4 ms·

The Apple FAQ itself answers the second side of this. If a browser can add PWA, they can claim they’re installing an app, and it would not be clear to a user t

by dagmx 3y ago

The Apple FAQ itself answers the second side of this. If a browser can add PWA, they can claim they’re installing an app, and it would not be clear to a user that they have a web app, not an isolated app. Now, none of these pseudo apps are guaranteed to be sandboxed from each other but the user cannot differentiate between apps that do provide security.

survirtual 3y ago
PWAs adhere to the same-origin policy, and all browser security policies associated. This means isolated storage (indexed db & local storage), isolated permissions, etc. Every modern browser has support for this. One webpage accessing the resources and data of another webpage is among the most basic of things globally known to be disallowed. This sandboxing reasoning is extremely bad faith.
- dagmx 3y ago
  Your argument hinges on a browser being a good citizen. The DMA makes no such requirement.
  - survirtual 3y ago
    Apple could trivially audit browser apps and provide warnings if they do not adhere to basic security policies literally every browser has implemented. This is a basic, user friendly approach. Their behavior is akin to a small, bratty toddler throwing a little tantrum, but instead of being a small toddler, it is one of the largest corporations on the planet. Their "little tantrum" impacts lives and livelihoods, because they are upset a population has reps that actually represent them. I hope they get what they deserve.
    - dagmx 3y ago
      Does the DMA allow for that level of data security being required?
hu3 3y ago
> Now, none of these pseudo apps are guaranteed to be sandboxed from each other... Except they are! Any browser worth their salt have been doing isolation since the dawn of time. Or do you really think bing.com can manipulate google.com cookies and storage?
- dagmx 3y ago
  Your qualifier is the issue: “Any browser worth their salt” Yes, a good browser does. But you’re still leaving it up to each individual implementation, and the DMA rules that Apple cannot judge accordingly.

by dagmx 3y ago

survirtual 3y ago

PWAs adhere to the same-origin policy, and all browser security policies associated. This means isolated storage (indexed db & local storage), isolated permissions, etc. Every modern browser has support for this. One webpage accessing the resources and data of another webpage is among the most basic of things globally known to be disallowed. This sandboxing reasoning is extremely bad faith.

dagmx 3y ago
Your argument hinges on a browser being a good citizen. The DMA makes no such requirement.
- survirtual 3y ago
  Apple could trivially audit browser apps and provide warnings if they do not adhere to basic security policies literally every browser has implemented. This is a basic, user friendly approach. Their behavior is akin to a small, bratty toddler throwing a little tantrum, but instead of being a small toddler, it is one of the largest corporations on the planet. Their "little tantrum" impacts lives and livelihoods, because they are upset a population has reps that actually represent them. I hope they get what they deserve.
  - dagmx 3y ago
    Does the DMA allow for that level of data security being required?

hu3 3y ago

> Now, none of these pseudo apps are guaranteed to be sandboxed from each other... Except they are! Any browser worth their salt have been doing isolation since the dawn of time. Or do you really think bing.com can manipulate google.com cookies and storage?

dagmx 3y ago
Your qualifier is the issue: “Any browser worth their salt” Yes, a good browser does. But you’re still leaving it up to each individual implementation, and the DMA rules that Apple cannot judge accordingly.