5 ms·

I’m going to be level with you: there is nothing so great about PWAs that they’re worth mandating or protecting by law in any jurisdiction and the EU doesn’t ow

by SllX 3y ago

I’m going to be level with you: there is nothing so great about PWAs that they’re worth mandating or protecting by law in any jurisdiction and the EU doesn’t owe it to you to try. Web developers like them. That’s it, and their PWA advocacy completely disregards what a privacy and security nightmare they can be without proper safeguards, because this little device I carry around in my pocket is 1) always with me and 2) stores a lot of information about me 3) has a full sensory array installed within it. Every new feature browsers add for better hardware access gets immediately disabled on any system I manage: cameras, mics, USB access, sensors, location, notifications, local storage, the whole works because the alternative is letting every website access those or getting spammed with access requests on every site I visit and the more crap that is added, the longer it takes me every time I setup a new browser install from scratch. Why disable them at all? Because 99% of these new features are primarily used to build a better supercookie to track and profile people without their consent. The actual marketable reasons are a secondary use at best. So if it’s not on Apple’s priority list to build out whatever they need to support and allow other browsers to support PWAs in a secure and privacy conscious manner, good for them. Web developers who want to circumvent Apple’s fees entirely don’t need to be anywhere near their top priority and can wait. For Apple: users come before developers, and App developers before web developers.

deminature 3y ago
I'm not a fan of PWAs either, but disabling them instead of allowing them to continue to run is an incredibly bad faith response to the DMA.
- SllX 3y ago
  Not if the alternative is allowing other browsers to install them without a privacy and security architecture in place first. Even if Apple thinks it’s worth doing, that takes time, and web developers aren’t worth prioritizing for them when they have a lot of other ground to cover building out a new system of APIs and entitlements to comply with the DMA’s other requirements.
  - deminature 3y ago
    The user is warned already on the App Store that installing apps from third-parties comes with certain risks via 'scare screens'. There's no reason they can't do the same for PWAs.
    - SllX 3y ago
      They probably will if they ever re-enable it in the EU, but they also built out over 600 new APIs and an accompanying system of entitlements to go with that scare sheet such that even if it’s “riskier”, they’re not just throwing up their hands and saying “alright devs, we scared them a little, so now go do whatever the hell you want”. EDIT: I should also add that of those 600, that includes APIs Apple built out specifically for third-party browsers.
      - deminature 3y ago
        I think PWA developers are going to be pretty unsympathetic to 'your PWA is going be available again in the EU at some unspecified time in the future, when some Apple product manager decides to prioritize it for a given year's roadmap and it's all in the interests of protecting users from unspecified privacy and security threats that nobody seems to be able to define'. Most importantly, the EU may feel the same way.
        SllX 3y ago
        Well to correct you, my position is more “Apple might re-enable this” more than “will”, which from their perspective I’m guessing is even worse and they will be more unsympathetic to it. Personally I think Apple will, but I have enough doubts that I don’t want to make that claim. > Most importantly, the EU may feel the same way. That’s the rub. The EU has been arbitrarily writing new laws which mostly target foreign tech companies that don’t quite read “show me your bellies so we can pick out the choice cuts” but they’re pretty close. So the EU might do a lot of things, but if there’s an argument against them doing that, it’s what I said in my first comment above: it’s not worth any jurisdiction’s time to do so. That includes the EU. You might need to support some technologies to get government contracts, but nobody ever mandated you had to support POSIX or J2ME or whatever to sell a computer or phone to regular people. That would be asinine, and a PWA mandate would also be asinine.
WirelessGigabit 3y ago
There is little difference on iOS between a PWA and a website which has a WebKit view and hosts a website. The only reason PWAs were interesting on iOS was to get an app on iOS, while feeling relatively native, without paying Apple.
- SllX 3y ago
  Apple can make security guarantees about their own rendering engine that they can’t for any other rendering engine. It’s not about what PWAs are like in Safari, it’s about what they’re like in third-party browsers that have to by law be allowed to do whatever Safari can do with their own fully enabled rendering engines.
  - ambigious7777 3y ago
    Apple could just say something like, "This app comes from a 3rd party browser engine, and it may not be secure. Are you sure you want to install this app?". Not too much effort, but still keeping the functionality.
    - SllX 3y ago
      I mentioned this in another comment but they built out over 600 APIs and a system of accompanying entitlements to comply with the DMA, they’re clearly not at this point just for PWAs going to throw up their hands and a scare sheet and say “good enough for government work, devs: do what you want now”. EU iPhone customers are still iPhone customers. The security and privacy considerations don’t go away just because a new law was passed.
      - ambigious7777 3y ago
        Obviously, those considerations must be considered. However, as I said, adding a simple confirmation prompt would be plenty enough. I think what is happening here, is that Apple is going like, "I don't get my market control, you don't get your shiny new features." Other phone platforms allow you to do things, that may be unsafe or insecure, but still plenty useful. Also, running a PWA really isn't that unsecure/unprivate as visiting a website. They both can access and ask for the same information or permissions. Really not that different. By your logic that PWAs are unsecure, then should iOS not support rendering webpages due to "security concerns"?

by SllX 3y ago

deminature 3y ago

I'm not a fan of PWAs either, but disabling them instead of allowing them to continue to run is an incredibly bad faith response to the DMA.

SllX 3y ago
Not if the alternative is allowing other browsers to install them without a privacy and security architecture in place first. Even if Apple thinks it’s worth doing, that takes time, and web developers aren’t worth prioritizing for them when they have a lot of other ground to cover building out a new system of APIs and entitlements to comply with the DMA’s other requirements.
- deminature 3y ago
  The user is warned already on the App Store that installing apps from third-parties comes with certain risks via 'scare screens'. There's no reason they can't do the same for PWAs.
  - SllX 3y ago
    They probably will if they ever re-enable it in the EU, but they also built out over 600 new APIs and an accompanying system of entitlements to go with that scare sheet such that even if it’s “riskier”, they’re not just throwing up their hands and saying “alright devs, we scared them a little, so now go do whatever the hell you want”. EDIT: I should also add that of those 600, that includes APIs Apple built out specifically for third-party browsers.
    - deminature 3y ago
      I think PWA developers are going to be pretty unsympathetic to 'your PWA is going be available again in the EU at some unspecified time in the future, when some Apple product manager decides to prioritize it for a given year's roadmap and it's all in the interests of protecting users from unspecified privacy and security threats that nobody seems to be able to define'. Most importantly, the EU may feel the same way.
      - SllX 3y ago
        Well to correct you, my position is more “Apple might re-enable this” more than “will”, which from their perspective I’m guessing is even worse and they will be more unsympathetic to it. Personally I think Apple will, but I have enough doubts that I don’t want to make that claim. > Most importantly, the EU may feel the same way. That’s the rub. The EU has been arbitrarily writing new laws which mostly target foreign tech companies that don’t quite read “show me your bellies so we can pick out the choice cuts” but they’re pretty close. So the EU might do a lot of things, but if there’s an argument against them doing that, it’s what I said in my first comment above: it’s not worth any jurisdiction’s time to do so. That includes the EU. You might need to support some technologies to get government contracts, but nobody ever mandated you had to support POSIX or J2ME or whatever to sell a computer or phone to regular people. That would be asinine, and a PWA mandate would also be asinine.

WirelessGigabit 3y ago

There is little difference on iOS between a PWA and a website which has a WebKit view and hosts a website. The only reason PWAs were interesting on iOS was to get an app on iOS, while feeling relatively native, without paying Apple.

SllX 3y ago
Apple can make security guarantees about their own rendering engine that they can’t for any other rendering engine. It’s not about what PWAs are like in Safari, it’s about what they’re like in third-party browsers that have to by law be allowed to do whatever Safari can do with their own fully enabled rendering engines.
- ambigious7777 3y ago
  Apple could just say something like, "This app comes from a 3rd party browser engine, and it may not be secure. Are you sure you want to install this app?". Not too much effort, but still keeping the functionality.
  - SllX 3y ago
    I mentioned this in another comment but they built out over 600 APIs and a system of accompanying entitlements to comply with the DMA, they’re clearly not at this point just for PWAs going to throw up their hands and a scare sheet and say “good enough for government work, devs: do what you want now”. EU iPhone customers are still iPhone customers. The security and privacy considerations don’t go away just because a new law was passed.
    - ambigious7777 3y ago
      Obviously, those considerations must be considered. However, as I said, adding a simple confirmation prompt would be plenty enough. I think what is happening here, is that Apple is going like, "I don't get my market control, you don't get your shiny new features." Other phone platforms allow you to do things, that may be unsafe or insecure, but still plenty useful. Also, running a PWA really isn't that unsecure/unprivate as visiting a website. They both can access and ask for the same information or permissions. Really not that different. By your logic that PWAs are unsecure, then should iOS not support rendering webpages due to "security concerns"?