Hacker News Reader

Comment by PragmaticPulp | Hacker News Reader

The Write XOR Execute restriction discussed in the article is a security feature, and it’s greatly beneficial from a security standpoint.

> Until I can run a proper version of Firefox on iPad

FireFox for iOS works just fine. The Gecko vs WebKit difference doesn’t really matter in practice.

If you want general purpose computing, just get a Mac. You can run Firefox and any other program you’d like. It would be great if there was an opt-in developer mode on iOS that bypassed certain restrictions, but I also understand why Apple chose to go with security and simplicity as 99.9+% of their customers have no need nor desire to go beyond the security and platform restrictions.

I have both an iPad Pro with keyboard case and a MacBook. Even if I could run whatever I wanted on the iPad, I’d still be reaching for the MacBook because it’s just a better physical platform for doing anything other than simple touchscreen and stylus work.

View on HN

Firefox on iOS is not Gecko. Like all other browsers on iOS, it is a skin on the OS-provided Webkit. This is because fast JS execution depends on operations that are illegal for apps to access.

So we're talking about the M1 Macs, not iPhones - Firefox on Mac is Gecko. So the comparison of Webkit (iOS FF) vs. Gecko (Mac FF) is the comparison being made as you can download both if you want.

W^X JIT seems to have been solved in Firefox in 2016. https://www.phoronix.com/scan.php?page=news_item&px=W-XOR-E-... So that's not the specific blocker for Gecko on iOS.

W^X doesn't get you very far on iOS. Apps are not allowed to make pages executable at all.

There is an opt-in developer mode on iOS. You can compile and install any software you want on your own iPad; no paid Apple developer account needed.

There’s even a way to get W^X memory regions on iOS by abusing ptrace: https://saagarjha.com/blog/2020/02/23/jailed-just-in-time-co...

It can’t be submitted to the App Store or deployed with TestFlight, but you can build and install an app using that hack just fine on your own device.

Open source browser vendors, like Firefox and Chromium, could provide builds that enable a full browser engine experience on iOS devices, were they to think it worth the effort.

> There is an opt-in developer mode on iOS. You can compile and install any software you want on your own iPad; no paid Apple developer account needed.

However, an Apple ID is needed, which requires an email and working phone number to get, along with additional EULA/terms acceptance. It's not really a mode, but an additional network service with its own terms and conditions.

From the link: "Preliminary testing on iOS 14 seems to indicate that Apple has changed the kernel so that this trick no longer works."

This is why the iPad needs a way to disable SIP (and the additional security features) just like the Mac. I could give a heck about the iPhone, to be honest, there's maybe one time in my life being able to JIT Python or whatever would've been useful on my phone. But they advertise the iPad as a computer, and yet their software restrictions make it a portable TV.

Doh, somehow I managed to not read that despite (or because?) being in a big callout box near the top of the page.

Huh! They removed that hack in iOS 14 but added “extended virtual addressing entitlement” in iOS 14.2 that allows this for real!

https://9to5mac.com/2020/11/06/ios-14-2-brings-jit-compilati...

Extended virtual addressing is exactly what it sounds like: you get more virtual memory, not the ability to JIT. The technique mentioned in that blog post is no longer possible.

Unfortunately, the sideloaded-JIT support seems to have been an accident, as Apple killed it off in 14.4.

https://twitter.com/altstoreio/status/1354096048650809349

> But they advertise the iPad as a computer, and yet their software restrictions make it a portable TV.

That's not at all true. It's not useful for some subset of what certain geeks want to use it for. It's very useful for all the other things a highly portable computer hooked up to a bunch of really cool sensors and a very capable peripherals ecosystem is.

Ordinarily I'm all for arguments that we, as an industry (software developers, that is) are laughable failures, but I don't think we've failed so badly that computers are useless if you can't—for any reason, including personal inability or lack of interest—run (e.g.) Python on them.

I was speaking more generally than this specific issue, but things like not being able to mount file shares in a stable way (where the connection isn't dropped a bunch, although maybe that's a me issue and not a Files.app issue) are blockers to video editing with something like Premiere taking off on the iPad. No allowance of alternative browser engines means software like VSCode or Figma that rely on Electron would have to port bespoke versions to either entirely native apps or to Safari (which Microsoft has been doing with VSCode, but that's a lot of work for teams that chose to make their app an Electron app because it would save porting time). I'm more willing to excuse the second one because it has made it possible for a second browser engine that isn't built by Google, but it's still a factor.

It's more of a death by a thousand cuts scenario at this point rather than major things being completely missing from iPadOS, which is why it's painful to watch as they sell extremely powerful hardware that could be used for something cool if not for the darned restrictions.

Besides, I don't get the whole "can't do geek things on an iPad". I have an iPad Pro 2017 and I've:

- Run full linux on it (both emulated X86 and via WASM magic, via A-Shell and iSH, both on the App Store)

- Coded Python, C#, Javascript and Lua on it (via Pythonista, Continuous, Scriptable and Codea) _and_ ran the code on the iPad itself

- Wrote blog posts for my old static site and pushed them to a git repo to publish them (via iA Writer for writing and Working Copy for Git)

- Connected via SSH and RDP to "real computers" (via the Remote Desktop app and Blink!, though there's many SSH clients on the AS)

- Used SFTP to transfer files to/from said computers/servers (via Secure Shellfish)

There's also an entire class of apps built upon the Shortcuts model, that allows you to extend and improve upon the Shortcuts (née Workflow, third party now first party) "coding model", which is very powerful and heavily integrated with the device and Apple services - though very different from "traditional" coding.

Is it a limited platform? Yes, absolutely.

Is it a general purpose computer? Yes, most definitely.

Can you do "geeky things" on it? Well, I've been doing them for years.

Can you run a full UNIX-like dev environment on it? Well, yes, with tricks. But why would you want to, when there's plenty of options that do it 1) natively 2) better? Use an iPad for what its purpose is, not for what a Mac's purpose is.

The apps you install expire after a week. You need to reconnect your device to a computer at least once every seven days and reinstall the custom app. Also, you're limited to three apps at a time.

It's not actually usable for anything. It's also a completely arbitrary and needlessly-punitive restriction—if I've opted in to installing custom software, why limit me to three apps at a time, and why make them only last a week? What security benefit does that provide?

Facebook has in the past asked users to deploy their Onavo app using this mechanism for their privacy invading VPN (2015-ish).

I thought they used an enterprise certificate? Those are still available and easily can be used to distribute software without Apple review (but perhaps not for companies as high-profile as Facebook)

They are no longer easily available - presumably as a direct result of the Facebook incident. I'm sure there are companies still grandfathered in, but as a new entrant you'll be aggressively shunted toward either the B2B or consumer App Stores.

https://altstore.io/faq/ is a pretty comprehensive way to make this actually work.

It’s useful for security if you’re running arbitrary JavaScript you’ve downloaded from the internet. Its utility in sandboxing old games is (mostly) dubious.

>> FireFox for iOS works just fine. The Gecko vs WebKit difference doesn’t really matter in practice.

Yeah; sorry - it really does - I vastly prefer Gecko’s rendering engine and notice it’s considerably speedier and more responsive on my MacBook Pro side by side to the newest Safari. The app even opens faster.

Not only that, but I imagine there are a ton of web devs here in the comments who have a requirement testing on the actual FireFox, not some light skin on top of the existing WebKit engine with bookmark sync support.

FireFox for iOS is the farthest thing from ‘FireFox’. It’s in name only.

Comparing my iPad Pro with keyboard folio and a 2014 11” MacBook Air, I agree that the MacBook has a much better trackpad-and-keyboard experience.

I do wonder how the 12” iPad Pro with Magic Keyboard would compare. I haven’t used one yet, but I suspect it would be pretty good. The 12” display seems a little large for a tablet, though.

The engine difference does matter, because it prevents other vendors from making iOS a better platform for web apps. It's in Apple's interest to keep web apps an inferior experience to App Store apps:

https://infrequently.org/2021/04/progress-delayed/

Reply on news.ycombinator.com