Anonymity: Death of the Stateless Web

[UnunoctiumTesticles]

Anonymity: Death of the Stateless Web
by UnunoctiumTesticles

To garnish more interest an apt title could have been, “Tor Is Not Anonymous—Web Paradigm Shift Underway”. I am referring to antithesis of the computer science term stateful—not to being without a nation-state.

Googling “death of the web browser” returns many articles claiming smart phone apps are replacing the web browser¹. For example, Facebook’s app provides a more optimized experience than browsing the web site on the phone. However, I posit that more content instances² are being added to and accessed from the traditional web than are being solely accessed from apps; for example, the posts to blogs and forums. My assumption seems intuitively valid for at least two reasons. Two finger typing blog and forum posts on small screens is highly inefficient and error prone. Secondly, new web content instances are being added much faster than new apps because writing HTML is much easier than programming the Android OS or iOS. Even if there exists an app that facilitates authoring popular categories of stateless content, the data format of that stateless content would become a standard MIME type (whether it was an open standard or reverse-engineered because of the content popularity), that app is a content browser, and web browsers could support the content MIME type.

The balance will tip in favor of apps because:

• Android apps are coming to your laptop and PC⁸.
• To supplant the web browser because apps can often provide a superior experience. I enumerate some possible improvements provided by apps in The Stateful Web section below.
• As the demand for anonymity on the web grows, the stateless web browser must be replaced by apps because network anonymity requires high network latency and only apps have the capability to provide a reasonable user experience when there is high network latency.

Anonymity Requires Latency

There are two fundamental types of anonymity mix networks: private information retrieval (a.k.a. PIR or “everyone sees everything”) a la Bitmessage and Chaum mixes such as onion routing a la Tor.

PIR although low latency is not anonymous for any practical internet packet model because it would be impossible to dynamically adjust anonymity set groupings which balanced the traffic between all set members without revealing correlations that destroy the anonymity; also any practical design would not be entirely decentralized. Also PIR requires a high bandwidth burden on the clients since each client must receive all the server responses for all clients in the anonymity set.

Onion routing is fully decentralized and does not require a high bandwidth burden on the clients. Although it also suffers correlations (intersections) from servers which dynamically exit the network, but if the persistent hidden services are the routing servers (which is not the case in Tor nor I2P) this will be a much less frequent event than the dynamically (constantly changing) balanced groupings required by PIR.

The following frequent Tor attacks render Tor extremely unreliable, but could be fixed in an improved onion network.

1.	Timing (traffic) analysis3 enabled by the requirement for low latency, thus not inserting random delays in relaying at each routing server. Dummy (a.k.a. cover or padding) traffic is more wasteful, ineffective if not global, thus not a decentralized solution.
2.	Anonymity set is egregiously too few at only 3 hops. Hidden services have 6 hops, but only 3 while initializing the rendezvous relay of the circuit.
3.	Entry, exit, and relay routing servers provide bandwidth for free; thus are likely provided by national security agencies which have the financial incentive to unmask anonymity on a wide-scale.
4.	No DDoS prevention; thus inexpensive4 spamming causes exit node banning, exacerbates the three prior items in this list, and makes hidden services unsuitable for high traffic sites.
5.	Exit nodes are a massive security hole because national security agencies have backdoors to important servers and SSL certificates5―ideally only hidden services should be allowed.
6.	Intersections from servers which exit the network.
7.	Hidden services which are not also routing servers, have an identifiable traffic pattern where many more packets are outgoing than incoming due to the incoming be requests for content.

Fixing #1 and #2 requires a high latency design. Fixing #2 - #7 requires clients paying per packet for (and to) the hidden services in order to incentivize them to be also the routing servers. If users select only hidden services they are familiar with for routing, this prevents a Sybil attack against the network.

So a high latency design with pay-per-packet economics can be truly anonymous, but it will require a stateful web at the client provided by apps. Whereas, Tor was designed to work with the existing stateless web employing low latency, exit nodes (instead of exclusively hidden services), and the stateless web browser. As a result, research claims up to 81% of Tor users can be identified³.

Latency Incompatible With Stateless Content

Web content—even often when cached to check the current server file timestamp—requires HTTP retrieval from the host server. Network latency delays the user on every click in a stateless web browser, which could be on the order of double-digit seconds per click on a correctly designed, high latency, anonymous network. Even Tor’s slightly increased latency—albeit lower than required for true anonymity—can be maddening tsuris.

Tor admits latency is a problem for hidden services (with its still tiny anonymity set of only 6 hops) and that solutions will likely come from restructuring the paradigm (“protocol” or “JavaScript hacks”). And Tor admits that supporting the “low latency web” is a “hard problem” that they “still don’t know how to do it correctly”.

Demand for Anonymity Increasing

Global police socialist nirvana cometh^{3 6}.

The 1878 Posse Comitatus Act forbade the use of armed troops on USA soil, but now it is openly violated by the legal switcheroo shell game of reconstituting the “peace officers” (a.k.a. police) so they are now effectively paramilitary. Even in Europe for example Switzerland is increasing gun control (oh grasshopper please understand why a lack of private arms means Putin’s ground forces can run over Europe like a hot knife through warm butter).

The Stateful Web

Strategies for minimizing the user’s perceived latency will vary and require client-side programming to be installed as client-side app. For example, a forum would persistently cache posts client-side, keep a persistent server-side record of cached posts for each client, and push new and edited posts to the client when the client is viewing a page which requires the updates.

Note that latency doesn’t reduce throughput, so clients might be optionally programmed to preload updates and other predictive strategies such as a search engine initiating loading of the top results before the user clicks to view each of them. Rarely updated content (e.g. images, videos) could aggregated by hidden service hub servers which could continuously push⁷ updates to client caches.

HTML5’s Offline Web Applications and Web Storage is moving in the direction of the stateful web, but it lacks the interfaces, design, programming, and programming language flexibility of the Android OS which also has a superior security model. Android OS is coming to your laptop and PC⁸.

App installation is normally as simple as clicking to confirm that approve of installing the app and the app’s requested permissions. Note most apps in the Android security model don’t need any special permissions at least those developed for the latest Kitkat version.

The title and content of this epistle is not about the death of all stateless content, rather I think it quite explicitly says death of the Stateless Web. This salient distinction is that per the Unix design principles of least presumptions, orthogonality, and separation-of-concerns, the content and rending model (e.g. HTML) shouldn’t have a monopoly over the transport model (e.g. HTTP). The Web is becoming more general, stateful, and the transport layer is detaching from market dominance by the rendering layer. This creates new opportunities and possibilities.

1	I found interesting data for smart phone penetration by region and country.

2	As opposed to the less meaningful bandwidth consumption comparison.

3

https://en.wikipedia.org/wiki/Onion_routing#Weaknesses https://en.wikipedia.org/wiki/Tor_%28anonymity_network%29#Traffic-analysis_attack Research claims 81% of Tor users can be identified. Timing analysis in conjunction with compromising the entry guard nodes and DDoS on exit nodes were possible attacks employed in the recent unmasking of hundreds of hidden services by FBI-ICE-Europol.

4	http://blogs.wsj.com/tech-europe/2012/11/05/where-to-rent-a-botnet-for-2-an-hour-or-buy-one-for-700/ http://www.networkworld.com/article/2168696/malware-cybercrime/black-hat--how-to-create-a-massive-ddos-botnet-using-cheap-online-ads.html

5

http://falkvinge.net/2013/09/12/the-nsa-and-u-s-congress-has-destroyed-ssl-we-must-rebuild-web-security-from-the-ground-up/ http://www.reuters.com/article/2013/09/05/net-us-usa-security-snowden-encryption-idUSBRE98413720130905 http://blog.cryptographyengineering.com/2013/12/how-does-nsa-break-ssl.html

6

Militarization of the peace officers a.k.a. police., reported even by the ALCU. Civil Asset Forfeiture police corruption. IRS confiscating money routinely. Licensing and taxing the internet as a means to filter free speech against the government. Maintaining top-down control, e.g. over the redistribution of resources, as the top-down global economy collapses. Required social network account for accessing government services. Facebook saves everything you type, even if you don't post it. Facebook requiring government id. Facebook soft-censoring political speech and alleged CIA connection. If you click this, you will have already committed a crime. Jail time if you don’t mow your lawn. Everything you do is monitored, even your TV is spying on you. Snapping selfies with your phone could become taxable by the government. Why the innocent plead guilty. ..more to be added...

7	The onion routing circuit can be reused indefinitely.

8	https://en.wikipedia.org/wiki/Chrome_OS#Support_for_Android_applications http://www.zdnet.com/could-an-android-desktop-replace-your-windows-pc-7000024837/ http://www.howtogeek.com/howto/22665/run-android-on-your-netbook-or-desktop/

[/list]

[herzmeister]

Time for Bitcloud / Storj / MaidSafe

[UnunoctiumTesticles]

I as an expert programmer with a reasonably deep understanding of the technical issues, assert that those who vote ‘No’ without posting any justification in the thread don’t have correct logic.

Note it is quite normal that I am usually 5 years ahead of most people in terms of seeing a budding trend. They are caught up in old paradigm thinking and can’t grasp my insight. If the ‘No’ voters aren’t willing to discuss their logic, then they are not likely correct.

Time for Bitcloud / Storj / MaidSafe

Those are not primarily trying to solve the anonymous networking problem, and certainly not general anonymous networking to any dynamic web site or service, e.g. a forum. You are comparing Apples and Oranges.

They are to some degree trying to address the problem of anonymous hosting for the static resources of the web.

But they have a fundamental design error or choice that most people don't realize.

Their economic models are fundamentally (and apparently irrevocably) based on the quantity of storage, not the bandwidth transferred. Thus these are decentralized clouds for saving low traffic personal files, not for serving high traffic content of web sites.

P.S. Returning readers note I have continued to edit the OP. In particular, note additions to the “Latency Incompatible With Stateless Content” section and footnote³.

[UnunoctiumTesticles]

Some significant incoherence in the OP has been corrected. Please try re-reading it.

[herzmeister]

It's not only about cloud storage, it can also replace the web and all the other use cases of the internet today (mail, messaging, media streaming, etc). It's just a question of time really until this "new web" goes viral and the old web will become pretty obsolete, much like the BBSs of yore, simply because it will be much easier and secure to use (first and foremost, no passwords and single-point-of-failure web-servers anymore). Conceptually, encrypted P2P clouds will abstract content and services away from location. This also will enable many use cases we can't even think of yet today. It's the next logical and necessary step in the evolution of networked computing. It'll also scale much better, and bandwidth and computation can be economically incentivized just as well. http://www.youtube.com/watch?v=Wtb6L7Bg3zY

[UnunoctiumTesticles]

P.S. I see we have more n00bs voting No and understandably too timid to reveal their myopic or irrationally biased justification. Perfect. The record will be here for when they get to eat humble pie.

It's not only about cloud storage, it can also replace the web and all the other use cases of the internet today (mail, messaging, media streaming, etc). It's just a question of time really until this "new web" goes viral and the old web will become pretty obsolete, much like the BBSs of yore, simply because it will be much easier and secure to use (first and foremost, no passwords and single-point-of-failure web-servers anymore). Conceptually, encrypted P2P clouds will abstract content and services away from location. This also will enable many use cases we can't even think of yet today. It's the next logical and necessary step in the evolution of networked computing. It'll also scale much better, and bandwidth and computation can be economically incentivized just as well. http://www.youtube.com/watch?v=Wtb6L7Bg3zY

Slick marketing has caused you to think these systems will be able to do things which they can not possibly do based on fundamental technical issues in their designs.

I saw that video nearly a year ago. My point remains from my prior reply to you upthread that MaidSafe and Storj are based on minimizing the amount of duplicate hard disk space employed for redundancy and their economic unit is backed by hard disk space. Afaik, they have no mechanism to charge for bandwidth used[1], rather only a quid pro quo exchange of equivalent proof-of-storage (via their verify algorithm I presume), thus they are not applicable for serving files to the public-at-large. They simply are not designed for hosting web sites. That is not their target market. Their design and target market is personal storage for your (or your enterprise’s) files (possibly shared with a few other people, but not the public-at-large) which you are access perhaps up to several times per day, but not 1000s of times per second. And afaics, they don’t solve the anonymity of the requesters IP address for data that is public to the public-at-large.

You miss a fundamental economic point that bandwidth is orders-of-magnitude more costly than hard disk space at any scale above a few accesses per day on average, yet bandwidth is also amazingly inexpensive too (which means it is very hard to pay-per-packet as you need some form of sub-micro-payments system or to trade in kind bandwidth-for-bandwidth).

The solution for anonymity for the requester of public files and for anonymity of the server is to make the improvements to onion routing that I have laid out in the OP, to build out the Stateful Web, and for the servers to be hidden services.

For MaidSafe, I suppose clients could pay per access directly to nodes on the DHT, but the technical design for where the data is stored appears to be based on randomness combined with a ranking algorithm, that does not factor in incentives to compete for the greater orders-of-magnitude revenue from selling bandwidth or in the absence of payment-per-access as is the case in the current design, then the incentive to game the system to not store fragments that are accessed frequently. There is a very complex game theory analysis that needs to be made of the system. In short, I suspect MaidSafe’s model is too complex to fully model and characterize. They can’t be using a quid pro quo exchange of bandwidth because the reciprocal exchanges would not be fungible in real-time, i.e. the other party may not possess a data fragment that the counter party needs at that instant (due to the randomized requirement of the fragments that is the fundamental feature of the system, there is no way this could be made fungible). I suppose that since only the owner of the original data can determine the address of a fragment, then DDoS on a fragment will cause the fragment to get blocked.

The concept of storing a file on multiple servers so we don’t have to depend on just one, is orthogonal, has always been the case with corporate scale servers, and such algorithms can be adapted to different architectures such as multiple hidden services or sitting behind one hidden service.

MaidSafe’s self-encryption and splitting a file up into sand grain sized (in terms of DHT address space collision probability) fragments is useful because in theory it means even the server nodes have no way to know anything about—and thus can’t discriminate against—the content of the data it is serving. And in theory the user doesn’t have to evaluate the reputation of any server node as would be necessary for traditional server. In theory this feature could be very valuable for files shared to the public-at-large. But traffic analysis can be used to correlate these fragments for files that have high traffic public-at-large access.

But I think that valuable portion of the system design can be split from the portion that tries to manage how many copies are stored on the system. So I think instead a flat economic model can be employed to incentivize multiple nodes to store the fragments. And put the decision of this choice and algorithm strategy in the hands of the client. This would be much less complex (easier to prove formally), much more decentralized, and much simpler. Then each node could sit behind a hidden service for sufficient IP address level anonymity.

The technical specifics of MaidSafe’s design is very sketchy and vague at this point. I seriously doubt whether they can handle the complexity and deliver the reliability they claim. The MaidSafe MaidSafe system is a complex state machine (layered on top of a DHT) and I have not seen a formal analysis of all possible states including DDoS and the game theory of attacks on it. To debate this would go into more technical detail than I care to enter right now on this forum.

In terms of David Lavine’s analogy to an ant colony, note each ant has 250,000 brain cells of entropy to configure itself uniquely within the colony (not just the 4 categories Lavine wants to presume) and the collective state machine of the ant colony has the 10 million brain cells of a human brain.

Also listening to David ramble on, he is not person who can hit directly to the generative essence of an algorithm with precision. Rather he rambles on vague analogies. He appears to be smart (salesman with some technical acumen) but appearing tousled and lacking of the eloquent sharp precision of a highly accomplished engineer. For example, never did he address any bandwidth economics which should be one of the first things out of his mouth in a presentation.

Accomplished engineers can readily detect bullshit. I smell some but I think he believes in his work even if can’t quite pull it all together further than vague explanations. About a year ago I tried to read technical descriptions at their website and it was a maze of vagueness and technobabble without complete formalization and citations.

[1]

G.Paul and J.Irvine, A Protocol For Storage Limitations and Upgrades in Decentralised Networks. http://strathprints.strath.ac.uk/49515/1/Paul_Irvine_SIN14_upgrades_in_decentralised_networks.pdf which showed that only 1% of network users were providing 73% of the network bandwidth needed to Permission to make digital or hard copies of part or all of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for third- party components of this work must be honored. For all other uses, contact the Owner/Author. Copyright is held by the owner/author(s). SIN ’14 Sep 09 - 11 2014, Glasgow, Scotland UK ACM 978-1-4503-3033-6/14/09. http://dx.doi.org/10.1145/2659651.2659724. share les. In an earlier study carried out on the Gnutella peer-to-peer network, Adar et al. presented in [1] that 70% of users were not sharing any les, and that 1% of all users were actually providing responses to over half of network requests. Early peer-to-peer networks were more focused on con- serving bandwidth, since they were typically designed for the purpose of sharing popular les between users quickly, with- out relying on a central server. The MaidSafe decentralised network, while focused more on the provision of storage, faces similar challenges, where malicious users could poten- tially use up all of the storage capacity of the network.

[phillipsjk]

Epic OP, though it appears to drift off-topic at the end.

The solution for anonymity for the requester of public files and for anonymity of the server is to make the improvements to onion routing that I have laid out in the OP, to build out the Stateful Web, and for the servers to be hidden services.

For some reason I was getting the opposite from the OP. Ie: the web is no longer stateless because it is being asked to run Applications that obviously need to store state. Cookies were invented as a way to store state without stupidly long URLs. However, since privacy-conscious people block such cookies, those long tracking URL are used anyway.

The latency brings up an interesting point. if you want to be anonymous, maybe you should consider reading information months or years old. The Archive Team tries to extract useful information from these new 'apps' before they are shut-down and deleted.

[UnunoctiumTesticles]

I do make the point in the OP that the web is already moving towards stateful because of the advantages applications can offer over a walled garden (meaning inflexibility or inability to change and extend some aspects of what is available by default) stateless or limited stateful HTML5 model. And my point is that provides an opportunity to do network anonymity correct with high latency, since Tor is ostensibly doomed by its low latency requirement as outlined in the OP.

Cookies are very limited form of state insufficient for the level of sophistication that apps are adding over the walled garden web browser.

The OP is talking about IP address anonymity, which is Tor’s raison d’être. So I don’t know why you are conflating this aspect of network anonymity with the nonencryption of public data which was never intended to be private. Sorry if I may be blunt (in spite of your reply constituting praise by faint damning), your understanding of the issues is too limited to fully comprehend. But hopefully this reply will help move you along towards the next level of understanding. One could say the OP post is responsible for readers not getting it, because it is written in a modular generative essence style where not every instance of ramification and implication is spelled out and readers have to take the modular variables presented and formulate all the ramification permutations. But really if I tried to explain it to people are not yet up-to-speed, it would need to be about 10 pages long. And I don't have time for that right now. But I guess that is what this dicussion thread is for.

P.S. No insult intended. Thanks for the feedback.

[CIYAM]

As you can use HTML 5 along with .js crypto to have encrypted stateful apps work over HTTP (such as CIYAM Open) I am not quite sure why you think that HTTP is going to disappear in favour of something like Android (or are you just a fan of Java or Android in general?).

Quite likely I've missed something in your "wall of text" so perhaps you could just focus on this one question in order to make it clearer to me what your point is.

[UnunoctiumTesticles]

CIYAM, yeah you can do really cool apps even within the walled garden of what is provided by web standards. For example, as you may know Blockchain.info was upgraded and now their wallet is fully encrypted client-side instead of server-side.

However there are always things developers would like to do which fit within a security sandbox model (e.g. Android OS‘ s sandbox) but which can‘t be done with the standard features provided by slow moving web standards. For example, tighter integration with other apps. On Android OS, I can write an Activity, Service, ContentProvider, or Intent which can interact with other apps in the system within the security model. I explained some the ramifications of this more deeply.

This transition to apps as a more general sandbox than the more limited web browser sandbox is epic and is underway in a massive paradigm shift. We could now leverage this to provide high latency network anonymity so we can do Tor correctly.

[Billbags]

@op

We heard these same things in 1997.

Please view this 1997 wired magazine link......

http://archive.wired.com/wired/archive/5.03/ff_push.html

[UnunoctiumTesticles]

Cross-posting this math discussion about anonymity from another thread...

I request we continue to delete our upthread posts on each reply as I have done, at least for as long as this sub-thread is of reasonable length. Hopefully we can reach agreement now.

I kindly request you to delete your prior posts upthread on this sub-thread of discussion as I have done also. So as to not clutter the thread, our entire discussion is quoted in this one post below.

anonymity is a myth

someone somewhere always knows

Actually as an expert computer scientist, I assert that is not true. I have explained that a high-latency redesign of Tor would be anonymous:

Anonymity: Death of the Stateless Web (a.k.a. “Tor Is Not Anonymous—Web Paradigm Shift Underway”)

You would be correct if you instead wrote, “if someone could correlate all the data in the world for infinite time, they could always know”.

being a mathematician i know full well there are no secrets, if it is anonymous it would not be long before it is not.

it is the same as saying the code is unbreakable

as the recent news on tor proves as well http://betanews.com/2014/11/19/new-report-claims-81-of-tor-users-can-be-identified/

You did not read the link I provided to you. In that link I explain that the reason Tor is vulnerable is because it is a low latency design. That exploit you linked to is well known to be caused by traffic analysis (confirmation) because of the low latency design. I have proposed how to make an improved Tor that is high latency and truly anonymous.

Please write down some math that you are using to justify your claim, so I can discuss with you in your mathematical perspective where we differ. I have some math capability also.

done deleted posts

read your post did not say much about the encryption

tor is vulnerable because it is mathematically encrypted ergo it can be mathematically unencrypted

not much to go into really, anonymity is achieved via encryption, encryption can be broken, yes a lot of resources required but it can still be done.

so if someone really wanted to see what was going on all they need is the resources, usually government/military.



the current project I am excited about at the moment is where electrical signals from the brain are being translated

e.g. if i think food the receiver reads the electrical brain signals I have at the time and translates this into the word food

This would defeat anonymity completely unless you are wearing funny hats.

I've done extensive thinking about the breakage of the encryption and that is why I favor Lamport signatures, Mceliece public key cryptography, and not using public key (i.e. using symmetric cryptography) as much as possible.

There is no reasonable quantum computing resistant Diffie-Hellman key exchange, so I am thinking we can eliminate it from an improved Tor by sending a Nonce to the prospective relay encrypted with its public key, then the encrypted (in our public key) reply must include the Nonce. The entire reason Diffie-Helman is needed in Tor is because the prior relay hop could inject its only symmetric key instead.

All encryption will eventually be broken and I made this point in a long discussion (READ THIS LINKED POST!) on this forum with smooth about how all anonymity can eventually be broken ex post facto. But as I stated in my first reply to you, this requires the adversary save all the data. For example, a global national security PRISM adversary can’t save the data mixes we do offline.

This is why I am arguing to use only quantum resistant encryption for anonymity aspects and to use much larger key lengths than we think are necessary.

Note I will be cross-posting our excellent discussion to that thread I linked in my first reply to you.

Being able to read the brain’s thoughts could indeed make anonymity much more challenging, but we are at least a decade from that being something the authorities can realistically deploy and even then it will probably require they get proximity to your brain. Our physical bodies are going to become a burden. Hopefully by that time we can upload our brain to a computer, put our body into zombie state, continue thinking there on the computer, then download it back to biological brain copy later. In that way, we could side-step the authorities anew. You see technology is not asymmetric in support of socialism. We just have to be willing to find the solutions for liberty.

I hope I have inspired some libertarian readers!

Outstanding I agree completely, anonymity can be achieved as outlined above and should be, but not at the expense of user acceptance that it is a fail safe and completely anonymous to all giving a false sense of security.

This has been an excellent enlightening discussion on the road to complete anonymity thank you

You reminded we need to inform the user as to limitations of anonymity.

Tangentially I note this thread is about to attain 40,000 Views.

[CIYAM]

However there are always things developers would like to do which fit within a security sandbox model (e.g. Android OS‘ s sandbox) but which can‘t be done with the standard features provided by slow moving web standards. For example, tighter integration with other apps. On Android OS, I can write an Activity, Service, ContentProvider, or Intent which can interact with other apps in the system within the security model. I explained some the ramifications of this more deeply.

Okay - I read that (thanks for the link) - but am still not really convinced that we are talking about something that is much more than what MIME already allows you to do (i.e. I could use a different PDF viewer in my browser if I plugged it in so I am not *stuck* with any particular one and the same for any other MIME type of content).

I am no iOS fan btw (in fact I have a Samsung Galaxy S3) so let's not get bogged down in iOS vs Android (I am more interested in why you think HTTP is going to end up being scrapped).

Living in China I can tell you that HTTP is about the *only* protocol that doesn't get *blocked* here (I cannot view HTTPS from numerous overseas websites without going via a proxy).

And also I would never trust anything on Android in China (nor iOS).

[herzmeister]

btw, welcome back Anonymint  (now I'm sure)

[UnunoctiumTesticles]

@op

We heard these same things in 1997.

Please view this 1997 wired magazine link......

http://archive.wired.com/wired/archive/5.03/ff_push.html

Among the possible reasons that did not prosper are because it was too narrowly focused on rich media, there were not these hardware features of smartphones that required breaking out of the web sandbox to fully leverage, and web browser vendors in cohorts with the W3C were eager to keep developers inside a restrictive sandbox.

The difference is Android has already displaced the web browser on mobile, so this isn’t conjecture. Now it is just the PC and laptop yet to conquer.

If I want to receive SMS message notifications on Android, I need to program for Android OS not a web app (or maybe there is or will be a web standard hook for it, but there will always be new things for which there are not).

For example Facebook recently required everyone to install their mobile app so they could give uniformly better chat features to all on the network.

Spend some time on mobile in a web browser versus an apps so you can experience the reason user’s prefer apps for things they access everyday. For the odd website they access infrequently they won’t bother with an app, but we developers can make app installation more seamless with visiting a website to overcome this.

In the future, users won’t even be able to discern whether they are in web browser or an app, and thus apps will have won.

[CIYAM]

Spend some time on mobile in a web browser versus an apps so you can experience the reason user’s prefer apps for things they access everyday. For the odd website they access infrequently they won’t bother with an app, but we developers can make app installation more seamless with visiting a website to overcome this.

That could be argued for any OS - yet web apps have become more and more predominant (especially in business - if you don't have a web version of a business app now you are *dead* and you just need to look at any major ERP system to see this).
 

In the future, users won’t even be able to discern whether they are in web browser or an app, and thus apps will have won.

I'd agree - except turn it around the other way - you won't be able to tell a web browser app from an app - so apps will have lost.

Writing apps for web is *much easier* and with tools like CIYAM it will soon be hundreds of times easier than writing using some normal app framework (please look into Software Manufacturing http://ciyam.org/docs/methodology.html which I have been working on for many years).

[UnunoctiumTesticles]

However there are always things developers would like to do which fit within a security sandbox model (e.g. Android OS‘ s sandbox) but which can‘t be done with the standard features provided by slow moving web standards. For example, tighter integration with other apps. On Android OS, I can write an Activity, Service, ContentProvider, or Intent which can interact with other apps in the system within the security model. I explained some the ramifications of this more deeply.

Okay - I read that (thanks for the link) - but am still not really convinced that we are talking about something that is much more than what MIME already allows you to do (i.e. I could use a different PDF viewer in my browser if I plugged it in so I am not *stuck* with any particular one and the same for any other MIME type of content).

There are features you can do on an app today that you can’t do yet in HTML5. This will also be the case in the future, because the web standards will always be moving too slow because they are top-down managed (e.g. by such as my old nemesis Ian Hickson and Daniel Glazman of Apple). For example, the ability to control the entire screen space or the Activity queue for the hardware back button on Android, etc.. Being able to access the external SD card. Not being limited to 5MB for the SQL database, etc, etc, etc..

I was trying since 10 years ago to get them over at W3C to make the web standards with a more open and orthogonal security model like Android has and more flexibility so we could write apps (that is how far into the future I was able to see, way before anybody thought of smartphones I was already envisioning it). I got tired of arguing with them. My name is listed on the CSS2 standard for example for my contribution on the discussion lists.

Yeah eventually the web browser can standardize popular features that apps do, but they will always be several years behind the innovation. And thus apps will win.

Decentralization scales faster than top-down. 10 years of lost time is proof of that!

The web browser won for static documents because there wasn’t that much you could do with them that would be so much more awesome in an app. Thus lack of fragmentation and the ability to "write once, run every where" was a more important consideration. But the dissatisfaction with the browser ever since DHTML (e.g. the move to Flash) has been rising in a pressure cooker and now apps have been the release valve and there is no turning back! And with Android taking 50 - 80% marketshare globally, soon it will be a no brainer. You will write to the web browser when you can get by with it and it is easier. You will write an app when you need the best user experience. Once we tack on high latency network anonymity, the pressure to move to apps will increase.

I am no iOS fan btw (in fact I have a Samsung Galaxy S3) so let's not get bogged down in iOS vs Android (I am more interested in why you think HTTP is going to end up being scrapped).

Living in China I can tell you that HTTP is about the *only* protocol that doesn't get *blocked* here (I cannot view HTTPS from numerous overseas websites without going via a proxy).

And also I would never trust anything on Android in China (nor iOS).

We might still be able to run the traffic over HTTP, we can probably just wrap the high latency functionality around it. I was thinking a little about the tradeoffs, but not too in depth yet.

Spend some time on mobile in a web browser versus an apps so you can experience the reason user’s prefer apps for things they access everyday. For the odd website they access infrequently they won’t bother with an app, but we developers can make app installation more seamless with visiting a website to overcome this.

That could be argued for any OS - yet web apps have become more and more predominant (especially in business - if you don't have a web version of a business app now you are *dead* and you just need to look at any major ERP system to see this).

Yup that is what I would expect even though I don’t have any experience in those markets.
 

In the future, users won’t even be able to discern whether they are in web browser or an app, and thus apps will have won.

I'd agree - except turn it around the other way - you won't be able to tell a web browser app from an app - so apps will have lost.

My implied unstated reason is because apps have more functionality and the app innovation will be leading the web standards which follow, e.g. if apps popularly and successfully move to adopting a high latency network anonymity model, then web standards will be forced to follow. Thus apps won.

Writing apps for web is *much easier* and with tools like CIYAM it will soon be hundreds of times easier than writing using some normal app framework (please look into Software Manufacturing http://ciyam.org/docs/methodology.html which I have been working on for many years).

I agree getting started writing an Android app took even me (a very accomplished programmer) several days. And I am about 2 weeks into it with only about 1000 lines of code accomplished. But I lost of lot of time perfecting my use of Scala to develop on Android with.

But it should be possible to entirely emulate everything you can do in a web page or web app, and add hooks to more things that can be accessed via JavaScript interface to the native system. Perhaps you can explore this for your framework at the opportune time.

As always, paradigm shifts open up a lot of new opportunities. Not one size fits all, which is the whole point. So rapid development environments that provide the best of HTML5 with some benefits of app-side, might be popular, but I am not signing up for thinking that marketing out.

[phillipsjk]

btw, welcome back Anonymint  (now I'm sure)

I had an inkling with the "agree or disagree with OP" poll; but dismissed it.

Missed the screen-shot of the mad-max thread.

[UnunoctiumTesticles]

I had an inkling with the "agree or disagree with OP" poll; but dismissed it.

I’m ecstatic that most of the votes are No. This means I am still (even 10 years hence) far ahead of most people. I assume most people haven’t quite yet grasped why HTML (static documents, a 100% immutable declarative language) was a special case that would not apply forever into the future. Humans are like that. They project the present into the future, without thinking about what made the present and what changed.

Remember I was telling everyone in 2013 that Tor was not anonymous because of timing analysis due to being a low latency network and Sybil attacks on the relay nodes by national security agencies. And everyone thought I was crazy. And now we see new research that says 81% of the users can be identified. Sigh.

[CIYAM]

I am still unconvinced that HTTP is going to die - IMO it is going to *change* (perhaps too gradually for the OPs liking) and things like CIYAM Open are starting to show just how far it can change (to become a "secure" and stateful protocol).