Hacker News Reader

Comment by hedora | Hacker News Reader

There is one solution to this problem that many people reading this message can contribute to:

Make sure your app has a progressive web app version that has feature parity with the store apps. That way, the app will work on phones like the librephone, and, if Apple or Google decide to kick you off the store, you and your users have some recourse. As a bonus, it’s compatible with open source — users can modify the app and install it without jailbreaks, root or (for now) sideloading.

React Native supports this (and can mostly be bundled with electron for mac/win/linux support).

Are there other stacks people can recommend?

View on HN

You are mixed up 3 different tech stacks: 1. React Native has nothing in common with web apps except JS runtime. It uses "native" widgets for Android and iOS. You need to add a new "native" runtime for your free OS. There are some third-party attempts to add mac/win/linux support, but they are not feature complete as officially supported platforms. Again, your free OS will be step behind. 2. Yes, you can write PWA with React (Web), but PWA still have many missing features which offered by platform APIs of Android and iOS. Your app will not be in "feature parity" with "native" app. Especially banking app. 3. Electron apps are integrated with desktop platform APIs, you cannot easily port Electron app to mobile. Every time big company with big investments wins.

What does a banking app need that a PWA can not provide?

Technically nothing.

In practice, banks will demand remote attestation of the environment the app is running in.

Does anyone have a recommendation for a good "Remote Attestation 101" tutorial? I'm trying to wrap my head around why someone couldn't just run an Android emulator to run your banking app or whatever. I mean there then must be hardware keys that are not present in the code, but then there must be a revocation method for compromised hardware keys, etc..

I have a react native app, and can compile it to pwa mode. It runs well in a browser.

99% of the code runs fine in electron to. Index.tsx is the main exception.

I’m not saying you can automatically run software for one of these targets across all three. I’m saying it’s straightforward to write portable software that works on all of them.

Also, I can’t think of any apps I use that require any platform-specific APIs at this point. Even if they did, the phone I want would be able to surface those APIs to pwas.

This won't help if Google/Apple/Microsoft roll out integrity checks for browsers, something which they have already suggested they want to do.

It won't just be them. I foresee Cloudflare and other CDNs offering a free checkbox: [] Require age of majority verified user

And it will in turn depend on Secure Attestation, Web Credentials, and other recent W3C work to provide proof that you're the registered owner, age of majority and verified by thumbprint or other biometrics, running an unmodified device. Your ID might be escrowed with your OS vendor, email provider, bank, ISP, or even Twitter/X, who knows. Either way, as an end user you'll be mollified that you don't have to provide your ID to the adult site, and the adult site will be happy that they don't have to implement any of this themselves.

And, of course, this will mean that an intelligence service could have ironclad proof of exactly what person visits what website, effectively killing a lot of online anonymity.

That sounds awful.

You’re probably 100% right and it’s honestly heartbreaking.

Time to donate to the EFF and FSF I guess…

Also, time to switch back to firefox, and turn off the DRM crap.

I get warnings from some sites (like radio stations) that DRM is required for the page, but haven’t noticed any breakage.

Using them in that mode adds signal to their web server logs saying that forcing DRM will break their site.

Everyone that cares about this stuff should be doing this.

(And, no, firefox isn’t broken. Also, Firefox doesn’t include the pile of dark patterns and mandatory google spam that chrome does.)

Firefox 100%!

Absolutely re: sending a message.

Using Chrome feels creepy, like the Google marketing team is watching me type or something. And risking the future of the open internet.

It's something they've already done, they just aren't being public about it yet. Look up the X-Browser-Validation header.

...and packaging my app as a PWA is going to help with cantankerous bank/ditigal-id apps, how, exactly?

Momentum.

Reply on news.ycombinator.com