Hacker News new | past | comments | ask | show | jobs | submit login
Chrome introduces Web App install banners (html5rocks.com)
173 points by mmahemoff on March 12, 2015 | hide | past | favorite | 74 comments



Finally. I've long given up on Apple ever doing anything like this in Safari (I've long since given up on them shipping it without bugs, too) but I've been wondering why Google never did more for webapps in Chrome.

I'd really love it if Android implemented navigator.standalone, too - I do understand the reasons for not implementing it, but it's useful.


We are certainly working on the standalone issue, right now it has been specced via Media Queries (because a lot of users only adjusted their UI). We also have other issues, standalone is binary, where as web apps can be launched in several modes and we want to let you be able to understand how it was launched...


Great! Loving what I'm seeing so far, looking forward to more.


Apple has "Smart App Banners" which is kinda similar, though.

https://developer.apple.com/library/mac/documentation/AppleA...


Yes, but they require a native app. This is web only.


But those are intended for the appstore, not for web apps...


This is going to be the new best feature for malware developers. (Note: Unpoliced malware is RAMPANT in the Chrome Web Store, Google is not policing it properly.)


Because it makes it more convenient for people to voluntarily add the malware to their home screen and later voluntarily launch it?

Sorry, not seeing the malware connection. There's no extra permissions granted here.

BTW I agree Google should do more to improve the security model of extensions and apps on the Chrome store. I shouldn't have to grant the right to see all content on all pages just to pretty-print JSON responses. But don't confuse today's announcement with Chrome Web Store apps or extensions. There could be convergence later, but so far it's just a rev on the Install To Home Screen feature that's been there on iOS since it began.


Not true.

The user has to visit "your site twice over 2 separate days during the course of 2 weeks". Also a valid SSL certificate, service worker, and manifest file. We're definitely not in the 1990s with IE's AddFavorite() free-for-all anymore. :)


Emphasis could be added on the animated gif.


Check back in a year and see how much of the consumer protection Google has quietly removed. Look at the history of Facebook privacy defaults. (http://mattmckeon.com/facebook-privacy/)


This has nothing to do with anything.


There is one mitigating feature:

> The user has visited your site twice over two separate days during the course of two weeks.

This should help reduce the number of casual shitty sites that can make use of this - the user has to at least have a reasonable level of engagement before this triggers. It's far from foolproof but it is a promising start.


We certainly want to make sure that it leads to a great experience. With the browser controlling the heuristics of when then pop-up fires I think we can mitigate some of the risk.


That does sound like it may help, though I wouldn't count against common users being regularly shunted through malicious portals.


Right, but goog is weighing malware + cash vs not helping exploit their users and coming down on the side of malware. I'm sure the cash is incidental to this decision. It's really disappointing.

Yet another reason to tell your parents to buy iphones.


Google made this decision a long time ago. Try searching Google for "flash player". The top two links are malware. Google knows their AdWords are used to slip malware at the top of download searches for major products, but has never done anything about it, like say, disabling AdWords on a term like "flash player" where any paid ad is basically guaranteed to be malicious.

This is a twofold benefit for the sleezy company: Google gets paid directly by malware developers, and the added malware on people's computers helps drive consumers to switch to Chromebooks. The "rampant malware on Windows" problem is largely a Google creation, and of course, Google advocates their product as the solution.


Wow. That just really changed my model of paid search results... and I'm not quite sure yet how to put it back together.

I clicked both results for "flash player" and nothing on my computer (Mac) or in the browser (Chrome) warned me, whereas I have received warnings on other sites for "phishing attempts". I never would have downloaded anything from those sites, but my parents sure would have.

Who knows, if I were in a hurry and it was a program I wasn't familiar with or that I was trying to get for free? And if the site was more polished or a full html/css clone of the real site? It honestly might have worked on me.

What kind of malware do these bogus paid results contain? What would have happened if I'd installed them? What can you do to defend against that besides being a savvy web user?

Thanks for this. I learned something.


What?

How is making it easier for developers to distribute apps on the open web "malware + cash"? It's more like balancing the risk of malware against the benefits of openness and encouraging web app development.


It sounds like you might be misunderstanding the feature. Can you explain precisely how you envisage it being used by malware?


Spam is my biggest issue for Chrome on mobile (not that much malware, so far PlayServices/Bouncer has done a great job for me). There are many sites that launch an intent to the play store for a random app. Some others that launch a download of their app. It makes navigating some websites a pain. I fear that this feature will be exploited as well.


Awesome that service worker is a requirement for this to show up. Hopefully this makes creating offline enabled apps more important.


That's the intention... kinda. The ServiceWorker doesn't mean that you manage the offline experience (you could just be handling push messaging), but we believe that it is an indicator that you are likely to be thinking about app like experiences.

As a by-product of the service worker though, we really hope developers start building offline experiences.


I'm sure that we will soon (if not already) have a project that creates a barebones service worker for people who want to skirt this requirement.


This was already linked from the announcement: https://github.com/GoogleChrome/samples/blob/gh-pages/app-in...


No matter how much I tried to install this on a side-project, I had no luck:

https://www.tithess.gr/

The test site displays the banner fine, my site doesn't. Given how hard these things are to debug, a simple "banner checker" page that would tell you what you did wrong would be a great help.


Agree on debugger. However, did you follow the guidance and turn on the flag in Chrome? The flag lets you bypass the heuristics for when to show the prompt. If you don't have it enabled you have to visit the site twice in two weeks (on separate days)


I did, yes (the test site works fine).


You don't appear to have a service worker registered.


What do you mean? I took the code straight from the example, and it prints "worker registered" in the console when I add a logging call there.


I was looking at the site, and I don't see it. Digging a little deeper, you need to work more on SW. Right now it is hosted on https://www.tithess.gr/static/js/service-worker.ba9881a3a5f4... - this means the service worker is only working for the directory 'https://www.tithess.gr/static/js/', if you want the banner to appear you need to have the service worker directly in the root of the site (note, this is how service worker is intended to work).


Thanks, I looked everywhere for something defining the scope and couldn't find any solid documentation. The registration is in the head, I'll move it to the top level, though, thanks.


Why are these banners so popular - they are actually my least favourite part of browsing on iOS - every single webapp (GMail, Yelp, Urbanspoon) sticks one of these banners at the top of my page and reduces my real estate and doesn't remember that I dismissed it the first time. I'm not super excited to be seeing these on Android too.

Do usage stats indicate that a lot of people use this feature?


As the article says:

* It will only appear for sites you use regularly * It will only appear once per site, ever


With this project we are trying to be as respectful of the user as possible, so yes it is correct we won't keep re-prompting once installed or dismissed. There is still a lot we are working on fine-tuning the heuristics of this but I am quite hopeful that we will see a reduction of custom banners on the web because we can provide a better experience for sites.


Very cool! This takes iOS's home screen web app feature to the next level with the install banner. Hopefully we'll be able to create a standard for these manifest files/meta tags so developers won't have to target specific devices. Also Apple needs to fix their web app meta tag parsing - it's super buggy in iOS 8.


Author of the post here. Wrt to manifest, it is being specced (and hopefully ratified as a standard soon) right now and we implement it (a lot of it) - https://w3c.github.io/manifest/ - now it is just a matter of getting other browsers to support the spec too.


> Wrt to manifest, it is being specced ... - https://w3c.github.io/manifest/

Today I learned that W3C is using Github for working with specs. Nice!

That's certainly going with the times.


The animated gif in the announcement goes by way too fast. Could you slow it down by 2x or so?


I recorded it at real-time speed iirc.


Perhaps you weren't waiting long enough before touching the next button while recording it? Someone seeing it for the first time needs time to take in what's on the current screen before seeing the transition to the next one.


For what is worth I could follow the gif without trouble. Perhaps it's harder to follow if you aren't used to Android?


That could be it. As an iOS user, I had to watch it loop through a couple times to understand it (and even to find the beginning). I felt it was moving a bit too fast.


Looping animated gifs are just a very, very inefficient means of communicating. It would be very easy to follow this one if you could have it start at the exact moment you fixed your attention on it, but the looping means you come in halfway and it makes absolutely no sense. I had to sit and concentrate on it for a couple of loops just to determine the starting point of the "story" it was telling, and once I figured that out, it still took a couple run throughs for me to comprehend what it was trying to show me. Maybe I'm just stupid, but I wish this trend would go away.


"We recommend the following simple Service Worker as a starting point," needs link.


Urgh. Fixing.

Update: Fixed. Thanks.


>My app meets all the criteria, but I don’t want the banner to display. Can I control this? Not right now. We are working on ways to give developers the ability to cancel the display of the prompt.

Sorry, what?


In other words, the prompt to "install" the shortcut will always appear for sites meeting all the criteria. I guess one can always remove the manifest file to stop the prompt from showing in the interim.


Bad wording on my part - I know what it meant, I just thought it was baffling that they don't let websites opt-out of this new feature at all.


That will be coming. It is mentioned in the article.


We are not letting developers to control when the prompt shows, other than to stop it from showing.


From the wording is sounds like developers can't stop it from showing. (Except by not using using the APIs that would trigger it.)


FYI there is a public proposal on GitHub for an API which would allow developers to control the banner more, particularly it's timing or suppressing it. Hopefully this will happen soon. https://github.com/slightlyoff/AppInstallImprovements/blob/m...


I find it a little amusing that the example is a site for people at a 2 day conference, but the banner will only appear if you visit a site on two separate days. In the real world this would be showing a banner saying "Install our app!" on the final day of the conference after it's lost most of it's usefulness.

Great technology and potentially very helpful, but not the best choice for an example of where you'd use it.


I created this example because when I looked at the site, we had huge numbers of returning visitors, especially on the run up to the announcement of registration and the announcement of talks. I can certainly clarify this in the article.


Great to see Chrome working on this! However I'm not sure about the 2 days over 2 weeks requirement. It's kind of unintuitive.

Ideally, the website would have an install page, lead the willing user to it, let them click an install button, and done.

Spammers are everywhere, so you can't allow that. But from the user's point of view, heuristics make the browser look like random. If a user likes a web app, they expect it to be easily installable now. The website can't ask "please come back tomorrow" and menus don't work for the lay user ("Add to homescreen" is the 9th item out of 12 in Chrome's menu), otherwise the user leaves with the impression the web app is unnecessarily complicated.

Have you considered making the prompt full-page? It could say:

    Would you like to install this app?

    Kinlan's Amazing App

    Website: kinlan.me

    By: Kinlan Corp  <-- this field is taken from EV certificates; hidden otherwise

    [Add to homescreen] [Cancel]

    [Mark as spam]
- Making it full-page prevents the website from contradicting the browser UI;

- "Mark as spam" raises awareness that the spam filter part of a user's brain should be put to use; it also changes the incentives for spammers as there is currently no downside to spam users;

- "Website" could be limited to the second-level domain because the bad guys use a deep subdomain a lot more than the first-class web app developers;

- the prompt would be shown when navigator.install() is called inside an onclick handler bound to a button (it's not a high bar for spammers but it's still a relief for users);


While we wait for Chrome 42, what do you guys think of https://github.com/cubiq/add-to-homescreen with https://github.com/carhartl/jquery-cookie for achieving something similar?


Chrome 42 lands in beta today. It'll be pretty much one month until it's in stable and all Chrome users have it.


I love that service workers require HTTPS. :3


It's just really unfortunate that Google App Engine is simultaneously a blocker for HTTPS:

https://code.google.com/p/googleappengine/issues/detail?id=1...


> My app meets all the criteria, but I don’t want the banner to display. Can I control this?

> Not right now. We are working on ways to give developers the ability to cancel the display of the prompt. Follow our “Intent to Implement” on blink-dev mailing list.

Hahah, that's good. No-opt-out is always fun.


Why do ServiceWorker really need SSL? Such requirement makes the development process and usage in smaller projects cumbersome.

IndexedDB API as NoSQL API isn't that great to work with. Give some love to WebSQL or continue on a SQL API standard based on SQL-92 standard.


Without SSL, there is a trivial way to upgrade a temporary MITM capability to a permanent MITM capability using ServiceWorker.


This is great for user experience on mobile web apps. Not ever app needs to be mobile, but convincing the user to save it to their home screen is no small task.

This will definitely augment UX for mobile devices.


Hasn't FireFox mobile browser been doing this for a few years? I've had qz.com as an icon for a while.


Putting an icon on the home screen isn't the interesting thing here, chrome has done that for years too. The news is the banner that prompts users to add it.


Is this planned to be a feature for the iOS version of Chrome at some point?


Would love it to be, however we can't take a web app and package it up to the App list on iOS. Because of this there is not much we can do.


Will this happen on android devices for apps anytime soon?


Hasn't WP been doing this "pin to start" thing for a while? If I am not mistaken.


Everyone has, Chrome has for a long time too, this is about Chrome being more proactive in letting the user know that they can install this experience.


If only I could force my clients to use Chrome in lieu of IE8.


Who are your clients? What industry? Is there a centrally-important program they all use that requires IE8 or WinXP, or do they just have a massive fleet of XP machines and not want to upgrade?

As a software vendor, I used to have a lot of trouble getting my clients to switch away from IE, but I feel like that really has been changing. My clients are large GC firms and other kinds of construction companies (infamous for being behind the times when it comes to technology) and I had >80% of them on Chrome 6 months ago. Have you tried telling them that even Microsoft dropped support for WinXP and IE8 a year ago? (I think it happened last April.)


They view IE as part of their support burden and rather not add to that burden until they can change the version requirement on everything at the same time. They would probably be happier if we branded Chrome and narrowed its UI to our app's needs.

> Have you tried telling them... They know. They are the purse holders, not the brain holders.

(unrelated side note: looks like someone is disappointed that I have clients on down-rev browsers)




Join us for AI Startup School this June 16-17 in San Francisco!

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: