241–250 of 330 posts
They're going to heavily lockdown WKWebView after the Instagram and Tiktok revelations, probably in iOS16.1. They may even remove it entirely and force people to use SFSafariViewController (heavily locked down web browser, opaque to developers other than URL). Best of luck to anyone that was using javascript injection for legitimate purposes, others have ruined it for everyone by abusing user trust.
Earlier quoted context omitted.
People are going to reply to you with the usual "we are better than them", "we are a democracy" etc., but reciprocity clauses are very common in areas like international trade, travel, disarmament treaties, emissions control and lots more. In fact China would never have been allowed into the WTO (which happened in 2001) had they not made sweeping changes to their economy and assured the world that they would compete…
Look, I'm no fan of the Chinese social construct, but in terms of investment and development in an area I've tried to work in for the past 20 years, namely high-tech renewable energy development, the USA has dropped the ball while China has run with it. The US response has been tariffs on Chinese monocrystalline silicon PV panels, in a rather pathetic attempt to prevent them from gaining market share, while promoting…
Earlier quoted context omitted.
So, I see this bandied about a lot, but I don't see the big deal in being spied on by a government that has 0 say in my entire hemisphere? Like, I have much bigger concerns about spying done on behalf of the five eyes alliance than China (obviously this would be the opposite if I was living in China). What are they going to do with my silly viewing habits, sell my data to advertisers? Well, same deal with youtube, go…
All china has to do to have a serious negative impact on our society is give a slight boost to moronic, antisocial content (tide pod challenge or mass robbery anyone?), and a slight penalty to constructive, educational content. It would be basically impossible to detect this. Remember that this is a country that regularly threatens a war that would likely involve the US.
They're going to heavily lockdown WKWebView after the Instagram and Tiktok revelations, probably in iOS16.1. They may even remove it entirely and force people to use SFSafariViewController (heavily locked down web browser, opaque to developers other than URL). Best of luck to anyone that was using javascript injection for legitimate purposes, others have ruined it for everyone by abusing user trust.
One could just follow what browsers do for extensions: have the developer specify a list of all the hostnames that they want to enable script injection on in a manifest, and ask for permissions at the start. Anything not on the list must be loaded via a sandboxed browser.
Keeps legitimate uses functional while preventing broad script injection.
Can websites protect against this through the use of Content Security Policy (CSP) [0]? [0] https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
Earlier quoted context omitted.
It might make it much harder to inject stuff, but since the apps control all aspects of the embedded browser and CSPs are enforced by the browser, they could feasibly just disable CSP enforcement and have the embedded browser ignore the CSP.
I don’t think Apple gives access to the CSP or a choice in obeying it. I’ve been working with WKWebView recently and don’t remember running across it. Now you could go really far to get around it. Request resources yourself and hand them to WKWebView directly so no CSP is served but that’s not going to be easy. You’d have to scan for any other resources that might get loaded, pull those, inject them correctly, etc. S…
Just make your own http(s) requests, fetch the page contents, ignore header CSP, strip CSP in the HTML and send the string to the web view thing. A cursory glance at the documentation seems to show that the web view thing allows for rendering HTML strings. Not sure if that also loads external resources in the HTML supplied, but if so it would be relatively minimal work.
(Companies have spent much more dev effort to get similar tracking capabilities. E.g. WeChat on Android implements an entirely custom rendering engine from scratch rather than use any system web view component.)
Earlier quoted context omitted.
TikTok is brought up because it has an insane amount of influence on the culture and identity of a huge swath of people. Do you seriously believe that China, or any country, would not want to leverage such influence to persuade or alter the culture or a potential advisory? We all shit our pants because Russia used Meta, and American company, to influence the 2020 election. Imagine the same amount of data, a more accu…
Who are you, Xi Jinping? You basically word for word translated their foreign social media policy. Luckily we live in a capitalist free market, free competition ideology and not a heavy protectionist centrally influenced market economy here in the US.
Earlier quoted context omitted.
It is not a double standard. There are already legal and cultural limitations in the US that have much more respect for user consent, user privacy and intellectual property than in China. Any US company caught putting arbitrary keyloggers in products can and should be condemned. Companies still track large amounts of data and pull shady antics, but the big difference is there is a means of holding US companies to acc…
> the big difference is there is a means of holding US companies to account if they violate privacy standards Have yet to see this in practice. What usually happens is a bunch of articles are written "condemning" their actions, they are fined some ridiculously small amount and then business continues as usual. The most recent action that seems to have had a significant impact on how Facebook captures data is Apple's…
US companies and regulators do not have to be shining beacons of user privacy and protections to be better than a system with no boundary between the state and private companies, with no expectation of privacy, and with censorship of opinion that criticizes shortcomings of the state.
I always hate in app browsers and always reopen them in Safari, for UX reasons. Now I hate them even more, with even stronger reasons.
Unfortunately I think they’re very popular with unsophisticated users. I’ve heard stories about companies getting a ton of support emails because someone clicked on an article link shown in $someApp, the user was booted to Safari, and didn’t know how to get back to where they were before. I’ve heard of developers adding the in-app thing despite hating it personally just to reduce the support burden.
They're going to heavily lockdown WKWebView after the Instagram and Tiktok revelations, probably in iOS16.1. They may even remove it entirely and force people to use SFSafariViewController (heavily locked down web browser, opaque to developers other than URL). Best of luck to anyone that was using javascript injection for legitimate purposes, others have ruined it for everyone by abusing user trust.
> They're going to heavily lockdown WKWebView after the Instagram and Tiktok revelations, probably in iOS16.1 are you just making a prediction, or do you have knowledge of this?