421–430 of 469 posts
I hope Apple doesn't disable JS injection in WKWebViews in response to this. JS injection is the (only?) way to call native Swift methods from JS ie. bridging. I am not sure what the solution here is. Maybe only allow injection to sites you control (via apple association file).
I was super confused by this since to the best of my knowledge SFSafariViewController blocks anything like this, you, as a developer, cannot inject anything or peak into the view it creates. Then I got to the bottom and realized I was correct, but FB/Meta/IG/etc aren't using SFSafariViewController and instead using the older ways to embed a web view. Honestly I thought all other methods had been deprecated and had no…
That said, in general, never, ever use in app browsers for surfing the web. We use them for specific pages on our website that should interact back to the app, otherwise we tell the system to open the URL in the user's browser
As a provider is it possible to defend against this with a Content Security Policy or does this mechanism override the site’s CSP?
Not only would CSP block it, but this type of behavior only strengthens Apple's decision to not allow third party rendering engines. Could you imagine the privacy nightmare that would ensue if Facebook could release a browser that bypassed any and all safeguards implemented by site operators?
Only Instagram? Every app maker who makes an in app browser can see what you do, that’s the point of embedding it. And why not? You arrive there because of a link in the container app you clicked on. They want to see what you do with the link they gave you. Otherwise only Google/Apple can see what you do with it. Someone can see what you do with the link no matter what.
Regardless, i don't consider it to be acceptable behaviour by Instagram to inject their tracking into all web pages i access through their app just because they can.
I was super confused by this since to the best of my knowledge SFSafariViewController blocks anything like this, you, as a developer, cannot inject anything or peak into the view it creates. Then I got to the bottom and realized I was correct, but FB/Meta/IG/etc aren't using SFSafariViewController and instead using the older ways to embed a web view. Honestly I thought all other methods had been deprecated and had no…
I was super confused by this since to the best of my knowledge SFSafariViewController blocks anything like this, you, as a developer, cannot inject anything or peak into the view it creates. Then I got to the bottom and realized I was correct, but FB/Meta/IG/etc aren't using SFSafariViewController and instead using the older ways to embed a web view. Honestly I thought all other methods had been deprecated and had no…
How come that my apps get rejected if i don't use SafariViewController but they can publish them?
How is that possible that Google Play and Apple store allow apps like this to get published?
I was super confused by this since to the best of my knowledge SFSafariViewController blocks anything like this, you, as a developer, cannot inject anything or peak into the view it creates. Then I got to the bottom and realized I was correct, but FB/Meta/IG/etc aren't using SFSafariViewController and instead using the older ways to embed a web view. Honestly I thought all other methods had been deprecated and had no…
I hope Apple doesn't disable JS injection in WKWebViews in response to this. JS injection is the (only?) way to call native Swift methods from JS ie. bridging. I am not sure what the solution here is. Maybe only allow injection to sites you control (via apple association file).
A domain verification would be a huge hassle for me, since I provide an app builder that allows my non-technical customers to build an app (which includes a webview). Asking them to do domain verification would be tricky.
I was super confused by this since to the best of my knowledge SFSafariViewController blocks anything like this, you, as a developer, cannot inject anything or peak into the view it creates. Then I got to the bottom and realized I was correct, but FB/Meta/IG/etc aren't using SFSafariViewController and instead using the older ways to embed a web view. Honestly I thought all other methods had been deprecated and had no…
How come that my apps get rejected if i don't use SafariViewController but they can publish them?
Earlier quoted context omitted.
What do you think is more likely? That your child will stumble upon, correctly identify and successfully exploit an in-app webview, or that they will simply type "4chan" into Google on a school/library/friend's computer/phone? Unless they are under constant supervision, they will find a way to access what you're hiding from them. And if they are, well then you don't need technical blocks in the first place, do you?
If I can slow my kids down by a year or three, it's well worth it.
I'm not telling not to worry about your kids' safety. I'm telling you not to worry about them dying from a lightning strike because they walk to school next to a 6-lane road full of drunk drivers every day. If they're going to get hurt, it won't be through the most complicated and least-likely way possible.