3 ms·

Sure it's reasonable ... because of course all these browsers don't have a security model and just allow web apps to do whatever they want. This is essentially

Sure it's reasonable ... because of course all these browsers don't have a security model and just allow web apps to do whatever they want. This is essentially saying no-one can build a secure browser.

MrDarcy 3y ago
No, it’s saying they’re being forced to support at least one insecure browser which would affect the security of an obscure feature so they’re removing the feature.
bee_rider 3y ago
Nobody can build a secure browser.
- shuckles 3y ago
  Truer words have not been spoken! Maybe only second to nobody can build a secure baseband.
  - dividedbyzero 3y ago
    Security is well achievable, absolute security is not. Somehow almost everyone seems to grasp that intuitively, but a subset of IT keeps pretending they're the same thing.
nozzlegear 3y ago
Nobody but Apple has experience building a secure browser. [1] [1] On iOS.
weberer 3y ago
I know at least Firefox has per-site permissions for location, webcam, and microphone access. Is it a correct interpretation that Safari on iOS does not have this feature?
- manmal 3y ago
  Safari has those features.
- shuckles 3y ago
  Their argument was they want the system (iOS) to enforce those permissions, not browsers on behalf of apps they've added.
  - jwells89 3y ago
    Ideally there should be both browser-level and OS-level controls. Reduces the chances of things slipping through the cracks and it limits the blast radius in case a browser vendor can’t get a hole patched up quickly for some reason.
dividedbyzero 3y ago
I don't think they're saying that. I read their statement more like "someone might build an insecure browser", which isn't that invalid a concern I think. I'd like Apple to be a bit more daring and just open up those APIs too, but I kind of get their incentives point the other way. Apart from some landmark design decisions, Apple is an extremely conservative company, and stalling on an issue like this is just what such an org would do.
- e12e 3y ago
  But they already give the "insecure browser" access to display web pages, access the camera etc. They just don't want "runs best on chrome" pwas eating they're app store cake.

MrDarcy 3y ago

No, it’s saying they’re being forced to support at least one insecure browser which would affect the security of an obscure feature so they’re removing the feature.

bee_rider 3y ago

Nobody can build a secure browser.

shuckles 3y ago
Truer words have not been spoken! Maybe only second to nobody can build a secure baseband.
- dividedbyzero 3y ago
  Security is well achievable, absolute security is not. Somehow almost everyone seems to grasp that intuitively, but a subset of IT keeps pretending they're the same thing.

nozzlegear 3y ago

Nobody but Apple has experience building a secure browser. [1] [1] On iOS.

weberer 3y ago

I know at least Firefox has per-site permissions for location, webcam, and microphone access. Is it a correct interpretation that Safari on iOS does not have this feature?

manmal 3y ago
Safari has those features.
shuckles 3y ago
Their argument was they want the system (iOS) to enforce those permissions, not browsers on behalf of apps they've added.
- jwells89 3y ago
  Ideally there should be both browser-level and OS-level controls. Reduces the chances of things slipping through the cracks and it limits the blast radius in case a browser vendor can’t get a hole patched up quickly for some reason.

dividedbyzero 3y ago

I don't think they're saying that. I read their statement more like "someone might build an insecure browser", which isn't that invalid a concern I think. I'd like Apple to be a bit more daring and just open up those APIs too, but I kind of get their incentives point the other way. Apart from some landmark design decisions, Apple is an extremely conservative company, and stalling on an issue like this is just what such an org would do.

e12e 3y ago
But they already give the "insecure browser" access to display web pages, access the camera etc. They just don't want "runs best on chrome" pwas eating they're app store cake.