5 ms·

Apple alleged web crippling: "not to be fixed by exec order"

32 points by mcantelon 16y ago

kilian 16y ago
I really, really need to get this fixed, we're in the middle of selling a web-based ipad app to a very large client, utilizing the local caching. This is a terrible bug for me :(
- jarin 16y ago
  One of the golden rules of iOS development is "work with what you've got". I'd get started on a workaround.
  - jrockway 16y ago
    One of the golden rules of developing for a proprietary platform is "work with what you've got". I'd get started on a workaround. Fixed that for you. Windows developers have the same problems.
    - mooism2 16y ago
      I upvoted you because I didn't think your comment deserved a subzero karma. But the snark was unnecessary.
    - DerekL 16y ago
      Don't open source operating systems have the same problem? It's legally and technically possible to fix or improve the system, but you may not have the skill or time. You also have to convince the maintainers to accept your patch and wait for your users to upgrade. No matter what system you write for, you have to work with what you've got. All open source lets you do is fork it and distribute your own version of the OS.
    - joebadmo 16y ago
      That's true enough, but there's a bigger distinction, isn't there? Maybe the better golden rule for developing for iOS is "work with what Apple will let you"? My point being Windows developers do not have exactly the same problems.
- deleted 16y ago
  [deleted]
- spoondan 16y ago
  Why do you need this fixed? Your app, even running in full screen, probably runs faster on iOS 4.3 than it did on any previous version of iOS.
  - jerome_bent 16y ago
    The OP said "local caching" not speed. I'm surprised the local caching hasn't gotten the media spotlight as that's been broken since 4.2.1. and is more important for web apps aiming to replace native apps.
- lukifer 16y ago
  It's sad that Apple has a disincentive against improving web-based dev tools. On my own project, I keep bumping up against unnecessary limitations on touch and focus events for form fields. For what it's worth, local caching should still work fine, either in Safari or UIWebView, so long as it doesn't involve natively executed ARM code.
- deleted 16y ago
  [deleted]
- some1else 16y ago
  Did you try and package fallback versions of files into a native app and load them with a UIWebView unless there's an internet connection? It's not perfect, but it could save your ass until they fix the bug. Afterwards, make sure you don't forget how much Apple cares about you if you're not in line with their objectives :-)
- some1else 16y ago
  Did you try and package fallback versions of files into a native app and load them with a UIWebView unless there's an internet connection? It's not perfect, but it could save your ass until they fix the bug. Afterwards, make sure you don't forget how much Apple cares about you if you're not in line with their objectives :-)
brudgers 16y ago
Apple takes steps to insure that proprietary App store is potentially more profitable than universal HTML 5. Film at eleven.
- saurik 16y ago
  HTML5 applications run from the browser, where they are most likely to be executed, are going to be fine. The fact that locally installed offline webclips don't have Nitro is frankly, honestly, an oversight. This really has nothing to do with native vs. HTML, it has to do with the browser vs. third party apps.
- rahoulb 16y ago
  That makes no sense ... apps that run in Mobile Safari get Nitro, native apps that use a browser component use the old JS engine. How is that boosting the App Store?
  - keltex 16y ago
    I'm not saying I agree that it's intentional, but I do agree that the result boosts the app store. It does so because you have to write the app for iOS rather than HTML5. If you wrote it for HTML 5 it would be lot less work to write a Android / Chrome / generic HTML 5 version.
    - rahoulb 16y ago
      I still dont understand. They've made JS in Safari faster than JS in native apps. If anything that would encourage people to dump the native app completely and write a pure web app.
      - brudgers 16y ago
        Monetizing a pure web app is a lot more difficult than monetizing an app-store app. It may be coincidence that HTML5 is a developer friendly way of creating a multiplatform mobile app and that Apple has kneecapped HTML5 offline apps via the architecture of iOS.
gte910h 16y ago
I'm guessing it's really hard to enable this for UIWebView without giving a billion more attack vectors for the jailbreakers.
- MrFoof 16y ago
  This seems to be exactly the case: http://daringfireball.net/2011/03/nitro_ios_43 http://daringfireball.net/2011/03/nitro_ios_43
- baddox 16y ago
  The only way to stop the jailbreakers is to not release the physical device. I suppose the jailbreakme.com website from iOS<=4.0.1 made jailbreaking extremely easy even for the non tech savvy, but even the "harder" jailbreaks are just programs that can easily be installed on Windows and they do everything for you.
  - gte910h 16y ago
    While you're most certainly right, Jailbreaks aren't hard as long as you don't accidentally update too soon, they're not plentiful enough that @comex et al can waste exploits yet with 0 day releases timed with Apple's releases. If they opened nitro access to non-mobile safari people, I'm guessing they would have tons. I honestly expect nitro access to open plenty of new avenues.
- DerekL 16y ago
  The security doesn't exist just to stop jailbreakers. It's to stop worms, rootkits, etc.
  - gte910h 16y ago
    Oh most certainly. However, I'm going to say there is at least one serious security flaw out and published every release (the currently used one by jail breakers) that can be used access usually. Generally speaking, you can just use that one for worms, rootkits, etc if the web is your attack vector (not all of them are that easy to exploit unaware, but many of them are).
Entlin 16y ago
I'm not believing that. It goes against all Apple said ("We've got 2 platforms, the App store and the web. The web is open and we support that"). This is all just hearsay. Where's the smoking gun? Where's the Exec email?
nkassis 16y ago
Mmmm. I'm no Apple fan but in this case I have to say this is paranoia. But we have to see if they fix it, at least for web applications saved to the home screen. Are those not just links opening up mobile safari? I don't buy the security argument. If it's available to web application can they not take advantage of security bugs in nitro? Oh and while there fixing stuff for web apps could they please get WebGL in a release real soon :) That would make my day.
jrockway 16y ago
> not to be fixed by exec order Not ever a problem I've had with Free Software. The walled garden is great until you realize that they are filling it with water and you don't know how to swim.
- jarin 16y ago
  Yeah, just replace that with "the code maintainers don't like your patch".
  - deleted 16y ago
    [deleted]
  - __david__ 16y ago
    But that's OK and their prerogative. They can't stop me from running my local patched version.
- dchest 16y ago
  Ha http://lwn.net/Articles/259196/ http://lwn.net/Articles/259196/
danilocampos 16y ago
This really has the stink of sensationalism, Ars. Xpost from another thread: I don't have any idea where the truth lies, here, but it's worth pulling the whole paragraph: But according to Matt Asay, who is vice president of business development for mobile Web framework maker Strobe, Apple supposedly has no plans to fix them. Instead, they are marked "not to be fixed by exec order," suggesting that a higher up at Apple is preventing engineers from fixing the problems. "Supposedly" and "suggested" let Ars weasel out of determining the truth of these assertions. Unless Apple has suddenly turned absurdly transparent, I have a hard time believing that this guy actually has any inside knowledge. On the other hand, he certainly has an incentive to bring pressure on Apple to make his business work better. Meanwhile, the author of Cydia, saurik, points out: Apple can't turn on the ability to do executable, dynamically written to memory pages just for their library: they'd have to turn it on for the entire process, at which point you could also do crazy things like download native code and execute it, bypassing the entire concept of their "codesign" mechanism. http://news.ycombinator.com/item?id=2338338 http://news.ycombinator.com/item?id=2338338 It's starting to sound less and less like Apple is doing anything shady here. Remember that RIM is having people disable JS entirely because of a WebKit exploit. This is a snarly problem.
- joebadmo 16y ago
  I'm not sure, but either way it seems to me an illustration of John Siracusa's "Apple Strategy Tax." http://news.ycombinator.com/item?id=2282066 http://news.ycombinator.com/item?id=2282066
heat_miser 16y ago
never attribute to malice that which can be explained by incompetence...
korch 16y ago
Apple's UIWebViews are the new IE. This whole issue can only get worse, since Apple has committed to a long bet against the web, because native apps can be controlled and they can snatch a 30% cut of the revenue. People don't pay for web apps. As the web converges on native apps, and as javascript libraries and performance nears that of native apps, what is Apple going to do? Of course they'll protect their app store cash-cow the same way Microsoft protected the Office suite by intentionally keeping IE several years behind other browsers. And this is only going to get worse. What happens when Apple doesn't enable WebGL in mobile Safari nor UIWebViews withing two or so years from now? After Chrome and even IE support it by default? After everyone is used to using WebGL apps in their browsers? Nope, you can't have that on a iDevice.
some1else 16y ago
WebSheet.app is obviously not doing anything MobileSafari.app isn't. I'd like to see this bug marked "not to be fixed by exec order" with my own eyes, after which I will disregard Objective C as easily as rounded-corners and transparent PNGs in IE6.
LilValleyBigEgo 16y ago
I've noticed a strange frequency with which Apple users use the word "cripple."
jarin 16y ago
Mark Pilgrim: "Wait, so the big conspiracy is that Apple made their browser faster? We should all have these problems." https://twitter.com/#!/diveintomark/status/48512225597591552 https://twitter.com/#!/diveintomark/status/48512225597591552

32 points by mcantelon 16y ago

I really, really need to get this fixed, we're in the middle of selling a web-based ipad app to a very large client, utilizing the local caching. This is a terrible bug for me :(

jarin 16y ago
One of the golden rules of iOS development is "work with what you've got". I'd get started on a workaround.
- jrockway 16y ago
  One of the golden rules of developing for a proprietary platform is "work with what you've got". I'd get started on a workaround. Fixed that for you. Windows developers have the same problems.
  - mooism2 16y ago
    I upvoted you because I didn't think your comment deserved a subzero karma. But the snark was unnecessary.
  - DerekL 16y ago
    Don't open source operating systems have the same problem? It's legally and technically possible to fix or improve the system, but you may not have the skill or time. You also have to convince the maintainers to accept your patch and wait for your users to upgrade. No matter what system you write for, you have to work with what you've got. All open source lets you do is fork it and distribute your own version of the OS.
  - joebadmo 16y ago
    That's true enough, but there's a bigger distinction, isn't there? Maybe the better golden rule for developing for iOS is "work with what Apple will let you"? My point being Windows developers do not have exactly the same problems.
deleted 16y ago
[deleted]
spoondan 16y ago
Why do you need this fixed? Your app, even running in full screen, probably runs faster on iOS 4.3 than it did on any previous version of iOS.
- jerome_bent 16y ago
  The OP said "local caching" not speed. I'm surprised the local caching hasn't gotten the media spotlight as that's been broken since 4.2.1. and is more important for web apps aiming to replace native apps.
lukifer 16y ago
It's sad that Apple has a disincentive against improving web-based dev tools. On my own project, I keep bumping up against unnecessary limitations on touch and focus events for form fields. For what it's worth, local caching should still work fine, either in Safari or UIWebView, so long as it doesn't involve natively executed ARM code.
deleted 16y ago
[deleted]
some1else 16y ago
Did you try and package fallback versions of files into a native app and load them with a UIWebView unless there's an internet connection? It's not perfect, but it could save your ass until they fix the bug. Afterwards, make sure you don't forget how much Apple cares about you if you're not in line with their objectives :-)
some1else 16y ago
Did you try and package fallback versions of files into a native app and load them with a UIWebView unless there's an internet connection? It's not perfect, but it could save your ass until they fix the bug. Afterwards, make sure you don't forget how much Apple cares about you if you're not in line with their objectives :-)

brudgers 16y ago

Apple takes steps to insure that proprietary App store is potentially more profitable than universal HTML 5. Film at eleven.

saurik 16y ago
HTML5 applications run from the browser, where they are most likely to be executed, are going to be fine. The fact that locally installed offline webclips don't have Nitro is frankly, honestly, an oversight. This really has nothing to do with native vs. HTML, it has to do with the browser vs. third party apps.
rahoulb 16y ago
That makes no sense ... apps that run in Mobile Safari get Nitro, native apps that use a browser component use the old JS engine. How is that boosting the App Store?
- keltex 16y ago
  I'm not saying I agree that it's intentional, but I do agree that the result boosts the app store. It does so because you have to write the app for iOS rather than HTML5. If you wrote it for HTML 5 it would be lot less work to write a Android / Chrome / generic HTML 5 version.
  - rahoulb 16y ago
    I still dont understand. They've made JS in Safari faster than JS in native apps. If anything that would encourage people to dump the native app completely and write a pure web app.
    - brudgers 16y ago
      Monetizing a pure web app is a lot more difficult than monetizing an app-store app. It may be coincidence that HTML5 is a developer friendly way of creating a multiplatform mobile app and that Apple has kneecapped HTML5 offline apps via the architecture of iOS.

gte910h 16y ago

I'm guessing it's really hard to enable this for UIWebView without giving a billion more attack vectors for the jailbreakers.

MrFoof 16y ago
This seems to be exactly the case: http://daringfireball.net/2011/03/nitro_ios_43 http://daringfireball.net/2011/03/nitro_ios_43
baddox 16y ago
The only way to stop the jailbreakers is to not release the physical device. I suppose the jailbreakme.com website from iOS<=4.0.1 made jailbreaking extremely easy even for the non tech savvy, but even the "harder" jailbreaks are just programs that can easily be installed on Windows and they do everything for you.
- gte910h 16y ago
  While you're most certainly right, Jailbreaks aren't hard as long as you don't accidentally update too soon, they're not plentiful enough that @comex et al can waste exploits yet with 0 day releases timed with Apple's releases. If they opened nitro access to non-mobile safari people, I'm guessing they would have tons. I honestly expect nitro access to open plenty of new avenues.
DerekL 16y ago
The security doesn't exist just to stop jailbreakers. It's to stop worms, rootkits, etc.
- gte910h 16y ago
  Oh most certainly. However, I'm going to say there is at least one serious security flaw out and published every release (the currently used one by jail breakers) that can be used access usually. Generally speaking, you can just use that one for worms, rootkits, etc if the web is your attack vector (not all of them are that easy to exploit unaware, but many of them are).

Entlin 16y ago

I'm not believing that. It goes against all Apple said ("We've got 2 platforms, the App store and the web. The web is open and we support that"). This is all just hearsay. Where's the smoking gun? Where's the Exec email?

nkassis 16y ago

Mmmm. I'm no Apple fan but in this case I have to say this is paranoia. But we have to see if they fix it, at least for web applications saved to the home screen. Are those not just links opening up mobile safari? I don't buy the security argument. If it's available to web application can they not take advantage of security bugs in nitro? Oh and while there fixing stuff for web apps could they please get WebGL in a release real soon :) That would make my day.

jrockway 16y ago

> not to be fixed by exec order Not ever a problem I've had with Free Software. The walled garden is great until you realize that they are filling it with water and you don't know how to swim.

jarin 16y ago
Yeah, just replace that with "the code maintainers don't like your patch".
- deleted 16y ago
  [deleted]
- __david__ 16y ago
  But that's OK and their prerogative. They can't stop me from running my local patched version.
dchest 16y ago
Ha http://lwn.net/Articles/259196/ http://lwn.net/Articles/259196/

danilocampos 16y ago

This really has the stink of sensationalism, Ars. Xpost from another thread: I don't have any idea where the truth lies, here, but it's worth pulling the whole paragraph: But according to Matt Asay, who is vice president of business development for mobile Web framework maker Strobe, Apple supposedly has no plans to fix them. Instead, they are marked "not to be fixed by exec order," suggesting that a higher up at Apple is preventing engineers from fixing the problems. "Supposedly" and "suggested" let Ars weasel out of determining the truth of these assertions. Unless Apple has suddenly turned absurdly transparent, I have a hard time believing that this guy actually has any inside knowledge. On the other hand, he certainly has an incentive to bring pressure on Apple to make his business work better. Meanwhile, the author of Cydia, saurik, points out: Apple can't turn on the ability to do executable, dynamically written to memory pages just for their library: they'd have to turn it on for the entire process, at which point you could also do crazy things like download native code and execute it, bypassing the entire concept of their "codesign" mechanism. http://news.ycombinator.com/item?id=2338338 http://news.ycombinator.com/item?id=2338338 It's starting to sound less and less like Apple is doing anything shady here. Remember that RIM is having people disable JS entirely because of a WebKit exploit. This is a snarly problem.

joebadmo 16y ago
I'm not sure, but either way it seems to me an illustration of John Siracusa's "Apple Strategy Tax." http://news.ycombinator.com/item?id=2282066 http://news.ycombinator.com/item?id=2282066

heat_miser 16y ago

never attribute to malice that which can be explained by incompetence...

korch 16y ago

Apple's UIWebViews are the new IE. This whole issue can only get worse, since Apple has committed to a long bet against the web, because native apps can be controlled and they can snatch a 30% cut of the revenue. People don't pay for web apps. As the web converges on native apps, and as javascript libraries and performance nears that of native apps, what is Apple going to do? Of course they'll protect their app store cash-cow the same way Microsoft protected the Office suite by intentionally keeping IE several years behind other browsers. And this is only going to get worse. What happens when Apple doesn't enable WebGL in mobile Safari nor UIWebViews withing two or so years from now? After Chrome and even IE support it by default? After everyone is used to using WebGL apps in their browsers? Nope, you can't have that on a iDevice.

some1else 16y ago

WebSheet.app is obviously not doing anything MobileSafari.app isn't. I'd like to see this bug marked "not to be fixed by exec order" with my own eyes, after which I will disregard Objective C as easily as rounded-corners and transparent PNGs in IE6.

LilValleyBigEgo 16y ago

I've noticed a strange frequency with which Apple users use the word "cripple."

jarin 16y ago

Mark Pilgrim: "Wait, so the big conspiracy is that Apple made their browser faster? We should all have these problems." https://twitter.com/#!/diveintomark/status/48512225597591552 https://twitter.com/#!/diveintomark/status/48512225597591552