ServiceWorker

developers/some browsers. and alas the browser still, 5 years latter[2], does not support ecmascript modules[3] in a wide number of places (which themselves are decade old!). even if we do try to use modern javascript, vanilla js + esm, new school modules with old school unframework, we run aground again & have to resort to bundlers if we dare try doing things off the main thread. i still agree with the core thesis. that it's us. that we are responsible for having introduced complexity & that a lot of it is unwarranted. i personally am hoping web components (really, just custom elements) can help us realign, simmer down some of the big framework mentality & return us towards a more apparent mode of development, a better state of grace. i feel fatigued not by how many frameworks there are, but by how few players there are trying to do better, trying to figure out good ways to do custom elements. thankfully there are some good works too. i am very excited to try github's new Catalyst[4], which is inspired by basecamp's Stimulus. there's an amazing mvc feel here that seems straightforward & sensible, makes it easy to look at the dom & grok how things happen. [1] https://github.com/WICG/import-maps [2] https://github.com/w3c/ServiceWorker/issues/831 [3] https://bugs.chromium.org/p/chromium/issues/detail?id=824647 [4] https://github.github.io/catalyst/

isn't chasing every API under the sun? Good for them. Web Devs assuming that whatever's in Chrome is the be all end all standards on the web? Bad for the web and for the devs. Apple possibly not prioritising Safari? Bad for the web as well.

hanna/seriously-though-what-is... 4: https://github.com/w3c/ServiceWorker/tree/c49c878cdcbaf7a81e... 5: http://offlinefirst.org/

bypass the SW from the web app, but only by basically relying on a bug in the spec: if you send a request from an <iframe srcdoc="..."> (or data/object url) it doesn't go through the SW. That will probably be fixed, but a less hacky mechanism will probably replace it [2]. There are some other remaining issues (some of which are discussed in [1]), but given the above the probability of detection of a malicious Service Worker is very high. [1]: https://github.com/w3c/ServiceWorker/issues/1208 [2]: https://github.com/w3c/ServiceWorker/issues/1026

e workers or any website in general. twiss says as much themselves: https://github.com/w3c/ServiceWorker/issues/1208 And yes, there is normally an implicit assumption that the hardware is not spying on you simply because there are no alternatives. It really comes down to how often I need to validate my trust and how easy it is to do so. Web apps, under the best conditions, are hard to grab and pull all the source into external files for examination and almost impossible to do so before executing it, baring using tools like curl or wget, and running the js yourself to figure out what else needs to be downloaded. Not to mention that needs to be done every time I access the app. With a traditional app or is, I could (not that anyone does) verify the code (which for f/oss is easy to obtain) before I compile it myself. (Where I'm trusting the compiler, yes.) I'm not trying to argue that there is a perfect method. I'm arguing that this application isn't even in the running for a good, fairly trustable method. I don't believe it solves the fundamental issue of having to trust the code download every single time, regardless of their service worker check because it itself is not protected. We'll, protected by the vigilance of the end user, which is where we started anyway.

og.airbornos.com/post/2017/08/03/Transparent-Web-Ap... [3]: https://github.com/w3c/ServiceWorker/issues/1208 [4]: https://bugs.chromium.org/p/chromium/issues/detail?id=773307, but it's not a browser bug. I should file a spec bug, but I'm still waiting for a reply on [3], too.