alt Hacker News@tptacek I think my question about your post is this — right now people rely on a lot of apps written by professionals for things like mobile banking, messaging, medical providers, mobile payments, and subscription services (music, tv, etc). The interests of the app publishers aren’t aligned with total user freedom — banking app developers don’t want a totally malleable OS where there are no process separations or trust partitions. Rather, they want to rely on OS level guarantees that their code is isolated from other apps, that the binaries are signed, that the platform is somehow trusted.
I love your idea of an OS where users write their own apps as they want. But if they want to connect to third party services or use commercial software, won’t there still have to be a lot of security guarantees? I don’t just mean the depressing “browsers must implement DRM or you can’t watch streaming video.” I mean “how will medical providers trust your device enough to give you your lab results” if you are thinking of majorly changing the mobile device security model.
It’s not a hostile question, I’m genuinely curious about this design tradeoff.
Replies
My little story:
I recently replaced my $HEALTHCARE_APP with the PWA of their website. It was the *exact* same. The app was just a webview (and a pretty good one at that!)
It makes me really question how much “security” these services need when they have websites that can do everything the app can do.
Have you seen the Googlebook? I think Google is taking the lead here with "Create a Widget". I think some have overlooked this feature or treated it as a gimmick. But this is the first step into average users building small micro apps just for themselves. I think it will go from Create a Widget to Create an App within a short period.
Banks and schools and businesses should get in the business of simply vending APIs (or MCP connections). Agents and bots are taking away the need for the endless knobs and dials of traditional software. Just expose my data securely and my agent will do what I want with it, when I need it.
Third party apps and commercial software will be the slowest to adapt to the new paradigm.
The fear maybe a year ago was SaaSpocalypse. Why pay for Salesforce when I can vibe a CRM to my exact needs? Turns out to not be that easy.
The lion's share of value in a product like Salesforce is the ability to say "we run Salesforce" and have everyone know what you mean and have ready answers to all your problems even if they're not perfectly tailored (or cheap). Same thing with OS really. If natural language is now the most powerful programming language then having shared vocabulary on technical topics is more valuable than ever.
My lab medical results are mine and only mine. It’s for me to decide if my device is secure enough. I do not need my insurance company to decide for me what device I should use. Same with my money in the bank.
Streaming is fair. Netflix can dictate their rules. I can decide not to pay for their content.
Doesn't sound hostile at all. These are the real hard questions. The 2 major mobile platforms don't seem to want this to happen at all, but you can work around that by building your own platform. But the largest API vendors don't want it either, and they're much harder to work around.