Hacker News Reader

Comment by smcleod | Hacker News Reader

As a user - I don't want web based "apps" - I actively avoid anywhere I can.

I want native apps - they better align to my operating systems native UI/UX, are more performant, have less (potentially insecure).

Yes - Platform APIs absolutely should be made available to varying technologies where security is less of a concern, But I'll take a few high quality apps over a plethora of 'creative' web-apps any day of the week.

If you only need a website - just have a website, you don't need an "app" to order a beer at the pub.

In my experience a large majority of people that want other people to use web-apps / glorified chrome wrappers are those that write them and often (but not always) have a vested interest promoting getting their product/features out the door over quality, performance and security.

View on HN

Apps are not always more secure. I have a baby monitoring app that is always using my mic on Android, even though i have "only when I'm using the app" enabled. I can close a website, and it's gone. I cannot just close an app - those little suckers are running 24/7 doing god knows what

For sure - I didn't say they're always more secure. But in general - the majority of (maintained) applications that have less dependencies tend to be. Just have a look at the insane number of NPM packages a node application includes - good luck running (timely) automated analysis across all of those let alone maintaining the dependency tree.

> the majority of (maintained) applications that have less dependencies tend to be

As a mobile dev (and sometimes web dev) I can tell you that dependencies (implicit and explicit) are numerous in even the most basic of apps.

> good luck running (timely) automated analysis across all of those let alone maintaining the dependency tree

`npm audit fix`? There's nothing even like this on Android or iOS.

> `npm audit fix`? There's nothing even like this on Android or iOS.

Because you don't need anything remotely like this for any proper app platform. I know of a complex web app that has more than half a million entries in its yarn.lock file. Five. Hundred. Thousand. Dependencies (of dependencies of dependencies of...)

Because there's literally nothing on the web that is suitable for app development, and you have to build the entire world from scratch, one dependency at a time, every single time.

And of course npm audit fix will not fix it because in true npm fashion even a minor update can trigger cascading failures across large swaths of the code you didn't even know were pulled in.

> I know of a complex web app that has more than half a million entries in its yarn.lock file. Five. Hundred. Thousand. Dependencies (of dependencies of dependencies of...)

I can't say I've seen anything like that in practice. I don't know why the app has that many dependencies, or of an analogous mobile app of similar scale and complexity to the nameless example you've cherry picked.

> Because there's literally nothing on the web that is suitable for app development, and you have to build the entire world from scratch, one dependency at a time, every single time.

Bit exaggerated, but I take your point.

The point of TFA, if we go back to that, is that ideally more functionality should be folded into the browser to reduce this redundancy. The undermining of web browsers by vested interests is precisely what makes web apps insecure in the manner you've described. And here you are defending the status quo – so it's mission accomplished from the perspective of Apple and Google.

The unseen dependencies on any mobile device are the operating system libraries, which vary from vendor to vendor, and have far greater privileges than a web app.

> And of course npm audit fix will not fix it because in true npm fashion even a minor update can trigger cascading failures across large swaths of the code you didn't even know were pulled in.

I call `npm audit fix` quite regularly and without issue. If you let it go stale, you're going to spend quite some time upgrading everything, irrespective of package management system. Can't tell you how much time I've wasted on upgrades with Gradle/SPM/Cocoapods/Carthage. So my gut says unless you either haven't spent much time in the mobile app development world, or you're being a bit disingenuous to make your point.

As a user, I actively avoid installing apps from restaurants and stores. Web apps are far superior and don't waste flash write cycles updating themselves repeatedly or complaining that they need to be updated if I turn off automatic updates. Also, web apps are easier to modify with extensions than native apps are to modify with Vanced-like patching.

Sure - that's just a prime candidate for a website isn't it? I don't see why you need any form of app for that.

Agreed. The problem with web ‘apps’ (as opposed to web ‘pages’) is that they are completely controlled by the remote server. They turn your computer into a thin client controlled by “the cloud” where every mouse movement can be used to track and profile you. This is why Google wants to crush Safari. The ideal is locally running libre software implementing open protocols. Web pages should be static documents only. Apple of course wants proprietary local apps so i dont support either Google or Apple’s vision.

You clearly never looked into how much tracking mobile apps have. There are a lot of tracking SDKs which literally track every click. At least on the web you can block things where mobile is black box.

You have a lot more control over things running on your device / network - regardless of what they _try_ to do.

Your browser is running locally on your own network. These comments are out of touch with the reality of web and native apps of the last decade

> The ideal is locally running libre software implementing open protocols

In contrast to the typical mobile user, this is a very niche M.O. Not practical for most I would say.

This is exactly what mobile apps are as well though. All apps today are thin clients utilizing a remote backend

That's not even close to true, I suspect you're severely biased as to how you use a mobile device.

Only about half of my most used mobile apps are used online let alone 'a thin front end for remote backend'.

Bear, Obsidian, Camera, Activity / Health, Things, Photos, Pixelmator, Hue, Music, iMovie, Home, AiWriter, Prompt, Water Minder, Yomu - I use all of these primarily offline / locally.

Even the apps that are very much for use with online services aren't simply thin wrappers - they're proper applications that fetch remote data when online, store and process locally - Podcasts / Overcast, Reeder, Mail, Working Copy, 1Password (7), LunaSea, Audible, Plex etc...

And if I think about what the apps on my phone that are closer to "thin" clients - IMDB, Goodreads, Banking, LinkedIn, Amazon, Slack etc - all of which are pretty janky compared to those previously mentioned.

What do you think most apps are? Frontends to some faraway backend web service. With some TLC most users wouldn't know the difference.

Maybe for you - see https://news.ycombinator.com/item?id=34254339

I think the issue is that generally speaking making an app takes more time and resources than building a website so it locks smaller players out and reduces choice to some extent. It makes things more centralised. Sure you can build something in react native but it requires a hell of a lot more skills than whipping up some HTML and pouring your heart out…

Forgive me for inferring your reasons, but the reason you actively avoid web based apps is because the web app experience is inferior to native apps because (or at least as the thread claims) Apple and Android actively sabotaged support for web apps favoring improving native features instead of improving and supporting web features.

No, they're terrible on the desktop where they've unfortunately become ubiquitous.

Agreed. Web apps are a last resort, to be used grudgingly with gritted teeth if no native apps are available.

I agree with you.

Reply on news.ycombinator.com