2 ms·

Well, while the argument is entirely bogus as "PWAs are unsafe" implies that loading web pages in that browser itself is unsafe and thus stopping PWAs but not l

Well, while the argument is entirely bogus as "PWAs are unsafe" implies that loading web pages in that browser itself is unsafe and thus stopping PWAs but not loading pages is pointless, you do have to have full trust in Apple for security of your device as they are the sole provider for the core platform providing most of the security primitives used. That just doesn't exclude trusting others as well.

Terretta 3y ago
> Well, while the argument is entirely bogus as "PWAs are unsafe" implies that loading web pages in that browser itself is unsafe Except that's exactly what Apple is saying. Their engine -- and their brand depends on it -- offers users assurances arbitrary engines do not offer. Apple says PWAs are safe because Safari is safe, while not-Safari PWAs are not-safe. And, if not safe, Apple is at least accountable. Google's brand, for instance, does not depend on it: https://www.engadget.com/the-morning-after-google-will-settle-5-billion-lawsuit-over-tracking-incognito-chrome-users-121651324.html https://www.engadget.com/the-morning-after-google-will-settl...
- anon373839 3y ago
  It doesn’t matter - they are going to support third party browsers anyway. They are just afraid the browsers will host PWAs better than Safari does, making them a more viable alternative to the App Store.
- addicted 3y ago
  Apple’s inability to protect its “brand” while doing what nearly every other platform owner in the world does routinely does not justify monopolistic and anti competitive behavior.
- troupo 3y ago
  Well, that link definitely plays in Apple's favour :)
- arghwhat 3y ago
  > Except that's exactly what Apple is saying. You misunderstand. If a foreign browser engine was to be made available for PWAs, it would be because the user installed the browser and browsed the web with it. In other words, if loading a web page in this browser was unsafe - which is what a PWA is - the user would already be compromised. PWA or bookmark does not matter. PWAs do not change the risk profile. PWAs only get a few extra APIs, but nothing major. Location, microphone, webcam, bluetooth, usb, etc. are all standard web APIs available to web pages, not PWA specific. The argument that PWA specifically has a special risk profile is null and void. The only sensible reasoning is that Apple is strongly against opening their platform at all (their way of implementing compliance is borderline malicious), and maybe want to weasel their way out of any effort they can avoid (allowing users to install new types of apps is zero work, changing which app opens a link by default is near-zero, while allowing users to replace the engine for PWAs require a bit more integration).
Dalewyn 3y ago
>implies that loading web pages in that browser itself is unsafe Since when was loading web pages ever considered safe, at least by those who actually breathe computer? It's frankly alarming how much trust we (must) give to Arbitrary, Remotely Executed Code(tm), especially given how many attack vectors are remote code executions.
- johnnyanmac 3y ago
  Never, but the world wide web is the one force of nature even Jobs couldn't fight back against. I'm sure he tried, too. So like most "too popular" stuff, it was given an exception that no other type of app would ever dream of.
- arghwhat 3y ago
  Well, that's a different argument altogether. Whether you consider browsing the web in any browser safe or not, the fact that PWAs do not change the risk profile of loading such pages remain true.

Terretta 3y ago

> Well, while the argument is entirely bogus as "PWAs are unsafe" implies that loading web pages in that browser itself is unsafe Except that's exactly what Apple is saying. Their engine -- and their brand depends on it -- offers users assurances arbitrary engines do not offer. Apple says PWAs are safe because Safari is safe, while not-Safari PWAs are not-safe. And, if not safe, Apple is at least accountable. Google's brand, for instance, does not depend on it: https://www.engadget.com/the-morning-after-google-will-settle-5-billion-lawsuit-over-tracking-incognito-chrome-users-121651324.html https://www.engadget.com/the-morning-after-google-will-settl...

anon373839 3y ago
It doesn’t matter - they are going to support third party browsers anyway. They are just afraid the browsers will host PWAs better than Safari does, making them a more viable alternative to the App Store.
addicted 3y ago
Apple’s inability to protect its “brand” while doing what nearly every other platform owner in the world does routinely does not justify monopolistic and anti competitive behavior.
troupo 3y ago
Well, that link definitely plays in Apple's favour :)
arghwhat 3y ago
> Except that's exactly what Apple is saying. You misunderstand. If a foreign browser engine was to be made available for PWAs, it would be because the user installed the browser and browsed the web with it. In other words, if loading a web page in this browser was unsafe - which is what a PWA is - the user would already be compromised. PWA or bookmark does not matter. PWAs do not change the risk profile. PWAs only get a few extra APIs, but nothing major. Location, microphone, webcam, bluetooth, usb, etc. are all standard web APIs available to web pages, not PWA specific. The argument that PWA specifically has a special risk profile is null and void. The only sensible reasoning is that Apple is strongly against opening their platform at all (their way of implementing compliance is borderline malicious), and maybe want to weasel their way out of any effort they can avoid (allowing users to install new types of apps is zero work, changing which app opens a link by default is near-zero, while allowing users to replace the engine for PWAs require a bit more integration).

Dalewyn 3y ago

>implies that loading web pages in that browser itself is unsafe Since when was loading web pages ever considered safe, at least by those who actually breathe computer? It's frankly alarming how much trust we (must) give to Arbitrary, Remotely Executed Code(tm), especially given how many attack vectors are remote code executions.

johnnyanmac 3y ago
Never, but the world wide web is the one force of nature even Jobs couldn't fight back against. I'm sure he tried, too. So like most "too popular" stuff, it was given an exception that no other type of app would ever dream of.
arghwhat 3y ago
Well, that's a different argument altogether. Whether you consider browsing the web in any browser safe or not, the fact that PWAs do not change the risk profile of loading such pages remain true.