19 ms·

Since the article doesn't actually repeat what Apple has said, here's what Apple says: == Begin quote == The iOS system has traditionally provided support for

• sccxy 3y ago
  TLDR: We did not want to give other browsers too powerful apis to compete with Safari & App Store.
  • LeoPanthera 3y ago
    I think this is an extremely cynical interpretation.
    • akaij 3y ago
      I think any other interpretation is extremely naive.
      • rimunroe 3y ago
        Could you explain why?
        • fsflover 3y ago
          Because accidentally this move will make more money for Apple. (Follow the money.)
        • dylan604 3y ago
          naive people accept at face value PR speak. unwilling to look past that and look for other ulterior motives even less charitable ones would pretty much be textbook naivety to me.
          • rimunroe 3y ago
            I didn’t ask because I think someone should take a company’s word at face value. I asked because the thing this company said in this particular instance aligned with what I’d heard from other (independent) parties and I wanted to know why this person seemed so sure about that being wrong.
            • dylan604 3y ago
              Naive people also forget the best lies have some truth woven in.
        • akaij 3y ago
          I don't think believing why the most valuable company in the world with the highest and thickest walls around its garden, and a track record of not playing nice with others, is doing this, requires much explanation except that they want to kill the possibility of anyone bypassing the toll gate to the said garden.
  • rimunroe 3y ago
    From the (admittedly little) I know about how iOS handles security and the speed at which they responded this sounds like a pretty credible explanation to me. What makes you think it isn't?
    • foobarchu 3y ago
      Have to agree (disclaimer, haven't been an iPhone user since the 4). Suddenly allowing all browsers to have those kinds of native permissions, even with massive testing, sounds like a security nightmare. You're introducing an entire extra dimension for security holes, given how much trust people place in their phones. This doesn't sound at all the same as allowing other engines for use inside browsers, based on both apples defense and the take-downs on them.
      • trothamel 3y ago
        Browsers support PWAs on the desktop platforms without there being a security nightmare, and while I'm sure there are some permissions that could be a problem, things like the camera and microphone are managed on the desktop without issue. Is there some flaw in iOS that makes it harder to secure than the desktop?
        • sccxy 3y ago
          They know that giving too powerful apis to other browsers will kill their marketshare and competitors will build a better product in free environment.
        • popalchemist 3y ago
          iOS was never conceived of as something which would run arbitrary code that could access system-level data (the siloed data). So basically the situation exists by design, and in order to achieve security when enabling PWAs from other browser engines, they'd have to add another layer of security that currently doesn't exist (since they never had to trust anyone's code but their own). So... yes, there is apparently a lack of security there, but that's because the layer in question was never intended to be anything but proprietary until this ruling.
• sigmar 3y ago
  tbh, I thought the summary in techcrunch was much easier to read and concise. >Browsers also could install web apps on the system without a user’s awareness and consent. Couldn't this be entirely solved with an OS permission-like prompt "are you sure you want [progressive web app name] added to home screen?"
  • npunt 3y ago
    You don't want random processes firing off permissions prompts, you want them to remain meaningful to users on a platform else they'll get prompt fatigue. Think of all the prompts users see and just press 'ok' to.
    • sigmar 3y ago
      Heard. But we're going to entirely eliminate all PWAs because there might be an additional prompt added? Seems excessive/specious to me.
      • npunt 3y ago
        It's not one additional prompt, it's a class of prompts that could be exploited over and over again. A single site could trigger hundreds by sites popping up in the background each which trigger it, and then the user's home screen is full of fake PWAs with names like 'save money' 'in debt?' 'casino cash bucks' etc. Next you're developing mitigations, spam cleanup, etc. We've gone through this kind of thing before.
        • sigmar 3y ago
          The user would get rid of the app/browser that is doing this, no? The same way they would have to for any malicious app that persistently requests a special permission?
          • samatman 3y ago
            I'm guessing you've never had to clean up a relative's Windows machine. I wish I could say the same.
• crazygringo 3y ago
  Thanks for posting that. I'm no iOS expert but it actually sounds like a pretty reasonable explanation. It's at least good to hear Apple's side here, and more knowledgeable commenters here can weigh in as to whether it really does seem genuine.
  • candiodari 3y ago
    Sure it's reasonable ... because of course all these browsers don't have a security model and just allow web apps to do whatever they want. This is essentially saying no-one can build a secure browser.
    • MrDarcy 3y ago
      No, it’s saying they’re being forced to support at least one insecure browser which would affect the security of an obscure feature so they’re removing the feature.
    • bee_rider 3y ago
      Nobody can build a secure browser.
      • shuckles 3y ago
        Truer words have not been spoken! Maybe only second to nobody can build a secure baseband.
        • dividedbyzero 3y ago
          Security is well achievable, absolute security is not. Somehow almost everyone seems to grasp that intuitively, but a subset of IT keeps pretending they're the same thing.
    • nozzlegear 3y ago
      Nobody but Apple has experience building a secure browser. [1] [1] On iOS.
• secondcoming 3y ago
  > malicious web apps could read data from other web apps and recapture their permissions to gain access to a user’s camera, microphone or location without a user’s consent. How is this even possible? It's shocking that these APIs even exist for any browser to use.
  • zer00eyz 3y ago
    >> How is this even possible? It's shocking that these APIs even exist for any browser to use. https://www.theverge.com/24054329/microsoft-edge-automatic-chrome-import-data-feature https://www.theverge.com/24054329/microsoft-edge-automatic-c... Ask MS, they already did it.
    • cqqxo4zV46cp 3y ago
      iOS and Windows’ security models are not remotely comparable. I can’t imagine that you’d be making such intellectually lazy comparisons if it wasn’t in the context of some perceived holy war.
    • veeti 3y ago
      This is completely irrelevant to the discussion, there is no sandboxing on PC.
  • amelius 3y ago
    I didn't read the article, but to me it sounds like Safari's security mechanisms need more work.
    • MBCook 3y ago
      Safari is fine. Other browsers would have to be trusted, Apple doesn’t have a mechanism to ensure that they do what they’re supposed to. So until they have time to add one (remember they already had to create all the API‘s for third-party browsers to use), they’re not allowed to give Safari preferential treatment. So they had to remove the feature.
  • kemayo 3y ago
• zer00eyz 3y ago
  Without this type of isolation and enforcement, malicious... camera, microphone or location ... Browsers ... 30 some million lines of code in chromium browsers. Thats bigger than the linux kernel. The HN crowed might not LIKE apples response but they have a very defensible position. Edit: Its not like we haven't seen this play out on the desktop recently: https://www.theverge.com/24054329/microsoft-edge-automatic-chrome-import-data-feature https://www.theverge.com/24054329/microsoft-edge-automatic-c...
  • cma 3y ago
    But the plain browser already can request camera permissions, in a bad security situation a site that didn't request it still receives it from the browser's system level request. This is just Apple wanting to avoid people being able to develop a platform on top of their platform without paying a tax.
    • zitterbewegung 3y ago
      That’s not the point though because WebKit is already secured by Apple but if you have multiple blink related apps like Microsoft edge or brave or Firefox apple will have to audit those too and be on the hook if something breaks and then Apple will have to take the blame over a security oversight they aren’t responsible for.
      • spaceribs 3y ago
        That assumes that Apple would be blamed for Edge/Brave/Firefox's security oversight.
        • etchalon 3y ago
          They would absolutely be blamed by users for it.
          • pjerem 3y ago
            Like when it happens on MacOS ? Oh wait…
• jensensbutton 3y ago
  Seems like an OS problem. They should fix that.
  • lannisterstark 3y ago
    Or they could just not.
    • agust 3y ago
      They could develop APIs to support alternate browser engines but could not allow them to install sandboxed web apps on the system? Like all other OSes do, including macOS? How surprising.
      • kmbfjr 3y ago
        Are not some of the changes in the EU so that people won’t have to rely on Apple’s APIs?
      • bobbylarrybobby 3y ago
        The whole point is that doing so would privilege safari over other browsers, which is illegal.
    • luuurker 3y ago
      What's the benefit for you as a user to side with Apple on things like this?
      • moogly 3y ago
        A seat at Steve Jobs' table in the lunch cafeteria in he...aven?
      • vdaea 3y ago
        He's not necessarily siding with Apple. He's pointing out they don't have to do that.
• carlosrg 3y ago
  Didn't Apple made a comprehensive list of requirements for alternative web browsers and web browser engines so they are secure and don't compromise the user's security? (https://developer.apple.com/support/alternative-browser-engines/ https://developer.apple.com/support/alternative-browser-engi...) I'm a little confused. So that long list of requirements is useless for PWAs? Some people will actually believe this. I'm utterly disgusted by Apple and their arrogance regarding the DMA, and the way they've managed all of this. My perception of them has completely changed. However, they seem very obedient when China asks them to censor apps or, for example, limit AirDrop when there's a protest going on.
• agust 3y ago
  [flagged]
  • lambdas 3y ago
    That’s ridiculous. It’s the antithesis of RTFA; you have to read an argument for yourself else you’re just parroting the opinions of others.
• shmerl 3y ago
  > Addressing the complex security and privacy concerns associated with web apps using alternative browser engines would require building an entirely new integration architecture Translation from Apple talk to real talk: allowing competing browser engines will undermine our grip on the market through lock-in to the engine we fully control. We don't want to lose power. As control freaks, we'll do all we can to sabotage it.
  • cqqxo4zV46cp 3y ago
    [flagged]
• sgift 3y ago
  so, tldr: Apple tries to bullshit the EU again. EU commission - get them. They say themselves it would be possible to be compliant with the DMA without removing what is obviously competition they don't like. But they try to take the road which - just by chance, obviously, the security is the real reason - helps them to keep more people away from competition. I don't buy it.
• stephc_int13 3y ago
  The technical justification are bullshit. They simply could ask browser vendor to follow strict rules, that they can check themselves. This is not like they would have to verify dozens of browsers every day. Only a few per months, top.
  • jeremyjh 3y ago
    They are not saying it is impossible, only that they have not done it. How long do you think it will take to spin up such a review and certification program? How much will it cost, and how many sales will they lose because of the lack of this feature in the EU?
    • veeti 3y ago
      There will already be a review and certification program for third party browsers that want the required entitlements (https://developer.apple.com/support/alternative-browser-engines/ https://developer.apple.com/support/alternative-browser-engi...), so why don't you ask Apple?
      • jeremyjh 3y ago
        Because I read their statement, which makes it pretty clear that there are additional security considerations beyond what is needed for a browser application.
  • TheGlav 3y ago
    Browsers need to run javascript to be competitive browsers. It would be practically impossible to check even simple "strict rules".
  • deleted 3y ago
    [deleted]
• wnevets 3y ago
  [flagged]
  • LeoPanthera 3y ago
    It's unethical to spread misinformation. Please don't do that.
    • wnevets 3y ago
      What did you think Triangulation was about? Its literally a backdoor that requires a secret key to use. Claiming that it doesn't exist is misinformation
• benguild 3y ago
  The “low usage” comment is going to be more ammo against Apple unfortunately. The whole reason they are low usage on PWAs is because of a lack of investment from Apple and a lack of parity, yet for the longest time Apple has played both sides by saying PWAs are a viable alternative to the App Store, all while channeling people to App Store for actual app downloads and not providing similar marketing or anything for PWAs
  • andsoitis 3y ago
    welcome to tradeoffs and unintended consequences.
  • thimp 3y ago
    Are you sure this isn't a tech industry viewpoint? I don't know anyone who knows what the difference between an app and a PWA is. I don't think I've seen anyone outside of the tech industry with a PWA active. In context 99% of the users I meet don't even know what USB-C is.
    • tester89 3y ago
      The only PWA that I think gets any use on i(Pad)OS is that for the Financial Times.
      • dcow 3y ago
        It’s just iOS and macOS.
      • cal85 3y ago
        I thought that was gone but you’re right, app.ft.com still works and can be installed as a full screen PWA. But the main site, ft.com, isn’t a PWA (or at least, it doesn’t install as a full screen web app). I had assumed they had shut down the PWA, because I haven’t seen any promotion/mention of it for years (and I use ft.com a lot) so I don’t know how regular people would find out about it these days.
    • anakaine 3y ago
• glenjamin 3y ago
  Am I missing something? Couldn’t they allow you open PWAs in Safari, or fall back to opening a URL in another browser? Is there some part of the DMA which demands full feature parity?
  • graeme 3y ago
    >Is there some part of the DMA which demands full feature parity? Very likely the EU wouldn't like them prioritizing their own browser for a feature
  • deleted 3y ago
    [deleted]
• WWLink 3y ago
  Apple's argument was the iOS was a robustly secure platform AND the app store made it even more secure. The reality of the situation looks more like the app store was a bandaid over a maybe-not-as-robustly-secure-as-we-hoped platform.
• al_borland 3y ago
  It makes sense. This is one of the many reasons why I’m not in favor of the government demanding things of Apple, it’s not like people don’t have another platform to choose from. As the governments demand more and more, I predict we will see several monkey paw moments.
• vundercind 3y ago
  Oh wow. I'd assumed, in earlier discussions about this, that Apple'd just keep forcing Safari-only for PWA installation and use. Does the rule not allow that? If so... yeah, as a user deep in their ecosystem and once-developer for the platform, hard agree on this. Whatever their other motivations (and Apple are masters at arranging things so that their interests happen to coincide with legitimate concerns about UX) the user-facing issues expressed are worth worrying about.
• oddevan 3y ago
  Feels like the same kind of malicious compliance with the rest of their DMA changes: 1. WebKit has access to special OS-level APIs that allow it to install and power web apps. 2. The DMA requires support for alternative browser engines with the same abilities as WebKit. 3. It is reasonable to assume this requirement extends to PWAs. 4. By taking away WebKit's ability to power PWAs, all browser engines are now on a level playing field. _Could_ they have done it differently? Maybe, maybe not: software development always takes longer than you think, and throwing more engineers at a problem doesn't always make it go faster. Do I think they saw another chance to be petulant and took it? Yes. So yeah, I'm disappointed, but no more here than with the rest of Apple's DMA response.
• breather 3y ago
  This would be a lot easier to believe if they allowed you to stop apps from accessing the internet. As they don't, I simply don't buy any argument they make from a privacy or security perspective.
• Roark66 3y ago
  >low usage This is hilarious. As a developer, if PWAs work properly I'm much more interested in writing them, test them on ios and market them to ios users. If the feature is uncertain, or outright broken like now of course no sane, businesses sense driven dev will spend the time to build a PWA app specifically for iOS.
  • rahkiin 3y ago
    I have never used PWAs, so could you elaborate what you mean with ‘work properly’? What happens now that is not ideal?
    • willlma 3y ago
      Now that push notifications and long-term localstorage are disabled, a PWA can't compete. Not being able to send notifications to your user is a huge drawback for many types of apps, and limiting localstorage means that offline capabilities are limited, so PWAs will require increased access to a network as compared to native apps.
• kelnos 3y ago
  My hat's off to Apple PR on this one: they came up with some spin for why they were adding a malicious component to how they are complying with the DMA. They're likely not lying when they say that it's more difficult to maintain their security standards while at the same time allowing any browser engine to run PWAs. But this is a problem they absolutely could solve, and a company with Apple's size and skill absolutely has the resources to make this work. But they've chosen not to. Another option would be to actually engage with EU regulators on the issue, and see if they could carve out an exception -- temporary or otherwise -- to allow them to require PWAs to run under their existing WebKit-based framework, regardless of the default browser. But they've again chosen not to do that. PWA adoption is likely as low as Apple claims. I think they're toeing a line here: because Home Screen Apps are a bit of a niche feature, they can break it without pissing off too many users, but also give a subtle middle finger to the EU. "Poor Apple users, Apple just has to disable a feature some people like because of the evil, overreaching EU and its burdensome DMA!" This is a shame in that I personally think we all should be relying less on mostly-closed-source, proprietary apps for everything. While the web platform is a bit of a mess, it actually does (or could) offer the same functionality that native apps do, especially if Apple and Google had worked on that sort of thing over the past 15+ years rather than pushing native apps so hard. We'd be in a much better place if that were the case: consider the savings in time and money if every company out there could just write a single PWA and not have to build two completely separate apps for iOS and Android. (Yes, I know there'd be some extra people dedicated to fixing issues caused minor but significant-enough differences between the platforms, but it'd still be a ton less work than two apps for two different platforms.) Also consider how much easier it would be for other smartphone platforms to break into the space, if all existing apps (as PWAs in my imaginary smartphone-utopia) would run on their platforms without much work. A big reason I will likely never adopt an alternative smartphone platform is because none of the apps I rely on day-to-day exist on them. Even though I'd absolutely love to ditch Android, but don't consider iOS any more palatable. Anyway, that ship sailed a long time ago. I'm still bitter about it, though. Ultimately this won't matter much. The number of people using PWAs on iOS is probably a rounding error. Restrict that to only people in the EU and it's even smaller. But Apple still gets in a jab at the EU over this, and most affected users will likely side with Apple on this one.
  • 3y ago
• lukan 3y ago
  "EU users will be able to continue accessing websites directly from their Home Screen through a bookmark with minimal impact to their functionality. " Does this "minimal impact to their functionality" mean, the app will loose its local data after 7 days of not using the app, like it is for normal websites? That is a pretty heavy impact.
  • beeboobaa 3y ago
    It means apple is lying, again
• fennecbutt 3y ago
  >Without this type of isolation and enforcement, malicious web apps could read data from other web apps and recapture their permissions to gain access to a user’s camera, microphone or location without a user’s consent Sounds like Apple is saying webkit is insecure and to not use safari or iOS webviews because if they can't be trusted to run a PWA then they can't be trusted for anything ;3
• beeboobaa 3y ago
  What an absolute crock of shit. Someone at apple must be feeling really, really pathetic lately. Why can't they just get over themselves and actually deliver a useful product instead of trying to achieve cult status?
  • rmbyrro 3y ago
    I dislike how Apple is evolving as an evil corporate, but they seem to have a real security and privacy concern on this issue.
    • agust 3y ago
      Just like they had when asked to support alternative browser engines, but the DMA formally mandates it, sot they did comply and allowed them. All other OSes support web app installation from any browser, including macOS. This is a lot more secure than installing any native app. This is just Apple spreading FUD as an excuse to keep preventing web apps from competing with native apps.
    • fauigerzigerk 3y ago
      I completely understand that companies will defend their own business interests. But the extent to which Apple has been leaning on spurious security arguments in order to do that is really starting to damage their reputation and in fact the security of their platforms. Clearly, they're just making a point here, hurting developers and users just to spite a regulator. What they are signalling to me as a developer is that mobile devices are just not a reliable platform. Better do as much as possible on the server.
      • DeusExMachina 3y ago
        I usually do not like these moves from Apple. For example, I strongly dislike all the new guidelines they added to comply with the introduction of alternative payment systems. However, I'm on their side in this case. I run a business. If having a feature comply with some regulation meant implementing a whole infrastructure I don't have to serve a minority of customers, I would also abandon the feature.
• rmbyrro 3y ago
  That's very informative, thank you. The "community note" of HN.
• mo_42 3y ago
  I think the DMA is not the best legislation. Some parts don't require regulation whereas missing parts definitively require regulation. For example, I cannot publish my app in the app store. I don't need an alternative market. I'd like to have an anti-discrimination law for app publishers (side note, I'm not trying to publish a porn app, just a small productivity app for a limited audience). In a previous comment [1], I considered abandoning Apple. With this official statement, I'll actually switch to Android. I'll welcome the F-Droid store very much. Apple, I've been your customer since 2006. I started with the iPod. During this time I had a significant fraction of your lineup. I'm not affected by your changes but I'm using some PWAs. With this erratic behavior, I'm afraid you kill features that I'm using. [1] https://news.ycombinator.com/item?id=39299007#39299469 https://news.ycombinator.com/item?id=39299007#39299469
• szasamasa 3y ago
  dma here: https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32022R1925&from=EN https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELE... Apple cannot simply invoke DMA (50) as a free pass. For its arguments to align with the intent of the legislation, here's a roadmap of what they need to do to justify their security-based restrictions on iOS: Apple must be transparent about the exact security issues posed by alternative browser engines with concrete instances (not merely speculative risks). They need to prove that these are unique to iOS, given the successful use of unrestricted browser engines on macOS (and every other OS). Before opting for the extreme step of removing functionality, Apple needs to offer documentation of all the methods for managing and mitigating specific threats that were considered and subsequently ruled out as infeasible (sandboxing, enhanced APIs, etc.). This emphasizes that their actions are indeed the last resort and not merely a way to suppress competition. The company needs to demonstrate how they would proactively work with browser engine developers to establish strong security controls and threat monitoring on par with or exceeding their current practices for native-only experiences. This shifts the focus to building a safe environment rather than merely limiting the scope of capabilities. Apple must guarantee that if and when these security challenges are met, it will progressively expand support for unrestricted use of web standards for third-party browser engines. This creates the long-term perspective the DMA is designed to protect and gives confidence to developers investing in advanced web app solutions. Without taking action in these key areas, Apple's reliance on this DMA portion won't hold up to regulatory scrutiny. They cannot cite generic security dangers then fall back on "practicality" arguments without robust, evidence-backed reasoning.