Hacker News Reader

Comment by Joeri | Hacker News Reader

I say this as a web developer: web apps are worse than native desktop apps in almost every way. They are slower, less usable, less accessible, less integrated with other software and they are harder to develop (although because most web developers never wrote desktop apps they don't realize how pitiful their tools are).

This is all true (or debatably conceivable), so why are so many apps web apps? Well, in my opinion, it's this: they are easier to deploy, easier to adopt, easier to bill, and much harder to pirate. Web apps are worse for end users and developers, but better for everyone else: the people who sell them, the people who buy them, the people who deploy them, and basically anyone who holds purchasing power.

View on HN

You're overlooking the fundamental quality of the web and why a lowly document format and simple protocol eventually became a poor man's GUI platform that has been slowly rolling forward and crushing the desktop app market in its wake.

The web is a fully cross-platform/cross-device, installation-free, and open-standards-based platform.

Although traditional GUI toolkits can chip away at different aspects of this, it is actually a much more intractable problem for them to solve than the aspects you cite as native desktop apps being better at. For example, interoperability between web apps has gotten steadily better as HTTP APIs have evolved, today's generation of web apps often make interoperability a selling point (Slack is a good example). From a traditional single-platform native developer the mechanism for this looks crufty and ill-defined, but that is the price you pay for a truly open standard not controlled by a monolithic entity. For instance, for all the beauty and elegance of Microsoft Visual Studio, there is no way they can bring that experience to OS X and Linux, let alone all the mobile platforms.

Native app developers have been wringing their hands over the "inferiority" of the web for 15 years now, but all the while ignoring that the web does something which no technology has ever done in terms of ubiquity. And what enabled this was the trojan horse of HTML/HTTP's initial simplicity. Hell, the simple HTML documents for which the format is ideally suited still outnumber apps by an order of magnitude, but the beauty is you have one platform that can support everything on the complexity continuum from the simplest documents all the way up to sophisticated business apps.

Agreed, especially about integration. Many web apps expose their functionality with RESTful JSON APIs or similar. It seems to me that integrating data & functionality from across web apps is far more common than in the desktop setting. I've never built a desktop app, but just from a users perspective most of my desktop apps are isolated pieces of functionality while web apps are entangled in the greater web community.

My background is mostly web app development, and when I started I was using open technologies such as PHP and NodeJS. This summer I'm doing some work in Visual Studio with a C# .NET MVC 4000 web app. Visual Studio is a slick interface _mostly_ with some great convenience _usually_ but overall it feels suffocating compared to slapping together random tangles of open web technologies. I like the messy open standards...

And many non web apps happily use RESTful JSON APIs too.

You can even compare web standards to the most ubiquitous formats used in the most ubiquitous desktop programs. MS Office formats still cause people problems when they try to open complex files in older versions of Office or compatible suites. Whereas if data is stored as JSON, you can be sure that anybody will be able to access the data correctly in any of the thousands of apps that handle JSON, and they'll be able to handle it indefinitely.

I don't often agree with Richard Stallman, but ...

http://www.gnu.org/philosophy/javascript-trap.html

http://www.theguardian.com/technology/2008/sep/29/cloud.comp...

The TLDR is simple : web apps makes Unisys, Microsoft, Apple, ... look like heroes of Freedom, even during their most anticompetitive days.

The worst behaviour microsoft ever exhibited is now standard practice. That's what web apps have gotten us.

That, of course, in addition to the fact that saying that the tools suck does not quite do justice to just how bad web development tools are.

I do often agree with Richard Stallman, but...

These are problems with particular web apps, not web apps in general. I host lots of web apps on my own servers, and they are just as free as any software, but I can access them anywhere from any device. In cases where web apps are non-free, I would have to say it's better than having them installed locally. Web browsers do quite a bit to keep apps in jails where they can't access and affect the rest of the system in the same way a local program can.

I disagree. The difference being :

locally installed non-free web app

app: not yours (BUT: communication between author and app is impossible if you want it to be) data: yours (meaning you can delete it)

remotely installed non-free app

app: not yours, and you can't prevent the author from updating their app under your feet. And the author can do nearly anything, meaning any encryption on your data is useless. data: not yours (meaning the author can read, change, delete, and you CANNOT unless the author, and anyone with a global root certificate (like Saudi Arabia, dozens of companies that have committed breaches of trust, ...) can mitm you, and gain the author's access to your data)

Non-free web apps definitely come with their own range of problems. Data doesn't need to be out of your control though. JavaScript is usually run locally, so there are lots of calculations being performed by your computer before it reaches the remote server. For example, Mega encrypts data client-side before it is archived online. Just like with regular non-free software, you have to trust what it is doing. The best way to deal with these problems without throwing away non-free software would be to have security functions like encryption performed client-side with free software.

I agree that server-run non-free software is neither safe nor private, but I still believe that this is the flaw of particular programs, not web-based software in general. It only emphasizes what a need there is for further development of open standards in web apps.

But the ability to use a cross-platform browser as a universal client and run software that is built on the advantages of networking is a huge bonus for software in general. Free software just needs to catch up in a few areas, but in general it is dominating the backbone of the web. Now we just need to push that freedom forward to the user.

> For example, Mega encrypts data client-side before it is archived online. Just like with regular non-free software, you have to trust what it is doing.

This is, sadly, not true at all. You have to trust

1) that the actual author of the site is playing fair

2) that you are not being mitm attacked by anyone in this list [1]. Note that 3 organisations on this list are known to have issued false certificates with the express purpose of stealing login credentials. They did this by sending through "amended" login javascript bundles.

> I agree that server-run non-free software is neither safe nor private, but I still believe that this is the flaw of particular programs, not web-based software in general. It only emphasizes what a need there is for further development of open standards in web apps.

No. Web apps can be replaced by malicious software every time you use it, and there is nothing you can do to prevent this. It is a fundamental design flaw of web based systems. And, of course, "cert pinning" simply means that a few organisations (google, facebook) get isolated from a few kinds of attacks.

The flaw is that control is placed entirely in the hands of the remote side. Needless to say, this is not secure.

I don't get where this idea of open standards being the solution to privacy problems comes from. Cookies are an open standard, the web is an open standard, TPMs are an open standard, the SSL certiciate chain principle is an open standard. Hell, microsoft palladium is an open standard. All are complete disasters for privacy and freedom.

> But the ability to use a cross-platform browser as a universal client and run software that is built on the advantages of networking is a huge bonus for software in general. Free software just needs to catch up in a few areas, but in general it is dominating the backbone of the web. Now we just need to push that freedom forward to the user.

I disagree. The web has brought back the "freedoms" of the mainframe era, only with a much bigger dependency on the mainframe system. Mainframes also in many cases ran free software. Can you claim with a straight face that a non-root account on a mainframe system is in any way free and private ?

If you don't decide what software runs on your machine, like on the web, you have ZERO security guarantees. Zero. Nothing, nada, zilch, ... no matter how secure anything built on top of that is. I don't get why this is even the slightest bit controversial.

[1] https://www.mozilla.org/en-US/about/governance/policies/secu...

You bring up legitimate problems, but again, they aren't unique to web apps. Physical computers can be compromised too. They can be compromised in manufacturing before they even reach you. There's never a guarantee of security, just trust that you are using a secure product.

Improving the trust model has almost nothing to do with how much of the computer you have administrative access too. Secure computing means trusting those who build and maintain your computers and the software that runs on them. It's less possible than ever to do everything yourself.

There are big privacy and security advances happening because people have lost so much control of their data. People are trusting others more than ever with control of their computers, and that means certain demands for trustworthines that didn't manifest when people felt better about their data because they knew where it was physically stored.

Moving the easiest point of attack on a system to the external network just means we have to be more explicit about what we do with each other's data. We have to learn to trust each other, and that means developing systems that are transparent, auditable, and free, but it also means developing cultures that promote trust and proof of trustworthiness, because that's where real security will come from.

I'll just say this : your data is not private. Take a divorce proceeding (which is a CIVIL proceeding) from the last 5 years. Press CTRL-F, "facebook", and recoil in horror.

Basically all your cloud data will be used against you in any civil dispute in the US. So remember when you use web apps : anything you type in there is accessible to anybody who enters into a serious court case with you.

Another example : any office 365 document (esp. spreadsheets) WILL be read by the IRS if they ever decide to sue you (and you'll pay the wage of the person doing it, to make matters worse, whether or not they find any wrongdoing). Again, the evidence is plain to see in court transcripts.

And, lastly, sometimes your accounts will be compromised in petty legal disputes.

Therefore my policy is :

1) As microsoft has publicly demonstrated, they will use your hotmail stored information and use it to take action against you. If you work for a company that has a cloud platform, or a company that has a significant relationship to one of the cloud platform companies, you're taking unacceptable risks.

2) any dollar sign in any mail to me will immediately result in dead silence. I'll call you up and warn you to never do that again. If it's important enough I'll call. And if it's really important I'll drop by. Both kinds of interactions have vastly superior legal protection.

3) I will NEVER negotiate or store any contract over email, not even my freaking cell phone bill. I have them on my (encrypted) hard drive, of course, even indexed. But contracts on online services is just stupid.

Note that this behaviour is NOT illegal : the purpose here is to safeguard my personal information, which is a normal thing to do that is in fact encouraged by the relevant departments. I am trying to hide personal information from everybody and everything, which is my right.

Yes, you have that right, but I still think we're talking about different things. When you're talking about web apps, you're talking about apps hosted by Microsoft, Google, etc. I'm saying that those have their own issues, but the issues are issues with Microsoft and Google, not server-hosted applications made with HTML5, JavaScript, and PHP.

The right way to do web apps is to have something like a Debian Freedom Box, where you have your own server running free software sitting in your living room and you can access it from anywhere. Another pretty good option is to buy hosting from someone you trust with your data and run your server in their data center, preferably encrypting your data client-side before it's sent to the data center. These privacy issues you mention with Microsoft are due to using their particular implementation of web apps.

This seems very biased.

Web developers have been "wringing their hands" for the last 5 years swearing blind that any day now everyone's going to give up on smart phone native app development and go html5.

All the web has managed to prove is how badly MS cocked up app deployment on windows, nothing more. The web 'won' against one platform, windows deployment, MSIs and the rubbish they've been putting out with WPF, "one click" deployment. Smart phones have shown us how the web actually doesn't compete very well against native once a decent deployment solution is in place.

I agree with everything you've said (with the exception of speed in many cases), and I would add: easier to maintain. Even supporting multiple browsers is NOTHING in comparison to supporting millions of potential OS/machine configuration installs.

That, and the fact that your app can be available everywhere without having to have it on every machine you want to use it on.

The 'speed' thing is mostly because we have so many inexperienced programmers writing web apps in the world - it's easy to publish these days but I don't think there is that much focus on making your app run really well. It's mostly UI focus. For example you can use Bootstrap and it handles a lot of UI, but most coders don't know what that UI framework is actually doing. Not slamming Bootstrap at all, just using that as an example that many people would know.

I never had much trouble supporting those 'millions of potential OS/machine configurations' but keeping a web-app on the rails for multiple browsers + mobile is the stuff of nightmares. It is almost as if they break things on purpose.

They are "slower" in that actions take longer, mostly because so much data has to be serialized, encoded, shipped long distances, decoded and deserialized before rendering, but they're "faster" in that updates happen instantly and transparently.

Desktop software used to be very quick to respond locally, but updates would take weeks, months, or even years to get pushed out. Some applications, once sold, would never, ever get an update. You'd just buy the new version whenever that came out.

I think you're right, and I like web applications and think they are a good avenue. However, looking at mobile apps and how updates work there, it is a nice middle ground. No doubt it's more essential as we're talking about phones, not desktops. But I think this sort of computing has come back in some ways.

Flip side of that last one, sometimes you would even buy a program, and it would still work long after the company that wrote it went out of business. These days, when a company pulls the plug on a web app, you are SOL.

Which is, btw, another incentive for web companies as it forces large companies who do decide to make use of a web product integral to their operation willing to pay a lot more to keep the web company alive.

I personally prefer the latter.

When you buy a license for a desktop application, the price you pay includes tech support and often times future upgrades. When the developer goes out of business, you lose out on all of that. In contrast, the vast majority of web apps are on a subscription model - as long as you continue to pay, you're getting your money's full worth. Sure, it can be a bit disruptive when the company pulls the plug, but in most cases there are reasonable alternatives that are both easy to discover and easy to start using (usually within the span of minutes).

Unless it's Free Software, like Newsbeuter.

I'd take a software-as-a-service solution that I can replicate the data from in an open standard format like JSON or XML over a closed-source application with an impenetrable binary file format any day.

That seems like a false dichotomy. There are SaaS applications with no data export option, and there are closed-source locally installed applications that use textual data formats (e.g. XML), if only as a matter of convenience for their developers.

I mean this by way of comparison to applications that were distributed on floppy such as WordPerfect, dBase, FoxPro and so on, where the data format was proprietary.

It's only relatively recently that we've seen open-source and open-data applications. These are arguably better but relatively rare.

One advantage of web apps is that they don't require an installation process. It's easier to convince someone to use your software if all they have to do is visit a link. But as the author said, your code is now running at a layer far from the hardware.

And running in a sandbox, they are (mostly) unable to harm the users computer, which is big part of why it's easier to convince someone to use it.

Other advantages for the user:

- They can run 24/7 without having to keep your machines on. You can fix that by having a native app with a server backend, but then you lose some of advantages of native apps.

- They're cross-platform. For Linux users, but even for OS X users, how many times have we seen an Windows app that is a pain/impossible to install even on Wine?

- They run without admin privileges (e.g. work machines) and even without permissions for execute unknown binaries.

- They're less likely to infect your system.

- The frontend is usually more customizable (e.g. it's much harder to make something like RES[1] for a native app)

[1] http://redditenhancementsuite.com/

It amazes me how this is always overlooked, why are web apps used over desktop apps?

Because it's easier for the end user.

Have you ever tried to get a user to install a piece of software? It is hard. They don't know what is going on, is it going to harm their system, is it a virus? What are these terms I'm agreeing to? Whereas a web app they go to the site and BOOM it's done, loaded, and ready to go.

Having to download and install a program makes a lot of things a non-starter for many users. A lot of us struggle with that concept due to a lack of empathy for a general computer user. I have downloaded three programs today alone and didn't think twice about it. But that is just not going to happen for the vast majority of users, and is one of the areas where we (software developers in general) have a hard time empathizing with our end users on.

Sure would be better if desktop apps could be sandboxed like web apps. Installation would be less risky and less questions asked.

There are programs that do this, such as sandboxie [0], or even a VM. But none of them are very user friendly to computer novices.

[0]: http://www.sandboxie.com/

The Windows world needs an standard application sandbox for Win32 applications like iOS, Android, Linux (docker) and FreeBSD (jail). WinNT has the functionality inbuilt since NT 3.1 but the Win32 shell doesn't expose it.

Mac OS X has done this since the Mac App Store was introduced. Doesn't Windows 8 do it for Market apps?

You know, once GMail was the web app. Now I don't use it in the web form anymore, but through native clients.

Web apps could be better, for some X, <script src="/myapp.X" type="text/X">

where X != "javascript". But only Google, MS, Apple, and Firefox working together can make this happen.

All well and good but which of my desktops would you target.

I'm typing this on Android 4.4, though I might have picked my 4.1 tablet. Or my Debian laptop running 64 bit Xfce. Or my Debian Arm netbook running Plan 9 from user space. Or I might be on a vnc session to my virtual servers, either plan9 or CentosVM. Or might be at my Windows 7 desktop. All of those are happy with Web Apps.

I think I have achieved the same easy of development of the very old FoxPro, that is, having one form for both create and edit an item, with the combination of Laravel and AngularJS.

But of course much more is needed. FoxPro is ancient, forgotten tech.

web apps are better for developers. Write once, run on multiple OS / browsers. They're easier to maintain, you don't need to go through approval process or worry about your users running a version that's 3 months behind, meaning you can iterate a lot faster.

> less usable

In what way?

> less accessible

Nope.

> harder to develop

Not when you're trying to develop for ever platform, mobile and desktop.

Your other points still stand.

> In what way?

Slower. Network-bound.

> Nope.

Require internet connections. Require vendors to stay in business indefinitely.

The other is a matter of taste.

Reply on news.ycombinator.com