3 ms·

All of these requirements look good for user security and privacy. I don't want apps to bring their own Blink or WebKit fork with all sandboxing and cross-site

All of these requirements look good for user security and privacy. I don't want apps to bring their own Blink or WebKit fork with all sandboxing and cross-site tracking protection disabled. I'm fine with apps bringing their own engine with the goal of performance or better user experience. These requirements enforce those expectations. There seems to be a concern that Apple will use these requirements to ban every single alternative including Blink and Gecko. I doubt that is the case since the purpose of these changes is to allow reliable, responsible players to run their engines on iOS without giving the keys to the kingdom to every app that requests it. Banning Google or Mozilla would not satisfy the EU requirements. Banning BlinkButItAlsoMinesCrypto is fine. The only additional thing I'd want as a user is transparency. I want to know if an app with a WebView is using WebKit, Blink, Gecko or EngineNobodyHasEverHeardOf.

Nextgrid 2y ago
> I don't want apps to bring their own Blink or WebKit fork with all sandboxing and cross-site tracking protection disabled Facebook's apps happily do this with the built-in WKWebView and then injects its own malicious Javascript to ensure it spies on what's within the page. You do not need to run a separate browser engine to do this. It's disappointing that the rhetoric about Apple's anti-competitive restrictions being for "security" still persists to this day especially on a technical forum.
- znpy 2y ago
  WeChat does this as well, and much more (and who know what else more!). But for some reason Apple is a-okay with that.
- cjpearson 2y ago
  I still haven't seen any arguments why these restrictions aren't good for users. Just a bunch of assumptions that these restrictions are a fig leaf. For a technical forum, I would expect more discussion around the actual details. Instead many people are building a strawman and fighting that instead. Assume for a moment that Apple will allow alternative web engines as long as they follow certain user privacy and security guarantees. (Given that the company has announced this and it's legally mandated, I think this is a safe assumption.) In that case, are users better served with or without these requirements?
  - fsflover 2y ago
    Where are all the security problems of Linux allowing "side loading"? Especially servers are very valuable.
    - acdha 2y ago
      That’s like saying everyone should carry grenades around because trained soldiers do. Linux servers do get compromised by people installing dodgy software but it’s nowhere near the scale of the same thing happening on PCs and phones because servers are mostly operated by people with the discipline and skill not to add some random site to their package manager. Anyone who’s ever supported normal people or even talked with their extended friends and family knows that this is not something you can assume for systems used by the general public. There’s a huge industry social engineering people into installing dodgy software to get deals, porn, games, address scary security threats, etc. and the billions of dollars they made annually means that when your grandfather is on the phone with the call center person walking him through turning off every security measure, he’s probably thinking that they’re more helpful than his actual bank. If normal people ran Linux, they’d be just as prone to run “sudo add-apt-repository“ as they are clicking through the Windows prompts now.
      - talldayo 2y ago
        > There’s a huge industry social engineering people into installing dodgy software to get deals, porn, games, address scary security threats, etc. But that happens everywhere, though. These same social-engineering ads show up in Safari, can manipulate you into giving away your banking details for a Nigerian prince or tossing your SSN and debit card into a little autofill HTML box. Call-center scammers will abuse your iPhone's callerID to make people think they're talking to the IRS or their car dealership. These scams are nothing new, locking out features doesn't "help" users any more than disabling the phone or browser does. Safety is Apple's abusive catchall excuse that they wheel out when they have to make the poison-pill taste like candy. The real kicker is that Apple's own App Store has been caught hosting malware. You can't really claim the open web is some scary harbinger of manipulative software when Apple's own first-party service has been caught hosting fake LastPass apps and abusive weekly-subscription services. Meanwhile on Android, I get my favorite apps off Github and don't have to interact with the enshittification-encumbered Google Play Store.

Nextgrid 2y ago

> I don't want apps to bring their own Blink or WebKit fork with all sandboxing and cross-site tracking protection disabled Facebook's apps happily do this with the built-in WKWebView and then injects its own malicious Javascript to ensure it spies on what's within the page. You do not need to run a separate browser engine to do this. It's disappointing that the rhetoric about Apple's anti-competitive restrictions being for "security" still persists to this day especially on a technical forum.

znpy 2y ago
WeChat does this as well, and much more (and who know what else more!). But for some reason Apple is a-okay with that.
cjpearson 2y ago
I still haven't seen any arguments why these restrictions aren't good for users. Just a bunch of assumptions that these restrictions are a fig leaf. For a technical forum, I would expect more discussion around the actual details. Instead many people are building a strawman and fighting that instead. Assume for a moment that Apple will allow alternative web engines as long as they follow certain user privacy and security guarantees. (Given that the company has announced this and it's legally mandated, I think this is a safe assumption.) In that case, are users better served with or without these requirements?
- fsflover 2y ago
  Where are all the security problems of Linux allowing "side loading"? Especially servers are very valuable.
  - acdha 2y ago
    That’s like saying everyone should carry grenades around because trained soldiers do. Linux servers do get compromised by people installing dodgy software but it’s nowhere near the scale of the same thing happening on PCs and phones because servers are mostly operated by people with the discipline and skill not to add some random site to their package manager. Anyone who’s ever supported normal people or even talked with their extended friends and family knows that this is not something you can assume for systems used by the general public. There’s a huge industry social engineering people into installing dodgy software to get deals, porn, games, address scary security threats, etc. and the billions of dollars they made annually means that when your grandfather is on the phone with the call center person walking him through turning off every security measure, he’s probably thinking that they’re more helpful than his actual bank. If normal people ran Linux, they’d be just as prone to run “sudo add-apt-repository“ as they are clicking through the Windows prompts now.
    - talldayo 2y ago
      > There’s a huge industry social engineering people into installing dodgy software to get deals, porn, games, address scary security threats, etc. But that happens everywhere, though. These same social-engineering ads show up in Safari, can manipulate you into giving away your banking details for a Nigerian prince or tossing your SSN and debit card into a little autofill HTML box. Call-center scammers will abuse your iPhone's callerID to make people think they're talking to the IRS or their car dealership. These scams are nothing new, locking out features doesn't "help" users any more than disabling the phone or browser does. Safety is Apple's abusive catchall excuse that they wheel out when they have to make the poison-pill taste like candy. The real kicker is that Apple's own App Store has been caught hosting malware. You can't really claim the open web is some scary harbinger of manipulative software when Apple's own first-party service has been caught hosting fake LastPass apps and abusive weekly-subscription services. Meanwhile on Android, I get my favorite apps off Github and don't have to interact with the enshittification-encumbered Google Play Store.