Skip to main content
Full Stack Radio

126: James Long - Building Distributed Local-First JavaScript Applications

61 min episode · 2 min read
·

Episode

61 min

Read time

2 min

Topics

Remote Work

AI-Generated Summary

Key Takeaways

  • CRDT Architecture: Conflict-free replicated data types enable true offline apps by duplicating data twice—normalized SQLite tables for queries and a messages table with hybrid logical clocks that replay in consistent order across all devices without conflicts.
  • Merkle Tree Syncing: Sync protocol uses Merkle trees to hash message chunks hierarchically, comparing single root hashes between clients to identify divergence points, then walking down tree branches to find exact messages needing sync without transferring entire databases.
  • Eventual Consistency Trade-offs: Apps must handle temporarily inconsistent data by normalizing database structure maximally, never deleting records (only tombstone flags), and querying only fully-consistent data at read time to prevent foreign key references to nonexistent records during sync.
  • Security Considerations: Electron apps allow JavaScript modification by unpacking and repacking, creating phishing risks for sensitive data like banking credentials. Service workers in browsers provide better security guarantees through sandboxing, making web-based local-first apps potentially more secure.
  • Service Worker Backend: Web implementation would run entire backend logic in service worker with IndexedDB for messages and WebAssembly-compiled SQLite in memory, enabling multiple browser tabs to sync instantly through single background process while maintaining offline functionality.

What It Covers

James Long explains building Actual, a local-first budgeting app using CRDTs for offline-first sync without central database, leveraging SQLite, Electron, and distributed systems concepts from backend architecture applied to client applications.

Key Questions Answered

  • CRDT Architecture: Conflict-free replicated data types enable true offline apps by duplicating data twice—normalized SQLite tables for queries and a messages table with hybrid logical clocks that replay in consistent order across all devices without conflicts.
  • Merkle Tree Syncing: Sync protocol uses Merkle trees to hash message chunks hierarchically, comparing single root hashes between clients to identify divergence points, then walking down tree branches to find exact messages needing sync without transferring entire databases.
  • Eventual Consistency Trade-offs: Apps must handle temporarily inconsistent data by normalizing database structure maximally, never deleting records (only tombstone flags), and querying only fully-consistent data at read time to prevent foreign key references to nonexistent records during sync.
  • Security Considerations: Electron apps allow JavaScript modification by unpacking and repacking, creating phishing risks for sensitive data like banking credentials. Service workers in browsers provide better security guarantees through sandboxing, making web-based local-first apps potentially more secure.
  • Service Worker Backend: Web implementation would run entire backend logic in service worker with IndexedDB for messages and WebAssembly-compiled SQLite in memory, enabling multiple browser tabs to sync instantly through single background process while maintaining offline functionality.

Notable Moment

James reveals his concern about launching bank credential syncing in Electron, explaining how attackers could modify the app's JavaScript to harvest passwords. He plans redirecting users to browsers for credential entry where URL bars provide verifiable security guarantees that desktop apps cannot offer.

Know someone who'd find this useful?

You just read a 3-minute summary of a 58-minute episode.

Get Full Stack Radio summarized like this every Monday — plus up to 2 more podcasts, free.

Pick Your Podcasts — Free

Keep Reading

More from Full Stack Radio

We summarize every new episode. Want them in your inbox?

Similar Episodes

Related episodes from other podcasts

Explore Related Topics

This podcast is featured in Best Cybersecurity Podcasts (2026) — ranked and reviewed with AI summaries.

You're clearly into Full Stack Radio.

Every Monday, we deliver AI summaries of the latest episodes from Full Stack Radio and 192+ other podcasts. Free for up to 3 shows.

Start My Monday Digest

No credit card · Unsubscribe anytime