There is this trade-off between usability and security. For example being able to load data from other domains, now with origin policy we have do fetch the data server side. One nice thing about web apps is that they do not require a server to work. But due to xxs injections we cant have nice things.
It's almost like the browser is being abused to do something it fundamentally should not be doing. If you need to do that much client side heavy lifting maybe a web browser is not the place for it?
The ship has probably sailed on that line of thinking but in my opinion a lot of the pain we experience in web security today comes from people trying to do things they really should not be doing.
Accessing data either require's identification to a database or you access the data over the web/http. Do you have any examples where you can access public data without logging in ? I can only think of FTP servers that lets you access anonymously ...
Good point. I’ll talk to some guys and we’ll turn off the World Wide Web tomorrow. Fun experiment but there were a few security bugs (fixable, but why spend the time?) and, most importantly, @mulmen didn’t like it too much.
If you need to write a full application why does it have to happen in a browser? Why can't we use the model so successfully employed on mobile devices?
A security hole in a web app is only confined to that app/domain. Where a security hole in a native app can be much more detrimental. It's also less work to make a web app if you want it to work on more then one platform. Making a web app is also a better dev experience, at least for GUI apps.
I know it's just trendy to hate on node/npm, but these are really turning into bad products and services. You need usability before there's a trade-off. Reputation is still important.
