Hacker News Reader

Comment by jolux | Hacker News Reader

Apple has its own opinions about what web standards it should implement. It’s as simple as that. Google has been extremely successful in convincing developers that browsers that don’t behave like Chrome are behaving wrong.

Don’t get me wrong, I wish Safari had more features, fewer bugs, and an evergreen release cycle. It’s clear Apple do not see themselves as competing with Chrome, largely because of iOS, and I do want them to take it more seriously. But the people who write Chrome explicitly do not care about other browsers, and think that the world would be a better place if Chrome were the only one. Between that behavior and the whole AMP fiasco, I’m surprised so much of the blame gets thrown at Apple for destroying the web. Am I supposed to be writing PWAs now, or AMP pages? If Reddit can’t figure it out, how the fuck am I supposed to?

View on HN

You’re talking as if the W3C or even Mozilla don’t exist. This isn’t an Apple vs Google thing. This is an Apple vs web standards thing. That’s why Safari is outdated for developers.

W3C hasn't been involved in HTML "standards" for over ten years now (they're hosting the CSS WG, though).

Don't get me wrong. I think WHATWG (Domenic et al, and Hixie before) worked very hard to bring HTML forward. And the idea to have a loose workshop of "browser vendors" agree on how to evolve browsers might've looked like a good one at the time. But is nevertheless not what standards are about, especially when it drives "browser vendors" out of business or out of producing browsers alltogether (such as Opera, Hixie's original employer, and even Microsoft).

Also, Mozilla lending credibility to such an effort hasn't helped Mozilla either when Firefox has fallen from its position as dominant and innovative browser to low 1-figure usage.

At a certain point years ago, work done on "web standards" has become a Google stealth ops to own the Web even more than they already do. As it stands, WHATWG will be remembered as the ones to have killed the Web, and oddly enough, Apple as the last ones standing in opposition to a web owned by Google. Certainly not webdevs caring about fscking PWAs and push notifications that absolutely nobody wants.

For the most part W3C is where standards go when they’re finished (often long after developers expect them to be available everywhere, especially these days). WebUSB for example is currently a draft, not a standard. Many of these complaints are about technologies that Chrome implements that have yet to be fully standardized.

> Many of these complaints are about technologies that Chrome implements

The article mentions explicitely: WebRTC, VP9, WebP, notifications, home screen icon shortcut, Local data storage, camera, microphone, USB port, and some more.

The only one in there that is not supported by w3c, as far as I know, is USB. All others are proper W3 standards yet unsupported by Apple WebKit/Safari.

Many of these complaints are about technologies that are fully standardized and supported by all other mayor browsers.

Notice how these are all Google technologies?

That doesn't contradict your point per se, but it basically feels to me like Google is dictating the standards right now. So I'm not sure Apple needs to play along.

It seems like the bigger issue is that Apple isn't playing a bigger part in developing web standards. If Apple doesn't like certain features, they should fight to keep them from being standardized, instead of just refusing to implement them on their own browsers. Where else are web developers supposed to look towards when trying to figure out what's standard and what's not?

How is push notifications, local storage, camera, location, microphone and USB "Google tech"?

This isn’t an Apple vs Google thing. This is an Apple vs web standards thing.

It’s actually and Apple vs. APIs and technologies that allow fingerprinting on the web thing.

Nobody mentions that Mozilla has sided with Apple much of the time to not implement some of these same APIs and technologies.

> It’s actually and Apple vs. APIs and technologies that allow fingerprinting on the web thing.

Of course it isn’t. Apple had longstanding (years long) bugs with IndexedDB. Their PWA implementation has been buggy from day one. They don’t implement push because it threatens their native app ecosystem, not because of privacy concerns.

Yes, there are some APIs with privacy concerns. But that’s a small part of the story of Apple’s neglect.

Then apple should focus on improving the APIs to be privacy safe (how they successfully do in their own APIs). But they are not.

It is not about privacy. It is about revenue.

hen apple should focus on improving the APIs to be privacy safe (how they successfully do in their own APIs).

If you follow some of the conversations on GitHub when a proposal comes up from Google, which I sometimes do, there’s no simple way to make some of these APIs private. And when Apple proposes ways to do so, Google balks at them because… their revenue is based on advertising that tracks users across the web. It’s not rocket science.

Remember, Google is the only company that ships a mainstream browser that doesn’t come with privacy settings by default. There’s no features in Chrome to block trackers or limit how 3rd party cookies are used unlike Safari, Firefox and Edge.

Apple’s market cap is around 2.5 trillion dollars; while they make revenue from apps, it’s a rounding error compared to their overall market cap or their iPhone revenue.

I don't know why you think the market cap is relevant here. But Apple's net income in 2020 was about $60B. The total App Store revenue was about $64B, out of which Apple extracted $20B in rent.

Not all of that $20B was profit, but based on what we know about the economics of running such stores, it was about $15B of profit. That is 25% of all of Apple's profit in 2020.

Apple will do anything to protect that income stream. If the way to protect it is to cripple the web, well, you can't make an omelette without breaking a few eggs.

And yet nobody is writing such articles about Firefox. There's plenty that's not privacy-invasive and that Firefox thus does implement, that Safari does not or does buggily.

Perhaps it has to do with Firefox not being the only browser(/browser backend) available on an entire class of Mobile devices.

> It’s actually and Apple vs. APIs and technologies that allow fingerprinting on the web thing.

A sibling comment says:

> The article mentions explicitely: WebRTC, VP9, WebP, notifications, home screen icon shortcut, Local data storage, camera, microphone, USB port, and some more.

Some of these things enable (more) fingerprinting, but VP9 and WebP? Nah.

I have all kinds of Apple stuff--phones, laptops, accessories--but a lot of what they do is strategic in service of enlarging their profit margins (look at right to repair, for example). I don't necessarily blame them; capitalism is a race to the bottom here. But let's not cast Apple in this light of noble privacy defenders. They're doing that to make money too.

For all pratical purposes they don't.

W3C nowadays only retifies standards that are in widespread use, and Firefox is no longer relevant in our browser matrix for deliveries, with a single digit usage.

>You’re talking as if the W3C

The W3C doesn't exist, hasn't mattered for 15+ years, haven't you heard? It's not even the HTML WG that matters anymore (which took over from W3C in an ad-hoc way). It's basically Google, and that's that.

Yes. From Google's point of view they don't exist.

https://webapicontroversy.com/ and WebHID timeline: https://twitter.com/dmitriid/status/1419436102373584905

There are countless other examples

Web standards stopped mattering in 2004, these days they are just whatever Chrome implements, and like Mozilla they are kept around so that Google can pretend they don't control the web.

The fact web standards exist doesn't not mean they are to be used or implemented. If that were the case, the web would have became the semantic web by now given how much standards the W3C wrote about that.

If we’re talking about mobile browsers, Mozilla functionally doesn’t exist. That space is just Safari vs. Chrome(ium).

And Apple are not obliged to have 100% feature parity with Chrome.

And if we’re talking about iOS browsers, Google doesn’t functionally exist. That space is just Safari.

…hence why people complain about Apple’s neglect.

Why do you say that? Firefox on Mobile exists, and I was under the impression that on Android, it uses its own rendering engine.

It exists, but its market share is negligible. According to StatCounter, Firefox has a market share of 0.5% on mobile: https://gs.statcounter.com/browser-market-share/mobile/world...

Even on desktop, Firefox is sliding towards irrelevancy, with just 7% market share.

Honestly it's weird to me that more people don't use Firefox on Android. Only mobile browser that supports uBlock Origin.

Apart from that, it's also fast, rock solid, has UI on the bottom, which is much easier to use, syncs with desktop (if you want that) etc...In general, it's excellent and I don't understand why it isn't hugely more used - unless I concede to the argument that people just don't care about privacy and Google's monopoly...

The difference in the amount of attention invested in spec support in Chrome and Safari can be explained by the difference in business models between Google and Apple.

For Google, the browser is closely associated with their revenue streams. If you profit by showing ads across web properties, you’d naturally prefer to have more control over how those properties are viewed.

The motivation can be benevolent in some aspects (to show more ads, we want people to want to browse the Web more—so we want to support fancier tech enabling fancier websites to be developed more easily) and less so in others (we want to control the viewing mechanism to ensure people keep seeing ads; we want to become the de-facto standard of browsing so that we don’t have to worry some newcomer eating at our revenue stream; the more complex the spec, the bigger our moat).

To Apple, the browser means relatively little on desktop; on the more sandboxed mobile OS it matters more due to being responsible for a lot of the attack surface.

Even worse for Apple, if there was a more capable browser on iOS, the need for their app store would be reduced.

Reddit is a pretty low bar. I don't think they care much about the site except to make it objectively worse than the app at every convenient opportunity.

> Reddit is a pretty low bar

Reddit is a multi billion dollar product and one of the most trafficked sites on the internet.

If you've ever used their mobile site, it's clear they go out of their way to sabotage the experience so that people will use the native app instead

Shit they even admit as much with the popup for the app saying "it's better in the app".

The oddest thing is it's still better on the web than the Android app that's practically unusable. You click open in app and then it loses your thread you're trying to read. I don't even have any strong objections to the app but happy to dance though the dark ux pattern to read the posts!

I have a curated list of subreddits I like to read. The moment old.reddit and i.reddit stop working I'll drop them like a bad habit. I'm not going to use their absolutely terrible "new" UI nor their insipid app.

As of late, if you’re not logged in, many features get disabled, like the ability to expand/read more comments.

Use old.reddit.com/i.reddit.com and many of those restrictions go away.

They sabotage the desktop site as well. I don't understand how anybody can see the current atrocity as an improvement. It's borderline unusable.

Why do they continue to degrade the mobile/desktop default web experience? Promoting the app is one thing, but then actively harming the user experience? Do most people not care? Insane either way. The day old.reddit dies Ill blacklist the site permanently.

Most consumer companies don't necessarily care about delivering the best UX, just gamifying it to get people to spend more money or time. Just look at AirBNB. You used to be able to sort by price but that option is gone completely and now you have to rely on their algorithm. There is no reason they would neuter the search unless it lead to more bookings.

As far as Reddit, I'm surprised the 3rd party apps using the API haven't gotten ads yet. They're heaps better than the official Reddit app.

They are degrading the web experience because it's easier to block trackers and advertisements in the web. When users are driven to the application, Reddit owns the whole experience and only people who are capable of configuring home firewalls have any hope of privacy.

Gordon Geckos are running the show.

A bit of a fallacy don't you think?

So learning a new language and OS (ObjC/Swift and iOS) is easier than learning a new web API when you're a web developer? And it's cool because everyone simply has their own _standards_? That's... a take I guess.

Why would you lump PWAs and AMP pages together? They're hardly the same problem. PWAs are a threat to the App Store model. It's obvious that it would spawn a new category of apps that effectively enable sideloading. You've got access to all the native functions too (sensors, camera, storage). Apple doesn't want that. So they drag their feet when it comes to support.

There is a tremendous bias in favor of Chrome in developer communities. E.g., things that aren't implemented in either Chrome or Firefox (well, it's their site) aren't even listed on MDN. (The CSS section is somewhat better on this.) Which creates this whatever-Chrome-is-doing effect…

Apple's opinions are simple: If they have a good browser, then the app store - their cash cow - becomes unneeded.

Google's opinions are just as simple: if the web loses even partly to apps, their cash cow becomes unneeded (80% of Google's revenue is online advertising).

Yes, exactly. Apple’s parochial interests are in opposition to the web being useful, Google’s are aligned with the web being useful.

No. Google's are aligned with the web being useful to Google. This is not the same as "the web being useful".

And these days more often than not Mozilla (which has no stakes in either apps or online advertisement) sides with Apple: https://webapicontroversy.com

I don't buy Mozilla's/Apple's concerns for those APIs.

Sure if seems sketch to access USB from the web, but as a user if I'm trying to achieve something and I can't do it on the web, I'll end up installing a native app which has way more access to my system.

As a developer I would much rather be able to just deploy cool things on the web instead of having to package up native apps for every platform just to do things like read/write NFC tags, or send notifications to users who want them.

> I don't buy Mozilla's/Apple's concerns for those APIs. Sure if seems sketch to access USB from the web, but as a user if I'm trying to achieve something and I can't do it on the web, I'll end up installing a native app which has way more access to my system.

There's a third possibility: that you give up achieving that something. The "activation energy" of installing an app is higher than loading a website, so if the user's desire for achieving that something is not strong enough, the native app won't be installed.

And besides, most users know (or should know) that installing apps can be risky, while a website is supposed to be sandboxed. That is, absent exploitable browser implementation bugs, going to any website should be safe.

How is giving up on achieving something a win for users?

Take Background Sync for example.

Mozilla considers the periodic sync API "harmful" because you could use it to track users IP and consumer resources when it's not clear they're interacting with the site

Their stated position:

> We're concerned that this feature would allow users to be tracked across networks (leaking private information about location and IP address and how they change over time), and that it would allow script execution and resource consumption when it isn't clear to the user that they're interacting with the site. We might reconsider this position given evidence that these concerns can be safely addressed, however, addressing them for periodic background sync appears substantially harder than doing so for one-off background sync.

But you could achieve very similar behaviour by using Web Push (which they _have_ implemented) and just sending periodic push message. So now as an honest web developer if I want nice background sync behaviour I have to implement some Rube Goldberg system of periodic push messages from a backend rather than just asking the system to wake me up every now and then.

> But you could achieve very similar behaviour by using Web Push

The fact that something was implemented, shipped, and has security/privacy hole is not an argument to implement and ship something else with a similar hole.

If the hole exists and is not going to be closed, why refuse to add other useful features that use the same hole?

It's like taking a room, and refusing to add a back door for "security" when the front door already exists.

Why expand the surface are of the hole?

Besides, it's quite possible that the hole in WebPush does not allow for some/many scenarios that a background sync would.

Because if the hole exists at all, malicious actors will find a way to abuse it. But if non malicious developers have to jump through too many hoops to provide useful functionality to users they will just give up and users lose out.

> Because if the hole exists at all, malicious actors will find a way to abuse it.

Yes, they will. So the question remains: why expand the hole?

Because it makes no difference if the hole is small or large. To an attacker its the same size.

It does make the difference. You don't deliberately increase the surface of attack if you can help it.

I feel like your speaking in atitides, but not looking at this situation specifically.

If I can unlock your computer with your password or with the word "hello" and you have no intention of removing the "hello" feature, would you not agree that we might as well remove the password entirely?

How do we increase the attack surface of service workers by adding background sync, when we can get nearly identical behaviour using push?

If you goal is purely to not increase the attack surface, you might as well never add any new APIs ever.

If you're going down the analogies rabbit hole: let's say your front door is unlocked. Should you then just open all your windows because, you know, everyone already has access to your house?

> when we can get nearly identical behaviour using push?

The devil is in the details: is it nearly identical behaviour? How nearly is it identical? I personally don't know.

One wakes up the background page on a timer, the other wakes it up based upon a external controllable trigger. It's trivial to fire that external trigger based upon a timer.

s/atitides/platitudes

> if I'm trying to achieve something and I can't do it on the web, I'll end up installing a native app which has way more access to my system.

This is not an argument to just go ahead and implement WebUSB/Bleutooth/Serial/whatever.

> As a developer I would much rather be able to just deploy cool things

Ah yes. It would so very nice if we could just trust all developers to not be malicious actors.

The fewer features the browser has, the more code ends up as native apps or on cloud backends instead of the user's device.

How many IoT devices could have just used bluetooth for interactive with them, but instead they all phone home to some central cloud server because the user experience of just hitting a web page is better than installing some clunky native app.

Should we "just go ahead" and expose everything? Of course not. But there's room for thoughtful implementation of these features that users want. A super secure platform that nobody uses provides security to no one.

> But there's room for thoughtful implementation of these features that users want.

Yes, there is. And that's exactly the position of both Firefox and Safari: don't rush in and implement stuff just because you can.

There is a rush to implement stuff though. The demand for functionality continues to grow, and if the platform stagnates developers and therefore users will move to other platforms.

It needs to be thoughtful, but the firefox position appears to be that web apps have no business accessing bluetooth or usb. Which as I explained earlier leads to user installing clunky native apps to interact with their bluetooth/usb gadgets, or the gadgets being deployed with phone home functionality so that user can still access them through a web portal.

If firefox wishes to remain relevant they're going to have to implement the things that developers and users want. Nobody wants a dumb document browser anymore, that ship has sailed. Browsers are a ubiquitous application platform.

> Chrome explicitly do not care about other browsers, and think that the world would be a better place if Chrome were the only one.

They are gunning for monopoly. No shame in that. The chrome app is the biggest gateway to the internet globally and winning that war means complete dominance as the world moves towards web applications. Using the carrot rather than the stick.

But therein lies the rub. Safari is betting on being bundled with macOS/iOS. That's a cool few million users with nary a breath of effort. I can at least empathise with Apple. Why put in the effort like a schmuck selling fried chicken, chips and skateboards door to door when I can lay back and just collect the meatball bacon cheddar pizza rolls falling from the sky?

> They are gunning for monopoly. No shame in that.

It is pretty shameful if you’re simultaneously claiming to be the biggest defender of the open web.

> Why put in the effort

It’s pretty clear why at this point: developers hate them and antitrust regulators are looking for the right opportunity to go for the throat. Apple screwed up when they killed Safari on Windows, they could have had a solid shot at being the #2 browser in the world on the merits ten years ago and they totally blew it. Eddie Cue even wrote about this in some of the emails from the Epic discovery: https://twitter.com/PatrickMcGee_/status/1389632382244847623...

My sarcasm was missed.

In any case, I'm the furthest from supporting Google or anything they do. But they aren't better or worse than Apple Inc.

To defend google, yes their software has the windows problem. They have to support an absurd amount of devices. So them pushing standards is just a big whale trying to get ahead of itself. No harm in that as long as devs don't go for bleeding edge features and harbour any expectations of cross browser compatibility.

In not blaming Google or the regulators. They can duke it out as long as the public benefits.

Safari wasnt all bad when IE was a thing. It's just that they took IE's spot by being obtuse and generally the rich kid who's a wierdo.

Thanks for the tweet link. Is there a site where leaks like this are common? I really liked it more than I should and how much Apple surprisingly looks at Google. I'd always thought Apple is above looking at companies serving peasants with peasant devices.

I believe I got that link from Daring Fireball originally.

All capitalists really want to be monopolists. There is some shame in that yes.

But the real shame is for the system, the laws, that allow that to happen.

Shaming Google or Apple does not do much. Legislating against monopolies like AppStore would be the solution.

> Legislating against monopolies like AppStore would be the solution

I'm sure Microsoft (Xbox game store), Sony (PSN store) and Nintendo (eShop) will be on board with banning proprietary app store monopolies owned by the hardware vendor.

Reply on news.ycombinator.com