Hacker News Reader

I think he's making a different point. He's talking about what capabilities web apps should have, not necessarily about the UI. The user will have to give it those permissions; it's irrelevant to this discussion whether the user understands those details and if these are defined one-by-one or by a combination of trusting the app store and clicking "install".

I see your basic point, but in the iOS case, something bad HAS happened -- your personal contacts may have been uploaded to the servers of many different companies without your permission.

The crux of the issue is that the web can't be designed like Apple. The reason the web took off is that it's decentralized. You don't need anyone's permission to set up a web site.

And in fact the contacts fiasco kind of illustrates the point. That happened because a company has monopoly on the (hidden) policies of their ecosystem.

I think one solution is to have programs that manage other programs in a future operating system. You could configure that Berners-Lee mentions by hand. But more likely you there could be a very simple system level app that presents a wizard: "You're running out of storage. Here is a list of all apps and how much storage their using." And it will guide the user through some actions to adjust the capabilities.

It is an open problem to determine whether general users can infer "access to my address book" + "network connectivity" -> "company can permanently store my contacts and spam my friends", and the like.

You did need someones permission to setup a website and the web still took off.

PS: DNS

As far as I know, there was never any registrar who insisted on approving your site's content before they would give you a DNS entry. Even if there was, there were many other places you could register that didn't.

If memory holds, it wasn't until relatively late that they allowed you to use swear words in .com domain names.

Good point, but you could have as many swear words as you want in your page content.

What's relatively late? The 2600 vs Ford fuckgeneralmotors.com lawsuit dates back to 2001, more or less predating "serious" web apps (I don't have a better date for the end of the swearing ban, but it's been at least ten years).

Even then, there are lots of other TLDs besides ".com".

PPS: IP

It sounds like he's taking about the "permissions model" that exists on Android, Facebook, etc. That is, before the user installs the app, they're given a list of what operations that app will be allowed to perform. It's a very simple interface, just one screen with "accept" or "decline".

"They don't trust the web because everyone has heard of email, credit card, etc. scams. One big reason for Apply to only allow in-app purchases through their system is that, therefore, third-party apps never see credit card information and can't do too much damage."

That's very easily solved. We just need a w3c spec for auth and payments in the browser, using browser-native UI and a pluggable framework so different identity providers and payment processors can hook into your browser.

If you think about it, the current system is equivalent to permanently giving a copy of your credit card to every shop you visit and telling them "bill me if you think i owe you something". The level of trust involved is mind boggling, and a system like that cannot ever become secure.

Nobody should see your cc details except your payment processor. Nobody should see your e-mail address except your identity provider (if a site wants to send you a mail, they should be using a browser-based notification api). The native app platforms have shown this works way better than the current browser model, so browsers need to play catch-up here.

Why can't we have both? It can be easy for "normal" people to install while also giving "advanced" users the control they desire.

Agree, but only because the items you cite here are too technical for an average user. I think the way the iPad implements location API is an example of permissions working really well.

> The only answer I can think of is through app stores run by trusted browser vendors.

Exactly, that's clearly what Google are thinking too, as you can install apps from the Chrome web store with elevated privileges today, e.g. the Secure Shell app: https://chrome.google.com/webstore/detail/pnhechapfaindjhomp...

Yes yes yes. Normal people want to install an app and just have it work. Which is exactly what Tim is describing the technical requirements of in terms of web apps.