Jammu,Apple has only recently changed their position on live updates with apps, so we're all treading in some new territory here as to what Apple will and won't accept. I think as long as you don't make an update that fundamentally changes your app (say from a chat app to minecraft clone), the concept itself is probably safe.
As to doing live updates, the catch is this: the code is still all local. That is, when an update is performed, the code is downloaded and stored local to the device (typically in a cache). In that sense, the code does not /run/ from the server -- it runs /locally/.
Now, your question was specifically about having problems with cordova.js from the server. Well -- there are a lot of problems doing that, security notwithstanding. For one, cordova.js is /different/ for every platform. For example, I have a fairly simple test app that I use to play around with sometimes, and the cordova.js version is definitely different. For android, it's something like 64K, while on iOS, it's 58K. That alone should tell you that something platform-specific is going on. Furthermore, cordova.js varies by platform version (for my project, I have i...@3.8.0, and And...@4.0.2)
In order to make things work correctly, you'd have to provide at least two versions of cordova.js, and have some local code to determine which one to use (or some network code that sniffs the device and serves the appropriate file). But you have another problem: if you are running from the server, what happens when the user has no network connection?
Apple requires apps to serve useful error messages when this occurs -- even something as simple as "This app requires an internet connection" is fine. But if all your code is remote, you may never have the opportunity to generate this message. So, at minimum, you need /some/ local code. Personally, the experience is much better (in my opinion) if you keep as much code local as you can. That doesn't mean you can't update it, just that the code you run should be local to the device.
That's what hydration and ionic's stuff does (or rather, should be doing: I don't use it), and I'd suggest going with something like that rather than building your own. The reason is security: you have to worry about properly securing that communication between your user's device and the source code. If the code was downloaded incompletely or in a corrupted form, would you catch it? What if there was a man-in-the-middle? Would you be able to detect that the code the user received was the same code you expected them to receive? The security here gets painful, and is one of many reasons why I suggest staying away from live updates entirely, but if you must do it, to NOT use something that's home-grown.(I also have a third reason: I don't like apps to be updated without my permission. After all, there may be a very good reason I've not updated yet: bugs, lost/changed features, etc.) Reaching in and updating my app without my consent feels like it crosses a line. But that's my opinion.)
One more reason: if you ever update your plugins, you'll need to deploy a regular update anyway. Live updates can only transfer www code, not native code.
I hope that helps.
Thanks Kerri for the detailed, extremely helpful feedback and for listing out all the pitfalls. Especially thank you for your professional and respectful reply.Please see some comments inline.
regardsOn Tuesday, July 21, 2015 at 12:40:56 PM UTC-7, Kerri Shotts wrote:Jammu,Apple has only recently changed their position on live updates with apps, so we're all treading in some new territory here as to what Apple will and won't accept. I think as long as you don't make an update that fundamentally changes your app (say from a chat app to minecraft clone), the concept itself is probably safe.As to doing live updates, the catch is this: the code is still all local. That is, when an update is performed, the code is downloaded and stored local to the device (typically in a cache). In that sense, the code does not /run/ from the server -- it runs /locally/.Yes, exactly right. We use the HTML5 cache events to download the files and then restart the app once it's completely downloaded.Now, your question was specifically about having problems with cordova.js from the server. Well -- there are a lot of problems doing that, security notwithstanding. For one, cordova.js is /different/ for every platform. For example, I have a fairly simple test app that I use to play around with sometimes, and the cordova.js version is definitely different. For android, it's something like 64K, while on iOS, it's 58K. That alone should tell you that something platform-specific is going on. Furthermore, cordova.js varies by platform version (for my project, I have i...@3.8.0, and And...@4.0.2)Makes perfect sense. Yet, Security/Auth etc is application level and applies to even pure Web Apps that have nothing to do with cordova.
Yes, indeed. Platform specific cordova versions is certainly an added complication.
In order to make things work correctly, you'd have to provide at least two versions of cordova.js, and have some local code to determine which one to use (or some network code that sniffs the device and serves the appropriate file). But you have another problem: if you are running from the server, what happens when the user has no network connection?When the user has no network connection the app works out of the HTML cache. We test it regularly on iOS.Do you think there might be still some issues with that?
Apple requires apps to serve useful error messages when this occurs -- even something as simple as "This app requires an internet connection" is fine. But if all your code is remote, you may never have the opportunity to generate this message. So, at minimum, you need /some/ local code. Personally, the experience is much better (in my opinion) if you keep as much code local as you can. That doesn't mean you can't update it, just that the code you run should be local to the device.Yeah, first time the user logs in the code is remote but at the time of logging in they need network access anyway. After first login there is always a copy of the code locally in the HTML cache.
Again, the code is always local unless the server tells the client that there is an update. In that case the client checks the HTML5 manifest files, updates the cache in the background and restarts the app.
Btw, just today, gmail did that for me when I logged into this forum. :)That's what hydration and ionic's stuff does (or rather, should be doing: I don't use it), and I'd suggest going with something like that rather than building your own. The reason is security: you have to worry about properly securing that communication between your user's device and the source code. If the code was downloaded incompletely or in a corrupted form, would you catch it? What if there was a man-in-the-middle? Would you be able to detect that the code the user received was the same code you expected them to receive? The security here gets painful, and is one of many reasons why I suggest staying away from live updates entirely, but if you must do it, to NOT use something that's home-grown.(I also have a third reason: I don't like apps to be updated without my permission. After all, there may be a very good reason I've not updated yet: bugs, lost/changed features, etc.) Reaching in and updating my app without my consent feels like it crosses a line. But that's my opinion.)Yeah, good to know about peoples preferences.One more reason: if you ever update your plugins, you'll need to deploy a regular update anyway. Live updates can only transfer www code, not native code.True. Live updates are for quick iterations and bug fixes. If and when plugins are updates we will have to push a full update.I hope that helps.It certainly helps and thank you again for all the great points you have made.Yet, I feel those are all technical complexities that are around putting any major app into production which can be handled with proper investment.
Aside from that, at least in test and dev, we see huge benefit. Would you also agree? Everything is trusted in the local network and platform dependence can be carefully managed. We have only a small set of devices. This process had significantly speeded up our test/dev on iOS.
Even with all those complications, I'm still wondering what is it preventing cordova to startup on Android.In one case cordova plugins are accessed from the application file system, in the other they are accessed from the HTML cache.Again, we have no issues with cordova on iOS. Is it timing related or something more fundamental about Android?
Would love to hear your thoughts/perspective on that.Lastly, please understand, these questions are coming from real needs and I'm not trying to point any fingers or upset anyone. I have dug around into all the documents that I have been asked to read but I have not found anything that addresses the issue. If I have missed it somehow, can you send me a specific link?My apologies in advance if this technical dialog upsets anyone.
RegardsJ
--
-- You received this message because you are subscribed to the Google
Groups "phonegap" group.
To post to this group, send email to phon...@googlegroups.com
To unsubscribe from this group, send email to
phonegap+u...@googlegroups.com
For more options, visit this group at
http://groups.google.com/group/phonegap?hl=en?hl=en
For more info on PhoneGap or to download the code go to www.phonegap.com
---
You received this message because you are subscribed to the Google Groups "phonegap" group.
To unsubscribe from this group and stop receiving emails from it, send an email to phonegap+u...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.