Mozilla Prism: not there yet!
From Mozilla’s Lab blog post: Prism is an application that lets users split web applications out of their browser and run them directly on their desktop
. I was intrigued.
For a moment I thought that my days in pain are over. Mozilla’ve got it right this time
! I really liked the concept. I still do. Unfortunately, when I installed the Prism environment and tried to hook some Google apps I am using all the time, I found myself in the exact same situation I was before. Essentially, Prism is nothing more but the Firefox browser with some fancier desktop shortcut features and without the normal chrome.
I really thought that Prism will allow web applications to run independently, without sharing resources such as cookies, etc. I through that by separating all applications, I care about, as independent Prism apps, I will achieve the level of security I’ve always needed in my day-to-day work.
The result was different though. Although Google Reader was set as a separate applications from Google GMail, once I authenticated one of them the other one also gets authenticated as well. Disappointment
! Through, I still like the concept. It just needs a bit polishing.
Suggestions
Here is a list of things, which make sense in terms of security and which mozilla developers should consider implementing into Prism:
- Prism applications should be placed on their own such as cookies, persistent storage, etc are not accessible by other Prism applications which run from the same origin.
- Prism should implement logical groups which allow applications to share cookies between each other, when required. So for example, I should be able to define that the GMail application can share cookies with the Google Reader, i.e they are in the same logical group.
- Requests to URLs outside of the current origin should be prohibited. I guess iframes, XMLHttpRequests and JavaScript remoting can be threated as safe operations since they are defined by the developers.
Keep in mind that you may still suffer from Cross-site scripting and Cross-site request forgery attacks, although the attack surface will be greatly mitigated! I hope that these kind of features are implemented into Prism soon. This will give us the ability to surf the web a little bit safer.
DinoBoff 
sull
good points.
prism project is def one to watch closely and/or participate in development.
the core concept is solid… i’ve always had an interest in simply wrapping content (client and server side) in multi-platform cross-compatible desktop applications… for all the obvious benefits and also for that ‘control’ layer. control in security, UI and exposed functionality.
typically, i looked at this from the angle of allowing integrated web browser within a desktop app… something we have seen for a long time… early napster days even. something i have wanted since the days of using Hotline and KDX. i purchased Runtime Revolution and one of the selling points was this simple feature… integrating native OS web browser into my apps… or to just wrap a restricted website as a desktop app and nothing more. runrev uses IE on windows and Safari on mac. So it is obviously not the same approach as Prism which IS a browser (firefox/gecko) itself.
At this point, I like the Prism approach alot. I’ve been following XULRunner and Webrunner so it was exciting to see the annoncement of the rebranded Webrunner as Prism and all the new discussion on what this means…. even as it is not exactly groundbreaking in a technical sense…. it still has the potential to be groundbreaking as the project evolves and launching prism apps becomes a more common thing…. it’s the popup window 2.0 ;)
What’s important now is everyone participate in the ddiscussions that will help to mold prism.
More of that, like this post here…. and less of the critically shallow early observations that prism is no big deal. Dont miss the point. Step outside the box and think about how this approach on RIAs and web/desktop hybrid niche can lead to new innovations. i dont mean to overstate the importance of this project… but i dont want their to be two camps that either belittle or over-hyper it. Just look at it for what it is and what it can and should logically become.
The comparisons to AIR and Silverlight are relevant but should not be the focus of Prism discussions. So I am glad to see this post doesnt go there :)
Sull