

Build Cross-Platform Applications for desktop using HTML, CSS, Javascript - elliotlai
http://appjs.org/

======
GeneralMaximus
I'm enamored with the idea of writing desktop applications with web
technologies, but I'm not enamored with the idea of running a node.js instance
locally for every such desktop application.

What I would _like_ to see is a "privileged mode" Chromium (or Firefox) that
would let applications break out of the browser sandbox and directly perform
operations such as filesystem I/O. Privileged Mode Chromium would obviously be
a huge security threat if it's allowed to run any old code, so it would be
wise to prevent it from downloading and executing scripts over the network, or
maybe have some kind of script signing support in place so that the only
scripts allowed to execute are the ones with the app developers' signature on
them. Or maybe I'm talking out of my ass here and what we have right now works
just fine. Feel free to correct me here.

Also, one question. Isn't the node.js instance serving my application visible
to other applications on the same system? Can't a malicious application take
advantage of this fact and cause my app to misbehave?

(Offtopic: I must point out an irritating and potentially harmful design trend
that is emerging as a result of Twitter Bootstrap's popularity: the top
navigation bar that stays in place as you scroll downward. It wastes precious
screen space, looks ugly and doesn't add anything of value to the website. Why
is it so important that I be forced to look at your website's logo and
navigation bar _all the time_? I'm not picking on the AppJS developers here;
this is a general sentiment directed towards all the designers who embrace
this terrible trend.)

~~~
gliese1337

        What I would like to see is a "privileged mode" Chromium
        (or Firefox) that would let applications break out of
        the browser sandbox and directly perform operations such
        as filesystem I/O.
    

This is exactly what Microsoft HTML Applications do (available since IE 5). In
other respects, I'm not a big fan of Internet Explorer, but this is one thing
I think it did amazingly right, and way before anybody else. I was very
excited to see the headline, and then horribly disappointed to discover that
what they're offering is Not As Good as 13-year-old Microsoft technology.

~~~
flomo
It may have been a very good idea, but the sandbox implementation was shoddy,
and 'Local Machine Zone' exploits are one of the main reasons IE has such a
terrible security reputation. So other browsers should be wary about
introducing a 'privileged mode'.

~~~
gliese1337
People can always install untrusted applications written in C. Why should the
fact that your application is written in HTML+JavaScript make any difference?
If it's just another native application; the implementation is unimportant to
the end user.

Now, security _is_ important, and it would be nice if _all_ applications could
be verified as to security. But they aren't. So while it would be good to
figure out how to properly sandbox desktop HTML+JavaScript applications, I
don't see as how failure in that regard should retard their adoption anymore
than it retards the adoption of native applications written in C.

~~~
flomo
The obvious different is that you don't want to execute arbitrary C code just
because a compromised ad network is serving malformed HTML. The ease of attack
is much greater on the web.

Mozilla has used "no IE-like privileged mode" as a marketing point in the
past. There's obvious benefits, but I hope any modern browser is going to be
careful about the sandbox is implemented.

~~~
gliese1337
You're comparing incomparable things. Serving a web page in an unsecured
environment is an obvious security problem, but _completely unrelated_ to
whether you have written a native application in HTML+JavaScript or something
more traditional like C.

Would the C version of your native desktop app download code from an online ad
network? Then it is just as problematic as a web app in an unsandboxed
browser. If the C implementation of your desktop app wouldn't do that, then
the HTML+JavaScript implementation of the same application shouldn't either,
and there is no problem.

~~~
flomo
Actually, you the one making this strange comparison to C code.

My point is simple: IE's sandbox was broken repeatedly, creating a bad
reputation and scoring marketing points for other vendors.

------
nardi
Q: "What's better than this stack for application development?"

A: So many things. Cocoa comes to mind.

HTML/CSS/JavaScript were never created to build applications, and it's very
apparent when you do so. I've built a lot of web apps, but out of necessity. I
think we're going to actually see the opposite trend in software: moving
client-server apps away from browser-based solutions and toward native apps.
In fact we're already seeing that movement—and I would argue that a big reason
behind it is how much writing client apps in JavaScript sucks.

------
AshleysBrain
This looks really cool, but for HTML5 games to work well it really could do
with these things:

1) support for hardware-accelerated rendering with canvas2D

2) support for hardware-accelerated WebGL

3) ability to turn off the extremely restrictive driver blacklists in Chrome
(which will turn off hardware acceleration for ~50% of users, and is not
necessary if building a desktop app)

Yeah, basically games _really_ need hardware acceleration. I know they don't
mention games at all but something like this is great for additional
distribution platforms and monetisation, as long as it has hardware
acceleration. Anyone know if it covers that?

~~~
Geee
It's based on Chromium so it's pretty likely it will support just about
everything and even more.

~~~
AshleysBrain
My experience with other wrappers is that's not so, sometimes they're based on
Chromium but don't support WebGL, the Web Audio API, etc. etc. I suppose
wrapping Chromium is harder than you'd think.

------
sktrdie
I think Topcube does this as well: <https://github.com/creationix/topcube>

Topcube, however, is missing the Mac version.

Another interesting idea would be to ditch Node all-together and use
HTML5/CSS3 literally for everything your desktop app needs. With localStorage
and other APIs being implemented in Chromium, one does not need the server
part anymore.

------
arturadib
The hardest part of all of this is getting a runtime that builds/installs
seamlessly across platforms. I just did an 'npm install appjs' as per docs,
and it failed (Mac).

I myself have gone through great lengths to create a similar (minus Webkit)
runtime for Mac, Windows, and Linux:

<https://github.com/arturadib/node-qt>

<https://github.com/arturadib/node-five>

Despite all my efforts there are edge cases where it simply won't
install/build.

Keep up the good work though -- this is a much needed project. (Bear in mind
too that Mozilla and other companies are coming out with their own runtimes
for web apps, so such projects will likely be rendered obsolete by them).

~~~
mhitza
Why are you trying to reinvent the wheel?

I already mentioned XULRunner here, and I´d suggest you have a look at it.
There are a few applications you may have heard about using it
<https://developer.mozilla.org/en/XULRunner_Hall_of_Fame>

~~~
veemjeem
ugh. have you ever developed stuff in XUL? It's not a great system. It's also
pretty ancient, so there's probably cruft there support old XUL applications
built in 2002.

I think the main problem is that XUL is like HTML, but not. So people's brains
are already wired to understand html, but when there's something that looks
identical to it, but has it's own set of quirks, it takes a lot of time
getting used to. It's as if someone took C++ and changed just enough stuff so
that you wouldn't notice it until you tried to run it.

How many html tags do you recognize here:
<https://developer.mozilla.org/en/XUL_Reference> ?

Lots of the tags are somewhat historical because css wasn't as powerful back
in 2002 as it is today. Most people starting to hack XUL won't know the
difference between a bbox and a deck tag.

~~~
mhitza
I admit not having worked extensively with XULRunner. Maybe 4 years ago was
it, but I know that html can be used via the html namespace
[https://developer.mozilla.org/en/XUL_Tutorial/Adding_HTML_El...](https://developer.mozilla.org/en/XUL_Tutorial/Adding_HTML_Elements)

It looks quirky, but I thought the most important part of using web
technologies is to use Javascript and CSS; which can be applied over XUL
elements just like HTML.

Also compared to the current project it is vastly superior in terms of
features and functionality that can be tapped into with Javascript.

There is space for improvement, like with most software, but it is in fact a
tested technology already.

------
duncanwilcox
<http://sandofsky.com/blog/apps-vs-the-web.html>
<http://sandofsky.com/blog/shell-apps.html>

Cough.

~~~
wavephorm
This guy's opinion of course omits the huge problems of walled gardens,
dickwad Apple rules, closed platforms, 30% royalty absurdity, and the archaic
development process of native apps.

~~~
duncanwilcox
To which the counterpoint is "awesome UX". You'll never get that with web
tech.

Sandofsky works at Twitter BTW.

You are probably right about most of the problems, though how much of a
problem they really are is related to where you place yourself on a purist-
pragmatic continuum.

Sandofsky explicitly mentions development: "Today, for high level work, I am
as productive using Objective-C as JavaScript." That's my experience as well.

------
christiangenco
Very interesting - kind of like PhoneGap for your computer.

I'd recommend placing a few screenshots of example apps on the front page
running natively on different systems (mac, windows, linux). Well done!

------
napolux
Hey men, what about Adobe AIR then? It's out there since 2008, it works on
Mac/Linux/Windows/Mobile and it's far more complete than App.js or any other
competitor.

You can use flash (OMG) or just plain HTML/JS (I've developed something in the
past using both)

But you know, we are in an app era right now and this technology has lost part
of his original appeal

~~~
nacs
Adobe Air dropped support for Linux around January of this year I believe. So
not quite a full cross platform solution.

In fact, Adobe has been getting worse with Linux support altogether lately
(including the Flash runtime).

------
darkstalker
I personally find disturbing how people wants to do _everything_ with web
technologies. Can't they just learn how to write native apps? I wouldn't like
to see my desktop full of slow and bloated web apps.

~~~
bzbarsky
> Can't they just learn how to write native apps?

They can, but then they need to either write multiple ports of the app or
target only a small subset of the market.

The first sucks (speaking as someone who in fact works on a project that ships
a nontrivial native app on several different platforms), and the second loses
you customers _and_ creates people who give you bad press because you're
"locking them out" by not providing an app on their platform.

Of course web technologies are not the only way to write cross-platform apps,
but the other options I know produce results that are even less appealing to
users.

------
mratzloff
Pokki (<http://developers.pokki.com>) is a similar platform that builds to
Windows and supports WebGL.

------
jiyinyiyong
`node-webkit` looks similar to this: <https://github.com/rogerwang/node-
webkit>

------
tferris
If your app runs on HTML/CSS/JS where's the point to make locally installed
app out of it?

One reason might be a better hardware accessibility (at the moment) but with
the pace Chrome, WebGL, etc. are evolving there shouldn't be any reason in
near future and you would have cross-platform apps without any installation
and update hassle.

------
vimota
This seems to be done currently through means like this:
[http://www.quora.com/Rdio-online-music-service/What-
technolo...](http://www.quora.com/Rdio-online-music-service/What-technology-
drives-Rdio%E2%80%99s-Mac-desktop-app), it'd be nice to see an even simpler
approach (like appjs) replace it.

------
rmATinnovafy
If you could do a one click install with no internet access this could have
huge potential.

Yesterday, while working with C# and sql compact I realised the need for
something like this.

Not that I have anything against C#. Love that thing, but it is complex
(.NET).

~~~
TimGebhardt
Instead of a "one click install" how about a "clickonce install". ClickOnce,
the installer/updater built into .NET since .NET 2.0. It can also work for
installing via CD or over a fileshare if you don't want it over the internet.

------
chris_engel
What a waste of time! Appcelerator is putting its titanium desktop framework
under opensource which does EXACTLY THAT. It already works on win/lin/mac and
would only need a cleanup and update.

Why wasting time and re-creating everythin from scratch?!

------
solox3
It felt a bit like Prism (<https://mozillalabs.com/en-US/prism>). Unlike them,
who are just slapping a browser inside a chromeless window, you are actually
building it from the ground up?

~~~
jarek-foksa
It looks like AppJS is built on top of CEF framework which is basically a
stripped down version of Chromium.

This also means that AppJS-based apps can't be shipped on Mac App Store
because CEF makes use of private frameworks.

------
outside1234
It seems to me that ember.js is a better approach to this - much cleaner
application model and richer data support with routing and view state.

That said, I'm with you broadly on Javascript+HTML5 on the desktop. Actually
just wrote something up around my thoughts on how to do this with Ember.js if
folks are interested:

<http://bit.ly/LybVgo>

~~~
arturadib
appjs.purpose !== emberjs.purpose

(former gives a cross-platform runtime, latter is merely a JS framework)

~~~
kanja
The tech is different but the purpose is the same - to give a great
application experience with software written in JS/html/css, on every platform
with a single codebase. Ember is betting on the browser to be the runtime,
appjs is writing their own.

------
mhitza
I still find XULRunner better suited for this task.

------
captaincrunch
I think for us, this is redundant as we made a direct jump to the cloud, but
for applications that need to be built on the desktop, this would be great.

Mike/Verelo.com

------
hobbyist
isn't this is an overkill.. using node.js for running desktop apps

------
its_so_on
What I don't get is, honestly, the reason web apps are so much more awesome on
PC's and Mac's than desktop applications are is that they are 0-configure,
0-install, 0-trace. These days, the people with the fastest computers aren't
the geeks - they're people who buy a fast clean empty computer, install
Firefox _and never anything else_ and just use web apps. If they uninstall any
crap that came with the computer, and keep, say, Windows (or Mac) and Firefox
updated (both these OS's and Firefox are pretty proactive about this too),
then after a year, their computer screams compared with anyone who downloads
anything. (Such a person will normally at least start up skype, an antivirus,
media programs, office suites, cam software, sometimes bittorrent or other
specialty software, etc etc etc. The list goes on. All of which like to update
themselves, have an update process in the background, sometimes hanging,
bugging the user, etc, and all of which like to start up with the computer.)

Honestly, what the desktop experience is missing is quite simple: 1) seeing
the first screen within 5 seconds of asking for it 2) every action takes a few
seconds including 'installation' 3) when you close the tab it's gone.

Honestly, even if you have a VM that is 100% in RAM on the fastest computer
available today, usually all programs fail at number 2 - if for no other
reason than that their installation program requires the user to click Next
Next Next Next Finish.

What would fix this? Well, for one thing if any web app also had root access
to a non-networked-except-with-its-own-servers 100% do whatever they want with
it local VM. Yet to my knowledge there is not even a distribution (of any kind
of operating system whatsoever) that is geared toward giving its entire stack
over to 1 application, assuming that it is all now 'tainted'.

Off hand, it would seem the requirements of such an OS would be:

\- Fast startup, no unneeded services

\- Very small footprint, so that a web service can go wild on it, modifying it
however it wants, removing anything it doesn't want, basically, it's theirs
now - and the resulting blob can be written out to disk quickly when the app
closes.

\- Extremely secure. No way for the app to break out of its jail, where it has
total root.

\- Some graphics acceleration would be awesome if this can be done securely,
secure access to opengl, etc.

\- EXTREME STANDARDIZATION THAT DOESN'T CHANGE FOR YEARS OR IS SUPER-
PREDICTABLE.

This is the MAIN area where Firefox shines: you can TARGET it. Whereas,
targeting Windows: good luck. Targeting Linux: um, a slew of questions
immediately pop up. Mac: which version?

The difference between offline games and online games is just huge. Imagine if
you could run any hardware accelerated game "right from your browser" waiting
a few seconds for it to load. The threshold to trying it out would fall 1-2
orders of magnitude. (I would argue, for an indie house falling 3 orders of
magnitude).

I do realize that this overlaps with NaCL. However, NaCL is not really about
providing the full desktop STACK to developers in a standardized way: instead
it focuses (from what I gather) on just the op codes. That's great, but it
hardly provides OpenGL (or DirectX) or a slew of other things that desktop
applications have if they want it.

Basically, I am saying: _if VM software is advanced enough that security
researchers run random viruses on their everyday boxes with their normal hard-
drive mounted, just in a vm, then how is VM software not advanced enough to
give a full desktop access to a web site, all cordoned off with write-on-
modify semantics and standardized, so that the user has 0 security
implications to this_?

Basically, the ONE thing I would add to the experience is putting at the top
of any tab that has this, the number of VM's currently running. Whereas I
expect flash to work well with 10 instances, that may be asking for too much
here.

~~~
dangoor
This description is a lot like Boot2Gecko, except that Boot2Gecko is currently
targeting phones rather than desktops. Chrome OS is a similar concept (though
I admit to not looking too deeply at it)

~~~
its_so_on
I guess I didn't describe myself plainly enough. What I mean is that it should
be just like Flash, working inside an HTML page right from any tab in your
browser, no extra 'install' - except a full VM instead of a Flash instance.

If an application (some accounting program say) comes in Windows, Mac, and
Linux downloads and is supposed to be downloaded and installed, but works fine
if you install it in a VM with a plain image, why can't they put it on the web
behind some HTML that asks for a jailed VM - and be given one? So that if you
are on Windows, whenever you open that web site in a new Firefox tab, you use
its app (right from that tab) in a few seconds without any (visible or
persistent) install. Even THOUGH it is a native-only application that isn't
built around networking (requests over http) nor any kind of internet
technology like javascript. It's just a local program.

If the 'just a local program' could live just as happily in a new tab in a
vanilla base-OS, you wouldn't need to go through installing it to try it, or
uninstall it if you're not interested: this is where a 'web app' shines.
Getting to the first screen takes less than one second (click the link you
heard about it from, including on a Google search) as opposed to 15-45 seconds
minimum to click through Download, Save, wait for it to download, Double-click
in Downloads window (hopefully still in foreground) to open, Click 'Install',
click 'I accept' click next, click next, click finish. Click OK and hopefully
run now. (If there is no 'run now' then click Start, click Programs, find the
new entry, click it.

Likewise, after you see the first screen you can say 'No this isn't what I had
in mind at all' and click Back in your browser or close the new tab: 1-2
seconds. On Windows uninstall is: Click Start, Click Control Panel, click Add
Remove Programs, wait for it to load, find the program, right-click, click
Uninstall, click OK, wait for it to uninstall, click OK. (Or you could wager
on whether they included an Uninstall icon next to their program icon in the
start menu, but most programs don't).

If this web alternative were possible...then anyone could develop however they
normally develop a native application (not app) - instead of having to turn it
all into a client-server app or do it in javascript, flash, etc - and just let
a user use it from their browser without 'actually' installing it. I guess my
concept - since it is based on the usability of using something without
actually-installing it (so that it goes into your normal start menu, for
example) - is too nuanced for people, or I am not describing it right. :/

