5 ms·

i don't understand why apple allows in-app browsers.

by joshu 4y ago

nkozyra 4y ago
You mean custom ones, right? WebViews are incredibly useful, but it definitely seems like implementing your own browser gives people a false sense of security, like they've been sandboxed when they haven't. What would be nice here is a permission requirement if you're injecting code into a browser view.
- joshu 4y ago
  webviews for clicking arbitrary links in apps like instagram or gmail are absurdly restrictive. i lose my context, cookies, and regular tools (bookmarks are gone, sharing often overridden, etc)
  - jhgg 4y ago
    This is why https://developer.apple.com/documentation/safariservices/sfsafariviewcontroller https://developer.apple.com/documentation/safariservices/sfs... exists and why the blog post advocates for using it.
    - wonderbore 4y ago
      That was a great update, but still not a true browser. No tabs, no bookmarks. Why should the website be restricted to one tab? Just open Safari and be done with it.
      - thirdsun 4y ago
        If you want a true browser there's always the option to move the current page from the in-app Safari View to the full browser. In many cases I'd like to stay within the app. Those in-app Safari Webviews allows that. And if it is a website I'd like to browse in my usual, more permanent browsing evironment I always have th eoption to do so. This two step approach is more useful to me than always opening links in the browser.
      - joshu 4y ago
        exactly
  - fleddr 4y ago
    They're supposed to be restrictive as to not confuse the user. An in-app browser isn't there to give you a full browsing experience, it's there to do a quick web-only task that somehow cannot be done in the native app itself.
- replygirl 4y ago
  since years ago apple added the little back button to return you to your previous app, even webview is dead weight. apple should only allow one, in some special context, that's so counterintuitive to implement that only frameworks e.g. react native can justify the effort
  - dylan604 4y ago
    And yet, we're normally seeing Apple === BAD because they limit everything to just the one Apple thing. Am I actually seeing requests for Apple to limit willingly?
    - bitwize 4y ago
      Most of Hackernews doesn't understand why Apple is the #1 tech company in the world -- they're still in the "no wireless, less space than a Nomad, lame" mindset.
    - replygirl 4y ago
      in 2015 i got an iphone for a job, then i made it my daily driver because i liked the restrictions. now my phones last four years instead of one
      - dylan604 4y ago
        How is the walled garden allowing a phone to last for four years? Where you getting new phones because you polluted your non-walled garden device with so many bad apps that you chose to get a new device? Not really following your point, but maybe I am?
        replygirl 4y ago
        i was getting new phones mostly because my devices were getting bogged down by android updates and capabilities. the os allowed developers to do more and more things, and offered more and more customization, faster than the pace of hardware improvements supported, to the point i'd have to get a new phone if i wanted something both up-to-date and fast. if i kept a phone longer much longer than a year, i'd have to worry about software updates as well, OR replace the OS and deal with instability. and i'm not talking about bad phones here — htc one s, nexus 4, nexus 5, nexus 5x. admittedly, degradation of shitty NAND is still a factor in higher-end android phones, so it's not all about the android ecosystem being a free-for-all an iphone xr will still run everything fine, including the latest version of ios. hundreds of dollars saved and a whole set of problems avoided over the life of the phone. i only replace my phones when they're smashed to bits now anecdote: someone in my family just had to replace their android phone because a software update caused the radio to stop working for calls. so the ecosystem issue is not just a userland thing
atwood22 4y ago
At the very least webviews should treat contents as a subframe and respect the frame option headers.
oconnor663 4y ago
Last I heard (years ago), iOS forced everyone to use Safari for webviews, which lots of people also complained about. Did that change? Or is the Safari webview the subject of this story?
- darknoon 4y ago
  Safari webview (WebKit) is what it's describing
  - pantulis 4y ago
    The key aspect here is that Instagram's app is using a Safari Webview but somehow it is injecting its own tracking pixel on the HTML body wether the target website had it or not. Which honestly does not surprise me, what surprises me is that Apple allows this. I think there was a time where certain Javascript capabilities were present in Safari but not in Safari Webview and there was certain outrage. Perhaps a solution would be to run the webview through Safaris content blocker engine?
    - saagarjha 4y ago
      To what? Disable the ability to inject JavaScript into the web view?
      - pantulis 4y ago
        Yes. Is there a legitimate use case for injecting arbitrary Javascript by the native app? (Honest question)
        rawling 4y ago
        Apps that use html for their UI and JS hooks to trigger touch ID, access the keychain etc.
        pantulis 4y ago
navanchauhan 4y ago
Do you want to cripple the entire app industry? Apps built using React Nativ / Flutter e.t.c use the WebView to render themselves. So they’re basically already running “in-app browsers” But then how do you differentiate when the app is rendering its own view rather than another website? You could apply some restrictions like <iFrame> has nowadays where you need extra security privileges (I think) to render pages / execute scripts not on the same domain Otherwise you can always open safari from all of these in-app browser views and they could implement a toggle which forces all of them to be opened in Safari automatically
- supermatt 4y ago
  Thats not how react native or flutter work at all. They use native views, not a browser. You are likely thinking of cordova (phonegap) et al.
  - navanchauhan 4y ago
    oh damn! I just went and looked into depth and indeed my knowledge was wrong. Well, TIL Honestly it is pretty fascinating how these cross-platform frameworks work.
- rullelito 4y ago
  It's a big difference between browsing your own pages in-app, and opening any link in an in-app browser and tracking it.
  - navanchauhan 4y ago
    I am not defending the practice. Maybe, Apple can addd it in their app store policy
- joshu 4y ago
  it’s a bad experience for opening external links. i don’t care that it’s not easy to get to. and no, not all apps do this. tiktok does not offer an escape, and instagram hides it behind two clicks.

i don't understand why apple allows in-app browsers.

by joshu 4y ago

i don't understand why apple allows in-app browsers.

You mean custom ones, right? WebViews are incredibly useful, but it definitely seems like implementing your own browser gives people a false sense of security, like they've been sandboxed when they haven't. What would be nice here is a permission requirement if you're injecting code into a browser view.

joshu 4y ago
webviews for clicking arbitrary links in apps like instagram or gmail are absurdly restrictive. i lose my context, cookies, and regular tools (bookmarks are gone, sharing often overridden, etc)
- jhgg 4y ago
  This is why https://developer.apple.com/documentation/safariservices/sfsafariviewcontroller https://developer.apple.com/documentation/safariservices/sfs... exists and why the blog post advocates for using it.
  - wonderbore 4y ago
    That was a great update, but still not a true browser. No tabs, no bookmarks. Why should the website be restricted to one tab? Just open Safari and be done with it.
    - thirdsun 4y ago
      If you want a true browser there's always the option to move the current page from the in-app Safari View to the full browser. In many cases I'd like to stay within the app. Those in-app Safari Webviews allows that. And if it is a website I'd like to browse in my usual, more permanent browsing evironment I always have th eoption to do so. This two step approach is more useful to me than always opening links in the browser.
    - joshu 4y ago
      exactly
- fleddr 4y ago
  They're supposed to be restrictive as to not confuse the user. An in-app browser isn't there to give you a full browsing experience, it's there to do a quick web-only task that somehow cannot be done in the native app itself.
replygirl 4y ago
since years ago apple added the little back button to return you to your previous app, even webview is dead weight. apple should only allow one, in some special context, that's so counterintuitive to implement that only frameworks e.g. react native can justify the effort
- dylan604 4y ago
  And yet, we're normally seeing Apple === BAD because they limit everything to just the one Apple thing. Am I actually seeing requests for Apple to limit willingly?
  - bitwize 4y ago
    Most of Hackernews doesn't understand why Apple is the #1 tech company in the world -- they're still in the "no wireless, less space than a Nomad, lame" mindset.
  - replygirl 4y ago
    in 2015 i got an iphone for a job, then i made it my daily driver because i liked the restrictions. now my phones last four years instead of one
    - dylan604 4y ago
      How is the walled garden allowing a phone to last for four years? Where you getting new phones because you polluted your non-walled garden device with so many bad apps that you chose to get a new device? Not really following your point, but maybe I am?
      - replygirl 4y ago
        i was getting new phones mostly because my devices were getting bogged down by android updates and capabilities. the os allowed developers to do more and more things, and offered more and more customization, faster than the pace of hardware improvements supported, to the point i'd have to get a new phone if i wanted something both up-to-date and fast. if i kept a phone longer much longer than a year, i'd have to worry about software updates as well, OR replace the OS and deal with instability. and i'm not talking about bad phones here — htc one s, nexus 4, nexus 5, nexus 5x. admittedly, degradation of shitty NAND is still a factor in higher-end android phones, so it's not all about the android ecosystem being a free-for-all an iphone xr will still run everything fine, including the latest version of ios. hundreds of dollars saved and a whole set of problems avoided over the life of the phone. i only replace my phones when they're smashed to bits now anecdote: someone in my family just had to replace their android phone because a software update caused the radio to stop working for calls. so the ecosystem issue is not just a userland thing

atwood22 4y ago

At the very least webviews should treat contents as a subframe and respect the frame option headers.

oconnor663 4y ago

Last I heard (years ago), iOS forced everyone to use Safari for webviews, which lots of people also complained about. Did that change? Or is the Safari webview the subject of this story?

darknoon 4y ago
Safari webview (WebKit) is what it's describing
- pantulis 4y ago
  The key aspect here is that Instagram's app is using a Safari Webview but somehow it is injecting its own tracking pixel on the HTML body wether the target website had it or not. Which honestly does not surprise me, what surprises me is that Apple allows this. I think there was a time where certain Javascript capabilities were present in Safari but not in Safari Webview and there was certain outrage. Perhaps a solution would be to run the webview through Safaris content blocker engine?
  - saagarjha 4y ago
    To what? Disable the ability to inject JavaScript into the web view?
    - pantulis 4y ago
      Yes. Is there a legitimate use case for injecting arbitrary Javascript by the native app? (Honest question)
      - rawling 4y ago
        Apps that use html for their UI and JS hooks to trigger touch ID, access the keychain etc.
        pantulis 4y ago

navanchauhan 4y ago

Do you want to cripple the entire app industry? Apps built using React Nativ / Flutter e.t.c use the WebView to render themselves. So they’re basically already running “in-app browsers” But then how do you differentiate when the app is rendering its own view rather than another website? You could apply some restrictions like <iFrame> has nowadays where you need extra security privileges (I think) to render pages / execute scripts not on the same domain Otherwise you can always open safari from all of these in-app browser views and they could implement a toggle which forces all of them to be opened in Safari automatically

supermatt 4y ago
Thats not how react native or flutter work at all. They use native views, not a browser. You are likely thinking of cordova (phonegap) et al.
- navanchauhan 4y ago
  oh damn! I just went and looked into depth and indeed my knowledge was wrong. Well, TIL Honestly it is pretty fascinating how these cross-platform frameworks work.
rullelito 4y ago
It's a big difference between browsing your own pages in-app, and opening any link in an in-app browser and tracking it.
- navanchauhan 4y ago
  I am not defending the practice. Maybe, Apple can addd it in their app store policy
joshu 4y ago
it’s a bad experience for opening external links. i don’t care that it’s not easy to get to. and no, not all apps do this. tiktok does not offer an escape, and instagram hides it behind two clicks.