Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple's claim is that it bans other browsers for security

twitter.com

Post reply on HN
Print view View original

11–20 of 593 posts

Re: Apple's claim is that it bans other browsers for security

#11

Post by mtomweb »

causi wrote: post #4
iasay wrote: post #2

It depends how you look at it and this twitter post takes only one perspective. Mine is different. The security I'm interested in for my use case is that there is one egress point from the operating system as far as a browser goes. That means I don't have apps shipping their own browser engines to circumvent the system block lists and screen time whitelist controls. Also comparing CVE rates is pointless as that's exp…

That means I don't have apps shipping their own browser engines to circumvent the system block lists and screen time whitelist controls. The mechanism for banning third-party browsers is rejection by the App Store reviewer, correct? Supposing Apple allowed third-party browsers but disallowed embedded browsers in non-browser apps, how would this security model change at all?

For In-App Browsers we'd advocate for implementing a system similar to CCT which means that it just uses the user's default browser. For WebViews for native apps we'd advocate for simply using the system browser (every other solution seems too complicated).

Re: Apple's claim is that it bans other browsers for security

#12

Post by brundolf »

xrisk wrote: post #8
amelius wrote: post #6

So they are saying that they can't make a secure sandbox? Why is running other applications somehow secure?

fwiw: the App Store also prohibits JITed code or in general code pulled in after app publishing. I guess the idea is that (at least in theory) that Apple sees all code that an app runs.

Not all code pulled in after app publishing; it's very common to push at least JS code to an app after the user's installed it, without going through the App Store

But I think they draw the line at native (read: unsafe) code, which, is not totally unreasonable

Re: Apple's claim is that it bans other browsers for security

#13

Post by criddell »

xrisk wrote: post #8
amelius wrote: post #6

So they are saying that they can't make a secure sandbox? Why is running other applications somehow secure?

fwiw: the App Store also prohibits JITed code or in general code pulled in after app publishing. I guess the idea is that (at least in theory) that Apple sees all code that an app runs.

There are development environments that run on the device. For example, Pyto[1] is for developing and running Python code.

[1]: https://apps.apple.com/us/app/pyto-python-3/id1436650069

Re: Apple's claim is that it bans other browsers for security

#14

Post by MBCook »

I’m going to ignore the security angle and post my big fear.

Chrome has dominance similar to IE at the height of its popularity.

Whatever you think of their decisions, Apple is the only thing stopping a 90%+ Chrome web. (Note: not why they’re doing it, just a side effect)

People keep arguing Apple is being anti-competitive. But no one seems to recon with the possible consequences of what they’re asking for. And I fear we may get a pyrrhic victory if these groups/governments keep pushing.

No, I don’t know a good solution. But I don’t think letting Chrome totally own the web is a good outcome.

Re: Apple's claim is that it bans other browsers for security

#15

Post by MBCook »

criddell wrote: post #13
xrisk wrote: post #8

Earlier quoted context omitted.

fwiw: the App Store also prohibits JITed code or in general code pulled in after app publishing. I guess the idea is that (at least in theory) that Apple sees all code that an app runs.

There are development environments that run on the device. For example, Pyto[1] is for developing and running Python code. [1]: https://apps.apple.com/us/app/pyto-python-3/id1436650069

But that’s probably a regular interpreter, not a JIT.

Re: Apple's claim is that it bans other browsers for security

#17

Post by mtomweb »

MBCook wrote: post #14

I’m going to ignore the security angle and post my big fear. Chrome has dominance similar to IE at the height of its popularity. Whatever you think of their decisions, Apple is the only thing stopping a 90%+ Chrome web. (Note: not why they’re doing it, just a side effect) People keep arguing Apple is being anti-competitive. But no one seems to recon with the possible consequences of what they’re asking for. And I fea…

Safari still has around 60% on MacoS and all the normal users believe that there is browser competition now. At best it's speculation, but we can compare that to the very real harms of Apple's browser ban.

We've written about the harms in detail here: https://open-web-advocacy.org/files/OWA%20-%20Bringing%20Com...

Re: Apple's claim is that it bans other browsers for security

#18

Post by JamesSwift »

amelius wrote: post #6

So they are saying that they can't make a secure sandbox? Why is running other applications somehow secure?

Yeah thats the part that always bugs me and makes me lean toward it being a disingenuous reason. Like... thats the entire point of your sandbox. It doesn't matter if you run program A or program B, from the system's perspective the risk is the same.

Re: Apple's claim is that it bans other browsers for security

#19

Post by mtomweb »

xrisk wrote: post #8
amelius wrote: post #6

So they are saying that they can't make a secure sandbox? Why is running other applications somehow secure?

fwiw: the App Store also prohibits JITed code or in general code pulled in after app publishing. I guess the idea is that (at least in theory) that Apple sees all code that an app runs.

They allow Wechat and Alipay to pull in code after publishing (See Mini-Apps). Regardless there's no evidence that Safari would do a better job at protecting user's security than Firefox or Chrome/Edge.

Re: Apple's claim is that it bans other browsers for security

#20

Post by Spivak »

Every discussion about this seems to have people cutting themselves on Occam's razor left and right. The idea that there can only every be one true motivation for someone's actions isn't even true for the individual, much less a massive organization. It can be simultaneously true that Safari being the only browser on iOS is enjoyed by the business side of Apple and the engineering side of Apple for different reasons.

And good lord this line of argumentation is extremely disingenuous even if you think the actual analysis is good (counting CVEs is not exactly the best measure). One because no one except nerds are going to switch browsers in response a random CVE and two because it doesn't even establish what Apple actually means by security and instead goes off on a rant "well if Apple really cared about [my personal view of] security you would blah blah" -- literally zero effort to understand the opposing view or evaluate other possible ways of addressing the security concerns.

But ya know, "Safari lags behind other browsers in RCE mitigations and mean time to patch" doesn't grab headlines and doesn't prescribe a single solution that is also motivated by more than just security ;)

Post reply on HN