Tag: web-applications

Categories
Mozilla Web Development

Web Application Coherence

One of the greatest things about Parallels is Coherence. The integration between the virtual machine and the host OS makes virtualized applications feel almost native. It’s a major win for users who don’t want to be locked into a mini-desktop.

I wonder if this concept could be brought to the web in a secure, but convenient method. There are many applications that could benefit. You could pull widgets off a page and onto your desktop as an application. For example you could take Meebo, an online IM service. In a matter of seconds it would feel as if you downloaded a new application, but your still using your browser. People love web applications, and hate downloads. This has been known for a while. Meebo is extremely popular because it feels somewhat like a desktop application, but it’s web based. Think of this as Apple’s Dashboard taken to a whole new level.

Take for example this psudocode (it’s just to make a point, not an API):

<div id="frame">
    <p>This is a window that can be brought to the desktop</p>
    <p id="test"></p>
</div>

var widget = document.getElementById(‘frame’);
 
// This would test if it’s currently coherent
if(!widget.coherence){
    // This would prompt the user to allow coherence on the page.  Typical extension-like install warning.
    widget.allowCoherence();
}
 
// When you first enter coherence mode
widget.coherence.oncoherence = function(){
    document.getElementById(‘test’).innerHTML = ‘I\’m in your OohS, integratin your web pagez’;
};
 
// When you focus (bring a window to the front)
widget.coherence.onfocus = function(){
    document.getElementById(‘test’).innerHTML = ‘Your in focus’;
};
 
// When you first enter coherence mode
widget.coherence.onminimize= function(){
     document.getElementById(‘test’).innerHTML = ‘I\’m idle right now.’;
};

The first time your browser would hit allowCoherence() you would be prompted to allow coherence for that domain. Other than the integrated look/feel it would adhere 100% to typical web sandboxing. This isn’t like building an XULRunner app where JS can write to the filesystem. It would just be a way to make web applications more usable for people. and breakout of the web browser feel.

There are other things that can be done as well. For example css theming could give the app a more native look/feel dependent on the host. Perhaps just an attribute in the <html/> would trigger the browser to render things to look like a native app by default (pinstripe background for page by default, etc). Another great thing to use with it would be offline support. A little more cleverness would allow you to create bookmarks that essentially “open the application”.

Ultimately this would still be about web applications, but making them live outside of the browser window. The user wouldn’t need to install anything more than a web browser. The applications would be as safe to use as browsing to a website.

So there’s my giant idea. Implementing this in something like Firefox would be a rather large task, and to be useful the API would need to be standardized across browsers, but much of the underlying stuff is there. Anyone interested in taking web applications to the next level?

Categories
Mozilla Security

WebApp as Desktop App Security Model?

Recently there has been a fair amount of talk about bringing web applications off of the web and onto your desktop, or to put it in really simple terms: providing a bare-browser that has no UI but the site you visit. It sounds good, but I’m not convinced it’s quite workable, at least at this point. A few example of these attempts are:

The first two are somewhat generic in purpose, while FullerScreen is intended more for the task of using a web page as a presentation medium. Making it a potential replacement for something like PowerPoint.

I’m not quite sure this is really a workable model for the “average user”. Take for example the following scenario:

Say you use this as a way to make your Gmail (or Yahoo) account feel more like a client-size application. You receive an email to visit a site. You click the link and visit the site. You think you are using Firefox. In reality you’re really viewing a spoofed window. Even if remote XUL is disabled you can still do a fair job with just a bunch of cut up GIF’s. Enough to fool a casual user. Firefox has some basic countermeasures to help prevent this, such as keeping some UI.

This could be prevented if a “windowless” browser always prompts or provides some other sort of notification before connecting to an unprivileged host. Or better yet: Simply launches the real browser rather than handling untrusted url’s. That would be better and less Vista-like.

So that leaves me with the question: how should such an application behave? A true desktop application typically launches the default browser on the computer. Notable exceptions being things like Real Player, Google Earth, etc who embed a browser. How do you give a desktop like feel to an application, yet still provide the UI feedback to the user that a browser’s chrome provides?

My suggestion is simply limiting by a hostname. You have a Gmail app, you trust Gmail and nobody else. In my mind an application does 1 task and does it well. If it was intended to feel like a Gmail client, then it should do that, and that only. Want to visit that website with the monkey that sniffs his own butt? Cool, but do it in your own browser.

I’d be curious what others thought of this potential problem. I think with XULRunner looking more stable, WebKit being available to Mac developers and the merging of the web and OS, things like this are a potential problem. We are getting more and more ways to embed browsers into things (widgets, extensions, etc.). This is going to be more of an issue moving forward.

This isn’t to say I don’t like the above products (I actually really like them). I just haven’t figured out exactly how they fit into the current security model of local:safe, web:devils-playground. I don’t think they do. I think they potentially break the barrier between the web and desktop applications. We’ve all been hoping would be broken. The question is: are we ready?

The higher level question is: How do you distinguish between trusted and untrusted data when it all looks like it’s local?

Categories
Mozilla

W3C Web Applications/Compound Documents

Daniel Glazman points out a new position paper Hixie (most likely) authored.

Most interesting he concludes:

I think this paper is going to face a fierce resistance…

Personally I give my vote on most resistance to Microsoft.

I’m curious what others think reading some of these. It’s really quite interesting. I’ve had a great time reading since Hixie mentioned it on his blog the other day. This is the stuff I enjoy reading most. It’s like SiFi, and reality merging into one. Ok, enough geek speak, time for work.