8 ms·

Better title: Apple restricts tracking by limiting browser storage, which hurts my particular app. Browsers need to be severely limited due to them running arb

Better title: Apple restricts tracking by limiting browser storage, which hurts my particular app. Browsers need to be severely limited due to them running arbitrary code from the web. Doesn't matter if it's an offline web app. If you want more access, make a native app (with or without web technologies).

m-p-3 7y ago
> If you want more access which is somewhat ironic, because the goal of a web app is to break free of the walled garden and become OS-independant.
- akmarinov 7y ago
  No way that's happening on iOS as long as Apple takes 30% off the top
  - scarface74 7y ago
    Yes because think of all the money Apple gets from taking 30% all of the free apps that would be free web apps....
    - vbezhenar 7y ago
      There are very few free apps. Most of apps are paid with ads or external subscription. And Apple wants cut there as well.
      - scarface74 7y ago
        Apple doesn’t have an ad network outside of the little money it makes from ads on the App Store itself. Also, Apple may want a cut of the subscription revenue but most companies who have significant subscription revenue, don’t go through Apple’s subscriptions payments.
      - rstupek 7y ago
        Apple doesn't get a cut of ads within apps. A free app with ads doesn't make Apple any more then the $99/year for being a developer
    - NightlyDev 7y ago
      Yeah, cause everything in the browser is free, right? Clearly it's A LOT of money for apple. If they didn't care about the money then they would just allow it so everyone could avoid receiving payments using apple and giving them 30 %.
      - scarface74 7y ago
        That still doesn’t answer the question. How many websites were required to be apps because of limitations of Safari? What makes you think users would willy nilly put their credit card on every random website. Everyone can avoid using Apple for subscriptions. There are existence proofs of apps on the store that require payments outside of the store - like all digital content from Amazon. Most of the money that people spend on the App Store are from games and in app consumables. Especially since the major services like Netflix and Spotify don’t allow in app subscriptions.
    - the_gipsy 7y ago
      The 30% includes any kind of subscriptions or payment tied to the user account.
      - scarface74 7y ago
        Seeing that most major subscription services on the App Store are already forcing users to subscribe outside of the App Store, Apple isn’t getting a cut of subscriptions from the most popular service. How many apps require a subscription and cannot be a web app because of limitations of Safari? How many paid apps would be websites if it weren’t for limitations of Safari?
        the_gipsy 7y ago
        The moment you offer in-app payment, apple gets a cut. This goes as far as not allowing apps that link to payment outside of the appstore's payment system. There is a huge number of cordova apps out there. These are webapps inside a native wrapper, to access exactly those features that are crippled in safari. Reliable storage, push notifications, and not much more.
        scarface74 7y ago
        Yet dozens on companies have had successful businesses not doing in app purchases - like Amazon.
        the_gipsy 7y ago
        Yeah big players get an exception - not a good example.
        scarface74 7y ago
        ACloudGuru does not allow you to pay for subscriptions via in app purchases, Udemy allows both. A company can decide whether it is right for their business model to allow in app purchases exclusively or along side their own payment options. Hulu for instance allows in app purchases for the regular Hulu service but not Hulu Live
- FpUser 7y ago
  Which in a current situation is running a risk to fall into Google's walled garden. It is not there yet but Google's working hard on subverting the Internet.
fierarul 7y ago
But browsers are severely sandboxed already. What the article is talking about is: > deleting all local storage (including Indexed DB, etc.) after 7 days which I can see how it might help privacy (since you could be tracked via local storage too) but also how it might break any potential web app that might need data to last more than 7 days. > If you want more access, make a native app But then, everybody will complain about yet another Electron app, right? Not to mention that you have to fork over $99 and go through the signing / notarization hoops that change from one week to the other. I think in the name of privacy and security only Apple and some select few corporations will be allowed to make software in the future. macOS / iOS and Windows 10 are evolutionary dead ends in many ways.
- DagAgren 7y ago
  They do not "change from one week to another". They have changed, what, twice ever?
  - conroydave 7y ago
    and to be honest the process has gotten a lot easier.
  - fierarul 7y ago
    Two counterpoints: * AdoptOpenJDK releases that were notarized some months ago are no longer accepted by Apple since they made the rules even more stringent. I had releases accepted by Apple that are not accepted today using the same AdoptOpenJDK binaries. * Apple's notarization rules are not global. There's whitelists for given companies/institutions/apps/files which means the same dylib might not have to be notarized by a bigger player but will have to be codesigned by you. The above happened to me in the span of less than 3 months I think? Indeed, the scripts I use per se to do the notarization are about the same as originally.
    - saagarjha 7y ago
      Do you have more details about this?
codesections 7y ago
> Apple restricts tracking by limiting browser storage But the argument that this will protect privacy in the first place seems really weak. Before this change in Apple's policy, an app could store my config data on my PC. After this change, they'd need to have me log in and send the config data to their servers. That seems like I've lost privacy, not gained it.
- JumpCrisscross 7y ago
  > they'd need to have me log in and send the config data to their servers You'd have to log in. That's a hurdle that involves implicit consent.
  - shadowgovt 7y ago
    That's a hurdle that involves de-anonymization of the user.
    - dev_tty01 7y ago
      No, Apple offers anonymous user credential technology. Server gets unique identifier and ability to authenticate with no actual user info. Server gets an anonymous redirected email for sending info to the user. Apple is the intermediary. Of course, you can choose not to trust Apple, but Apple already has my info and their business model is not predicated on tracking and advertising. I'd rather continue to trust them than spread my data across more orgs, but that's my choice. You might choose differently.
      - matsemann 7y ago
        But that's a solution for a single OS, for a web page that should be cross platform by default. And it's not really a solution, just additional complexity to what was a solved problem.
      - shadowgovt 7y ago
        I choose differently, but my choice may matter to you if I throw up my hands and say "Too much effort; if the user visits my site in Safari, I'm just going to toss up a banner page that says "this site does not work in your browser." It's a power-play on Apple's part to intermediate themselves where their inter-mediation isn't necessary. And all kinds of customers (enterprise in particular) won't appreciate Apple getting a free "hi hello" signal on how much their company uses some service that leverages this scheme. Especially if Apple is a potential competitor to them.
manigandham 7y ago
Technically local data is more private than contacting a remote server to download it again. I don't see that being a controversial stance.
k__ 7y ago
I know this is ad hominem, but your comment just sounds like "I make big money with native apps and don't want web apps to catch up!"
vbezhenar 7y ago
> If you want more access, make a native app (with or without web technologies). Browsers usually ask for an additional permission in this case which would be a good approach. Your post sounds like "browsers need to be severely limited, so if you want to watch video, just launch VLC". It does not work this way.
zzzcpan 7y ago
> Browsers need to be severely limited due to them running arbitrary code from the web. Doesn't matter if it's an offline web app. If you want more access, make a native app (with or without web technologies). Native apps have the same problems too and such "severe" limiting of apps in web browsers still doesn't solve it. The only more or less privacy preserving model I can think of for native apps today is open source repositories with app distribution not controlled by app developers, like f-droid or repositories in various linux distros.
megous 7y ago
> If you want more access, make a native app (with or without web technologies). How's installing a native app better for a random user privacy or security wise, exactly?
- jrockway 7y ago
  You have to send every change to Apple before the user can run the code. In theory, that allows Apple to do more checks than when the code is dynamically loaded from your web server.
  - kingo55 7y ago
    I'm sure apple catch all privacy violations of their so developers.
  - hombre_fatal 7y ago
    Apple doesn't care if your app logs your usage to Google Analytics every 1000ms. Besides, in the browser you have trivial tools like uBlock and the network tab. In native apps, you have to use mitmproxy just to see what the app is doing at all.
- kingo55 7y ago
  With embedded SDKs and device identifiers that work similarly to third party cookies, they're not. I understand it's changing too, but not as fast as safari.
- IggleSniggle 7y ago
  It must go through the App Store vetting process, whereas a web app can come from anywhere.
Wowfunhappy 7y ago
And, um, any other app which saves local data locally.
TeMPOraL 7y ago
It's not "limiting browser storage", it's making browser storage expire. TFA's example is just some random app, but this essentially kills the entire concept of an offline-first web app, and severely hurts the browser as an application platform.
- fpoling 7y ago
  Web apps brings nothing in revenue to Apple.
untog 7y ago
Genuine question: what makes native ad frameworks different here? They execute with the same privilege of their containing app so surely they’re open to similar privacy concerns. Shouldn’t native apps have their storage cleared?
kkarakk 7y ago
OR maybe it's apple's responsibility to figure out how that usecase can exist without security flaws? As a customer, I'm tired of devices functionality being limited coz "security risks". Functionality that is arguably superior to native apps apart from the security risk.
greggman3 7y ago
Wouldn't making it first party only cover it? I don't see how this has anything to do with privacy/tracking. webpages can still leave long term cookies. The only way this is a privacy issues is if 3rd party iframes can use localstorage but just like 3rd party resources have their cookies blocked so to could localstorage. Otherwise this has absolutely nothing to do with privacy or tracking.
alerighi 7y ago
Making a native app is more complicated than making a webapp, especially if you want something cross platform. Browsers are now an universal virtual machine, what was the JVM years ago, and with webassembly we will se more and more things done in the browser. The real 'write once, run everywhere' are webapps, a webapp doesn't care if you are using Apple, Windows, Linux, BSD, whatever, if you have a compatible browser you use the app. Sure there is Electron (or React Native), to me it doesn't make sense, what is the point that every application needs to ship basically a browser? And still Electron apps need to be compiled and packaged for every platform, while with webapps you enter the URL in the browser and you are done with it. Doesn't adding APIs to browsers not only to use the local storage but also to access the filesystem of your device (of course asking the permission to the user) make more sense? Of course what really Apple fears is loosing the control of the apps that gets used on their device, now they control the App Store that is the only way to get apps on their devices (beside jailbreak), with webapps is different, since you can access them directly from the browser. And the thing that is absurd is that the first iPhone didn't have the App Store since Apple decided that the only way to get third party apps was trough the browser, now they are aiming for the opposite thing.
- badthingfactory 7y ago
  My company created a web client for our chat software product around 5 years ago. The quality of our product has slowly deteriorated as browser vendors continually remove or restrict features that once worked fine. Just to name two examples: autoplay audio for chat notifications and tab throttling killing websocket connections and background timers. I understand bad actors are abusing these things, but they're breaking totally legitimate use cases. We've been forced into an electron client and now urge our customers to ignore the web client. If we didn't have a small number of customers on Macs, we would abandon web tech altogether and build a native Windows client.
- andrekandre 7y ago
  > The real 'write once, run everywhere' are webapps, a webapp doesn't care if you are using Apple, Windows, Linux, BSD, whatever that’s not been my experience* * unless you use some huge web framework to abstract everything and patch all the differences between the browsers
the_gipsy 7y ago
> If you want more access, make a native app ...and give apple their cut. Why not add permissions to webapps? Like location, or push notification... oh that's another feature that happens to be missing only in safari. Just accepting these moves from apple as "in the interest of users" is naïve. Apple has a huge vesting in their appstore, and every webapp is a potential appstore-app that is some lost revenue. I mean, maybe apple is right, and the web should go back to a readonly document-like format, like in the old days. Articles and links. Apps for everything else. But let's not kid ourselves that they do it purely in the user's interest.
pier25 7y ago
> which hurts my particular app A big chunk of the web these days uses JWT and localStorage for auth.

m-p-3 7y ago

> If you want more access which is somewhat ironic, because the goal of a web app is to break free of the walled garden and become OS-independant.

akmarinov 7y ago
No way that's happening on iOS as long as Apple takes 30% off the top
- scarface74 7y ago
  Yes because think of all the money Apple gets from taking 30% all of the free apps that would be free web apps....
  - vbezhenar 7y ago
    There are very few free apps. Most of apps are paid with ads or external subscription. And Apple wants cut there as well.
    - scarface74 7y ago
      Apple doesn’t have an ad network outside of the little money it makes from ads on the App Store itself. Also, Apple may want a cut of the subscription revenue but most companies who have significant subscription revenue, don’t go through Apple’s subscriptions payments.
    - rstupek 7y ago
      Apple doesn't get a cut of ads within apps. A free app with ads doesn't make Apple any more then the $99/year for being a developer
  - NightlyDev 7y ago
    Yeah, cause everything in the browser is free, right? Clearly it's A LOT of money for apple. If they didn't care about the money then they would just allow it so everyone could avoid receiving payments using apple and giving them 30 %.
    - scarface74 7y ago
      That still doesn’t answer the question. How many websites were required to be apps because of limitations of Safari? What makes you think users would willy nilly put their credit card on every random website. Everyone can avoid using Apple for subscriptions. There are existence proofs of apps on the store that require payments outside of the store - like all digital content from Amazon. Most of the money that people spend on the App Store are from games and in app consumables. Especially since the major services like Netflix and Spotify don’t allow in app subscriptions.
  - the_gipsy 7y ago
    The 30% includes any kind of subscriptions or payment tied to the user account.
    - scarface74 7y ago
      Seeing that most major subscription services on the App Store are already forcing users to subscribe outside of the App Store, Apple isn’t getting a cut of subscriptions from the most popular service. How many apps require a subscription and cannot be a web app because of limitations of Safari? How many paid apps would be websites if it weren’t for limitations of Safari?
      - the_gipsy 7y ago
        The moment you offer in-app payment, apple gets a cut. This goes as far as not allowing apps that link to payment outside of the appstore's payment system. There is a huge number of cordova apps out there. These are webapps inside a native wrapper, to access exactly those features that are crippled in safari. Reliable storage, push notifications, and not much more.
        scarface74 7y ago
        Yet dozens on companies have had successful businesses not doing in app purchases - like Amazon.
        the_gipsy 7y ago
        Yeah big players get an exception - not a good example.
        scarface74 7y ago
        ACloudGuru does not allow you to pay for subscriptions via in app purchases, Udemy allows both. A company can decide whether it is right for their business model to allow in app purchases exclusively or along side their own payment options. Hulu for instance allows in app purchases for the regular Hulu service but not Hulu Live
FpUser 7y ago
Which in a current situation is running a risk to fall into Google's walled garden. It is not there yet but Google's working hard on subverting the Internet.

fierarul 7y ago

But browsers are severely sandboxed already. What the article is talking about is: > deleting all local storage (including Indexed DB, etc.) after 7 days which I can see how it might help privacy (since you could be tracked via local storage too) but also how it might break any potential web app that might need data to last more than 7 days. > If you want more access, make a native app But then, everybody will complain about yet another Electron app, right? Not to mention that you have to fork over $99 and go through the signing / notarization hoops that change from one week to the other. I think in the name of privacy and security only Apple and some select few corporations will be allowed to make software in the future. macOS / iOS and Windows 10 are evolutionary dead ends in many ways.

DagAgren 7y ago
They do not "change from one week to another". They have changed, what, twice ever?
- conroydave 7y ago
  and to be honest the process has gotten a lot easier.
- fierarul 7y ago
  Two counterpoints: * AdoptOpenJDK releases that were notarized some months ago are no longer accepted by Apple since they made the rules even more stringent. I had releases accepted by Apple that are not accepted today using the same AdoptOpenJDK binaries. * Apple's notarization rules are not global. There's whitelists for given companies/institutions/apps/files which means the same dylib might not have to be notarized by a bigger player but will have to be codesigned by you. The above happened to me in the span of less than 3 months I think? Indeed, the scripts I use per se to do the notarization are about the same as originally.
  - saagarjha 7y ago
    Do you have more details about this?

codesections 7y ago

> Apple restricts tracking by limiting browser storage But the argument that this will protect privacy in the first place seems really weak. Before this change in Apple's policy, an app could store my config data on my PC. After this change, they'd need to have me log in and send the config data to their servers. That seems like I've lost privacy, not gained it.

JumpCrisscross 7y ago
> they'd need to have me log in and send the config data to their servers You'd have to log in. That's a hurdle that involves implicit consent.
- shadowgovt 7y ago
  That's a hurdle that involves de-anonymization of the user.
  - dev_tty01 7y ago
    No, Apple offers anonymous user credential technology. Server gets unique identifier and ability to authenticate with no actual user info. Server gets an anonymous redirected email for sending info to the user. Apple is the intermediary. Of course, you can choose not to trust Apple, but Apple already has my info and their business model is not predicated on tracking and advertising. I'd rather continue to trust them than spread my data across more orgs, but that's my choice. You might choose differently.
    - matsemann 7y ago
      But that's a solution for a single OS, for a web page that should be cross platform by default. And it's not really a solution, just additional complexity to what was a solved problem.
    - shadowgovt 7y ago
      I choose differently, but my choice may matter to you if I throw up my hands and say "Too much effort; if the user visits my site in Safari, I'm just going to toss up a banner page that says "this site does not work in your browser." It's a power-play on Apple's part to intermediate themselves where their inter-mediation isn't necessary. And all kinds of customers (enterprise in particular) won't appreciate Apple getting a free "hi hello" signal on how much their company uses some service that leverages this scheme. Especially if Apple is a potential competitor to them.

manigandham 7y ago

Technically local data is more private than contacting a remote server to download it again. I don't see that being a controversial stance.

k__ 7y ago

I know this is ad hominem, but your comment just sounds like "I make big money with native apps and don't want web apps to catch up!"

vbezhenar 7y ago

> If you want more access, make a native app (with or without web technologies). Browsers usually ask for an additional permission in this case which would be a good approach. Your post sounds like "browsers need to be severely limited, so if you want to watch video, just launch VLC". It does not work this way.

zzzcpan 7y ago

> Browsers need to be severely limited due to them running arbitrary code from the web. Doesn't matter if it's an offline web app. If you want more access, make a native app (with or without web technologies). Native apps have the same problems too and such "severe" limiting of apps in web browsers still doesn't solve it. The only more or less privacy preserving model I can think of for native apps today is open source repositories with app distribution not controlled by app developers, like f-droid or repositories in various linux distros.

megous 7y ago

> If you want more access, make a native app (with or without web technologies). How's installing a native app better for a random user privacy or security wise, exactly?

jrockway 7y ago
You have to send every change to Apple before the user can run the code. In theory, that allows Apple to do more checks than when the code is dynamically loaded from your web server.
- kingo55 7y ago
  I'm sure apple catch all privacy violations of their so developers.
- hombre_fatal 7y ago
  Apple doesn't care if your app logs your usage to Google Analytics every 1000ms. Besides, in the browser you have trivial tools like uBlock and the network tab. In native apps, you have to use mitmproxy just to see what the app is doing at all.
kingo55 7y ago
With embedded SDKs and device identifiers that work similarly to third party cookies, they're not. I understand it's changing too, but not as fast as safari.
IggleSniggle 7y ago
It must go through the App Store vetting process, whereas a web app can come from anywhere.

Wowfunhappy 7y ago

And, um, any other app which saves local data locally.

TeMPOraL 7y ago

It's not "limiting browser storage", it's making browser storage expire. TFA's example is just some random app, but this essentially kills the entire concept of an offline-first web app, and severely hurts the browser as an application platform.

fpoling 7y ago
Web apps brings nothing in revenue to Apple.

untog 7y ago

Genuine question: what makes native ad frameworks different here? They execute with the same privilege of their containing app so surely they’re open to similar privacy concerns. Shouldn’t native apps have their storage cleared?

kkarakk 7y ago

OR maybe it's apple's responsibility to figure out how that usecase can exist without security flaws? As a customer, I'm tired of devices functionality being limited coz "security risks". Functionality that is arguably superior to native apps apart from the security risk.

greggman3 7y ago

Wouldn't making it first party only cover it? I don't see how this has anything to do with privacy/tracking. webpages can still leave long term cookies. The only way this is a privacy issues is if 3rd party iframes can use localstorage but just like 3rd party resources have their cookies blocked so to could localstorage. Otherwise this has absolutely nothing to do with privacy or tracking.

alerighi 7y ago

Making a native app is more complicated than making a webapp, especially if you want something cross platform. Browsers are now an universal virtual machine, what was the JVM years ago, and with webassembly we will se more and more things done in the browser. The real 'write once, run everywhere' are webapps, a webapp doesn't care if you are using Apple, Windows, Linux, BSD, whatever, if you have a compatible browser you use the app. Sure there is Electron (or React Native), to me it doesn't make sense, what is the point that every application needs to ship basically a browser? And still Electron apps need to be compiled and packaged for every platform, while with webapps you enter the URL in the browser and you are done with it. Doesn't adding APIs to browsers not only to use the local storage but also to access the filesystem of your device (of course asking the permission to the user) make more sense? Of course what really Apple fears is loosing the control of the apps that gets used on their device, now they control the App Store that is the only way to get apps on their devices (beside jailbreak), with webapps is different, since you can access them directly from the browser. And the thing that is absurd is that the first iPhone didn't have the App Store since Apple decided that the only way to get third party apps was trough the browser, now they are aiming for the opposite thing.

badthingfactory 7y ago
My company created a web client for our chat software product around 5 years ago. The quality of our product has slowly deteriorated as browser vendors continually remove or restrict features that once worked fine. Just to name two examples: autoplay audio for chat notifications and tab throttling killing websocket connections and background timers. I understand bad actors are abusing these things, but they're breaking totally legitimate use cases. We've been forced into an electron client and now urge our customers to ignore the web client. If we didn't have a small number of customers on Macs, we would abandon web tech altogether and build a native Windows client.
andrekandre 7y ago
> The real 'write once, run everywhere' are webapps, a webapp doesn't care if you are using Apple, Windows, Linux, BSD, whatever that’s not been my experience* * unless you use some huge web framework to abstract everything and patch all the differences between the browsers

the_gipsy 7y ago

> If you want more access, make a native app ...and give apple their cut. Why not add permissions to webapps? Like location, or push notification... oh that's another feature that happens to be missing only in safari. Just accepting these moves from apple as "in the interest of users" is naïve. Apple has a huge vesting in their appstore, and every webapp is a potential appstore-app that is some lost revenue. I mean, maybe apple is right, and the web should go back to a readonly document-like format, like in the old days. Articles and links. Apps for everything else. But let's not kid ourselves that they do it purely in the user's interest.

pier25 7y ago

> which hurts my particular app A big chunk of the web these days uses JWT and localStorage for auth.