6 ms·

Apple rejects Puffin Browser on iOS

70 points by pingyen 9y ago

phobius 9y ago
Is it not possible there's just a security violation they need to sort out? Am unfamiliar with Puffin, but the post leaping straight to "it's a conspiracy!" without indicating what the stated rationale for rejection was appears a bit off. (I'd I'm normally first in line to attribute things to corporate greed)
- b4lancesh33t 9y ago
  Their medium article explains the reason apple rejected them. They use chromium on their servers to render pages. Apple wants them to use webkit.
  - pier25 9y ago
    If this is really the case it’s nonsense that an iOS policy would extend into your servers too.
    - martin_bech 9y ago
      The problem isnt that its serverside, its thats a different renderingengine, and therefor visually could/is rendering differently than safari/webkit.
      - hungerstrike 9y ago
        Who cares? There are tons of games in the App Store with custom user interfaces that don’t match anything from Apple.
        martin_bech 9y ago
        Thats not the issue, the issue is that cnn or whatever.com might render differently or not at all if viewed in one browser, instead of the other. I dont know the internals of puffin, but security and js attack vector, might be different as well.
        hungerstrike 9y ago
        You said "and therefor visually could/is rendering differently than safari/webkit" You didn't say anything about security, but there is no security problem either. The client side wouldn't be evaluating JavaScript outside of Apple's JS engine so there is no security risk whatsoever.
trynumber9 9y ago
for those who don't like to visit Facebook https://hackernoon.com/its-time-to-bringappletojustice-cf12ce860932 https://hackernoon.com/its-time-to-bringappletojustice-cf12c...
- fny 9y ago
  This should be the link. It gives more context than the Facebook post.
- robterrell 9y ago
  Hard to take the article seriously with this breathless and inaccurate lead: “Take the “BatteryGate” for example. Apple secretly and deliberately reduces the performance of old phones in order to boost new phone sales in the name of extending the battery life. The company only revealed this after being caught red-handed.”
  - scarface74 9y ago
    And it couldn't be they reduce performance to keep the phone from shutting down prematurely when you have a bad battery- a known issue that people were having? If they wanted to encourage people to buy new phones wouldn't it just be easier to not support older phones with new iOS updates? Why base the slow down on battery life instead of just slowing the phone down after two years? There are much easier ways to encourage people to buy new phones if they wanted to be underhanded than the Rube Goldberg conspiracy that you are suggesting.
- pilif 9y ago
  >Puffin is a victim of Apple’s abuse. Puffin is a server-based web browser where web browser sessions are executed on the cloud servers You and me know to not use something like this for any kind of sensitive site. But the common iOS user doesn’t know this. Apple is protecting their users and their platform. It’s 2018. making a web browser where all traffic goes through the browser makers server, being unencrypted and then reencrypted is not acceptable any more (I would argue it never was, but then, back in the days of 9600 bits/s it was more excusable)
pier25 9y ago
I’ve never understood why Apple doesn’t allow other browser engines on iOS. It seems a really ridiculous policy that doesn’t really benefit anyone.
- fny 9y ago
  In the Medium article, the CEO claims the issue stems from them rendering pages on their servers using Chromium rather than WebKit. On the face of it, this seems bizarre but I could definitely see how Apple has an interest in having their User Agent stamped on outgoing requests.
  - scarface74 9y ago
    They weren't telling the truth about "superior virus protection" or Apple trying to protect Google ad revenue (Apple has supported third party content blockers in Safari for years), why should we believe they are telling the truth here? Besides, Opera Mini does the same thing - Server side rendering - and has been on the Apple Store for years.
- jacknews 9y ago
  Except Apple themselves...
  - pier25 9y ago
    Why does it benefit Apple? Imagine if you could only use Safari on macOS...
    - lern_too_spel 9y ago
      Don't give Apple ideas. The cat's already out of the bag, but if Apple could force people to obtain MacOS apps only from the Mac App Store, which does not have other rendering engines, they would. See also: Windows 10 S.
- SXX 9y ago
  Isn't that obvious? With iPhone being major mobile device they put enough pressure on web developers to support WebKit which benefits Safari not just on iOS, but on macOS as well. This also not just wins better support for Safari, but give Apple some foot in making of web standards. If they allow alternative engines on iOS they'll just slowly lose browser market share they still have which likely end up in death spiral for Safari support. It's extremely hard to compete with Google since even Firefox on Android is still extremely rare no matter how much effort Mozilla put into it.
firloop 9y ago
Apple's App Review guidelines used to say something along the lines of "If you have a problem, trashing us in the press never helps." I'm not trying to place judgment on Puffin, but this seems to be the wrong strategy. False negative App Store rejections are typically due to a misunderstanding than a nebulous "corporate greed" angle... or sometimes they were even (at least sort of) justified in the first place [0]. See also: when Rollout got rejected, their open letter [1] didn't help them either. [0]: https://9to5mac.com/2016/10/10/apple-dash-removal-from-app-store https://9to5mac.com/2016/10/10/apple-dash-removal-from-app-s... [1]: https://rollout.io/blog/open-letter-to-apple-secure-javascript-injection-ios/ https://rollout.io/blog/open-letter-to-apple-secure-javascri...
- lern_too_spel 9y ago
  From the Medium post: Puffin releases were rejected citing app review guideline 2.5.6: “Apps that browse the web must use the appropriate WebKit framework and WebKit Javascript.” Our server-side web browser is based on Chromium instead of Apple’s WebKit, therefore, Puffin is rejected. We disputed and escalated but Apple insisted it has jurisdiction over our server-side technology.
  - eridius 9y ago
    Seems like a pretty clear violation of the rules. Trying to find a loophole doesn't work, the rules aren't an Ethereum smart contract, they're actually subject to human judgement.
    - im3w1l 9y ago
      I thought the stated reasoning for the rules was that Apple for safety reasons didn't want apps downloading and running code (javascript in this case). Clearly that justification doesn't apply if the code runs on a server and not the device.
  - feverishaaron 9y ago
    Most likely insisted upon due to the obfuscation of user privacy
deleted 9y ago
[deleted]
debt 9y ago
Puffin circumvents Apple’s ability to block ads which other app developers provide at a premium on the App Store. It also circumvents all the parental controls provide by Safari. It’s a great idea but it Likely needs to incorporate the settings on the phone.
rgovostes 9y ago
This whole post is manipulative bullshit. > Apple, concerned about the rising competition, decided to sabotage Puffin in order to protect the billions of dollars of search revenue from Google. Settings → Safari → Search Engine → Yahoo/Bing/DuckDuckGo. There, look, no Google. The next sentence: > Puffin releases were rejected citing app review guideline 2.5.6: "Apps that browse the web must use the appropriate WebKit framework and WebKit Javascript." Setting aside whether that is a good rule or not, it has nothing whatsoever to do with the previous claim.
- melloclello 9y ago
  Quite sincerely, they should just look into running WebKit server-side. That said, in my experience if Apple has secretly decided they don't like you, they tend to move the goalposts on you in subsequent reviews, so migrating their systems to WebKit may not be time well spent.
  - touringcomplete 9y ago
    Server-side??? Apple requires apps use the Apple WebKit framework only for web content, which runs only on the client-side. The point of Puffin is to run Flash and other desktop crapware websites that don’t work on Mobile Safari (Apple WebKit) properly. Puffin isn’t a native or local web browser; it’s an optimized, virtual, remote browser viewer. If they sell it as a “Citrix for the web,” they might have a shot.
    - melloclello 9y ago
      Ah, I didn't realise that was Puffin's use case.
    - scarface74 9y ago
      Opera Mini does the same thing as Puffin. Puffin wasn't denied access because it rendered on a server.
- indubitable 9y ago
  I think your first example is somewhat disingenuous. The vast majority of people will never change their default settings on the vast majority of things. The ability to change something does not contradict the view that a company is engaging in that behavior, and persisting it, for money. E.g. Mozilla/Firefox recently swapping to Google as their default browser would be the same thing, even if they know it's likely somewhat antithetical to many of their users - they will profit from those who are too lazy, or too ill informed, to change it.
vosper 9y ago
Full text from their Facebook post, so you don't have to go to FB "Many of you have asked why we haven’t updated our iOS app and we’re finally ready to share our story – Puffin is a victim of Apple's abuse. In 2010 we brought our cloud-based Puffin browser to iOS, allowing iPhone users to enjoy the wicked fast speed, frugal data usage, and extreme virus protection available through server-side rendering. But, Apple has now decided to reject our app, claiming it violates its guidelines. For seven years, Puffin has been approved with no mention of this violation. But now that Puffin has grown to almost 100 million active loyal users, such as yourself, Apple wants to sabotage Puffin in order to protect the billions of dollars of search revenue from it receives Google. It’s time to call out the #BadApple and if you agree, feel free to share your comments via the hashtag. For our full story, please visit us on Medium: http://bit.ly/2BsLqI2" http://bit.ly/2BsLqI2"
anilshanbhag 9y ago
The bigger problem with iOS is that its a complete lock-in. Even if users want the app, Puffin is unable to distribute its app to users since Apple doesn't approve it. This doesn't happen on Android, if you don't like Play Store, you can still distribute apk and ask the user to download & install. People may spin it any way they want but this is corporate greed !
QML 9y ago
This might seem like a random question, but does Webkit partition their browser into a kernel and a render engine like Chromium does?
ec109685 9y ago
Such an icky product, man in the middle’ing every page you visit.
Dim0N 9y ago
From their Facebook page: >Not seeing any documentation on https and puffin. If I log in using puffin, can your servers see my password? Their answer: >Yes. Puffin server will see your password even for HTTPS. The browser is physically running on the server. The closest analogy to Puffin is RDP (remote desktop). Am I reading this right? Who in their right mind would use this shit?
- piva00 9y ago
  This by itself is a good enough reason for Apple to reject the app on grounds of protecting customer privacy. Liking it or not, of the major tech companies Apple has had a track record of caring about its users' privacy. I remember Tim Cook mentioning that as a basic value for him personally.
scarface74 9y ago
Let's look at the statement on its merits. 1. If Apple was so concerned about protecting its search ad revenue from Google, why would it offer a method to install third party content blockers? 2. Puffin offers "extreme virus protection"? Apple banned "virus protection" programs in the App Store a year or two ago because they were all scams.

70 points by pingyen 9y ago

Is it not possible there's just a security violation they need to sort out? Am unfamiliar with Puffin, but the post leaping straight to "it's a conspiracy!" without indicating what the stated rationale for rejection was appears a bit off. (I'd I'm normally first in line to attribute things to corporate greed)

b4lancesh33t 9y ago
Their medium article explains the reason apple rejected them. They use chromium on their servers to render pages. Apple wants them to use webkit.
- pier25 9y ago
  If this is really the case it’s nonsense that an iOS policy would extend into your servers too.
  - martin_bech 9y ago
    The problem isnt that its serverside, its thats a different renderingengine, and therefor visually could/is rendering differently than safari/webkit.
    - hungerstrike 9y ago
      Who cares? There are tons of games in the App Store with custom user interfaces that don’t match anything from Apple.
      - martin_bech 9y ago
        Thats not the issue, the issue is that cnn or whatever.com might render differently or not at all if viewed in one browser, instead of the other. I dont know the internals of puffin, but security and js attack vector, might be different as well.
        hungerstrike 9y ago
        You said "and therefor visually could/is rendering differently than safari/webkit" You didn't say anything about security, but there is no security problem either. The client side wouldn't be evaluating JavaScript outside of Apple's JS engine so there is no security risk whatsoever.

trynumber9 9y ago

for those who don't like to visit Facebook https://hackernoon.com/its-time-to-bringappletojustice-cf12ce860932 https://hackernoon.com/its-time-to-bringappletojustice-cf12c...

fny 9y ago
This should be the link. It gives more context than the Facebook post.
robterrell 9y ago
Hard to take the article seriously with this breathless and inaccurate lead: “Take the “BatteryGate” for example. Apple secretly and deliberately reduces the performance of old phones in order to boost new phone sales in the name of extending the battery life. The company only revealed this after being caught red-handed.”
- scarface74 9y ago
  And it couldn't be they reduce performance to keep the phone from shutting down prematurely when you have a bad battery- a known issue that people were having? If they wanted to encourage people to buy new phones wouldn't it just be easier to not support older phones with new iOS updates? Why base the slow down on battery life instead of just slowing the phone down after two years? There are much easier ways to encourage people to buy new phones if they wanted to be underhanded than the Rube Goldberg conspiracy that you are suggesting.
pilif 9y ago
>Puffin is a victim of Apple’s abuse. Puffin is a server-based web browser where web browser sessions are executed on the cloud servers You and me know to not use something like this for any kind of sensitive site. But the common iOS user doesn’t know this. Apple is protecting their users and their platform. It’s 2018. making a web browser where all traffic goes through the browser makers server, being unencrypted and then reencrypted is not acceptable any more (I would argue it never was, but then, back in the days of 9600 bits/s it was more excusable)

pier25 9y ago

I’ve never understood why Apple doesn’t allow other browser engines on iOS. It seems a really ridiculous policy that doesn’t really benefit anyone.

fny 9y ago
In the Medium article, the CEO claims the issue stems from them rendering pages on their servers using Chromium rather than WebKit. On the face of it, this seems bizarre but I could definitely see how Apple has an interest in having their User Agent stamped on outgoing requests.
- scarface74 9y ago
  They weren't telling the truth about "superior virus protection" or Apple trying to protect Google ad revenue (Apple has supported third party content blockers in Safari for years), why should we believe they are telling the truth here? Besides, Opera Mini does the same thing - Server side rendering - and has been on the Apple Store for years.
jacknews 9y ago
Except Apple themselves...
- pier25 9y ago
  Why does it benefit Apple? Imagine if you could only use Safari on macOS...
  - lern_too_spel 9y ago
    Don't give Apple ideas. The cat's already out of the bag, but if Apple could force people to obtain MacOS apps only from the Mac App Store, which does not have other rendering engines, they would. See also: Windows 10 S.
SXX 9y ago
Isn't that obvious? With iPhone being major mobile device they put enough pressure on web developers to support WebKit which benefits Safari not just on iOS, but on macOS as well. This also not just wins better support for Safari, but give Apple some foot in making of web standards. If they allow alternative engines on iOS they'll just slowly lose browser market share they still have which likely end up in death spiral for Safari support. It's extremely hard to compete with Google since even Firefox on Android is still extremely rare no matter how much effort Mozilla put into it.

firloop 9y ago

Apple's App Review guidelines used to say something along the lines of "If you have a problem, trashing us in the press never helps." I'm not trying to place judgment on Puffin, but this seems to be the wrong strategy. False negative App Store rejections are typically due to a misunderstanding than a nebulous "corporate greed" angle... or sometimes they were even (at least sort of) justified in the first place [0]. See also: when Rollout got rejected, their open letter [1] didn't help them either. [0]: https://9to5mac.com/2016/10/10/apple-dash-removal-from-app-store https://9to5mac.com/2016/10/10/apple-dash-removal-from-app-s... [1]: https://rollout.io/blog/open-letter-to-apple-secure-javascript-injection-ios/ https://rollout.io/blog/open-letter-to-apple-secure-javascri...

lern_too_spel 9y ago
From the Medium post: Puffin releases were rejected citing app review guideline 2.5.6: “Apps that browse the web must use the appropriate WebKit framework and WebKit Javascript.” Our server-side web browser is based on Chromium instead of Apple’s WebKit, therefore, Puffin is rejected. We disputed and escalated but Apple insisted it has jurisdiction over our server-side technology.
- eridius 9y ago
  Seems like a pretty clear violation of the rules. Trying to find a loophole doesn't work, the rules aren't an Ethereum smart contract, they're actually subject to human judgement.
  - im3w1l 9y ago
    I thought the stated reasoning for the rules was that Apple for safety reasons didn't want apps downloading and running code (javascript in this case). Clearly that justification doesn't apply if the code runs on a server and not the device.
- feverishaaron 9y ago
  Most likely insisted upon due to the obfuscation of user privacy

deleted 9y ago

[deleted]

debt 9y ago

Puffin circumvents Apple’s ability to block ads which other app developers provide at a premium on the App Store. It also circumvents all the parental controls provide by Safari. It’s a great idea but it Likely needs to incorporate the settings on the phone.

rgovostes 9y ago

This whole post is manipulative bullshit. > Apple, concerned about the rising competition, decided to sabotage Puffin in order to protect the billions of dollars of search revenue from Google. Settings → Safari → Search Engine → Yahoo/Bing/DuckDuckGo. There, look, no Google. The next sentence: > Puffin releases were rejected citing app review guideline 2.5.6: "Apps that browse the web must use the appropriate WebKit framework and WebKit Javascript." Setting aside whether that is a good rule or not, it has nothing whatsoever to do with the previous claim.

melloclello 9y ago
Quite sincerely, they should just look into running WebKit server-side. That said, in my experience if Apple has secretly decided they don't like you, they tend to move the goalposts on you in subsequent reviews, so migrating their systems to WebKit may not be time well spent.
- touringcomplete 9y ago
  Server-side??? Apple requires apps use the Apple WebKit framework only for web content, which runs only on the client-side. The point of Puffin is to run Flash and other desktop crapware websites that don’t work on Mobile Safari (Apple WebKit) properly. Puffin isn’t a native or local web browser; it’s an optimized, virtual, remote browser viewer. If they sell it as a “Citrix for the web,” they might have a shot.
  - melloclello 9y ago
    Ah, I didn't realise that was Puffin's use case.
  - scarface74 9y ago
    Opera Mini does the same thing as Puffin. Puffin wasn't denied access because it rendered on a server.
indubitable 9y ago
I think your first example is somewhat disingenuous. The vast majority of people will never change their default settings on the vast majority of things. The ability to change something does not contradict the view that a company is engaging in that behavior, and persisting it, for money. E.g. Mozilla/Firefox recently swapping to Google as their default browser would be the same thing, even if they know it's likely somewhat antithetical to many of their users - they will profit from those who are too lazy, or too ill informed, to change it.

vosper 9y ago

Full text from their Facebook post, so you don't have to go to FB "Many of you have asked why we haven’t updated our iOS app and we’re finally ready to share our story – Puffin is a victim of Apple's abuse. In 2010 we brought our cloud-based Puffin browser to iOS, allowing iPhone users to enjoy the wicked fast speed, frugal data usage, and extreme virus protection available through server-side rendering. But, Apple has now decided to reject our app, claiming it violates its guidelines. For seven years, Puffin has been approved with no mention of this violation. But now that Puffin has grown to almost 100 million active loyal users, such as yourself, Apple wants to sabotage Puffin in order to protect the billions of dollars of search revenue from it receives Google. It’s time to call out the #BadApple and if you agree, feel free to share your comments via the hashtag. For our full story, please visit us on Medium: http://bit.ly/2BsLqI2" http://bit.ly/2BsLqI2"

anilshanbhag 9y ago

The bigger problem with iOS is that its a complete lock-in. Even if users want the app, Puffin is unable to distribute its app to users since Apple doesn't approve it. This doesn't happen on Android, if you don't like Play Store, you can still distribute apk and ask the user to download & install. People may spin it any way they want but this is corporate greed !

QML 9y ago

This might seem like a random question, but does Webkit partition their browser into a kernel and a render engine like Chromium does?

ec109685 9y ago

Such an icky product, man in the middle’ing every page you visit.

Dim0N 9y ago

From their Facebook page: >Not seeing any documentation on https and puffin. If I log in using puffin, can your servers see my password? Their answer: >Yes. Puffin server will see your password even for HTTPS. The browser is physically running on the server. The closest analogy to Puffin is RDP (remote desktop). Am I reading this right? Who in their right mind would use this shit?

piva00 9y ago
This by itself is a good enough reason for Apple to reject the app on grounds of protecting customer privacy. Liking it or not, of the major tech companies Apple has had a track record of caring about its users' privacy. I remember Tim Cook mentioning that as a basic value for him personally.

scarface74 9y ago

Let's look at the statement on its merits. 1. If Apple was so concerned about protecting its search ad revenue from Google, why would it offer a method to install third party content blockers? 2. Puffin offers "extreme virus protection"? Apple banned "virus protection" programs in the App Store a year or two ago because they were all scams.