly fantastic. I don't particularly care about the underlying protocol, but I pray that CalDAV and CardDAV support gets more consistent and more popular.

Erm, I hope it is. My Nextcloud uses WebDav, CalDav, CardDav and a whole host of other things to sync everything from files to bookmarks and calendar appointments.

Absolutely! Nextcloud and Owncloud both use WebDAV. I have a couple of TB on one Netxcloud with a few dozen users and a few 100GB on another with >600 users.

Yep, using WebDav with Nextcloud too - much nicer to use than the official desktop client, IMO.

I work with Salesforce Commerce Cloud all day. HTTP(S) is the only protocol you can talk to it with, so WebDAV is used constantly to upload code and product images. It's not painful to use, but when PCI requirements made TLS 1.2 mandatory, we had to look around for upload clients that supported WebDAV over TLS 1.2 specifically.

It's still used for a project with another team at my work. For some reason, regular old FTP wasn't good enough for deployment, so this is what they use. They use Microsoft Expression Web 4 to upload/download files, which itself is no longer supported, I believe.

One of the reason I'd prefer WebDAV to FTP from an operational perspective is that WEBDAV needs just one port open whereas FTP needs either connection tracking, which does not work with TLS, or an open port range for its passive connections.

I've used WebDAV successfully for a client's network storage system.

I use Apache2 + SQLite for the authentication, here is an example configuration: https://gist.github.com/aurorabbit/36c509ddeeba2b97c3019534f...

I use buildroot for creating a minimal linux install.

Cryptomator[0] uses WebDAV to locally mount its encrypted vaults natively in the operating system.

Also provides vault URLs so you can use third-party clients if need be on a local (and configurable) port.

[0] https://cryptomator.org

WebDAV is still one of the main protocols for pushing HLS live streams to CDNs

source?

I use Apache to run WebDAV at home for my various OmniGroup applications - I like self-hosted cloud/sync services, so I hope OmniGroup continues to support WebDAV for the forseeable future.

Yes, I use Zotero (a reference manager) which uses WebDav for file sync to a Nextcloud server. You can also use davfs to mount a Nextcloud share.

When I was shopping around for a Sony Digital Paper tablet I noticed that the original model did in fact support WebDav, I thought that would be ideal, I could have all my notes dump themselves onto the office NAS without any additional proprietary shitware getting involved.

No. And I'm surprised by all the other comments. There are some big systems still using CalDav but the promise of WebDav as read-write version of HTTP got very little adoption and the dev community stopped talking about it years ago.

WebDav never replaced SMB/CIFS/NFS and is mostly implemented by few websites.

It's unreliable; a tangle of half-implemented standards and incompatible clients, and it's uninteresting as a file system that lacks basic features, like locking, server-side search, etc...

Seconded this thread, don't understand all other laudatory threads.

Tried again recently, Windows 10 with latest apache webserver fails hard on simple tests.

Some technologies must just die and disappear.

I still see it as an option in some places, but I don't ever see it used.

It had a lot of promise, but very poor actual implementation. I'd still like to see a generalized, cross-platform replacement for SMB/NFS/CIFS.

I tried to use it as replacement for ftp for deployment 14 years ago, in part because I could mount a drive and perform some costly (for a VM at that time) sanity checks on the deployment. It was OK, but too unstable on that kind of connection. Now with jenkins, sonar, docker... CI/CD has become way easier. Also cloud services with a REST API replace pretty much any functionality offered by WebDAV in a simpler, more efficient, more versatile, more interoperable and scalable way, so... Not relevant anymore, I think.

Yandex Disk cloud storage service uses it as a main protocol. They have added some proprietary extensions for their native client, but simple mounting also works.

It is still compiled into nginx by default. That is one of the reasons I have to compile it myself. That would suggest a number of people still use it.

You compile it yourself in order to disable WebDav?

Yes. I remove about a dozen modules. If I can leave out code I do not use, then future vulns around that code won't apply to me. The code is still present even if it is not enabled in the configuration.

I also compile it for other reasons, including getting the latest version and applying all the libc hardening options and using the latest pcre. I do this for about a dozen internet facing daemons. It takes about 9 minutes for all my packages to compile.

Smart move. That technique was used in the Poly2 project among others:

https://www.cerias.purdue.edu/assets/pdf/bibtex_archive/0125...

http://projects.cerias.purdue.edu/poly2/

Ever since I saw eCos OS, I wanted every OS to come with both the ability and a GUI tool to just check off all the features I want, compile kernel with just those features, and create installer for that kernel. Current tech in repos should even let one create that configuration automatically based on what packages they wanted or have already installed in a sample system (eg bare metal or VM). Could also use program analysis where features are dropped if they're not called and/or info from security policies like SELinux for further constraints.

I really like the simplicity of WebDAV especially when combined with Docker. HTTP just works.

Have you ever tried to properly set up samba or NFS in a container?

I can run WebDAV both client and server on my iPhone, which makes it pretty convenient to transfer files to and from it.

WebDAV is a fantastic file system for the web. It comes built in with auto-resume (content-range header), and in a world where everything but HTTP and HTTPS ports are blocked, I see it as increasingly useful.

It works great. Implementations are badly missing a standard MFA mechanism.

Salesforce Commerce Cloud uses client side certificates (in addition to username + password) on WebDAV uploads. They're a pain to set up, but clients aren't too painful to use with them.

I’m using WebDAV for my OmniPresence Sync (syncing OmniGraffle and OmniOutliner, OmniFocus, and DEVONThink.

Usually if you have a desktop/mobile application that has a self hosted setup they are using WebDAV.

I believe Adobe's CMS, Adobe Experience Manager, supports WebDAV.

Not for anything useful. I've done a bunch of installs and webdav was never part of the implementation.

Look into crdts. Much cleaner, simpler and powerful.

https://en.wikipedia.org/wiki/Conflict-free_replicated_data_...

Short answer: Yes. Refer to all the comments here.

YES,

It is done and finished.

Webdav was mostly used to provide "easy" access to webdevelopers where at time were using IDEs for Flash (Macromedia) and HTML (Frontpage).

Once they finished from the IDE they upload the files.

But webdav is a mess to setup (servers and permissions) and was deprecated to better protocols (ssh, scp).

I've been doing some web davalopment and can say that React and Node have worked for me, a web davaloper.

If you were trying to be funny, the humor did not come through. Puns often get lost in text.

I took this to mean a mispelling of webdev and was giggling at the thought of hackernews being so far ahead of the curve and/or hipster that someone outright asks that question. I was sad to not see responses entertaining the idea.

I don't know anyone using it since Microsoft Frontpage[1] went out of fashion almost 20 years ago.

[1] https://en.wikipedia.org/wiki/Microsoft_FrontPage

Reply on news.ycombinator.com