3 ms·

> It is unclear to me that this vulnerability has ever been patched To my understanding Apple has provided a solution in the form of a new type of webview avai

> It is unclear to me that this vulnerability has ever been patched To my understanding Apple has provided a solution in the form of a new type of webview available to apps that protects privacy. Last I checked (I don’t have the FB app installed for this exact reason so I’m not up to date) FB have not switched to using this new webview. It would be difficult to remove the functionality from the original API (WKWebView) because app developers like myself use it for legitimate reasons with internal web content. There have been some moves to lock advanced features behind an app-defined list of domains but it’s far from comprehensive. Maybe in iOS 18 (he said skeptically). The answer is simple: Apple just needs to deny FB App Store approval until they switch APIs. Of course they haven’t done that, and they won’t.

danShumway 3y ago
Thanks for the details, I've been curious for a while how this would shape up and I'm glad to get some information about the current state of things. Cross-origin privileges for inserting code would be my naive guess about how to lock that down, so it's good to hear that there's at least some dialog about it, even if it unfortunately seems to have not gone beyond the dialog. > The answer is simple: Apple just needs to deny FB App Store approval until they switch APIs. Of course they haven’t done that, and they won’t. Right, I guess to be a bit more fair to Apple, there are things they could do here that would make me more sympathetic to their arguments about moderation. The reason I'm generally unsympathetic to arguments that Apple moderation keeps the app store safe is because they don't moderate enough. I feel like I have a lot stricter standards about what apps should be able to get away with than Apple does. If Apple had when this story broke literally removed Facebook from the app store and forced them to disable that code, that would have been decent evidence to me that their moderation of the app store could have a substantial impact on privacy. I do think there are things Apple could do that would better justify their hold over the app store.

danShumway 3y ago

Thanks for the details, I've been curious for a while how this would shape up and I'm glad to get some information about the current state of things. Cross-origin privileges for inserting code would be my naive guess about how to lock that down, so it's good to hear that there's at least some dialog about it, even if it unfortunately seems to have not gone beyond the dialog. > The answer is simple: Apple just needs to deny FB App Store approval until they switch APIs. Of course they haven’t done that, and they won’t. Right, I guess to be a bit more fair to Apple, there are things they could do here that would make me more sympathetic to their arguments about moderation. The reason I'm generally unsympathetic to arguments that Apple moderation keeps the app store safe is because they don't moderate enough. I feel like I have a lot stricter standards about what apps should be able to get away with than Apple does. If Apple had when this story broke literally removed Facebook from the app store and forced them to disable that code, that would have been decent evidence to me that their moderation of the app store could have a substantial impact on privacy. I do think there are things Apple could do that would better justify their hold over the app store.