During the Great Web Standards Stagnation of 2000-2007, web applications seemed as dead as they could get. Javascript and DOM were good for cute tricks like making letters follow your mouse, but not capable of any real work. ActiveX was busy opening up new security holes in Windows every week, Java applets sucked in the same ways they've always sucked, and flash was used for that damn introductory page on every commercial web site. HTML had no new features, and no prospect of gaining any.
Eventually, though, something had to give. Everyone was on the web, and people were finally making money again. Despite the best efforts of the SVG and XHTML groups facing a dead yet dominant browser in Internet Explorer 6, nothing seemed to be happening.
The undercurrent of frustration finally broke through in a couple of places. Google legitimized XMLHttpRequest, a nonstandard Microsoft creation, by using it in their search engine. Apple created the <canvas> tag to enable web developers to write dashboard widgets, and the WHATWG gathered steam by picking it up and specifying it.
When Google and the WHATWG began planning for a standard to succeed HTML 4 and replace the largely failed XHTML spec, the walls began to crumble. For the past year and a half, the web has seen a staggering increase in the capabilities available to web application developers. The HTML 5 standard, backed by Google, is specifying a real programming environment using javascript and DOM. Concurrently, Flash has gone semi-open, gained desktop integration, and brought 3d and video to the web. ActiveX is dead, and Microsoft reinvented it in a more secure and semi-cross-platform manner. Java applets, however, still suck.
Faced with a bevy of alternative programming environments, a rapidly evolving HTML spec supported differently by every version of every browser, and people still using IE6, it's no longer easy to say what is possible with web applications and what is not. In the spirit of Hilbert's unanaswered questions of mathematics , this article will attempt to sketch a few of the limits of what is possible to distribute to a large majority of internet users, and discuss some of the issues around those limits.
Should Facebook be allowed to communicate with Flickr via your browser, with your credentials? Of course not - that leads to all kinds of security problems, like cross-site scripting attacks. What if spammers hacked Flickr and used an XSS attack to friend themselves to everyone?
On the other hand, it is pretty neat that I can piggyback off google's copy of jquery. Or put disqus comments on my blog without worrying about installing anything to my server. Or put any one of a million "badges" on my website that display live data about me or my friends off my favorite websites.
The browser has a serious schizophrenia about websites telling the client to pull data from other sites; it's allowed if it's the source of an iframe, image, css or javascript file, but it's not