5 ms·

The reasoning here from Apple seems reasonable to me to be honest - they’ve gone into a surprising level of technical detail, quite interesting. I suspect many

The reasoning here from Apple seems reasonable to me to be honest - they’ve gone into a surprising level of technical detail, quite interesting. I suspect many in this thread are commenting without actually reading their argument.

lxgr 3y ago
The reasoning can at the same time be technically correct ("we would have needed to allow Firefox and other browsers to provide homescreen PWAs as well in our read of the DMA, and that would have been somewhat annoying") and highly motivated by business interests ("oh, I guess you'll have to develop native apps now and pay us a CTF for them").
- threeseed 3y ago
  > and that would have been somewhat annoying Allowing PWA to access the camera/microphone without system prompts and install other apps on the device is a little more than just annoying.
  - MrStonedOne 3y ago
    than disable that specific functionality until you can make the framework instead of throwing out the whole thing in a tempter tantrum?
    - threeseed 3y ago
      On iOS you can't disable functionality in that way. Objective-C allows dynamic dispatch to private API methods which would be just fine to do on third party app stores. As I mentioned above the issue is likely related to engines being able to cache the system prompts approvals across multiple PWAs effectively bypassing them.
      - lxgr 3y ago
        The third-party browser could just have its own prompt until Apple delivers their API, no? On macOS, I already have to both grant Firefox permission to access camera, and then Firefox asks me about every website trying to access it individually, using their own UI.
        threeseed 3y ago
        So you want to hand over control of who has access to the camera, microphone, photos, contacts to random browsers. Or to companies like Google and Meta for advertising purposes.
        lxgr 3y ago
        Did you read my comment? You still need to grant the permission to the browser in the first place. This isn't any different from how it works already for all kinds of apps: If you grant Zoom the permission to access your camera, you do that once, and have to trust it on a per-call basis to not turn on your camera without your explicit consent. If you don't trust your third-party browser to respect your choice as to which websites you want to grant access to your sensitive data, you probably shouldn't be using it, or at least not grant it access to that data in turn.
        threeseed 3y ago
        Websites today don't have access to my contacts, messages, photos etc. And you may be happy changing the status quo to allow that but I think it is a terrifying proposition.
        lxgr 3y ago
        How would websites get access to your contacts? Just don't grant access to your contacts to your browser, whatever it is, problem solved! The same applies to photos. iOS even has an API to let you pick a single photo to upload/share with an app that doesn't grant any access beyond that. And for messages there isn't even an API in the iOS sandbox. Maybe you could clarify your concern; as far as I understand it, nothing whatsoever is changing on iOS due to the DMA in this regard (and I wouldn't want it to).
  - lxgr 3y ago
    They can always remove that capability from WebKit PWAs in the EU if they really can't come up with something better.
jwagenet 3y ago
People want to do whatever they please on iPhone, but also expect Apple to create all the appropriate interfaces to accommodate them basically for free.
- FirmwareBurner 3y ago
  >basically for free iPhone costs ~$1000, with the highest profit margins on hardware plus AppStore out of any phone maker = for free lol. Is this astroturfing HN loves to provide Apple for free? Apple fans will go out of their way to white knightly defend a trillion dollar company who can easily afford do implement any regulatory challenge, gaslighting you for having the audacity to hold Apple accountable to a high standards, as if they're some broke 3 person start-up scraping behind the couch cushions for money, when Apple is absolutely minted with the GDP of an entire country.
  - nickthegreek 3y ago
    [flagged]
    - FirmwareBurner 3y ago
      Ever heard of averages? The iPhone 15 starts ar MSRP 950 Euros in the EU or close to 1000 USD. And the Pro base model starts at 1200 Euros and the Pro Max base model starts at 1440 Euros, 20% and 40% more than my Original estimation. There's also the cheaper models you can buy. What's your point with this? Or do you just enjoy taking things super literally and spinning them into strawmen?
      - nickthegreek 3y ago
        Make whatever excuses you want for posting misinformation. I am simply stating that your facts are wrong. I didnt build the strawman, you did when you used the cost of the iphone for the basis of your post and that cost was inaccurate.
        3y ago
adrr 3y ago
Its not honest. PWA has the same functionality as standard web app. You still need to grant permissions like Microphone Access, Camera access. Only difference is that a PWA has a manifest which defines appearance, splash screens, localization. Here's the starbucks PWA which is one the most popular PWAs. https://app.starbucks.com/ https://app.starbucks.com/
- _factor 3y ago
  Try comparing that pwa to the native app and you'll soon find that most navigation ends up with quasi browser bars that obstruct the UI and slow the experience down. Apple surely does this on purpose to prevent PWAs from being useful. Can't let any App store competition arise.
- threeseed 3y ago
  > You still need to grant permissions like Microphone Access, Camera access "including isolation of storage and enforcement of system prompts to access privacy impacting capabilities on a per-site basis" One scenario is that today there is one instance of WebKit owned by the Home Screen process shared amongst all of the PWA apps which is enforcing that prompt. With third party engines that prompt would appear for the first app invocation but not any subsequent ones. This is only an issue with PWA since for normal apps the browser process is per-app rather than shared. Now they could rewrite the Home Screen execution environment to support one engine per app but their argument is that it's not worth their effort.
  - adrr 3y ago
    You run the apps in the context of the default browser app. The same way Mac OS does PWAs.
MichaelMug 3y ago
Could they not have created a API browser vendors could implement, and the user can select in the settings app which implementation they want to use for running PWA's? With the default implementation being whatever the user selected for their default browser? For example Apple has `UIWebView` and `JavaScriptCore`. They could have abstracted the implementation so PWA's run in like a `UIHomeScreenWebAppView` which requires a protocol `IWebView` and `IJavaScriptEngine`. Implementations could delegate OS integration tasks back to the operating system. For example notifications. The technical approach and legwork is already done with React Native. I can appreciate that Apple has put in a lot of thought into this but it seems like they are not following the spirit of the DMA laws. And I can understand why.
- kayodelycaon 3y ago
  The issue is isolating each PWA from each other and giving permissions per site, for example, camera. Right now, a single instance of Safari is the only thing enforcing that. If you swapped Safari out for Chrome, that isolation is gone. If one PWA has camera access at the OS level, all of them have it.
veeti 3y ago
Yet somehow Android and Chrome with the same sandboxed security model manages to do it just fine. Makes you wonder.
ijhuygft776 3y ago
native apps are potentially much less secure... why don't they also remove them?

lxgr 3y ago

The reasoning can at the same time be technically correct ("we would have needed to allow Firefox and other browsers to provide homescreen PWAs as well in our read of the DMA, and that would have been somewhat annoying") and highly motivated by business interests ("oh, I guess you'll have to develop native apps now and pay us a CTF for them").

threeseed 3y ago
> and that would have been somewhat annoying Allowing PWA to access the camera/microphone without system prompts and install other apps on the device is a little more than just annoying.
- MrStonedOne 3y ago
  than disable that specific functionality until you can make the framework instead of throwing out the whole thing in a tempter tantrum?
  - threeseed 3y ago
    On iOS you can't disable functionality in that way. Objective-C allows dynamic dispatch to private API methods which would be just fine to do on third party app stores. As I mentioned above the issue is likely related to engines being able to cache the system prompts approvals across multiple PWAs effectively bypassing them.
    - lxgr 3y ago
      The third-party browser could just have its own prompt until Apple delivers their API, no? On macOS, I already have to both grant Firefox permission to access camera, and then Firefox asks me about every website trying to access it individually, using their own UI.
      - threeseed 3y ago
        So you want to hand over control of who has access to the camera, microphone, photos, contacts to random browsers. Or to companies like Google and Meta for advertising purposes.
        lxgr 3y ago
        Did you read my comment? You still need to grant the permission to the browser in the first place. This isn't any different from how it works already for all kinds of apps: If you grant Zoom the permission to access your camera, you do that once, and have to trust it on a per-call basis to not turn on your camera without your explicit consent. If you don't trust your third-party browser to respect your choice as to which websites you want to grant access to your sensitive data, you probably shouldn't be using it, or at least not grant it access to that data in turn.
        threeseed 3y ago
        Websites today don't have access to my contacts, messages, photos etc. And you may be happy changing the status quo to allow that but I think it is a terrifying proposition.
        lxgr 3y ago
        How would websites get access to your contacts? Just don't grant access to your contacts to your browser, whatever it is, problem solved! The same applies to photos. iOS even has an API to let you pick a single photo to upload/share with an app that doesn't grant any access beyond that. And for messages there isn't even an API in the iOS sandbox. Maybe you could clarify your concern; as far as I understand it, nothing whatsoever is changing on iOS due to the DMA in this regard (and I wouldn't want it to).
- lxgr 3y ago
  They can always remove that capability from WebKit PWAs in the EU if they really can't come up with something better.

jwagenet 3y ago

People want to do whatever they please on iPhone, but also expect Apple to create all the appropriate interfaces to accommodate them basically for free.

FirmwareBurner 3y ago
>basically for free iPhone costs ~$1000, with the highest profit margins on hardware plus AppStore out of any phone maker = for free lol. Is this astroturfing HN loves to provide Apple for free? Apple fans will go out of their way to white knightly defend a trillion dollar company who can easily afford do implement any regulatory challenge, gaslighting you for having the audacity to hold Apple accountable to a high standards, as if they're some broke 3 person start-up scraping behind the couch cushions for money, when Apple is absolutely minted with the GDP of an entire country.
- nickthegreek 3y ago
  [flagged]
  - FirmwareBurner 3y ago
    Ever heard of averages? The iPhone 15 starts ar MSRP 950 Euros in the EU or close to 1000 USD. And the Pro base model starts at 1200 Euros and the Pro Max base model starts at 1440 Euros, 20% and 40% more than my Original estimation. There's also the cheaper models you can buy. What's your point with this? Or do you just enjoy taking things super literally and spinning them into strawmen?
    - nickthegreek 3y ago
      Make whatever excuses you want for posting misinformation. I am simply stating that your facts are wrong. I didnt build the strawman, you did when you used the cost of the iphone for the basis of your post and that cost was inaccurate.
      - 3y ago

adrr 3y ago

Its not honest. PWA has the same functionality as standard web app. You still need to grant permissions like Microphone Access, Camera access. Only difference is that a PWA has a manifest which defines appearance, splash screens, localization. Here's the starbucks PWA which is one the most popular PWAs. https://app.starbucks.com/ https://app.starbucks.com/

_factor 3y ago
Try comparing that pwa to the native app and you'll soon find that most navigation ends up with quasi browser bars that obstruct the UI and slow the experience down. Apple surely does this on purpose to prevent PWAs from being useful. Can't let any App store competition arise.
threeseed 3y ago
> You still need to grant permissions like Microphone Access, Camera access "including isolation of storage and enforcement of system prompts to access privacy impacting capabilities on a per-site basis" One scenario is that today there is one instance of WebKit owned by the Home Screen process shared amongst all of the PWA apps which is enforcing that prompt. With third party engines that prompt would appear for the first app invocation but not any subsequent ones. This is only an issue with PWA since for normal apps the browser process is per-app rather than shared. Now they could rewrite the Home Screen execution environment to support one engine per app but their argument is that it's not worth their effort.
- adrr 3y ago
  You run the apps in the context of the default browser app. The same way Mac OS does PWAs.

MichaelMug 3y ago

Could they not have created a API browser vendors could implement, and the user can select in the settings app which implementation they want to use for running PWA's? With the default implementation being whatever the user selected for their default browser? For example Apple has `UIWebView` and `JavaScriptCore`. They could have abstracted the implementation so PWA's run in like a `UIHomeScreenWebAppView` which requires a protocol `IWebView` and `IJavaScriptEngine`. Implementations could delegate OS integration tasks back to the operating system. For example notifications. The technical approach and legwork is already done with React Native. I can appreciate that Apple has put in a lot of thought into this but it seems like they are not following the spirit of the DMA laws. And I can understand why.

kayodelycaon 3y ago
The issue is isolating each PWA from each other and giving permissions per site, for example, camera. Right now, a single instance of Safari is the only thing enforcing that. If you swapped Safari out for Chrome, that isolation is gone. If one PWA has camera access at the OS level, all of them have it.

veeti 3y ago

Yet somehow Android and Chrome with the same sandboxed security model manages to do it just fine. Makes you wonder.

ijhuygft776 3y ago

native apps are potentially much less secure... why don't they also remove them?