10 ms·

I’ve heard so many people complain on HN about Safari’s lack of support for APIs. Before now, we didn’t have a public justification why Apple refused to impleme

I’ve heard so many people complain on HN about Safari’s lack of support for APIs. Before now, we didn’t have a public justification why Apple refused to implement them. Now we know. The price of a Safari user in the ad market is going down, and it’s exactly what should be happening. I’m very happy with Apple. https://9to5mac.com/2019/12/09/apple-safari-privacy-feature-ads/ https://9to5mac.com/2019/12/09/apple-safari-privacy-feature-...

Sayrus 6y ago
Safari already implements API that leaks enough information to uniquely fingerprint a device. For instance, the Audio API. You can test it using OpenWPM [1][2] and you will get the same ID in both normal and incognito mode. And this is only one of many things not blocked by default. ETAG tracking is pretty popular on pixels. I'm not saying they aren't right, I'm just saying that they are somehow doing more PR than anything else. And as other comments are calling out, this makes it even harder to compete on IOS using PWA (How is a website asking for permission different from an app? Can't we have a permission framework just like apps?). [1] https://audiofingerprint.openwpm.com/ https://audiofingerprint.openwpm.com/ [2] https://github.com/mozilla/OpenWPM https://github.com/mozilla/OpenWPM
- reaperducer 6y ago
  Safari already implements API that leaks enough information to uniquely fingerprint a device. What's your point? Because one API can be used for something, Apple should let Safari be a free-for-all?
needAnAltHN 6y ago
"privacy" the new excuse for monopolistic practices. Apple users hate to hear they believe the marketing, but it doesn't get more clear cut than twisting these things to be positive.
fastball 6y ago
Except "privacy" as a justification is BS. You can implement these APIs while at the same time requiring explicit permission from the user before a web application can use them. This preserves privacy while also giving users the option to have much more powerful web applications. Apple doesn't want to implement these APIs because currently if you want access to these things on iOS, you need to go through their walled garden App Store, where they get a big chunk of any revenue you might make on such a service and can nerf competitors and all the other anti-competitive stuff they're doing.
- user5994461 6y ago
  I don't want random web sites I open (and their ads) to ask permission to scan bluetooth in my area and use usb devices connected to my computer. A website has no business doing any of that. There is no justification for these API to exist.
  - fastball 6y ago
    I disagree. I want that. Therefore a website does have business asking for those things.
    - fennecfoxen 6y ago
      You're wrong. Therefore the developers' effort should not be wasted, and certainly not while exposing their users to privacy risks, exploits, and such other dangers as will inevitably arise when placing the capabilities to perform sensitive operations in software which also deals with untrusted input from the Internet.
      - Sayrus 6y ago
        This is definitely going to be downvoted. Isn't App store apps (Not reserved to Apple's one, this also works for Google, Microsoft and many others) untrusted code too? It runs with even more privileges than your browser's code and have access to more fingerprinting information if that's what it is going to do. As far as I see it, a PWA with these permissions has less privacy risks than a native application I can find on a store. I'd really like to understand how installing an app is not an issue but having the access from the browser is. Is it simply the permission framework that is broken and you don't trust it to not leak information when the API is disabled?
johncolanduoni 6y ago
They didn’t mention the biggest one that people (including me) complain about, which is the push notification API. That’s intellectually honest of them (it inherently requires explicit permission before activating for a particular origin), but pointing to these far less likely to be used APIs is not making a good case for neutering PWAs on privacy grounds.
whoopdedo 6y ago
There's an unintended consequence in this, though. Which is that if you don't use an ad blocker you'll see the lowest cost, and thus lowest quality of ads. So in addition to keeping a private presence you're required to use an ad blocker. And services which have built their business around being ad-supported will see you as a deadbeat. Which motivates them to be more aggressive in upselling you, or denying service if you don't whitelist their ads.
- Wowfunhappy 6y ago
  > Which is that if you don't use an ad blocker you'll see the lowest cost, and thus lowest quality of ads. Is this a thing? Do people in demographics which are less appealing to advertisers also see more intrusive ads?
  - philistine 6y ago
    To me, intrusive ads mean ads which intrude on my privacy. So if you use Safari, no, you will not see more intrusive ads, quite the contrary. Those ads might be terrible chum bucket stuff, but they would not be intruding into your privacy.
- reaperducer 6y ago
  Which is that if you don't use an ad blocker you'll see the lowest cost, and thus lowest quality of ads I haven't worked with web ads in a while, but from what I remember when I did, people with little data on file with the advertising networks got more ads, and better ads, because there was no record of them having seen the high-paying ads already. The longer you surfed, and the longer you were tracked, the lower quality the ads became. Again, I haven't been in this arena for a while, but that was true at the time, as told to me by the president of one of the larger non-FAANG advertising networks, over coffee. But it's all a red herring anyway, isn't it? Are there any people out there saying, "I wish there was a way to give Google more information about me so that I can see better quality ads!"
afrcnc 6y ago
Firefox doesn't support them either. Most of these are implemented on Chromium, for Google's ChromeOS primarily. They're kinda useless for web browsers, but people see them in Chromium and believe they must be there for a reason other than ChromeOS. Apple and Firefox are doing it right. These things don't have a place in browsers.
the_gipsy 6y ago
Native apps are much, much more privacy-invasive. Apple forces you to use those. You have no choice, like on other platforms.
- Karupan 6y ago
  I agree, with a caveat - Apple can and does remove apps which are caught stealing data permanently. The App Store and Apple's policies act as a safeguard for users. As far as I know, there is no reliable way to do that for web apps.
  - the_gipsy 6y ago
    Don't fool yourself, Apple will never remove killer apps, only small insignificant apps. Instagram for example "steals" way too much data than necessary, yet apple does not remove them. TikTok just got caught for some stuff - still there. So they might catch some rogue apps, but far from reliable or trustworthy. They protect their platform image, nothing more. With webapps at least I can take some measures like ad and tracking blocking myself. I don't have to give access to the system unless some case really warrants it.
manquer 6y ago
Outside this list Safari's support is limited or nor for many other APIs. MediaRecorder and many WebRTC APIs have no clear roadmap for support. Many APIs including getUserMedia and all of WebRTC are not supported in WkWebView (only way Firefox/Chrome works on iOS due to Apple policy blocking them from building their own browser) Means some apps will only work in iOS-Safari and not in iOS-Chrome/Firefox. None of this has to do with privacy, being able to record media locally without sending to STUN/TURN server increases privacy not reduce it.

Sayrus 6y ago

Safari already implements API that leaks enough information to uniquely fingerprint a device. For instance, the Audio API. You can test it using OpenWPM [1][2] and you will get the same ID in both normal and incognito mode. And this is only one of many things not blocked by default. ETAG tracking is pretty popular on pixels. I'm not saying they aren't right, I'm just saying that they are somehow doing more PR than anything else. And as other comments are calling out, this makes it even harder to compete on IOS using PWA (How is a website asking for permission different from an app? Can't we have a permission framework just like apps?). [1] https://audiofingerprint.openwpm.com/ https://audiofingerprint.openwpm.com/ [2] https://github.com/mozilla/OpenWPM https://github.com/mozilla/OpenWPM

reaperducer 6y ago
Safari already implements API that leaks enough information to uniquely fingerprint a device. What's your point? Because one API can be used for something, Apple should let Safari be a free-for-all?

needAnAltHN 6y ago

"privacy" the new excuse for monopolistic practices. Apple users hate to hear they believe the marketing, but it doesn't get more clear cut than twisting these things to be positive.

fastball 6y ago

Except "privacy" as a justification is BS. You can implement these APIs while at the same time requiring explicit permission from the user before a web application can use them. This preserves privacy while also giving users the option to have much more powerful web applications. Apple doesn't want to implement these APIs because currently if you want access to these things on iOS, you need to go through their walled garden App Store, where they get a big chunk of any revenue you might make on such a service and can nerf competitors and all the other anti-competitive stuff they're doing.

user5994461 6y ago
I don't want random web sites I open (and their ads) to ask permission to scan bluetooth in my area and use usb devices connected to my computer. A website has no business doing any of that. There is no justification for these API to exist.
- fastball 6y ago
  I disagree. I want that. Therefore a website does have business asking for those things.
  - fennecfoxen 6y ago
    You're wrong. Therefore the developers' effort should not be wasted, and certainly not while exposing their users to privacy risks, exploits, and such other dangers as will inevitably arise when placing the capabilities to perform sensitive operations in software which also deals with untrusted input from the Internet.
    - Sayrus 6y ago
      This is definitely going to be downvoted. Isn't App store apps (Not reserved to Apple's one, this also works for Google, Microsoft and many others) untrusted code too? It runs with even more privileges than your browser's code and have access to more fingerprinting information if that's what it is going to do. As far as I see it, a PWA with these permissions has less privacy risks than a native application I can find on a store. I'd really like to understand how installing an app is not an issue but having the access from the browser is. Is it simply the permission framework that is broken and you don't trust it to not leak information when the API is disabled?

johncolanduoni 6y ago

They didn’t mention the biggest one that people (including me) complain about, which is the push notification API. That’s intellectually honest of them (it inherently requires explicit permission before activating for a particular origin), but pointing to these far less likely to be used APIs is not making a good case for neutering PWAs on privacy grounds.

whoopdedo 6y ago

There's an unintended consequence in this, though. Which is that if you don't use an ad blocker you'll see the lowest cost, and thus lowest quality of ads. So in addition to keeping a private presence you're required to use an ad blocker. And services which have built their business around being ad-supported will see you as a deadbeat. Which motivates them to be more aggressive in upselling you, or denying service if you don't whitelist their ads.

Wowfunhappy 6y ago
> Which is that if you don't use an ad blocker you'll see the lowest cost, and thus lowest quality of ads. Is this a thing? Do people in demographics which are less appealing to advertisers also see more intrusive ads?
- philistine 6y ago
  To me, intrusive ads mean ads which intrude on my privacy. So if you use Safari, no, you will not see more intrusive ads, quite the contrary. Those ads might be terrible chum bucket stuff, but they would not be intruding into your privacy.
reaperducer 6y ago
Which is that if you don't use an ad blocker you'll see the lowest cost, and thus lowest quality of ads I haven't worked with web ads in a while, but from what I remember when I did, people with little data on file with the advertising networks got more ads, and better ads, because there was no record of them having seen the high-paying ads already. The longer you surfed, and the longer you were tracked, the lower quality the ads became. Again, I haven't been in this arena for a while, but that was true at the time, as told to me by the president of one of the larger non-FAANG advertising networks, over coffee. But it's all a red herring anyway, isn't it? Are there any people out there saying, "I wish there was a way to give Google more information about me so that I can see better quality ads!"

afrcnc 6y ago

Firefox doesn't support them either. Most of these are implemented on Chromium, for Google's ChromeOS primarily. They're kinda useless for web browsers, but people see them in Chromium and believe they must be there for a reason other than ChromeOS. Apple and Firefox are doing it right. These things don't have a place in browsers.

the_gipsy 6y ago

Native apps are much, much more privacy-invasive. Apple forces you to use those. You have no choice, like on other platforms.

Karupan 6y ago
I agree, with a caveat - Apple can and does remove apps which are caught stealing data permanently. The App Store and Apple's policies act as a safeguard for users. As far as I know, there is no reliable way to do that for web apps.
- the_gipsy 6y ago
  Don't fool yourself, Apple will never remove killer apps, only small insignificant apps. Instagram for example "steals" way too much data than necessary, yet apple does not remove them. TikTok just got caught for some stuff - still there. So they might catch some rogue apps, but far from reliable or trustworthy. They protect their platform image, nothing more. With webapps at least I can take some measures like ad and tracking blocking myself. I don't have to give access to the system unless some case really warrants it.

manquer 6y ago

Outside this list Safari's support is limited or nor for many other APIs. MediaRecorder and many WebRTC APIs have no clear roadmap for support. Many APIs including getUserMedia and all of WebRTC are not supported in WkWebView (only way Firefox/Chrome works on iOS due to Apple policy blocking them from building their own browser) Means some apps will only work in iOS-Safari and not in iOS-Chrome/Firefox. None of this has to do with privacy, being able to record media locally without sending to STUN/TURN server increases privacy not reduce it.