Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple confirms it's breaking iPhone web apps in the EU on purpose

techcrunch.com

Post reply on HN
Print view View original

31–40 of 829 posts

Re: Apple confirms it's breaking iPhone web apps in the EU on purpose

#31

Post by kemayo »

secondcoming wrote: post #20
LeoPanthera wrote: post #7

Since the article doesn't actually repeat what Apple has said, here's what Apple says: == Begin quote == The iOS system has traditionally provided support for Home Screen web apps by building directly on WebKit and its security architecture. That integration means Home Screen web apps are managed to align with the security and privacy model for native apps on iOS, including isolation of storage and enforcement of sys…

> malicious web apps could read data from other web apps and recapture their permissions to gain access to a user’s camera, microphone or location without a user’s consent. How is this even possible? It's shocking that these APIs even exist for any browser to use.

I assume you mean the "read data from other web apps" part. That'd be because there's (presumably) not a system-level way to launch a third-party browser in "web app mode", with all data siloed off per-PWA. Thus the only way they could currently make web apps work would be to launch the third-party browser and trust that it silos everything adequately itself internally.

Apple could add a bunch of new APIs to support this case for third-party browsers. Presumably there's something equivalent that's being done for said web apps currently in Safari. But they're not wrong to say that there's not an existing system in place that said third-party browsers are already written to use. (And, you know, they're clearly not invested in trying to make this law succeed.)

Re: Apple confirms it's breaking iPhone web apps in the EU on purpose

#32

Post by foobarchu »

rimunroe wrote: post #14
sccxy wrote: post #11

Earlier quoted context omitted.

TLDR: We did not want to give other browsers too powerful apis to compete with Safari & App Store.

From the (admittedly little) I know about how iOS handles security and the speed at which they responded this sounds like a pretty credible explanation to me. What makes you think it isn't?

Have to agree (disclaimer, haven't been an iPhone user since the 4). Suddenly allowing all browsers to have those kinds of native permissions, even with massive testing, sounds like a security nightmare. You're introducing an entire extra dimension for security holes, given how much trust people place in their phones.

This doesn't sound at all the same as allowing other engines for use inside browsers, based on both apples defense and the take-downs on them.

Re: Apple confirms it's breaking iPhone web apps in the EU on purpose

#34

Post by jensensbutton »

LeoPanthera wrote: post #7

Since the article doesn't actually repeat what Apple has said, here's what Apple says: == Begin quote == The iOS system has traditionally provided support for Home Screen web apps by building directly on WebKit and its security architecture. That integration means Home Screen web apps are managed to align with the security and privacy model for native apps on iOS, including isolation of storage and enforcement of sys…

Seems like an OS problem. They should fix that.

Re: Apple confirms it's breaking iPhone web apps in the EU on purpose

#35

Post by carlosrg »

LeoPanthera wrote: post #7

Since the article doesn't actually repeat what Apple has said, here's what Apple says: == Begin quote == The iOS system has traditionally provided support for Home Screen web apps by building directly on WebKit and its security architecture. That integration means Home Screen web apps are managed to align with the security and privacy model for native apps on iOS, including isolation of storage and enforcement of sys…

Didn't Apple made a comprehensive list of requirements for alternative web browsers and web browser engines so they are secure and don't compromise the user's security? (https://developer.apple.com/support/alternative-browser-engi...)

I'm a little confused. So that long list of requirements is useless for PWAs?

Some people will actually believe this. I'm utterly disgusted by Apple and their arrogance regarding the DMA, and the way they've managed all of this. My perception of them has completely changed. However, they seem very obedient when China asks them to censor apps or, for example, limit AirDrop when there's a protest going on.

Re: Apple confirms it's breaking iPhone web apps in the EU on purpose

#36

Post by cma »

zer00eyz wrote: post #22
LeoPanthera wrote: post #7

Since the article doesn't actually repeat what Apple has said, here's what Apple says: == Begin quote == The iOS system has traditionally provided support for Home Screen web apps by building directly on WebKit and its security architecture. That integration means Home Screen web apps are managed to align with the security and privacy model for native apps on iOS, including isolation of storage and enforcement of sys…

Without this type of isolation and enforcement, malicious... camera, microphone or location ... Browsers ... 30 some million lines of code in chromium browsers. Thats bigger than the linux kernel. The HN crowed might not LIKE apples response but they have a very defensible position. Edit: Its not like we haven't seen this play out on the desktop recently: https://www.theverge.com/24054329/microsoft-edge-automatic-c..…

But the plain browser already can request camera permissions, in a bad security situation a site that didn't request it still receives it from the browser's system level request.

This is just Apple wanting to avoid people being able to develop a platform on top of their platform without paying a tax.

Re: Apple confirms it's breaking iPhone web apps in the EU on purpose

#37

Post by gear54rus »

johanneskanybal wrote: post #25

As a European dev I want apple to fail super hard and implode. They used to be so cool and make slick hardware for their nische but now I'm happy to use worse hardware as long as they disapear from the face of the earth.

They ain't never been cool. The shit practices they are trying to defend were there from day 1 and are baked into their DNA. Treating their users like stupid animals that don't know what's good for them is what they do. And they will fight tooth and nail to continue to do it. Even as EU tries to kick their predatory ways out of them.

To think there's a hardware thing in 2024 that does not allow its owner to compile and install arbitrary software while still calling itself a smartphone is just laughable.

It's a good thing people are starting to wake up to this even on legislative level.

Re: Apple confirms it's breaking iPhone web apps in the EU on purpose

#38

Post by agust »

LeoPanthera wrote: post #7

Since the article doesn't actually repeat what Apple has said, here's what Apple says: == Begin quote == The iOS system has traditionally provided support for Home Screen web apps by building directly on WebKit and its security architecture. That integration means Home Screen web apps are managed to align with the security and privacy model for native apps on iOS, including isolation of storage and enforcement of sys…

[flagged]

Re: Apple confirms it's breaking iPhone web apps in the EU on purpose

#39

Post by MBCook »

amelius wrote: post #26
secondcoming wrote: post #20

Earlier quoted context omitted.

> malicious web apps could read data from other web apps and recapture their permissions to gain access to a user’s camera, microphone or location without a user’s consent. How is this even possible? It's shocking that these APIs even exist for any browser to use.

I didn't read the article, but to me it sounds like Safari's security mechanisms need more work.

Safari is fine.

Other browsers would have to be trusted, Apple doesn’t have a mechanism to ensure that they do what they’re supposed to.

So until they have time to add one (remember they already had to create all the API‘s for third-party browsers to use), they’re not allowed to give Safari preferential treatment. So they had to remove the feature.

Re: Apple confirms it's breaking iPhone web apps in the EU on purpose

#40

Post by deminature »

SllX wrote: post #16
deminature wrote: post #6

In combination with the 'Core Technology Fee' that financially cripples any developer that tries to release a popular app outside the official app store, this is pathetic behavior. Hopefully the EU smacks them down for this temper tantrum at being forced to adhere to the DMA. They are trying to flex their market power and should be reminded they operate within a system of laws that doesn't bend for anyone, regardless…

I’m going to be level with you: there is nothing so great about PWAs that they’re worth mandating or protecting by law in any jurisdiction and the EU doesn’t owe it to you to try. Web developers like them. That’s it, and their PWA advocacy completely disregards what a privacy and security nightmare they can be without proper safeguards, because this little device I carry around in my pocket is 1) always with me and 2…

I'm not a fan of PWAs either, but disabling them instead of allowing them to continue to run is an incredibly bad faith response to the DMA.
Post reply on HN