Things engineers believe about Web development
birtles.blog
birtles.blog
The problem isn't so much those but how most developers lump themselves in with the incredibly interactive sites because it sounds sexier and cooler to work on something complex than something simple. The phrase becomes "well, what about Figma and Photoshop (and my mostly CRUD SaaS)?"
I think a valuable insight that the MPA / minimal JS crowd is bringing to the table is the idea is that you shouldn't strive for cool and complicated tools, you should strive for the simplest tool possible, and even further, you should strive to make solutions that require the simplest tools possible whenever you can.
Why do you believe this? I couldn’t disagree more. People should strive for the most effective tool, and most of the time that’s what they already know, unless some new tools’ efficacy outweighs cost to learn it
....which any proponent of the new tool will argue it does
SPA, MPA, who cares. Ship.
- Scalpel, forceps, who cares, do surgery.
- Reinforced concrete, 2x4s, who cares, build a bridge.
No, pretty much every profession that uses tools cares about using the correct tools for the job.
If there’s an actual issue like there was with deaths in the medical profession due to not washing hands, then they evaluate.
2. Software development is a little unique as an industry since it's not all that common that the users of the tools are also the people who make the tools. There's naturally going to be a lot of discussion about tools if you're both the maker and the user of them.
3. Us not having a standard for which tool to use is a reason to have these discussions, not a reason to say "pick whatever, it doesn't matter". The reason that those people don't write blog posts and have discussions about the merits of a hammer vs. a screwdriver is precisely because they're so well established - if both were a couple of years old, absolutely people in construction would be discussing whether to use nails or screws for an application.
MPA frameworks tend to present themselves as complete and batteries included. If you're using Rails, you can build a complete application without thinking about a single other library than what Rails ships with.
Neither approach is correct, but comparing them is like saying that HTML is so much simpler than C++ so everyone should use HTML.
If you want to build a vector editor in the browser then yes, probably you want to leverage webassembly, canvas, webgl or whatever you fancy.
But if you're building a more basic application (like most CRUD SaaS actually are) then probably you don't want to over-complicate it, as you instead want to be able to change and iterate quickly, so simplest tools and solutions gives you the most velocity for changes, until you've figured out the best way forward.
Trouble is to recognize where on the scale of "Figma <> news.ycombinator.com" you should be, and it's hard to identify exactly where the line gets drawn where you can justify upfront technical innovation in favor of true-and-tested approaches.
If you're a tech lead, your worst nightmare is when you have to say - "this is very difficult to do with the current stack. When we were choosing this stack, we assumed you'll never want these things". You're not going to extract a binding promise from product/business that they will never want a certain class of things - you can only guess, and then hope, that the product will remain a dumb CRUD.
One thing that I'll always view as a smell though is "we don't need X now, but we might need X in the future, so we should adopt this more complex technology just in case". We've learned that lesson MANY times as developers, it's not any less true for front-end technologies.
I think a good heuristic is looking at whether the UX of your app feels more multi-page or single page, that should be a pretty big factor in your decision.
Especially as one man teams it just doesn't make sense. Any on teams with multiple people having relatively static HTML is a really effective abstraction.
In practice, you can make both as complicated as you want, but SPA seems like a simpler starting point.
Most MPA apps treat the browser and front end as dumb clients basically - strictly responsible for putting stuff on a screen
SPA excel in complex interactions if you need only very simple forms it will be PITA
developers are salarymaxxing first, second virtue signaling to support their case in their employers' selection process, third work-minimization and pain-minimization. Even the Simplicity Paladins are min/maxxing the same three priorities, perhaps weighing pain-minimization above salarymaxxing, yet still subject to the same invisible macro forces that shape our lives. and I postulate that this is a complete explanation of developer behavior at scale.
Most developers I’ve worked with have just been interested in solving problems.
I'm not planning on experiencing it either in the future. Though I'm sure some people like this kind of environment, and good for them.
Here's an example of libreoffice running entirely in the browser: https://lab.allotropia.de/wasm/
Once it does it's painfully long download and bootstrap it works pretty nicely. This is a big complicated legacy app, but I'm sure if reasonable file sizes and graceful loading was an actual goal you could get some pretty good results. Sure, it's not going to be as easy to hire for right now, but I think for complicated programs that general kind of workflow is likely to be better than the big pile of JS scripts.
Google seems to think the same if flutter is any indication.
Old article: https://www.figma.com/blog/webassembly-cut-figmas-load-time-...
So neither of those are a good argument in favour of these complicated javascript stacks, are they?
Also, for me, the statically typed, component-based approach to UI development that I get with Preact is my favorite way to build UIs. I’ve used Rails, PHP, ASP (the og), ASP.NET, ASP.NET MVC, along with old-school native windows development in VB6, C# Winforms, whatever garbage Microsoft came up with after Winforms (I forget what it was called), and probably other stacks I’m forgetting. VB6 and C# Winforms were the peak of my productivity. But for the web, the UI model of Preact is my favorite.
This way people who are just looking for some information on a website can go visit, get, and leave, without having to enable intrusive JS blobs, while those in for the interative things on the website can get their preferred experience as well. Instead many websites are developed with only the second group in mind, often intentionally forcing you to run their code on your computer, or not delivering useful information at all.
The motte: SPAs are a good way to write highly complex applications in the browser, like Photoshop and Figma, to compete with desktop apps.
The bailey: SPAs are a good way to write most web applications.
If you attack the bailey, proponents retreat to the motte, which is hard to disagree with. With the motte successfully defended, proponents return to the bailey, beneficial for those enthusiastic about SPAs but much harder to defend.
The only way to tease this issue apart is to stick to specifics and avoid casting SPAs or MPAs as universally good or bad. Show me the use-case and we can decide which route is best.
At the end of the day, we're talking about whether a specific interaction (or a set of interactions) can be handled over the network or not.
If you need the interaction to fully resolve (as in the state is updated and the success or failure of the interaction is visible to the user) within 800ms or so, then it shouldn't be performed over the network.
For interactive editors like Figma, you often have interactions based on key repeats, which usually fire at 50-200ms intervals. So client-side rendering is really the only feasible option.
Most real-world SPA sites perform a lot more roundtrips over the network than the MPA equivalent, not less. And every roundtrip adds yet another 800ms to your update latency, plus the risk that some random network failure will break the SPA state update and force you to reload it from scratch.
Everywhere else (desktop, mobile etc) the model is SPAs.
The only reason people distinguish it for web is because of legacy: html + DOM, i.e. Documents.
Documents don't generally require programmers even if using lateX.
Both models can coexist. I believe that SPAs somewhat supersede MPAs and that an MPA can be a simplification sometimes for a specific kind of apps, a website being simply an app that has been broken apart and is sent piece by piece.
Or the window-is-application/process (Windows, Linux DEs) vs window-is-document-and-application-is-independent (MacOS) models
Or spatial navigation vs file browser.
> Everywhere else (desktop, mobile etc) the model is SPAs.
It exists for CLIs too, where some projects provide a collection of single-purpose programs (e.g. imagemagick) and others provide a single program which can do many things (e.g. git)
Yes there are two approaches, but you can switch between the two with 98% of the code intact.
of course, mostly because very few oh-new-shiny-woah-such-modern tools doesn't even attempt to solve the problem of backend-frontend state sync. sure, maybe you get a piece of the puzzle (eg. a library that conveniently rerenders on state change, React, or one that you can wire up with all the fancy observables, Angular, or one that's super simple, sleek, even has magical runes that help with only rerendering the things affected by the state change, Svelte ... and maybe on top of these you get a state manager library, and then you still end up writing a thousand mutator/reducer in Redux by hand).
So we are still nowhere near a nice end-to-end full-stack tool that helps model both backend and frontend changes and then helps to design and implement an efficient API between them. (Because, obviously, it seems that this is not obvious to most people. Hence we get solutions like expose your DB as REST API and ship your DB via WASM sqlite, and so on.) That said, even those might be better than one more frontend-only state management lib.
Those are the reasons why SPA and MPA are so different
> The only reason people distinguish it for web is because of legacy: html + DOM, i.e. Documents.
There’s another key difference: the other model has preinstalled software and most functionality is on trusted clients. If I email you a Word document, you don’t have to download Word from the Office servers to open it, which creates very different trade offs. There’s also a big difference in trust: I don’t need to ask whether I want each web page I open to have access to the data on my computer.
The web’s big selling point was the immediacy of being able open anything quickly and not needing to trust the remote server to run native code on your system (even in the 90s we knew that was a bad idea), so it’s not surprising that there’s so much gravity to its core model. The addition of more app-like abilities is really useful but it’s lead to a certain amount of app-envy where people often pick the cool technical challenge without asking whether they’re working on an app which needs it.
My view is that you should perform as much processing as possible in the backend. This allows you to send as little data as possible over the network and allows your application code to make more sense because all your domain logic is centered in one self-contained app.
Now this self-contained app is just a software library, it doesn't do anything on it's own. But you can throw a CLI on top of it and use it through the terminal. You put a web api on top of it and use it from an SPA. You can use it as a backend for a server side rendered app.
The ideal, in my eyes, is that th frontend only concerns itself with actually displaying things. It doesn't get a big list of data, filter and transform the data, then display it. It asks the backend for exactly what it needs and the backend provides exactly what it needs and it displays it and that's the end of it.
Now you can have a website and a mobile app that are both trivial to develop and both use the same backend - if you fix a bug in the backend you've fixed it on both frontends.
I realize this may not always be possible or practical, but I think it is both of those things more often than not.
Using this metaphor can imply significant disingenuity: a lack of honesty about one's true belief.
I actually disagree. I think this is the natural state of people, and they come by it honestly. We make decisions emotionally and then justify them rationally. It's just the way we are.
You could maybe say it's a lack of honesty about one's true belief to themselves. But even then it's hard to fault somebody for lack of awareness for something that is very subtle.
Honestly I think pointing out this human tendency and calling it out with examples like this is the best way to combat it. Once people become aware of it, they are more likely to fight it internally.
Second, people do can and do lie about this kind of thing. I’m talking about conscious deception. Motives vary; they range from “I’ll pick my battles” to “this is good for my income stream” to “these other people don’t know it yet, but I’m right, and they’ll thank me later” and others.
Sometimes that works. Sometimes it just causes people to dig in deeper.
It's almost as if some developers choose technologies based on "what'll look good on my CV"
When we start to even think about debate fallacies when comparing engineering methodologies, it's completely clear we already lost the game. In fact, we also lost the meta game, and probably some 2 or 3 outer meta layers of it.
So yes, we should design software for the specifics of the function it will provide. Do not let people evade their competency by talking in generalities.
It is not only Figma or Photoshop. Any site with multiple steps of interactions or complex filters over search result etc. benefit from SPA and declarative code. The experience is smoother and development of anything, but simple forms is much faster.
People disabling JS or working on satellite internet from a remote island are fringe cases and are not relevant for the business.
How about people working on a train?
People working from a train or on data roaming are not a fringe case. They have amounts of bandwidth that, 20 years ago, were enough to serve any complex web experience. It’s not acceptable that we now require more data than is contained in all the books in the library of congress to buy a ticket on Ticketmaster.
I can’t understand how someone looks at the ratio of useful action to code size, sees it’s something like 1:1e6, and thinks this is fine.
The modern web’s usability, efficiency and reliability are terrible, and worse each year. Defending the tech stack that led to this with “it’s a good UX” is both wrong and makes me feel like web devs live on another planet from the rest of us.
I have a hard time taking these arguments seriously because they get so exaggerated on HN.
I’ve done a lot of work from flights and extremely low bandwidth, high latency connections in foreign hotels. Not once have I encountered anything like a web form taking 100MB.
I agree it sounds exaggerated, but I don’t think it is. This is kind of my point, it’s past the point you would think likely.
But the "MPA to another results page" causing an HTML reload with a flickering blank screen is a jarring UI experience.
The issue isn't what's "easy" to implement. Instead, users prefer a fluid and responsive UI. An example of a website that has superfast filters in SPA style instead of "MPA results page" is McMaster-Carr: https://www.mcmaster.com/
On that website, when the user changes the categories or filters, the results of items instantly change without the jarring disruption and delay of a new page being loaded.
There were several previous HN threads about it. Based on the near-universal praise in the comments of those threads, I don't think converting McMaster architecture to your suggested "MPA search results" would be considered an improvement. :
+ https://news.ycombinator.com/item?id=32976978 : Mcmaster.com is the best e-commerce site I've ever used (bedelstein.com) 1402 points by runxel on Sept 25, 2022 | hide | past | favorite | 494 comments
+ https://news.ycombinator.com/item?id=34306793 : McMaster-Carr: A refreshingly fast, thoughtful, and well-organized website(https://www.mcmaster.com/) 102 points|jer0me|1 year ago|36 comments
+ https://news.ycombinator.com/item?id=24803857 : McMaster-Carr: Beautifully organized and informational industrial product store(https://www.mcmaster.com) 40 points|astrocat|3 years ago|27 comments
+ https://news.ycombinator.com/item?id=34000502 : Best ecommerce UX practices from mcmaster.com(https://medusajs.com/blog/9-best-ecommerce-ux-practices-with...) 322 points|amoopa|1 year ago|167 comments
Pretty much every modern full stack framework includes approaches to do partial renders and / or DOM morphs of server generated HTML responses, eliminating the full-page refresh effect.
www.mcmaster.com seems to utilize this to some degree, actually - while yes there are JSON responses, there are what appear to be HTML partial responses as well that are presumably injected on the page. In any case, everything on that search engine would be trivially accomplished using a server rendered HTML approach without needing to utilize a SPA. It's actually a great example of something that would work great with progressive enhancement - the search bar can start as a simple input that leads to full page search results, the navigation can do a full page refresh if the partial page refresh JS isn't available for some reason. Javascript can make it better without being a requirement.
A good rule of thumb is that if an interaction existed at roughly the same fidelity during the Web 2.0 days, it's not something that requires a SPA framework. Typeahead search results and categorized product listings existed and were functional to the level of the site you linked back then.
Uhm... yes?!? The behavior you listed is exactly why I gave you that McMaster example. So I guess I'm a little confused. In any case, your comment matches up with the wikipedia definition of SPA (https://en.wikipedia.org/wiki/Single-page_application):
>A single-page application (SPA) is a web application or website that interacts with the user by dynamically rewriting the current web page with new data from the web server, instead of the default method of a web browser loading entire new pages. The goal is faster transitions that make the website feel more like a native app.
An alternate way of interpreting your reply to me is if you also categorize McMaster's website behavior as a form of "MPA". In other words, you classify McMaster's loading of new HTML fragments and rewriting DOM as "multiple pages". I've not heard others define MPA in this way.
>, everything on that search engine would be trivially accomplished using a server rendered HTML approach without needing to utilize a SPA. It's actually a great example of something that would work great with progressive enhancement - the search bar can start as a simple input that leads to full page search results, the navigation can do a full page refresh
Yes, we've already agreed about it being technically trivial. The issue is end user's preferred UI experience. Users don't want the "page refresh/reload" even though it's trivial.
That's not really strictly the same thing as what the acronyms SPA and MPA, but in reality, people refer to a Rails application that uses large amounts of Hotwire as a "MPA" (even if it never results in full page refreshes and often doesn't even feel like navigating pages) and things built with tools like React as "SPAs" (even if you're perfectly capable of navigating between pages and getting React rendered by the server until the client takes over routing.
If your definition of "MPA" is "every interaction requires a full page load", it's a pointless discussion, because that's not really the reality of development even with "MPA" frameworks like Rails or Phoenix (I can't really speak to stuff like Laravel, but I'm sure they have an equivalent)
Maybe a good way to think about it is that the fundamental interaction model of frameworks like Rails is that they're built around the concept of the server returning new pages on navigation, and optimize that to provide a better experience, and SPAs are designed around the idea of a single web page visit instantiating an application at which point the client is control of navigation, but they optimize that to provide a better user experience (i.e. server side rendering of pages on first load).
It seems like there was already terminology of CSR-vs-SSR (client-side vs server-side rendering) to differentiate that so there was no need for SPA-vs-MPA to overlap with CSR/SSR to try and make the same distinction.
>Whether it displays that with a full _page_ refresh or by injecting HTML via Javascript does not in practice matter.
It seemed like the 'P' in SPA-vs-MPA is literally about the Page(s) being reloaded. It's "single page" or "multiple pages". That's why developers like to clarify that Next.js -- even with SSR HTML hydration of various subpages -- is still an SPA because the page on the client-side browser isn't reloaded. I just did some skimming of various "SPA vs MPA" search results and none seemed to use those acronyms as a way to classify CSR-vs-SSR. (https://www.google.com/search?q=spa+vs+mpa)
I'm also not clear how you classify Mcmaster.com ? Is it an MPA to you?
>If your definition of "MPA" is "every interaction requires a full page load", it's a pointless discussion,
No I'm not saying every interaction. I was responding to your original suggestion of "MPA with query parameters to a results page" ... and showing how McMaster.com search filters do not work the way you recommend it should. Each click of navigation and filters triggers a JSON payload and dynamically rebuilds the DOM tree. The browser's performance.timing.loadEventEnd property value does not change.
Most SPAs can't give you that either.
This is the worst and dumbest excuse for SPA bullshit. It's not jarring. You'll get over it. It's a fraction of a second where your devices is obviously doing a thing.
Web devs love the word "jarring" like it's some world shattering visual effect. SPAs break all the time in dumb-ass ways that are way more jarring and experience breaking than a page load.
I've never been a web dev. I'm just explaining why the typical mainstream end users who don't have the same patience as HN-type techies (who more happily accept MPA) do not like the discontinuous UI of reloading pages.
Another example of that SSR MPA page reload/refresh would be old Mapquest before 2006. Screenshot: https://www.e-education.psu.edu/geog160/sites/www.e-educatio...
Each click on North/South/East/West buttons and Zoom In/Out blanked out the entire page and loaded a new page to shift the map viewport. This was a suboptimal UI experience for the typical user. I concede it wasn't "jarring" to you but it was to a lot of users -- especially compared to a CDROM maps experience. Example video of a smoother maps UI experience circa ~2000 from Microsoft CDROM desktop software without "blank reloading pages" to move a map around and change zoom levels: https://www.youtube.com/watch?v=4YO_KGdsUm4
The Mapquest "MPA page reloads" from 2006 was a UI that was less smooth than the Microsoft Streets CD software from 2000.
In 2005, when Google launched Google Maps with extensive usage of Javascript live-loading map tiles to provide smooth scrolling without reloading pages, end users liked that UI because it felt more interactive. In response, Mapquest also eventually switched away from the old-style SSR MPA page reloads: https://techcrunch.com/2007/10/12/exclusive-mapquest-plays-c...
The 2005 SPA-style of Google Maps just gets the UI back to what users already experienced in 2000 with desktop software. The SSR MPA page reloads was something that end users endured with Mapquest but it wasn't actually the UI they really wanted.
I'm not advocating the web devs use SPA (or SPA frameworks). Instead, I'm saying that responding with "SPA websites can be redone as MPA and it's trivial" is saying something that's true but still doesn't actually address the issue that mainstream endusers don't like the discontinuity of MPA type of UIs. That's the subthread I was addressing: https://news.ycombinator.com/item?id=38901249
E.g. McMaster.com is not a "web app" like Figma/Photopea but users prefer the SPA-style UI of that parts catalog website.
Satellite internet (even before Starlink) is actually plenty fast for a modern website, as long as delivery is halfway optimized to avoid a thousand round trips.
It’s people on mobile phones in 3rd-world countries that suffer the most, but they end up with specially optimized websites and even separate mobile apps if they’re a target market.
People who disable JS are virtually non-existent in the real world, outside of bubbles like HN comments. Building technology strategies to cater to this tiny minority is not a good decision.
Except for all the microbrowsers[0] and crawlers that don't have JavaScript enabled or don't run all the JavaScript bullshit on a page. Building accessible sites that can be used in the widest possible context is good engineering.
The thing about JS SPA is that they are hard to make it 100% right. Even the simplest thing. And this goes back to the topic about Web Development and computing. Modern day web is designed by Google for Google. Making things easier for 98% of the web simply isn't their thing. And that is not just on the Web but everything else they do as well. And since no one gets fired for using what Google uses, we then end up with additional tools to solve the complexity of what Google uses.
Depending on how you count it we are now fast coming close to 20 years of Google dominance on the web. And there hasn't been a single day I didn't wish for an alternative to compete with them. I know this sounds stupid. But may be I should start another Yahoo.
It can definitely be an MPA. The only somewhat dynamic part it has is the comments.
And now it's so egregiously bad that it's the single source of bad scores in Google's own metrics: https://twitter.com/dmitriid/status/1742669322487533801 and https://twitter.com/dmitriid/status/1742670032113402049 (yes, it loads 47KB of CSS/2.7 MB on desktop among other things)
Are you sure about that? Well made SPAs don't look like apps. They navigate seamlessly and instantly because they're not redownloading and parsing all their header and footer HTML, re-constructing a brand new DOM, loading and reinterpreting CSS, and bootstrapping a new Javascript runtime on every click.
Look at https://react.dev/learn, click around the documentation pages - do you think that's an SPA or an MPA?
Open up your network tab, and you'll find out what's happening: When you hover over a nav header, it starts preloading a JSON file containing the content for that page. When you click on a navigation link, that content's loaded into the react DOM and some more prefetches of just JSON content for likely next pages are loaded up. Your browser navi is updated, but you are still in the same original page context you started in. It is insanely snappy to interact with.
There's NO NEED for a browser to reload and reconstitute the entire page context on every interaction! It's a crazy way to architect applications!
... wut?
Wouldn't that make them 'compile to SPA' frameworks?
> During rendering, Turbo Drive replaces the current <body> element outright and merges the contents of the <head> element. The JavaScript window and document objects, and the <html> element, persist from one rendering to the next.
So... it makes your app into an SPA.
Architecturally, you'll still designing your application as though the user is performing a complete navigation, there's just Javascript present to optimize away some of the issues with that approach.
If the official React documentation website can't implement SPA page navigation properly, what chance does anyone else have?
The idea is sound, and the basic loading behavior is as I said (not sure what the people who are encountering 1.5 second navigation times are doing), and the existence of an implementation bug doesn't undermine the theoretical soundness of the architecture.... although, as you say, having one on the react docs is embarrassing.
On CPU-limited devices (and my computer with 4x CPU throttling enabled in devtools), react.dev appears to block the main thread for 500-1000ms while navigating to some of the "Learn React" pages—even if all the data for that page is already cached in memory.
I remember reading all kinds of blog posts about how Concurrent Mode and Time Slicing were gonna magically solve this by breaking up long tasks and prioritizing above-the-fold content so that it would pop into view faster. It would be funny if, in addition to being unable to correctly use the History API, the React team was also unable to use their own framework's performance features.
Yes, and that is why despite hating the idea from the get go, which was before 2009. I gave it plenty of time to mature. But the truth is, any technology is only as good as the human factor. We aren't perfect, and that is why even basic thing like this we would make mistake.
And this example just proves it even more. And I am ignoring the site's performance which felt really slow for what should be a MPA ( and it is not ).
edit: and like the sibling comment noted, the history back button gets messed up. edit2: I mistakingly wrote nexus 5a instead of pixel 5a
I think it's a page with broken use of the history api.
I clicked your link, opened the menu (as a comment mentioned it being slow), and then had to hit back 3 times to return here.
A lot of web developers strive for some amount of templating and client-side interactivity on their websites. And when frameworks like React came up they solved interactivity issues but made it hard to integrate into existing server-side templating systems, which were mostly using different programming languages.
So because integrating the frameworks for client-side interactivity was hard, the frameworks also took on the job of templating the entire site and suddenly SPAs were popular. I think a big draw here was that the entire tooling became JavaScript.
But the drawbacks were apparent, I guess a big one was that search engines could not index these sites and of course performance, so the frameworks got SSR support. The site was still written in the framework, rendered to HTML on the server and then hydrated back to a SPA on the client.
Now, even more recently we got stuff like islands, where you still use the handy web framework but can choose which parts of your site should actually be interactive (i.e. hydrated) on the client. And I believe this is the capability that has just long been missing. Some sites require no JS on the client (could even be SSGs), others require a little interactivity, and some make most sense as full blown SPAs.
We're finally entering the era where the developer has that choice even though they use the same underlying framework.
I’ve gone back to making MPA apps with minimal JS. It helps me actually ship my projects rather than tinkering and having an over complicated setup for mostly CRUD tasks.
In one project that is a bit more data intensive and interactive I’m using Laravel Breeze / Laravel + inertajs (SSR react pages).
I’m also a big fan of Jekyll lately, I made my own theme on Thursday with only 2 tiny scripts for the mobile menu and submission of the contact form.
Using DOM APIs and managing a little bit of state is fine for many, many projects.
OTOH when you don’t control the requirements and the business asks for a ton of stateful widgets progressive enhancement can become a mess of spaghetti in the UI and API unless very carefully managed and well thought out. At that point you might as well go all in on React/Angular/Vue, especially when you have to account for a mix of skill levels and turnover.
In comparison a server-side MPA will probably be at least decent to use unless the dev has been entirely careless, because that model better matches what browsers have been built for.
The takeaway is that for SPAs to be consistently good for both devs and users, browsers need to do the bulk of the heavy lifting and provide a “happy path”, largely eliminating the need for overwrought JS libraries that try to paper over browser inadequacies.
Have you seen any serious proposals on this front?
I, for one, don't want them rendered in my browser. I have an OS that can run apps, and I want my browser to be an app that renders simple HTML pages. If you want an app, make a damn Desktop app that can run on my OS.
I kind of find it ironic, though: why not write one desktop app that only supports the latest version of Windows, and tell your users to use that? If you're big enough, surely you can force them to use the OS you want, right?
I am convinced that most people who love webapps kind of hate the idea of being forced to use the latest version of Windows. But somehow they find it okay to force everyone to use Chromium? What's the difference?
Adobe apps like Photoshop are some of the worst offenders. Sometimes I'll kill an Adobe process running in the background, only to realize that there's an additional background process ready to restart the first one. It's like playing whack a mole trying to stop all of the creative cloud junk processes. I would much rather sandbox software like that in the browser where I can close a tab and be done with it (and where I'll be prompted before an app tries to read passwords from my clipboard or access files from my filesystem).
For instance Android does that sandboxing by default.
You can do a lot of things in theory, but in practice browsers are much better sandboxes than desktop operating systems.
> a browser that is so complex that nobody can even imagine writing a new one.
I'm not sure how this is relevant? As a user I don't care how complex a browser is. I care that it sandboxes applications better than my desktop operating system. Unless you mean to say that the complexity implies a greater surface area for security related bugs, in which case surely the underlying os is even more complex (which is what native apps run on). I would imagine writing a new desktop os would be even more complex than writing a browser app that runs on top of it.
> For instance Android does that sandboxing by default.
Ok, so now we're talking about mobile operating systems rather than desktop operating systems, which to me feels like an implicit concession that desktop operating systems are indeed bad at sandboxing applications.
But even if we do shift the goalposts — even mobile operating systems pale in comparison to a web browser when it comes to sandboxing. Android and iOS will notify you if an app reads from the clipboard (which they've only recently started doing), but your browser won't just notify you, it'll ask you to confirm before a website reads from the clipboard. A website can't even make a request to a third party domain unless the website has cors enabled. And new vulnerabilities pop up all the time. There was an article that generated a lot of traction on HN just a few weeks ago about how certain iOS applications can pinpoint your location by scanning for known hot spots your device has access to [1].
Do you know anything about sandboxing, or are you throwing that there for the sake of the argument?
> I would imagine writing a new desktop os would be even more complex than writing a browser app that runs on top of it.
Oh right, I guess you don't really know about sandboxing then. So it won't be a super constructive debate given that your position is apparently fundamentally based on your intuition about sandboxing.
> As a user I [...]
I don't know who invented that "As a user" thing, but I find it completely stupid. In my view it is just used as a justification for anything one wants when they don't have a better argument.
In this case users are perfectly fine running standalone apps on their smartphone, let's not pretend they would really not want the same model on their desktop.
> which to me feels like an implicit concession that desktop operating systems are indeed bad at sandboxing applications.
Not at all, I was just giving a real-world example of sandboxing of apps at scale.
> even mobile operating systems pale in comparison to a web browser when it comes to sandboxing
If your baseline is sending a full web browser with every app you make, on desktop you could run each app in a VM and it would obviously be better.
> A website can't even make a request to a third party domain unless the website has cors enabled.
An app can't make a request unless it has the internet permission, what's your point?
My point is that webapps move everything into the browser, going towards a world where something like ChromeOS is the only valid way to use a computer. I want to choose my OS, I don't want to rent an OS provided by BigTech, whether it is ChromeOS, Windows or anything else. The model where users pay for a product but don't own it is good for companies, not for users. "As a user", I want to own the product I pay for. And I want to pay for the product I want to own.
> "As a user", I want to own the product I pay for.
Ironically, you're the one who lacks a concrete argument, which is why you're attacking the wording of my statement, rather than the substance of it. You're honing in on the first three words of my sentence, because you can't debate the argument on its merits. You then use the exact same wording in your final sentence, but encase it in quotes as if that somehow absolves you of your hypocrisy. Given that this website is frequented by software developers, I think there's a useful distinction to be made between thinking about problems in terms of their development, versus thinking about them in terms of their utility to end users.
> Not at all, I was just giving a real-world example of sandboxing of apps at scale.
It would be charitable of me to call it a "real-word example". You simply said "Android does that sandboxing by default", without a single supporting statement or example, despite your so-called extensive knowledge of sandboxing.
> If your baseline is sending a full web browser with every app you make, on desktop you could run each app in a VM and it would obviously be better.
No one is "sending a full web browser with every app you make". Browsers come preinstalled on every popular operating system.
> An app can't make a request unless it has the internet permission, what's your point?
What in the world is "the internet permission"? I've never had an operating system ask me if I'd like to grant an app "the internet permission". Have you operated a computer before?
> Do you know anything about sandboxing, or are you throwing that there for the sake of the argument?
> Oh right, I guess you don't really know about sandboxing then. So it won't be a super constructive debate given that your position is apparently fundamentally based on your intuition about sandboxing.
As someone who's written both web apps and desktop apps, I do in fact know a considerable amount about sandboxing. Do you know anything about sandboxing? You're questioning my knowledge to deflect from your lack of a coherent rebuttal. What exactly have you written during this conversation to demonstrate your comprehensive knowledge of sandboxing? You're concluding that I lack knowledge on sandboxing because I admitted to not having single-handedly written an operating system or web browser? Really? Are you writing an OS in your free time when you're not writing about the mysterious "internet permission"?
> My point is that webapps move everything into the browser, going towards a world where something like ChromeOS is the only valid way to use a computer. I want to choose my OS, I don't want to rent an OS provided by BigTech
You've got it backwards. If I want to add support for users running a free open-source operating system like Linux, as a web app developer I don't have to do anything special. Linux can run web browsers, and therefore it can run web apps. Case in point is Photoshop. Neither Photoshop nor the rest of the Adobe Creative Suite runs on Linux, but the Photoshop web app does, because web apps are universal. There's a reason why Apple took years to finally add push notification support to iOS web apps, because web apps threaten the mobile operating system duopoly.
Thanks for explaining to me what I did ;-).
> You simply said "Android does that sandboxing by default", without a single supporting statement or example
Are you questioning the fact that Android apps are sandboxed? If yes, you may need to do some reading on your own. I am not here to teach you how Android works.
> No one is "sending a full web browser with every app you make".
All the webapps that try to look like Desktop apps have to ship a browser with them. You mentioned VScode, right?
> What in the world is "the internet permission"? I've never had an operating system ask me if I'd like to grant an app "the internet permission". Have you operated a computer before?
Oh come on... you just don't have the slightest idea how native apps work, do you? It's literally called "android.permission.INTERNET". Have you ever tried something not web?
> Are you writing an OS in your free time when you're not writing about the mysterious "internet permission"?
As a matter of fact, not an OS but embedded distributions. That... wait for it... use sandboxing. Do I need to get back on the "mysterious" internet permission? Wait, here's a link to help you: https://developer.android.com/develop/connectivity/network-o....
> as a web app developer I don't have to do anything special.
Not even Google "Internet permission" before dismissing someone's point. I love that kind of webapp developers.
> because web apps threaten the mobile operating system duopoly.
They threaten every platform by making everything a ChromeOS system (no, not literally ChromeOS, but something based more and more around Chromium, which is owned by Google).
You're welcome.
> Are you questioning the fact that Android apps are sandboxed? If yes, you may need to do some reading on your own. I am not here to teach you how Android works.
I'm not questioning whether or not Android apps are sandboxed. I'm questioning how well they're sandboxed relative to web apps, which is why I gave you several examples of capabilities that a native app has that a web app does not. You're losing the thread of the conversation.
> All the webapps that try to look like Desktop apps have to ship a browser with them. You mentioned VScode, right?
> Not even Google "Internet permission" before dismissing someone's point. I love that kind of webapp developers.
I never said anything about VSCode. You can't even remember what we've talked about. I love that kind of commenter. We're not talking about desktop apps that use web technologies vs desktop apps that don't. We're talking about desktop (and now apparently mobile) apps vs web apps that run in the browser. Allow me to quote your original comment that I replied to as a memory refresher: "I, for one, don't want them rendered in my browser. I have an OS that can run apps, and I want my browser to be an app that renders simple HTML pages." This is what we are debating. You want to shift this conversation into a flamewar about desktop apps built with Electron, because you know your actual argument has less merit. This whole conversation has consisted of you shifting goal posts, and retreating to a lesser version of your original argument. I'm still waiting for you to compare the security of desktop apps to web apps, which was my entire original point.
> Oh come on... you just don't have the slightest idea how native apps work, do you? It's literally called "android.permission.INTERNET". Have you ever tried something not web?
I'm talking about permissions that a user has to intentionally grant via an explicit prompt, not a list of bullet points that appear to a user if they happen to view an app's detail page [1]. Your own link explains it best: "Note: Both the INTERNET and ACCESS_NETWORK_STATE permissions are normal permissions, which means they're granted at install time and don't need to be requested at runtime."[2]
But you were actually responding to my comment about CORS when you brought up "the internet permission", which unlike the coarse grained permissions that most operating systems offer allows any website to prevent any other website from accessing its resources. Which means I can't use a web app to form a botnet that attacks some innocent server, unless that server explicitly allows it via a CORS header (and also ignores the incoming origin header). A desktop app can connect to any domain it wants, and can even directly connect to the server's ip and impersonate a legitimate client by forging the origin and user-agent headers.
> They threaten every platform by making everything a ChromeOS system (no, not literally ChromeOS, but something based more and more around Chromium, which is owned by Google).
No...they don't. Have you forgotten that Firefox and Safari exist, or should I send you a link to their home pages? But even if we put that aside, during this entire discussion you've been championing Android which is...wait for it... developed by Google. Please tell me you're being intentionally obtuse?
[1] https://developer.android.com/guide/topics/permissions/overv....
[2] https://developer.android.com/develop/connectivity/network-o...
I am not AT ALL saying that we should push for Android everywhere. I am just saying that Android (and iOS, but I don't know the details of how iOS works) are sandboxing apps. I don't think security is an argument for PWA. The argument for PWAs is "I know webtech and it would be cheaper if everything ran in Chromium".
Be assured that if the discussion was about using Android everywhere (web, mobile, desktop), I would be against it as well. I don't want a one-size-fits-all solution, because it usually doesn't fit that well, and it kills diversity.
Oh right, I guess you don't really know about iOS sandboxing then. So it won't be a super constructive debate given that your position is apparently fundamentally based on your intuition about iOS sandboxing. Remember that line [0]?
> I don't think security is an argument for PWA. The argument for PWAs is "I know webtech and it would be cheaper if everything ran in Chromium".
Security is MY argument for distributing software in the browser vs as a desktop or mobile application. If you refuse to engage me about the point I'm making, then you're arguing against a straw man, which ultimately indicates that you just don't have a strong rebuttal, which is what I've been saying since the very beginning [1].
> Be assured that if the discussion was about using Android everywhere (web, mobile, desktop), I would be against it as well. I don't want a one-size-fits-all solution, because it usually doesn't fit that well, and it kills diversity.
So you're an Android developer who's mortally afraid of Google hegemony? That's some next level cognitive dissonance. If you're afraid of Google dominance, I'm sorry to tell you this, but Android is their best tool for accomplishing that goal. The EU fined them 5 billion in 2018 over this, and told them to stop "forcing manufacturers to preinstall Chrome and Google search in order to offer the Google Play Store on handsets. Google will also need to stop preventing phone makers from using forked versions of Android" [2]. You're afraid of the influence of Chrome, and want people to develop directly for Android, but Google is using their Play Store and all of its Android apps as leverage to force manufacturers to preinstall Chrome (and Google search). Android apps give Google the leverage to force Chrome down everyone's throats.
You're afraid of a Google browser monoculture, and don't think Firefox and Safari present enough competition, and your solution is for people to develop apps directly for Android and iOS, where there's even less competition? And by the way, the only competition Android has is a closed source operating system (iOS) that doesn't even allowing sideloading apps or competing app stores. If web apps were more popular we wouldn't have a mobile duopoly (iOS and Android), or a desktop duopoly (Windows and macOS), because the web is an open platform and there are web browsers on every operating system (including desktop Linux, the various BSD variants, Ubuntu Touch, et cetera). This is why I told you a long time ago that you've got it all backwards [3].
[0] https://news.ycombinator.com/item?id=38913989
[1] https://en.wikipedia.org/wiki/Straw_man
[2] https://www.theverge.com/2018/7/18/17580694/google-android-e...
[3] https://news.ycombinator.com/item?id=38917623#:~:text=You%27....
Sandboxes usually have to give permissions, with some granularity. The more permissions you give, the larger the attack surface. There is nothing that makes browsers inherently safer than other sandboxes: a browser is just a process running in user space. If anything, modern browsers are so complex (and getting worse with time) that the attack surface is big, which is why they require a ton of resources in terms of security.
Moreover, Web UIs bring their own class of issues that don't really apply to native apps. You insisted on CORS, which is one mitigation for some of those issues. But CORS is really a browser thing, I don't think it really makes sense to compare it to anything outside the "webview world".
If security is your concern (and you seem to insist that it is), then webapps are really not better than the alternatives. Actually, the Apple Store and the Play Store (to give an example in the mobile world) allow Apple and Google to somehow monitor the apps that users install, which is most certainly more secure than a model where anyone can load any webapp from any website.
I see many reasons to want PWAs (which I may or may not share), but security is not one.
I think you're whichever kind of developer your current position requires. You've been talking about Android non-stop throughout this conversation, and conversations you've had with others on this website [1]. When you were lambasting me about my perceived knowledge of mobile development you were touting your Android knowledge, and taunting me about whether or not I've done anything outside the web. Now that I've proven Android is actually one of the primary tools Google uses to promote Chrome (and you admitted you don't know much about iOS) you want to distance yourself from mobile development altogether.
> Other examples include whatever iOS does (which I don't know), containers (docker and the likes), VMs, and everything in-between (like what snap or flatpak use).
We're not discussing theoretical means with which you could sandbox an application, we're talking about how apps are actually used in reality. If you need to fire up a virtual machine every time you use your favorite desktop apps, then you're only proving my point that they're not inherently very secure. Not to mention, the average user probably has no idea what Docker or a virtual machine even is. Like I said in my original response, lots of things are possible in theory, but in practice web browsers are much better at sandboxing apps than desktop operating systems (and even better than mobile operating systems). And by the way, you can run a browser inside of a vm too, so if anything the technologies you're advocating for bolster the security of web apps rather than compete with them.
> If anything, modern browsers are so complex (and getting worse with time) that the attack surface is big
Ironically, a lot of that complexity arises from the web's insistence on security. V8 is complex because it has so many safeguards in place to sandbox JavaScript, and that sandboxing is taken very seriously. There's a reward anywhere from 10,000 to 150,000 USD if you can escape the sandbox [2][3]. Browsers are inherently more secure than desktop apps because they limit access to the underlying platform. Someone developing malware as a web app has to first escape the browser sandbox, just to gain the privileges that a desktop app has natively. If it helps, you can think of every desktop app as a webapp which has already escaped the browser.
> Moreover, Web UIs bring their own class of issues that don't really apply to native apps.
No, web developers have just spent so much time thinking about security, that native app developers haven't even realized these security issues are relevant yet. It took years for Apple and Google to come to the brilliant conclusion that they should notify users when an app is reading from the clipboard, something which at the time was considered just a browser "class of issue". Maybe in 2034 they'll figure this out for desktop apps.
> But CORS is really a browser thing, I don't think it really makes sense to compare it to anything outside the "webview world".
It makes sense to compare it to things outside of the browser because it protects users and servers. You seem to want to disqualify any point I make that you can't disprove. If you don't think web technology is comparable to anything outside the browser, then what are we even arguing about? This whole discussion has been about comparing the security of web apps to non-web apps.
> If security is your concern (and you seem to insist that it is), then webapps are really not better than the alternatives. Actually, the Apple Store and the Play Store (to give an example in the mobile world) allow Apple and Google to somehow monitor the apps that users install, which is most certainly more secure than a model where anyone can load any webapp from any website.
Security is not some new thing I'm insisting on, it's been my whole point from the very beginning. You're just finally deciding to engage with me about it, instead of derailing the conversation constantly. Apple and Google have to monitor which apps make it to their app stores, BECAUSE apps are so much more prone to security problems. You once again have it completely backwards. No one has to gatekeep websites because browsers are so much better at sandboxing applications. And allow me to remind you that you admitted you have no idea how iOS sandboxing works, so you can't really be confident about this stance even if it did make sense.
And now you're arguing in favor of the app store duopoly which contradicts your point about software diversity. You can't have it both ways. You're trying to hold on to two contradictory points at the same time: you don't like the supposed lack of browser diversity (which is why you seem to detest Chromium), but you like the supposed security guarantees of the mobile app store duopoly, which is even less diverse.
[1] https://news.ycombinator.com/item?id=38919389
[2] https://github.com/google/security-research/blob/master/v8ct...
[3] https://bughunters.google.com/about/rules/5745167867576320/c...
Ok I get it.
Let me rephrase it just to make it clear: It is true that I don't like the lack of diversity (that would come from everything being webtech on top of Chromium), and it is also true that I like the security that comes from a managed app store. I do! I can have it both ways! Isn't that marvelous?
If you can't understand how this is possible, I think we can stop here. We won't get anywhere if you can't understand what I write.
> It is true that I don't like the lack of diversity (that would come from everything being webtech on top of Chromium), and it is also true that I like the security that comes from a managed app store.
You've said previously: "My point is that webapps move everything into the browser, going towards a world where something like ChromeOS is the only valid way to use a computer. I want to choose my OS". [1]
So you think the best way to increase OS diversity is to get developers to submit their apps to proprietary app stores that only run on their own respective operating systems, instead of using open web standards that work on every operating system? How does that make sense?
> I do! I can have it both ways! Isn't that marvelous?
No! You can't! Not if you value logical consistency.
> If you can't understand how this is possible, I think we can stop here. We won't get anywhere if you can't understand what I write.
I don't think you comprehend what you're writing, or rather, you're not willing to admit that what you're writing is incomprehensible. Saying "my argument makes sense, you just can't understand it" is just you being petulant. You want to "stop here" because you've argued yourself into an illogical corner.
I did not say that. I said that my preferences are consistent. Security and diversity are orthogonal concepts. I can say: "I want as much security as possible AND as much diversity as possible". It is not an argument, it is a preference.
You come and say: "Aha, I got you! You cannot want both security and diversity! You have to want one or the other, not both, because I say so! You just lost the debate, you dumb ass".
Fine, I lost the debate, you're the best.
As you like to say when you're clarifying, "let's take a step back here". I'll just repeat my last comment, and hopefully you won't evade it like you always do:
You've said previously: "My point is that webapps move everything into the browser, going towards a world where something like ChromeOS is the only valid way to use a computer. I want to choose my OS". [1]
So you think the best way to increase OS diversity is to get developers to submit their apps to proprietary app stores that only run on their own respective operating systems, instead of using open web standards that work on every operating system? How does that make sense?
Do you get it yet? You're claiming you want OS diversity, but you're advocating for the solution that results in LESS OS diversity, that's why you're contradicting yourself, and that's why your position is logically inconsistent. You absolutely know this, which is why you're dodging every attempt to actually debate it. And I know you know this, because you purposely omitted the first sentence of my paragraph when you quoted it, which was [2]: "And now you're arguing in favor of the app store duopoly which contradicts your point about software diversity." That part didn't fit your narrative, which is why you omitted it. You're better at evasion, and rhetorical trickery than you are at actually discussing technical topics. If you had said instead: "I admit my position implies less OS diversity, but in this case I'm willing to make that trade off in exchange for better security guarantees", then we could move on to the security question (and you'd lose that debate too).
You can admit that one of those pesky web developers you're so fond of condescending to actually has a good point, it won't hurt.
[1] https://news.ycombinator.com/item?id=38913989#:~:text=what%2...
[2] https://news.ycombinator.com/item?id=38934276#:~:text=did%20...
No, I don't. I think that having different tools, more or less specialized for particular platforms, is better than using webtech everywhere. My reason being that I tend to hate webtech and all it represents to me: I don't like unmanaged language package managers like npm and how they allow devs to have no clue about their dependencies. I don't like Javascript. I don't like having to run a browser to access Discord, or alternatively to have a fake Desktop app that is essentially a hardcoded one-tab browser. I don't like to run complicated webapps in a tab that can freeze my whole browser. I don't like that if my browser crashes, all my webapps stop. I find that pushing for WebAssembly to run everything in the browser is completely overkill given that we already have tons of ways to run stuff on different OSes. I don't like how web people tend to not know anything not web (including native/non-native-but-not-web mobile apps, native/non-native-but-still-not-web Desktop apps, mobile OSes like iOS/Android/Linux-based-but-not-ubuntu, Desktop OSes like Windows/macOS/Linux/-BSD, embedded OSes like OpenWRT/-BSD) but still claim that webtech is better.
I like C when it makes sense, I find merit to C++ in many situations, I think Rust is interesting (except for the language package management which seems to come straight out of the webtech hell). I like Java/JVM and its evolution in the last years (no, it's not just an interpreter and web applets since the beginning of the century, but too many web people missed the memo), I find that Android has done a lot of interesting stuff with JIT and AOT, I think that GraalVM is really promising. I love Scala and Kotlin, and the new Jetpack Compose way for UIs (coming to Desktop apparently). I wish I could spend more time on Swift and discover SwiftUI, and I had fun learning Flutter and Dart (though it's still has the fundamental issues of cross-platform frameworks IMO). I don't know anything about .NET, but it doesn't seem bad. I like making custom Linux with fun tools (buildroot, Yocto, pmbootstrap) or learning how relatively mainstream distributions work. I like running stuff on -BSD (not in a browser, actually on the system). I like how Linux distributions approach their package management.
I am a big fan of open protocols, which mean that I can run my TUI IRC client (written in C) on my OpenBSD, my favorite email client (written in Go) on my Alpine Linux, and a whole bunch of stuff like git/gpg/ssh/podman/pass in CLI. I can even enjoy tools written in niche languages like Hare!
Those things I like, TO ME, represent diversity, and allow me to choose the tools that are more ergonomic for me, and even to contribute to them. Webtech, TO ME, represents those shitty Slack/Discord/Teams/NameYourCloud proprietary apps (and those are the good ones), written by people who want a one-size-fits-all solution so that they can be more productive by knowing ONE tech and making ONE mediocre app that will run badly on all those systems they never cared to study, governed by rules like "no need to optimize for memory, memory is cheap ahahaha!!!1!". All that forcing me to run full-blown apps (and not websites anymore) in a damn browser, in a world where Safari is Apple's way of refusing webtech for as long as they can, Firefox is a joke (which I use, don't get me wrong) and everything else non-Chrome is about customizing Chromium and pretending that they own their codebase.
PWAs are a promise to move that shitty world out of the browser and into mobile devices (because ElectronJS already succeeded in moving that shitty world out of the browser and into the Desktop... by duplicating a browser I did not choose, and in my back). All of that is transforming my Desktop OS and my mobile OS into basically a big browser that I hate (Chromium) running bad apps written with webtech that I hate.
Native Android and iOS apps are not perfect of course. But they are not webtech. And at this point I'm holding to anything that is not damn webtech (or worse: "AI" bullshit).
Go on, tell me why I should not feel the way I feel or, even better, prove it to me, with cross-references to whatever you find (I still won't click on your links, though, I really don't give a shit).
> then we could move on to the security question (and you'd lose that debate too).
I am not here to win (is there a price for the winner?). I would genuinely be very happy if you taught me something (just a small thing) about why browsers are fundamentally better in terms of security than any other kind of sandbox I can imagine. But something constructive, like why it is that whatever is used to sandbox processes in a browser cannot be used to sandbox processes outside the browser. Or why granular access control works in the browser and fundamentally cannot be used outside of it.
But if it is to tell me that browsers are better because smart people spend a lot of time working on V8, or that web people invented access control last year, please don't lose your time.*
This is the reason why your responses have been so arrogant. This is why you assumed I lacked knowledge about sandboxing before we'd even had a chance to discuss the topic in any sort of depth. You have this preconceived notion that all web developers are myopic and can't see anything outside of the web, and you've projected this stereotype onto me as if you're omniscient. If you truly do enjoy engaging in good faith arguments, and learning from other commenters, then you wouldn't start with the pompous assumption that the person you're talking to is ignorant.
> I don't like unmanaged language package managers like npm and how they allow devs to have no clue about their dependencies. I don't like Javascript.
Finally, you just came out and said it. You have a deep seated visceral hatred of JavaScript and anything even tangentially related to it. This is why you've been trying to bait me into talking about Electron, to the point of literally fabricating statements (at one point you claimed I was talking about VSCode). This is your pet issue, and your clamoring for a chance to talk about it. I get it, you don't like JS. It's a popular opinion amongst snobbish developers who like to promote this culture of contempt that pervades the software development world [1].
The problem is...we're not talking about the pros and cons of JavaScript as a language, or npm as a package manger. I have feelings about that as well (which I may or may not share), but my primary conjecture has always been that software is safer when run in the browser (especially on desktop operating systems). That's why I originally responded to your comment about Figma and Photoshop, and provided my own anecdote about my experiences using Adobe Photoshop on my desktop computer.
> Those things I like, TO ME, represent diversity, and allow me to choose the tools that are more ergonomic for me, and even to contribute to them.
The preceding paragraphs read like a CV with every technology you've ever interacted with, and many of them are very interesting, but all of that is completely besides the point. I'm going to quote you again here, you said: "My point is that webapps move everything into the browser, going towards a world where something like ChromeOS is the only valid way to use a computer. I want to choose my OS".
We're not talking about the diversity of tools used to build applications, we're talking about the diversity of operating systems used to run graphical user interface apps. You absolutely refuse to stay on topic. Submitting apps to proprietary app stores that only run on their respective operating systems is not the best way to promote operating system diversity. If I build an app for the browser it'll run on every operating system (since they all ship with a web browser), that's just an objective fact.
> is there a price for the winner
You should be a comedian. I'm here to talk about technology.
> I would genuinely be very happy if you taught me something (just a small thing) about why browsers are fundamentally better in terms of security than any other kind of sandbox I can imagine.
We're not talking about what you can fundamentally imagine, we're talking about how software is used in reality.
> why it is that whatever is used to sandbox processes in a browser cannot be used to sandbox processes outside the browser. Or why granular access control works in the browser and fundamentally cannot be used outside of it.
I hate to keep repeating myself but, we're not discussing theoretical means with which you could sandbox an application, we're talking about how apps are actually used in practice. You seem to want to discuss how desktop apps could theoretically be just as safe as web apps, but I'm more interested in reality than theory. I've given you several examples of security features which are present in the browser, and have no proper analog built in to desktop operating systems.
Here's a non-exhaustive list of things that make webapps more secure than desktop apps (many of these points haven already been mentioned, but you keep ignoring them):
- Webapps can't read from the clipboard without user confirmation.
- Webapps can't make themselves truly persistent the way a desktop app can.
- Webapps can't record your keystrokes when their tab isn't active, whereas keyloggers are one of the most pervasive forms of desktop malware. On a Mac for instance, I normally have to use Reikey to mitigate this threat.
- Webapps can't forge the origin and user-agent HTTP headers to impersonate legitimate clients.
- Webapps can't read the response of an HTTP request to a third party origin unless the site allows it via a CORS header.
- Webapps can't read a single file from your filesystem unless you explicitly allow it.
- Webapps can't see which SSIDs your computer is connected to in order to pinpoint your location by matching them against known wifi networks.
Could some of these protections be implemented on the desktop in the future? Sure, and if they do I'd be happy to revisit this discussion in a few years. But my arguments are firmly rooted in reality, not speculation about future enhancements. And please don't bring up onerous security measures like virtual machines. First because that only proves that desktop apps are insecure by default, second because most users are likely unaware that such measures even exist, and third because those measures can be applied to a browser as well, so they only augment the security of webapps if anything.
This is very similar to the NoSQL arc. Some people at prestigious places posted about some cool problems they had, and a generation of inexperienced developers started that they needed MongoDB and Cassandra to build a CRUD app with several orders of magnitude fewer users, transactions, or developers. One of the biggest things our field needs to mature on is the idea of focusing on the problem our users have rather than what would look cool when applying for a new job.
The SPA obsession has been frustrating that way for me because I work with public-focused information-heavy sites where the benefits are usually negative and there’s a cost to users on older hardware – e.g. the median American user has JavaScript performance on par with an iPhone 6S so not requiring 4MB of JS to display text and pictures has real value – but that conflicts with hiring since every contractor is thinking about what’ll sound “modern” on their CV.
Having a stable reliable generally applicable decision/toolset you can apply beats this hunt for optimization to smithereens. Don't optimize case by case. Optimize for your org, for your life, lean into good tools you can use universally and stop special casing your stuff. There's nearly no reason to complicate things by hounding for "simplicity." Other people won't be happier if you keep doing side quests for simple, and you won't be either.
(Do learn to get good with a front-end router, so you can avoid >50% of the practical downsides of SPAs. And I hope over time I can recommend WebComponents as a good-for-all un-framework.)
Wikipedia states that
"Keep it simple, stupid!", is a design principle first noted by the U.S. Navy in 1960 [0]
If this is brought to the table now it is only seemingly so, caused by the fact that those at the table must have forgot it, or never learned it. Of course, there are also commercial interests in keeping things as complicated as possible - it could just be that these have had too much influence for too long.
I had some nostalgic notion that MVC was going to be a smooth ride. That all this JS cruft was slowing me down. Then I needed a search bar, then validation, then I kept running into weird surprises with Razor templates. After a month I ruefully concluded I'd have gotten it done a heck of a lot faster just using my usual stack.
I now regret all those times I complained about how much bloat there is in the JS ecosystem. Yes, is it possible to make crud apps with Razor, sure, people do it everyday. But for me, with a project with increasingly complex display logic and validation, I definitely should have tried a little harder to talk them into using Next and TS.
As an aside, I was surprised that getting HMR with C# is kind of a pain. I never figured out how to get it while debugging. So every time I wanted to debug some new issue with the template not sending data right to the controller (which felt like every few seconds of work) I'd have to restart the server and wait 10+ seconds for it to restart and then renavigate to where I was, reenter my form fields, and then try again. After I was done and wanted HMR, I'd have to restart the server again. That extra hassle really started to grind on my patience.
> But for me, with a project with increasingly complex display logic and validation
It always sucks if the requirements are not clear in the beginning, if the dev can't anticipate how they will grow in advance?
But what has validation to do with it? That's completely backend, how would that have been easier with React+Next?
> As an aside, I was surprised that getting HMR with C# is kind of a pain.
Proper systems dynamically interpret their templates on every request in dev mode because of this, like Ruby/Sinatra does.
I think the reality is that Razor has been left rotting for a while. It still works, and there's nothing that bad about it but the DX is not good, especially compared to modern JS frameworks.
It's hard to explain to people who haven't worked with Razor how annoying things like validation are. There is a "happy path" where the different parts of the validation framework all talk to each other, but it's not obvious and the Razor documentation on MSDN is very _not good_. It doesn't help that there's like 5 completely different things all called "Razor/Blazor" and a lot of semantic overlap between them all. Very frustrating to need to sift through so much to find something that feels like it should be easy and well supported.
Everything running in a browser is interpreted. There is no reason for webdev to require a build step, and it largely does so because JS standards haven't delivered anything around static typing. Even a "this syntax is valid but ignored" would enable IDEs to provide checks via LSPs, but for no-build running.
Build steps and development iteration overhead is something to be avoided at all costs. For it to have been introduced, with multi-second latency, to web dev. is a sign of developer experience dropping off a cliff.
Time-to-iterate, tool quality, release speed, etc. are essential to being able to build mental models of code (etc.)
That's exactly the reason for a build step.
In a build step the code can be optimized to reduce and/or accelerate the code that needs to be interpreted.
A build step is a huge barrier that makes authoring your own websites require significantly more expretise than it otherwise would. It thus makes web development less accessible, and puts anything even a little bit complicated out of reach of anyone who isn't already an experienced web developer or exceptionally dedicated. It also discourages the slow development of some pet website of a not-primarily-a-web-developer-by-trade into something more featureful, since expanding beyond the point where you can still reasonably avoid a build step suddenly requires acquiring a lot more exprertise and expending a lot of effort all in one go, instead of just being a smooth expansion into a more featureful project.
The simpler it is to make your own website without having extensive web development experience, the more people will be able to have their own website instead of being directed to the endless array of corporate silos like social media (which has largely replaced personal websites) and corporate middlemen (which have largely replaced in-house commercial websites for smaller actors) that take care of the burden of making your own website for you, with some rather obvious downsides.
Like, if you have two or more pages, you probably want them to share the same header or footer, and unless you want to A) repeat the same markup on each page or B) inject them with a client-side script, you will need some sort of build step. There are more accessible solutions out there, like Hugo.
How else are you going to achieve that? Sure you could use PHP, but I don't see how that is more accessible or maintainable than having a build step.
People already thought about that problem when the World Wide Web was invented and they came up with Server Side Includes [0], a scripting standard that predates the Apache HTTP Server.
Looks like this inside the HTML document:
<!--#include file="header.html" -->
<!--#include file="footer.html" -->
Not many people use this anymore, but it is easy to share common markup and very accessible for people with just basic HTML knowledge. Major web servers of today still support it.
”In a high-level language like C...” - chip designer
”In a low-level language like C...” - application programmer
The best programmer I ever worked with writes drivers for a hobby.
I actually made a deal with some of them to teach them C/C++ in return for them teaching me Verilog/SystemC but unfortunately that never came to pass. I even got me a couple of Verilog/VHDL books and FPGAs to teach myself what i call "Actual and True Hardware Programming" but haven't really sat down with it. Hopefully sometime in the future so i can finally know everything from the bottom-most layer to the top-most.
Not to nitpick his nitpick, but...I've said this exact thing in the past, and his parenthesized explanation is what I meant. It's too much of a mouthful to try and be super accurate and specific all the time.
Pick what solves your problem. In the context of web development that overwhelming means using whatever is most popular given your preferred programming language.
This may actually be an ePrivacy limitation (cookie law) not a desire to avoid JS. Persisting the setting across pages requires client size storage, which in ePrivacy countries requires either that the setting be obvious to the user that it's persisted, getting per-action consent (ex: a "preferred language" setting) or site-wide user consent (a cookie pop-up).
Things get a bit muddy when sending to server but even then you may not need a consent if it is a feature that is required for correct working of the website or better experience without tracking and profiling.
Example: If you're storing lightOrDarkTheme in a cookie/localStorage, then there is no need to try to follow any directives, nor are you required to inform the user about that you're storing the preference.
For example, see the discussion the sibling commenter linked around storing UI customization choices for only the duration of the current session: https://ec.europa.eu/justice/article-29/documentation/opinio...
--- start quote ---
3.6 UI customization cookies
These customization functionalities are thus explicitly enabled by the user of an information society service (e.g. by clicking on button or ticking a box) although in the absence of additional information the intention of the user could not be interpreted as a preference to remember that choice for longer than a browser session (or no more than a few additional hours). As such only session (or short term) cookies storing such information are exempted under CRITERION B
--- end quote ---
As long as it's clear to the user that they're making a site-wide UI customization choice and just not choosing the language for this specific example I agree with you, but I don't think it's clear in the typical case.
So, what's wrong with the old way of having embedded web assets in a service for building simple admin pages?
...and if jQuery and WordPress do the job, they are sound technical decisions.
What is not a sound technical decision is forever chasing the latest fashion in technology. Also known as the "oh look a shiny thing development paradigm".
Maybe MDN should have a comment section, like the PHP docs. That would be more representative.
What does it say about this whole domain when, as the author says, Web Apps and Sites/Blogs (also add in Mobile apps) are so very different from each other using a myriad set of technologies each of which has a learning curve? Where is the uniformity and commonality in all this? Why are developers even perpetuating this?
That said, this might be a good place to ask for recommendations for study since i am not a "Web Developer";
1) Comprehensive books/other sources on full-stack Web App and Site development. Bonus points if they use a single language for frontend/backend/everything else.
2) The same as above but using C/C++ languages.
The problem is that users/customers have higher expectations for their user experiences than the web can offer on mobile/desktop/etc.
Robinhood, Duolingo, Slack are a few good examples of UX being huge differentiators.
Is there an alternative renderer/something that handles "complex and long-lived $something-trees with dynamic changes" better than web engines does?
They've been optimized for just that during decades at this point, with huge investments both in human-hours and money. Hard to imagine there is something else that can handle that better than browser engines.
The critical features missing from HTML are data binding and data templates. Last time I checked, many modern frontend frameworks contain overcomplicated, incomplete, and inefficient implementations of these features on top of HTML DOM.
There’s an equivalent cross-platform GUI framework called Avalonia https://www.avaloniaui.net/ I don’t have a hands-on experience with it, but based on the internets I have an impression the tech is pretty good by now.
Literally everything else.
My favorite recent example is: 1000 objects with complex behaviour, lighting and animations takes 4 microseconds to render, at 9:36: https://youtu.be/kXd0VDZDSks?si=PjqeFVoSTPSsbdIk
> They've been optimized for just that during decades at this point
You can't optimize beyond the limitiations of the ad-hoc hackish nature of the web. There's only so much optimisation you can do when even the simplest of things will cause re-flow and re-render o the entire page.
Well, games redraw the entire screen, but they can draw thousands of objects in a fraction of time it takes the web browser to figure out how to layout them.
Edit:
- Figma had to reimplement everything from scratch in WebGL because browsers (that is, DOM) are just bad
- Google Docs and Google Sheets reimplemented everything in canvas, once again bypassing the "greatest renderer on earth" to be able to render and control the rendering.
then you will spend 5 hours replacing/updating deprecated/newly incompatible npm/system issues.
With new SSR frameworks like Next.js, I think this whole MPA/SPA dichotomy starts to dissolve a little bit. I’m thrilled that browser standards are evolving to help it along!
That's nonsense, there isn't any progress here. You're just rebuilding things that could easily be built 20 years ago, but with 10X the complexity. And then to solve slow load times your solution is to add even more complexity..
Honestly, who is saying that? Who is saying these things?
> https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que... (28 results)
So at least some are saying something along those lines. I'm sure if you search Xitter you'll find even more hits.
I think the argument is usually not made in isolation like that though, and usually with exceptions. "Websites without heavy user interaction should work without JS", "Websites should work without JavaScript, unless based on live data" and so on, which makes a lot more sense.
Generally speaking the experience will be horrible (what should be a modal or a partial page reload will be a full reload) but using the technologies I use it's not that hard and it makes my development experience easier while delivering some (rarely needed) benefits to end users, so it's an unqualified win for my particular use case.