13 ms·

Without this type of isolation and enforcement, malicious... camera, microphone or location ... Browsers ... 30 some million lines of code in chromium browsers

Without this type of isolation and enforcement, malicious... camera, microphone or location ... Browsers ... 30 some million lines of code in chromium browsers. Thats bigger than the linux kernel. The HN crowed might not LIKE apples response but they have a very defensible position. Edit: Its not like we haven't seen this play out on the desktop recently: https://www.theverge.com/24054329/microsoft-edge-automatic-chrome-import-data-feature https://www.theverge.com/24054329/microsoft-edge-automatic-c...

cma 3y ago
But the plain browser already can request camera permissions, in a bad security situation a site that didn't request it still receives it from the browser's system level request. This is just Apple wanting to avoid people being able to develop a platform on top of their platform without paying a tax.
- zitterbewegung 3y ago
  That’s not the point though because WebKit is already secured by Apple but if you have multiple blink related apps like Microsoft edge or brave or Firefox apple will have to audit those too and be on the hook if something breaks and then Apple will have to take the blame over a security oversight they aren’t responsible for.
  - spaceribs 3y ago
    That assumes that Apple would be blamed for Edge/Brave/Firefox's security oversight.
    - etchalon 3y ago
      They would absolutely be blamed by users for it.
      - pjerem 3y ago
        Like when it happens on MacOS ? Oh wait…
        etchalon 3y ago
        Yes, people blame Apple for it when it happens on a macOS. Have you ever worked an IT support desk?
    - ChilledTonic 3y ago
      Why wouldn't they be? Especially considering their existing reputation in consumers minds for security and reliabilty?
      - spaceribs 3y ago
        Because they own and maintain the operating system, not the vulnerable software? I understand that they've built this image of being a grand infinite protector for all their users within the walls of their garden, but they've had plenty of security issues within their own software, and plenty of cases where application developers have sidestepped their rules. This relationship of trust with Apple is cultish at best. To say that I can trust Apple but not Mozilla? What are we smoking here?
      - pjerem 3y ago
        Because it never ever happened on any other platform including MacOS.
    - shagie 3y ago
      If you add a PWA (with Safari) a year ago to your Home Screen and then change your browser to Firefox, and that PWA breaks out and steals some other application data... Will you blame the software maker that you used to install the icon on the screen? or the one that is seemingly unrelated to the icon on your Home Screen?
      - seszett 3y ago
        I would probably blame the "the software maker" for silently switching the engine used by previously installed PWAs. Why do that?
      - rickdeckard 3y ago
        You think this uneducated me would know that this was a PWA and no app and also remember that it was installed by Safari, an app I apparently don't own anymore at this stage...? Why wouldn't Safari remove all its PWA icons when I uninstall it, considering that it anyway cannot transfer the data to another browser...?
      - m-p-3 3y ago
        Why silently change the underlying browser engine of an existing PWA without the user's knowledge? That sounds like a bad UX. At least make the existing PWA stay with Safari and provide the ability to switch the underlying engine for each PWA afterwards if migrating is possible.
        shagie 3y ago
        As I understand the legislation, Apple has three choices for how to comply with the law. They can either allow third party browsers the elevated system access that Safari currently has in order to be able to access the data for multiple PWAs ... which compromises Apple's security standards, but puts Safari and other browser engines on the same footing. Or, Apple can remove the additional security permissions that Safari uses in order to access the data of multiple PWAs so that Safari and other web browsers are on the same footing again. Or, Apple can invest significant time and resources into creating a new sandbox for browser engines (including Safari) such that a PWA running in the browser engine will not be able to escape and access the elevated permissions of the browser engine or the data of other PWAs through a flaw in the browser engine. Given the amount of effort that the third option would take, the low adoption of PWAs from most users within the European market, and the not going to compromise on the first option - the second option of removing security permissions from Safari (and other browser engines) to run PWAs is the only option to comply with the law in Europe.
  - Ajedi32 3y ago
    So extending this logic to other platforms: if Chrome has a security bug on Windows... you believe people will blame Microsoft? And you think that would be valid justification for Microsoft pushing a "security update" that uninstalls all competing browsers and replaces them with Edge?
    - graeme 3y ago
      If you made a "Microsoft Windows Desktop Citibank App" from Edge, and then in stall Chrome, and the Uber app now uses Chrome, and a bug in Chrome lets someone steal your Citibank info, yes, the user probably would blame Microsoft as it was Windows software which made the Desktop app for Citibank. And yes, if Windows had this feature and then Europe demanded it work like I described, Microsoft would be acting reasonably if it disabled the Desktop App feature in Europe. Apple doesn't disable competing browsers, it just doesn't allow different web engines to underly the browsers. You can argue with that but it isn't the same as "uninstalling all competing browsers".
- Gigachad 3y ago
  Browsers can still do that. It's more that PWAs look like entirely separate apps which the user would expect to be sandboxed. While a tab in a browser is clearly part of the browser app.
  - anon373839 3y ago
    This is not a meaningful distinction. Users ALSO expect ordinary websites’ data to be sandboxed. Users trust that pornhub.com won’t be allowed to read data entered into irs.gov.
    - almostnormal 3y ago
      > Users trust that pornhub.com won’t be allowed to read data entered into irs.gov. Likely, most are worried about the other direction.
    - Gigachad 3y ago
      There is also a brand rep issue. If there is a Chrome bug that leaks data, it will be seen as a Google issue. If PWAs have the same problem, it will be seen as an Apple security issue. One that they have no ability to fix.
  - cma 3y ago
    If I gave camera permissions to the zoom website on my browser, it is way worse if a random malicious email link gets them too on a different domain than if a permission spreads across PWAs I hand installed. This is Apple shaking people down.
summerlight 3y ago
Why should we trust Apple for security in that context? Apple also provides all those functionalities via their proprietary API, which is not even audit-able. If Apple really believes in that argument, they should disable their own API as well.
- M4v3R 3y ago
  You have to trust someone if you're using a computing device connected to the Internet. The point of being in Apple ecosystem is that you trust Apple, and then (supposedly) you can not trust anyone else. To many that's a very strong proposition.
  - summerlight 3y ago
    > The point of being in Apple ecosystem is that you trust Apple, This seems to be over-generalization? Users are using Apple devices because those are good products, not because they want to delegate every single trust problem to the Apple ecosystem. That might be a great proposition for people like you, but there is a significant number of people who consider it a compromise rather than a value.
    - chongli 3y ago
      Users trust Apple because Apple is ultimately accountable for security breaches on iOS devices. If a 3rd party app causes a data breach it does not matter if the breach was made possible by compliance with regulations like the DMA, Apple will still take the blame.
      - summerlight 3y ago
        > Users trust Apple because Apple is ultimately accountable for security breaches on iOS devices. As a long time user of Windows which historically had an incomparably large amount of security incidents, I can assure you that Apple won't get blamed that much for 3rd party data breach unless it involves Apple's own service and user data.
thimp 3y ago
As an end user who has been fucked over by the other side (MS/Google/crappy app vendors), I am behind their decision. If I was not I can choose to leave. I know this is a divisive comment. Please see my further extrapolation in a child comment.
- circuit10 3y ago
  How does removing web apps help anything? To me it seems like part of a ploy to create backlash against this law by removing features
  - thimp 3y ago
    It's a move against the third party browser engines which have been the bane of my existence from a security perspective on other platforms. For example, the about box in an Android app bundled a whole different browser engine which circumvented device policy entirely and allowed data to be exfiltrated. This app change was delivered in an update by clueless or lazy developers. This is not possible on iOS due to the platform restrictions. In this case they have to change the integration and sandbox model to allow the security policy to remain intact for people who want and need it. That breaks a few things but it stops the integration from being used for exfiltration among other things. Note that they're not completely breaking it, just ensuring that the security model stays intact when browser engines have to coexist on the same device. That means sacrificing some convenience for security.
    - chrisjj 3y ago
      > For example, the about box in an Android app bundled a whole different browser engine which circumvented device policy entirely and allowed data to be exfiltrated. This app change was delivered in an update by clueless or lazy developers. This is not possible on iOS due to the platform restrictions. If this prevention is by OS security, then your complaint is about the OS. If it us by store guards, then yiu complaint is about the store. So sorry, but I don't see how your complaint is properly about the browser engines.
  - 3y ago
anon373839 3y ago
> The HN crowed might not LIKE apples response but they have a very defensible position. You and Apple both are ignoring the fact that these permission APIs exist even if the website isn’t being displayed in standalone/full screen mode. The modern web is built on them, and third-party browser engines WILL provide access to these APIs in Europe.
arghwhat 3y ago
It really doesn't make sense. By that logic, I shouldn't be allowed to load web pages because it's impossible to secure a browser. PWA's only need a few extra integration privileges like badge- and window control, rest is just a web as usual. What you link is a case of one app (edge) reading the data of another app (chrome), which is entirely unrelated to PWAs.
- emgeee 3y ago
  In my experience even "a few extras privileges" can take many months to implement, especially for a company as large as Apple.
  - layer8 3y ago
    The EU gave them six months after being designated as a gatekeeper. The regulation already entered into force an additional ten months earlier, so Apple arguably could have already prepared for their likely designation. The real issue, however, is that Apple is not saying “we need more time to implement the APIs”, which the EU would very likely concede, but “we don’t think it’s worth it for us”.
    - deleted 3y ago
      [deleted]
    - chrisandchris 3y ago
      Is that teally an issue? From a legal perspective (as a layman) Apples decision seems fine for me. So how can we say "bad Apple" if they're legally doing it correct? That does not mean that their decision is the proper one, just that it's legally ok.
      - layer8 3y ago
        Why are you limiting this to the legal perspective? They are not doing what is in the interest of their users (and the spirit of the DMA), for petty reasons. As a user, that’s obviously bad.
rchaud 3y ago
Android handles this just fine. These are the world's largest corporations we're talking about, not some mom and pop shop that will be crushed under the heel of overzealous regulation.
- 2OEH8eoCRo0 3y ago
  Suddenly the user respecting innovators are all out of ideas!
- SigmundA 3y ago
  So Android allows alternative rendering engines besides Chrome for PWA? If you install Firefox it uses Gecko but still has native app look feel? I honestly don't know but would be surprised if they did.
  - Symbiote 3y ago
    Installing a PWA on Firefox for Android adds the icon to the homescreen with a tiny Firefox icon at the bottom. The look and feel is Android, there's no obvious bits that would look either Firefox or Chrome. https://web.dev/learn/pwa/tools-and-debug#using_physical_devices https://web.dev/learn/pwa/tools-and-debug#using_physical_dev... at "Firefox Remote Debugging" says there's a way to debug Firefox for Android PWAs. So I'm fairly sure the PWA is running using Firefox for Android. I also never accepted the terms and conditions for Chrome on this phone.
    - rchaud 3y ago
      The look and feel of the app itself is a CSS issue. There are web app frameworks that specifically offer themes matching style guides provided by Apple and Google. Framework7 is an example: the demo app on the home page is styled using iOS UI elements, and there is an option for more Android style designs as well. https://framework7.io/ https://framework7.io/
      - rafram 3y ago
        I wouldn’t say that demo is very convincing…
jc_dc 3y ago
I don’t buy it. Apple build iOS and I’m sure they will sandbox alt browsers as they do with every other 3rd party app on the phone.
heisenbit 3y ago
It makes absolutely no sense. Apple could have pointed out to the EU that there are major and not - in the given time - fixable security issues with allowing other browsers on the home screen. PWA runtime platform could be seen as imho. other market than general web browsers. PWA serve niche markets (and corporate in-house) and this move may hurt the long tail in the EU but also globally.
lukan 3y ago
If chrome is really the problem, then chrome is already the problem and nothing about PWAs can change that. And if PWAs from chrome are the problem, then it would also be possible to not allow chrome PWA's but still allow webkit PWA's.
InsomniacL 3y ago
Why can the camera be accessed through third-party browser engines so long as it's in a browser window? If the browser engine can't be trusted to segregate camera access through a PWA then why is it trusted to segregate it in-app?
beeboobaa 3y ago
Lol, no. They were fine for years but are not throwing a hissy fit. It's all utter nonsense. Third party apps are subject to the same security guarantees the system has been operating on for years. But a legislator forced their hand so now they gotta cry about it.

cma 3y ago

But the plain browser already can request camera permissions, in a bad security situation a site that didn't request it still receives it from the browser's system level request. This is just Apple wanting to avoid people being able to develop a platform on top of their platform without paying a tax.

zitterbewegung 3y ago
That’s not the point though because WebKit is already secured by Apple but if you have multiple blink related apps like Microsoft edge or brave or Firefox apple will have to audit those too and be on the hook if something breaks and then Apple will have to take the blame over a security oversight they aren’t responsible for.
- spaceribs 3y ago
  That assumes that Apple would be blamed for Edge/Brave/Firefox's security oversight.
  - etchalon 3y ago
    They would absolutely be blamed by users for it.
    - pjerem 3y ago
      Like when it happens on MacOS ? Oh wait…
      - etchalon 3y ago
        Yes, people blame Apple for it when it happens on a macOS. Have you ever worked an IT support desk?
  - ChilledTonic 3y ago
    Why wouldn't they be? Especially considering their existing reputation in consumers minds for security and reliabilty?
    - spaceribs 3y ago
      Because they own and maintain the operating system, not the vulnerable software? I understand that they've built this image of being a grand infinite protector for all their users within the walls of their garden, but they've had plenty of security issues within their own software, and plenty of cases where application developers have sidestepped their rules. This relationship of trust with Apple is cultish at best. To say that I can trust Apple but not Mozilla? What are we smoking here?
    - pjerem 3y ago
      Because it never ever happened on any other platform including MacOS.
  - shagie 3y ago
    If you add a PWA (with Safari) a year ago to your Home Screen and then change your browser to Firefox, and that PWA breaks out and steals some other application data... Will you blame the software maker that you used to install the icon on the screen? or the one that is seemingly unrelated to the icon on your Home Screen?
    - seszett 3y ago
      I would probably blame the "the software maker" for silently switching the engine used by previously installed PWAs. Why do that?
    - rickdeckard 3y ago
      You think this uneducated me would know that this was a PWA and no app and also remember that it was installed by Safari, an app I apparently don't own anymore at this stage...? Why wouldn't Safari remove all its PWA icons when I uninstall it, considering that it anyway cannot transfer the data to another browser...?
    - m-p-3 3y ago
      Why silently change the underlying browser engine of an existing PWA without the user's knowledge? That sounds like a bad UX. At least make the existing PWA stay with Safari and provide the ability to switch the underlying engine for each PWA afterwards if migrating is possible.
      - shagie 3y ago
        As I understand the legislation, Apple has three choices for how to comply with the law. They can either allow third party browsers the elevated system access that Safari currently has in order to be able to access the data for multiple PWAs ... which compromises Apple's security standards, but puts Safari and other browser engines on the same footing. Or, Apple can remove the additional security permissions that Safari uses in order to access the data of multiple PWAs so that Safari and other web browsers are on the same footing again. Or, Apple can invest significant time and resources into creating a new sandbox for browser engines (including Safari) such that a PWA running in the browser engine will not be able to escape and access the elevated permissions of the browser engine or the data of other PWAs through a flaw in the browser engine. Given the amount of effort that the third option would take, the low adoption of PWAs from most users within the European market, and the not going to compromise on the first option - the second option of removing security permissions from Safari (and other browser engines) to run PWAs is the only option to comply with the law in Europe.
- Ajedi32 3y ago
  So extending this logic to other platforms: if Chrome has a security bug on Windows... you believe people will blame Microsoft? And you think that would be valid justification for Microsoft pushing a "security update" that uninstalls all competing browsers and replaces them with Edge?
  - graeme 3y ago
    If you made a "Microsoft Windows Desktop Citibank App" from Edge, and then in stall Chrome, and the Uber app now uses Chrome, and a bug in Chrome lets someone steal your Citibank info, yes, the user probably would blame Microsoft as it was Windows software which made the Desktop app for Citibank. And yes, if Windows had this feature and then Europe demanded it work like I described, Microsoft would be acting reasonably if it disabled the Desktop App feature in Europe. Apple doesn't disable competing browsers, it just doesn't allow different web engines to underly the browsers. You can argue with that but it isn't the same as "uninstalling all competing browsers".
Gigachad 3y ago
Browsers can still do that. It's more that PWAs look like entirely separate apps which the user would expect to be sandboxed. While a tab in a browser is clearly part of the browser app.
- anon373839 3y ago
  This is not a meaningful distinction. Users ALSO expect ordinary websites’ data to be sandboxed. Users trust that pornhub.com won’t be allowed to read data entered into irs.gov.
  - almostnormal 3y ago
    > Users trust that pornhub.com won’t be allowed to read data entered into irs.gov. Likely, most are worried about the other direction.
  - Gigachad 3y ago
    There is also a brand rep issue. If there is a Chrome bug that leaks data, it will be seen as a Google issue. If PWAs have the same problem, it will be seen as an Apple security issue. One that they have no ability to fix.
- cma 3y ago
  If I gave camera permissions to the zoom website on my browser, it is way worse if a random malicious email link gets them too on a different domain than if a permission spreads across PWAs I hand installed. This is Apple shaking people down.

summerlight 3y ago

Why should we trust Apple for security in that context? Apple also provides all those functionalities via their proprietary API, which is not even audit-able. If Apple really believes in that argument, they should disable their own API as well.

M4v3R 3y ago
You have to trust someone if you're using a computing device connected to the Internet. The point of being in Apple ecosystem is that you trust Apple, and then (supposedly) you can not trust anyone else. To many that's a very strong proposition.
- summerlight 3y ago
  > The point of being in Apple ecosystem is that you trust Apple, This seems to be over-generalization? Users are using Apple devices because those are good products, not because they want to delegate every single trust problem to the Apple ecosystem. That might be a great proposition for people like you, but there is a significant number of people who consider it a compromise rather than a value.
  - chongli 3y ago
    Users trust Apple because Apple is ultimately accountable for security breaches on iOS devices. If a 3rd party app causes a data breach it does not matter if the breach was made possible by compliance with regulations like the DMA, Apple will still take the blame.
    - summerlight 3y ago
      > Users trust Apple because Apple is ultimately accountable for security breaches on iOS devices. As a long time user of Windows which historically had an incomparably large amount of security incidents, I can assure you that Apple won't get blamed that much for 3rd party data breach unless it involves Apple's own service and user data.

thimp 3y ago

As an end user who has been fucked over by the other side (MS/Google/crappy app vendors), I am behind their decision. If I was not I can choose to leave. I know this is a divisive comment. Please see my further extrapolation in a child comment.

circuit10 3y ago
How does removing web apps help anything? To me it seems like part of a ploy to create backlash against this law by removing features
- thimp 3y ago
  It's a move against the third party browser engines which have been the bane of my existence from a security perspective on other platforms. For example, the about box in an Android app bundled a whole different browser engine which circumvented device policy entirely and allowed data to be exfiltrated. This app change was delivered in an update by clueless or lazy developers. This is not possible on iOS due to the platform restrictions. In this case they have to change the integration and sandbox model to allow the security policy to remain intact for people who want and need it. That breaks a few things but it stops the integration from being used for exfiltration among other things. Note that they're not completely breaking it, just ensuring that the security model stays intact when browser engines have to coexist on the same device. That means sacrificing some convenience for security.
  - chrisjj 3y ago
    > For example, the about box in an Android app bundled a whole different browser engine which circumvented device policy entirely and allowed data to be exfiltrated. This app change was delivered in an update by clueless or lazy developers. This is not possible on iOS due to the platform restrictions. If this prevention is by OS security, then your complaint is about the OS. If it us by store guards, then yiu complaint is about the store. So sorry, but I don't see how your complaint is properly about the browser engines.
- 3y ago

anon373839 3y ago

> The HN crowed might not LIKE apples response but they have a very defensible position. You and Apple both are ignoring the fact that these permission APIs exist even if the website isn’t being displayed in standalone/full screen mode. The modern web is built on them, and third-party browser engines WILL provide access to these APIs in Europe.

arghwhat 3y ago

It really doesn't make sense. By that logic, I shouldn't be allowed to load web pages because it's impossible to secure a browser. PWA's only need a few extra integration privileges like badge- and window control, rest is just a web as usual. What you link is a case of one app (edge) reading the data of another app (chrome), which is entirely unrelated to PWAs.

emgeee 3y ago
In my experience even "a few extras privileges" can take many months to implement, especially for a company as large as Apple.
- layer8 3y ago
  The EU gave them six months after being designated as a gatekeeper. The regulation already entered into force an additional ten months earlier, so Apple arguably could have already prepared for their likely designation. The real issue, however, is that Apple is not saying “we need more time to implement the APIs”, which the EU would very likely concede, but “we don’t think it’s worth it for us”.
  - deleted 3y ago
    [deleted]
  - chrisandchris 3y ago
    Is that teally an issue? From a legal perspective (as a layman) Apples decision seems fine for me. So how can we say "bad Apple" if they're legally doing it correct? That does not mean that their decision is the proper one, just that it's legally ok.
    - layer8 3y ago
      Why are you limiting this to the legal perspective? They are not doing what is in the interest of their users (and the spirit of the DMA), for petty reasons. As a user, that’s obviously bad.

rchaud 3y ago

Android handles this just fine. These are the world's largest corporations we're talking about, not some mom and pop shop that will be crushed under the heel of overzealous regulation.

2OEH8eoCRo0 3y ago
Suddenly the user respecting innovators are all out of ideas!
SigmundA 3y ago
So Android allows alternative rendering engines besides Chrome for PWA? If you install Firefox it uses Gecko but still has native app look feel? I honestly don't know but would be surprised if they did.
- Symbiote 3y ago
  Installing a PWA on Firefox for Android adds the icon to the homescreen with a tiny Firefox icon at the bottom. The look and feel is Android, there's no obvious bits that would look either Firefox or Chrome. https://web.dev/learn/pwa/tools-and-debug#using_physical_devices https://web.dev/learn/pwa/tools-and-debug#using_physical_dev... at "Firefox Remote Debugging" says there's a way to debug Firefox for Android PWAs. So I'm fairly sure the PWA is running using Firefox for Android. I also never accepted the terms and conditions for Chrome on this phone.
  - rchaud 3y ago
    The look and feel of the app itself is a CSS issue. There are web app frameworks that specifically offer themes matching style guides provided by Apple and Google. Framework7 is an example: the demo app on the home page is styled using iOS UI elements, and there is an option for more Android style designs as well. https://framework7.io/ https://framework7.io/
    - rafram 3y ago
      I wouldn’t say that demo is very convincing…

jc_dc 3y ago

I don’t buy it. Apple build iOS and I’m sure they will sandbox alt browsers as they do with every other 3rd party app on the phone.

heisenbit 3y ago

It makes absolutely no sense. Apple could have pointed out to the EU that there are major and not - in the given time - fixable security issues with allowing other browsers on the home screen. PWA runtime platform could be seen as imho. other market than general web browsers. PWA serve niche markets (and corporate in-house) and this move may hurt the long tail in the EU but also globally.

lukan 3y ago

If chrome is really the problem, then chrome is already the problem and nothing about PWAs can change that. And if PWAs from chrome are the problem, then it would also be possible to not allow chrome PWA's but still allow webkit PWA's.

InsomniacL 3y ago

Why can the camera be accessed through third-party browser engines so long as it's in a browser window? If the browser engine can't be trusted to segregate camera access through a PWA then why is it trusted to segregate it in-app?

beeboobaa 3y ago

Lol, no. They were fine for years but are not throwing a hissy fit. It's all utter nonsense. Third party apps are subject to the same security guarantees the system has been operating on for years. But a legislator forced their hand so now they gotta cry about it.