4 ms·

Would there actually be a security problem in allowing PWAs to run under whichever browser engine put them there? Added from Chrome? Runs in Chrome. Added fro

Would there actually be a security problem in allowing PWAs to run under whichever browser engine put them there? Added from Chrome? Runs in Chrome. Added from Safari? Runs in WebKit. etc. Why the drama?

Rohansi 3y ago
Apparently the level of security required for home screen web apps can only be met by Apple. Because nobody else can be trusted to isolate the data of different web apps from each other.
- jfoster 3y ago
  I can tell from the phrasing that you don't agree with Apple on that, but just want to respond anyway. Apple will still be sandboxing the browser engines, so even if Apple doesn't trust the browser vendors, this still isn't a logical argument against allowing them to run PWAs.
  - simondotau 3y ago
    It might not be practical for the OS to enforce sandboxes between multiple PWAs running on the same third party browser engines. Browsers are incredible resource hogs and loading many instances with perfect isolation enforced by the OS could result in a poor experience.
    - redox99 3y ago
      On Android I think PWAs do indeed share the same browser process. So it's like having another tab. Still, tab level isolation is taken extremely seriously by browser developers.
      - stefanlindbohm 3y ago
        Runtime access, yes. But I’m assuming this is to also prevent cookie/storage sharing between PWA:s too, which third party browser vendors (well, Google) have incentive to allow and Apple wants to prevent.
    - jfoster 3y ago
      Does Safari sandbox between multiple PWAs running? Besides, shouldn't it be up to the browser engine to decide on sandboxing between PWAs? The important part for Apple should be that the browser engine itself is sandboxed from the rest of the OS.
- niutech 3y ago
  This is BS. All iOS apps are sandboxed. PWA works in Android, Ubuntu Touch, even worked in Firefox OS (OWA). And Apple cannot work it out?

Rohansi 3y ago

Apparently the level of security required for home screen web apps can only be met by Apple. Because nobody else can be trusted to isolate the data of different web apps from each other.

jfoster 3y ago
I can tell from the phrasing that you don't agree with Apple on that, but just want to respond anyway. Apple will still be sandboxing the browser engines, so even if Apple doesn't trust the browser vendors, this still isn't a logical argument against allowing them to run PWAs.
- simondotau 3y ago
  It might not be practical for the OS to enforce sandboxes between multiple PWAs running on the same third party browser engines. Browsers are incredible resource hogs and loading many instances with perfect isolation enforced by the OS could result in a poor experience.
  - redox99 3y ago
    On Android I think PWAs do indeed share the same browser process. So it's like having another tab. Still, tab level isolation is taken extremely seriously by browser developers.
    - stefanlindbohm 3y ago
      Runtime access, yes. But I’m assuming this is to also prevent cookie/storage sharing between PWA:s too, which third party browser vendors (well, Google) have incentive to allow and Apple wants to prevent.
  - jfoster 3y ago
    Does Safari sandbox between multiple PWAs running? Besides, shouldn't it be up to the browser engine to decide on sandboxing between PWAs? The important part for Apple should be that the browser engine itself is sandboxed from the rest of the OS.
niutech 3y ago
This is BS. All iOS apps are sandboxed. PWA works in Android, Ubuntu Touch, even worked in Firefox OS (OWA). And Apple cannot work it out?