Re: [w3c/manifest] User-approved permissions (#967)

@marcoscaceres 

> This is by design. It's the "one web" principle that we have operated under for the last ~15 years

Keeping old designs as eternal truth is not what is going to make the web moves forward. 15 years ago, no one even imagined that javascript could be used on the server or onto the desktop outside of the browser, while now it is pretty common. 

The thing is that we can not use the website model for web applications, as there is an intrinsic difference between a website and an application. Websites display something external to the user, while applications are softwares that allow much greater user inputs and concern the creation and/or the modification of documents and informations under the user's own intellectual property. 

So if it makes sense that websites are hosted and under the total control of external servers, web applications, by default, should not be so tied to external servers or running into a sandbox totally open to the internet, as it may compromise the privacy, the security and the intellectual property of the users  of the applications and can not offer a secure environment for users.

Also, we should keep in mind that the web is not just the browser and a server in the cloud, it is also the local computer that allows the browser itself to operate. So we can not totally remove of the equation the user's local computer, otherwise we prevent users to use web technologies to their full potential, for local computing, and we keep the web as well as the rights of users in hostage by the cloud companies.

That's why web applications can not be the same as websites, as the website model has not be thought for  applications. Web applications should not have internet access by default. This way, many kind of software scenarios could emerge that would allow developers to build secure applications for users with native functionality, all the way up to less secure applications much like website nowadays but with no access to local computing.

It is not about creating a dichotomy of install versus non install, it is about preserving the rights of users, the security of the internet, and using the web in the interest of users with its full potential.



-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3c/manifest/issues/967#issuecomment-810827023