Comments on: Site Specific Browser - WebRunner http://starkravingfinkle.org/blog/2007/03/site-specific-browser-webrunner/ Fri, 25 Jul 2008 03:54:54 +0000 http://wordpress.org/?v=2.5 By: leslie http://starkravingfinkle.org/blog/2007/03/site-specific-browser-webrunner/#comment-1056 leslie Thu, 22 Mar 2007 18:37:01 +0000 http://starkravingfinkle.org/blog/2007/03/site-specific-browser-webrunner/#comment-1056 Neat. I've since written an Apollo-based Gmail.app, and I have to say that that was roughly 5x easier to get running than the equivalent XULRunner-based Gmail.app. Have you guys ever thought about whether or not SSBs (I started to call them minibrowsers, but site-specific minibrowser might be more apropos) have any place in reducing security risks for knowledgable users? I don't think it solves the end-user phishing / trusted path problem, but for power users, I can imagine it's a lot easier to trust a downloaded SSB which has almost no chrome and no extensions, and is launched separately like a desktop application. If each SSB has its own cookiespace, then CSRF-style attacks become more difficult. Ka-Ping Yee has done some work in making voting more secure (http://zesty.ca/voting/), and I wonder if SSBs would at least be a step in a more secure direction for power users. At the very least, SSBs ought to make it easier to prototype trusted path browsers... I'll probably be at the Mtn View dev day if you'd like to chat more about this. ~L Neat.

I’ve since written an Apollo-based Gmail.app, and I have to say that that was roughly 5x easier to get running than the equivalent XULRunner-based Gmail.app.

Have you guys ever thought about whether or not SSBs (I started to call them minibrowsers, but site-specific minibrowser might be more apropos) have any place in reducing security risks for knowledgable users?

I don’t think it solves the end-user phishing / trusted path problem, but for power users, I can imagine it’s a lot easier to trust a downloaded SSB which has almost no chrome and no extensions, and is launched separately like a desktop application.

If each SSB has its own cookiespace, then CSRF-style attacks become more difficult.

Ka-Ping Yee has done some work in making voting more secure (http://zesty.ca/voting/), and I wonder if SSBs would at least be a step in a more secure direction for power users.

At the very least, SSBs ought to make it easier to prototype trusted path browsers…

I’ll probably be at the Mtn View dev day if you’d like to chat more about this.

~L

]]> By: Benjamin Smedberg http://starkravingfinkle.org/blog/2007/03/site-specific-browser-webrunner/#comment-932 Benjamin Smedberg Thu, 08 Mar 2007 15:21:29 +0000 http://starkravingfinkle.org/blog/2007/03/site-specific-browser-webrunner/#comment-932 Right now, if you use a separate process, you also get a separate cache/history store, which is probably not desirable. For Moz2 we will hopefully have cross-process shared cache and history, but in the meantime I think we should focus on making this work within the Firefox process. We could do this with an extension now, I'd bet. Link targeting is still the hard part... how do you decide which links are "external"? I've written up a proposal for a link rel="external" that would allow webapps to specify that explicitly, but nobody has implemented that yet. Right now, if you use a separate process, you also get a separate cache/history store, which is probably not desirable. For Moz2 we will hopefully have cross-process shared cache and history, but in the meantime I think we should focus on making this work within the Firefox process. We could do this with an extension now, I’d bet. Link targeting is still the hard part… how do you decide which links are “external”? I’ve written up a proposal for a link rel=”external” that would allow webapps to specify that explicitly, but nobody has implemented that yet.

]]> By: Allan http://starkravingfinkle.org/blog/2007/03/site-specific-browser-webrunner/#comment-927 Allan Thu, 08 Mar 2007 05:10:24 +0000 http://starkravingfinkle.org/blog/2007/03/site-specific-browser-webrunner/#comment-927 I am reasonably new to programing web application and am still feeling my way, so please for give me if I have the concept wrong. I think that in my case SSB’s would be a god send! I write applications that I deploy on customers systems and then they use them with what ever browser they have installed. Then they upgrade the browser or it upgrades automatically, hay presto my applications no longer runs. The ability to install a scaled down version of say Firefox, ( no need fo toolbars etc... ) when installing my web app and point the web app to that browser to run in would mean my web app would run first time ever time. My customer would be much happier to. Bring it on, the sooner the better. I am reasonably new to programing web application and am still feeling my way, so please for give me if I have the concept wrong. I think that in my case SSB’s would be a god send! I write applications that I deploy on customers systems and then they use them with what ever browser they have installed. Then they upgrade the browser or it upgrades automatically, hay presto my applications no longer runs.

The ability to install a scaled down version of say Firefox, ( no need fo toolbars etc… ) when installing my web app and point the web app to that browser to run in would mean my web app would run first time ever time. My customer would be much happier to. Bring it on, the sooner the better.

]]> By: rebron.org » site specific browsers http://starkravingfinkle.org/blog/2007/03/site-specific-browser-webrunner/#comment-921 rebron.org » site specific browsers Thu, 08 Mar 2007 00:08:09 +0000 http://starkravingfinkle.org/blog/2007/03/site-specific-browser-webrunner/#comment-921 [...] of site specific browsers since 2001 when iTunes was first released.  There’s some talk of site specific browsers now and we’ll likely see more discussion around [...] […] of site specific browsers since 2001 when iTunes was first released.  There’s some talk of site specific browsers now and we’ll likely see more discussion around […]

]]> By: biodecay http://starkravingfinkle.org/blog/2007/03/site-specific-browser-webrunner/#comment-919 biodecay Wed, 07 Mar 2007 21:46:22 +0000 http://starkravingfinkle.org/blog/2007/03/site-specific-browser-webrunner/#comment-919 I dare say that this is a champion concept. The ideal incarnation, for me, would be the means to custom-configure an existing platform such as Firefox on a per-site basis. Specifically, a bit of code can be placed on the site indicating that it supports a custom interface. Firefox then prompts the user whether they would like to use the custom interface and if so, it is downloaded, installed and used. This preference is then remembered. This is a neat solution to a number of problems. One, it's convenient for users. Two, users retain control over their experience. Three, an enhanced experience can be delivered through the SSB; however, users with other browsers or environments may still access the app. Four, the web app code can still be standards-compliant, globally-renderable code... but specific, cleanly degrading hooks can be added for the SSB to do things in a more efficient manner. Five, because the custom interface can be tied to a domain, a shortcut can simply be created by way of a link to that URI. Simple! I agree that XULRunner seems a promising basis. -Rob. I dare say that this is a champion concept. The ideal incarnation, for me, would be the means to custom-configure an existing platform such as Firefox on a per-site basis. Specifically, a bit of code can be placed on the site indicating that it supports a custom interface. Firefox then prompts the user whether they would like to use the custom interface and if so, it is downloaded, installed and used. This preference is then remembered.

This is a neat solution to a number of problems.
One, it’s convenient for users.
Two, users retain control over their experience.
Three, an enhanced experience can be delivered through the SSB; however, users with other browsers or environments may still access the app.
Four, the web app code can still be standards-compliant, globally-renderable code… but specific, cleanly degrading hooks can be added for the SSB to do things in a more efficient manner.
Five, because the custom interface can be tied to a domain, a shortcut can simply be created by way of a link to that URI. Simple!

I agree that XULRunner seems a promising basis.

-Rob.

]]> By: enefekt http://starkravingfinkle.org/blog/2007/03/site-specific-browser-webrunner/#comment-917 enefekt Wed, 07 Mar 2007 16:32:07 +0000 http://starkravingfinkle.org/blog/2007/03/site-specific-browser-webrunner/#comment-917 "I am not suggesting that an SSB be tied to any XULRunner runtime shipped with Firefox" Assuming multiple SSBs share a single runtime, then part of this WebRunner endeavor would be creating a decent install/update experience of the WebRunner runtime. This would be a cool (though difficult) effort, if Mozilla doesn't do this with Firefox 3. But, IF Firefox 3 did end up coming with XULRunner, then why not use it? If a perfectly good, recent, "official" XULRunner runtime exists already, why install another one? “I am not suggesting that an SSB be tied to any XULRunner runtime shipped with Firefox”

Assuming multiple SSBs share a single runtime, then part of this WebRunner endeavor would be creating a decent install/update experience of the WebRunner runtime. This would be a cool (though difficult) effort, if Mozilla doesn’t do this with Firefox 3.

But, IF Firefox 3 did end up coming with XULRunner, then why not use it? If a perfectly good, recent, “official” XULRunner runtime exists already, why install another one?

]]> By: Faaborg http://starkravingfinkle.org/blog/2007/03/site-specific-browser-webrunner/#comment-915 Faaborg Wed, 07 Mar 2007 15:25:38 +0000 http://starkravingfinkle.org/blog/2007/03/site-specific-browser-webrunner/#comment-915 I would really like users to be able to right click on a bookmark and turn it into an application (or maybe an option in the File menu for the current site). Firefox then dumps it on their desktop, and when the user opens it they get a SSB that has its own icon, place in alt/command-tab, in the taskbar/dock, etc. I would really like users to be able to right click on a bookmark and turn it into an application (or maybe an option in the File menu for the current site). Firefox then dumps it on their desktop, and when the user opens it they get a SSB that has its own icon, place in alt/command-tab, in the taskbar/dock, etc.

]]> By: Mark Finkle http://starkravingfinkle.org/blog/2007/03/site-specific-browser-webrunner/#comment-914 Mark Finkle Wed, 07 Mar 2007 14:56:08 +0000 http://starkravingfinkle.org/blog/2007/03/site-specific-browser-webrunner/#comment-914 Luis & Abdulkadir - The browser will likely stay the predominant way people use webapps, I agree. There are advantages / disadvantages in both approaches. A SSB is just an alternative. enefekt - I am not suggesting that an SSB be tied to any XULRunner runtime shipped with Firefox. Wladimir - WebRunner is a XULRunner application with a few extra parameters that allow it to wrap different webapps. This is not a new platform. Luis & Abdulkadir - The browser will likely stay the predominant way people use webapps, I agree. There are advantages / disadvantages in both approaches. A SSB is just an alternative.

enefekt - I am not suggesting that an SSB be tied to any XULRunner runtime shipped with Firefox.

Wladimir - WebRunner is a XULRunner application with a few extra parameters that allow it to wrap different webapps. This is not a new platform.

]]> By: Wladimir Palant http://starkravingfinkle.org/blog/2007/03/site-specific-browser-webrunner/#comment-913 Wladimir Palant Wed, 07 Mar 2007 13:55:11 +0000 http://starkravingfinkle.org/blog/2007/03/site-specific-browser-webrunner/#comment-913 I fail to see the point in having another platform for this. XULRunner is the platform of choice for standalone applications once the deployment/installation issues are sorted out. So IMO this makes sense as a XULRunner application generator that would generate such an application from a few parameters like starting page, sites the application should be limited to and maybe some custom XUL/JavaScript code. Unless of course a WebRunner extension is supposed to have lower privileges than a XULRunner application but that might be difficult given your requirements. I fail to see the point in having another platform for this. XULRunner is the platform of choice for standalone applications once the deployment/installation issues are sorted out. So IMO this makes sense as a XULRunner application generator that would generate such an application from a few parameters like starting page, sites the application should be limited to and maybe some custom XUL/JavaScript code. Unless of course a WebRunner extension is supposed to have lower privileges than a XULRunner application but that might be difficult given your requirements.

]]> By: enefekt http://starkravingfinkle.org/blog/2007/03/site-specific-browser-webrunner/#comment-912 enefekt Wed, 07 Mar 2007 12:56:23 +0000 http://starkravingfinkle.org/blog/2007/03/site-specific-browser-webrunner/#comment-912 "Platform with extensions" How do you see this one being delivered? As a separate-from-Firefox platform "WebRunner"? Or utilizing XULRunner with Firefox 3? If it is the last one, the information on the Firefox3/Gecko Feature List seems to throw a little cold water on the prospect. "Firefox on XULRunner (and shipping XULRunner platform)" is only given a P3 priority, and the comments read: "In Progress; we can ship without it" - http://wiki.mozilla.org/Firefox3/Gecko_Feature_List Doesn't seem like it's too high up on the radar. “Platform with extensions”

How do you see this one being delivered? As a separate-from-Firefox platform “WebRunner”? Or utilizing XULRunner with Firefox 3?

If it is the last one, the information on the Firefox3/Gecko Feature List seems to throw a little cold water on the prospect. “Firefox on XULRunner (and shipping XULRunner platform)” is only given a P3 priority, and the comments read:
“In Progress; we can ship without it”
- http://wiki.mozilla.org/Firefox3/Gecko_Feature_List

Doesn’t seem like it’s too high up on the radar.

]]>