Apple's claim is that it bans other browsers for security
twitter.com
twitter.com
Chrome has dominance similar to IE at the height of its popularity.
Whatever you think of their decisions, Apple is the only thing stopping a 90%+ Chrome web. (Note: not why they’re doing it, just a side effect)
People keep arguing Apple is being anti-competitive. But no one seems to recon with the possible consequences of what they’re asking for. And I fear we may get a pyrrhic victory if these groups/governments keep pushing.
No, I don’t know a good solution. But I don’t think letting Chrome totally own the web is a good outcome.
Imposing an artificial limit on iOS isn't how the web will move forward.
> Whatever you think of their decisions, Apple is the only thing stopping a 90%+ Chrome web.
I don't see Apple making any effort to diversify the browser ecosystem by making their browser available on other operating systems, so their inaction on other fronts isn't going to reverse the trend either.
At the same time, most desktop computer users are able to use Firefox and we can see how often they choose to do so.
https://github.blog/2022-06-10-how-we-think-about-browsers/
Of course this is just part of the story. In every country it's different. In some EU countries Firefox is up to 20%. In UK it's almost non-existent. Local markets shape the browser support. If a few major websites are too lazy to support a browser properly, users will leave, and then others can say "there are no users, so we can stop supporting!".
1. Whether this is an overt policy or simply choosing to skimp on testing, it's a choice.
Desktop-using software engineers can write software for desktop users in a ton of different ways. There's so much freedom and there exist multiple mechanisms and platforms to deploy your code.
Desktop-using software engineers are not free to choose how to deploy software to mobile audiences. They've got to go through Apple to reach 50+% of the US market. Apple sets unreasonable rules.
Unfortunately, Americans spend most of their time computing with mobile devices now. We've been forced into this situation.
Both Apple and Google have made our industry worse and more locked down than Microsoft in the 90's and 00's, and they both deserve to the the target of smartphone and browser antitrust lawsuits.
How? As a user I’m able to do the things I want with reasonable guarantees of privacy and security. Most developers that release iOS software seem to be doing ok with those “unreasonable” rules. And the user benefits. If I wanted Android, I would have bought Android. I bought Apple specifically because I see value as a user to those unreasonable rules.
I use different browsers for different things so I want to chose how to open external app links.
I would install a shim browser that does just that if I knew of one.
https://github.com/TrianguloY/UrlChecker
It also integrates ClearURLs functionality (https://gitlab.com/KevinRoebert/ClearUrls) to let you remove tracking from links before sending it to the browser or app. This feature is optional.
It was blocked in Chrome too until I toggled desktop mode on.
What are they doing, blocking based on the user agent string? How mediocre. They're clearly not doing feature detection.
On desktop it doesn't even list Firefox as an option at all.. It's pretty annoying for me because I use that portal a lot for work and I use FF on everything. Safari is not an option for me because I use Mac, FreeBSD, Windows, Linux, Android all mixed and I need the sync.
And yeah I think they're just blocking the agent. I haven't tried bypassing it. I kinda was afraid something would go wrong (I don't want to wipe 10.000 iPhones from the portal instead of 1 - lol)
Garbage.
As far as I’ve ever been able to tell it only existed to help people test the fake “apps” and their sites without buying an iPhone.
As real apps were allowed and the iPhone became more popular (so devs had them for testing sites) that need went away. And so did Safari.
What about Webkit?
Forcing users to a prebuilt Webkit, that they cannot change is definitely not the same.
If Chrome became as dominant as IE was then using Firefox on any platform might become impractical.
It denies you from using Gecko. You can use an actual Mozilla Firefox web browser on iOS.
- it protects what's important
- you can "Personalize your experience with new colorways."
- has Facebook Container
- syncs across your devices
Mozilla knows the actual engine isn't the deciding factor when trying to get people to change browsers.
So no, using the proper names for things is not a semantic nitpick. The commentator didn't not try to invalidate the parent's point, just show the language issue.
You can read Mozilla's submission about the #AppleBrowserBan here: https://www.regulations.gov/comment/NTIA-2022-0001-0131
- don’t allow it to browse the web (https://developer.apple.com/app-store/review/guidelines, section 2.5.6: “Apps that browse the web must use the appropriate WebKit framework and WebKit Javascript”)
- compile Gecko to JavaScript and run it in Safari.
If you serve the compiled Gecko from a web server I don’t see them stopping you from doing the second, but of course, it would just be Gecko, not FireFox, and performance ‘might’ be somewhat subpar.
Also while an independent entity having a larger presence is better than Apple at least Apple having a large market share makes Google need to consider what happens in safari before they do something particularly shady with web standards
Desktop-based extensions integrate pretty seamlessly, which I love
I am No one, we are legion. Have been using FF on mobile since it became viable, many years ago. I just like my ads blocked and my data mine, that's why.
IE shipped on (almost) every machine, had a ton of lock in features like ActiveX, etc. MS actively abused their monopoly position to make it so preventing default installation of Netscape by OEMs, incentivising ISVs to ensure web based enterprise products shipped with "Works best in Internet Explorer" etc. Netscape lost market share to IE not because it lost users but because while the userbase was massively expanding they were buying Wintel boxes that shipped with IE on them so they never learnt that Netscape existed.
Chrome is something users install because it's their preferred choice. We can argue as to why it's their preferred choice but the point remains that users actively download and install Chrome - usually as one of the first things they do when they purchase a new computer.
That to me puts things on an entirely different level. To compete reasonably with Chrome you need to compete for users directly. You could argue that Google abuses it's monopoly position to market Chrome and that would probably be a valid argument but again, it doesn't change the active decision users are making.
If anything Safari (especially on iOS) is more like IE. In that it serves Apple more than it serves users. Apple wants PWAs to remain gimped, by simply dragging their feet or refusing to implement certain web standards/proposals they effectively gimp PWAs. This forces apps to be written for their platform which in turn is where they generate the vast majority of their scalable growth/profit.
The android OS has no knowledge of chrome and it doesn't get any special handling or abilities like iOS/Safari.
By contrast iOS is ~50% of mobile OS market share (in the US, I think it's less elsewhere). Hardly a monopoly. If using a different mobile browser is important to you, there's a competing, popular mobile OS that can provide that.
It's good for Google when Chrome is good. So Google has a great incitament to improve Chrome. The only drawbacks would be proprietary functionality others can't use.
[1] https://www.howtogeek.com/724441/what-is-googles-floc-and-ho...
And what proprietary functionality is that? Chromium exists and does all the same things.
Ah yes.
The preferred choice advertised by dominant web search.
The preferred choice that is forced by Google apps when clicking on links that actually conveniently forget about said choice.
The preferred choice when Google sabotages competition across its dominant platforms https://twitter.com/johnath/status/1116871231792455686
And so on
Chrome is getting bundled with a buttload of software. So many software that comes with an ‘installer’ has a hidden checkbox somewhere that if you don’t uncheck it, it will install Chrome on your windows machine.
Also Edge is now the default on Windows which is also Chromium. So a Chromium-only future doesn’t sound so distant anymore.
Namely an engine isn't a product and most value-add is in the porcelain of the browser, implementation of web standards -shouldn't- be a competitive advantage because doing leads the the sort of fragmentation that we don't want.
If all the major browsers shared and worked on a single engine collaboratively (similar to PostgreSQL and Linux) I think the web would be a -much- better place as a result for a number of reasons.
1. Aforementioned standards could be relied on by developers.
2. Browser vendors could spend less time duplicating efforts on low level standards implementation that aren't product differentiation.
3. Platform specific performance optimisation could be shared across browsers instead, i.e Safari like energy performance for everyone.
4. Plugin architecture could potentially be shared across all available browsers which would help plugin authors out significantly.
5. The engine could be linked as a dynamic library so that multiple browsers could be installed without duplicating the engine binaries if they are using the same version (probably only viable on Linux distributions but would be nice)
6. Fuzzing and security efforts wouldn't need to be duplicated across engines. This is important because of just how gnarly the sorts of code you see in browsers. Namely XML/SGML parsers, JS runtimes/isolation, etc. Also with every vendor chipping in this infrastructure could likely be greatly expanded.
This is a utopian view and most of this probably wouldn't come to pass because the world sucks at doing the "right" thing but the potential is there.
On the other hand the downsides mostly amount to Chromium governance could be bad and Google could abuse their position to make it hard to create new browsers based on Chromium/Blink. However they would be incentivised not to in order to prevent a return to the current fragmented situation.
None of the future IEs were very good though, IMHO.
What? Why? I assure you that's not how Google thought of it when they were facing off against Firefox and IE. They were putting Chrome installers in every SourceForge download and telling you to install Chrome when you searched Google. Why should their competitors lie down and let Chrome roll over them?
And they were pushing it at a time when Safari for Windows was slower than Internet Explorer.
The aftermath could be the complete death of the open web. Unwinding that may be nearly impossible.
There needs to be a plan in place before Pandora’s box is opened.
Short term, it's decidedly not good, but long term? How can we know?
If the approach is so inherently flawed that this result is an inevitability, maybe it deserves to die and be replaced by something else.
This is how we end up with the death of uBlock origin (in a few months from now) on January 2023.
Firefox has resisted this thus far but I am pretty sure Google will eventually twist their arms enough to either kill it, or at the very least _severely_ handicap it.
Google is a threat to the open web, it needs to be heavily regulated and punished for all its despicable behaviors: from harvesting user data without consent to tracking our every move and selling it to anyone who wants it for pittance.
I am very well aware of the fact that many of the HNers are partaking in this and am not going to pretend that I wouldn't be tempted had I been in their shoes but I think it's time to for the smoke and mirrors to clear: Google is nothing more than a giant spyware and an adware company because their core business model _literally_ requires it. This is why they keep fighting against privacy regulations, lobby the governments, punish Adblock extensions and come up with clever ways to circumvent your privacy protections.
So no, I for one am glad that at least Apple exists to thwart this. They may not be doing this because of their "ethics" but given the choice, I'd rather side with Apple on this one.
So I don't know that seeing Safari as a bulwark against Chrome really makes sense here.
If the regulator does not step in they are choosing the status quo which by itself also is a deliberate choice. Inaction is always also a form of action.
That’s not what I see. I see people constantly calling for the ability to run other browsers (really Chrome) on iOS.
I almost never see people trying to get Google’s massive browser share reduced.
If you do one without the other I expect disaster.
That was the point of my comment. I want the “open web” people (in general, not just this org) to call for BOTH. But I don’t see that.
The blog post at the top of this thread talks about CVEs and other measures of resistance to 3rd party bad actors. It does not engage with the concept of Google themselves as a bad actor.
With full control of the rendering engine on all platforms, Google can stop engaging with standards bodies. Web rendering standards will become simply what Google says they are, even if it is to their benefit. Imagine AMP but on steroids. When Safari stops rendering mobile sites correctly, there will be lots of helpful friends and family (and ads) telling folks to "just switch to Chrome, it's a better browser anyway."
Google could also ship their own root certificate list and take control of Web PKI. Imagine Symantec but entirely at Google's option. Play ball or get security warnings. This would allow an end run around the democratization afforded by Let's Encrypt, for example. Controlling 90% of the client end of TLS confers just as much power as controlling the CA end.
Google also has no incentive to make Chrome secure or performant on iOS devices; they run the competing mobile OS platform. If Chrome/Blink is forced into iOS, it won't be long before complaints crop up and we start seeing "Android runs Chrome better than iPhone" ads.
The fundamental fight is not about browsers, it is about defining the platform: "commoditizing your complement." Google wants Chrome to be the platform, and commoditize the computer. This will let Google centralize profits to itself. This is why Android is free (as long as you ship Google's services too).
They will spend as much as they must to achieve this. It is existential.
Lots of folks in this thread talking about Firefox. In this context, Firefox is a strategic front-end for Google. Google is essentially paying for Firefox to continue existing, so that people will use Firefox as an ideological cudgel against Apple.
Also seeing some comments about antitrust. So the plan is to get the government to step in to quash the competition that exists, wait for all the predictable bad things to happen, and then get the government to step in again to re-establish competition.
Does anyone actually think this is a good idea? Or is "antitrust" just a convenient way to dismiss legitimate fears and objections.
You could say this is less about Apple vs Google, and more about users vs advertisers.
The fundamental fight is always about eyeballs. Apple is holding the better cards because control over hardware gives you control over software which gives you control over eyeballs.
Apple's market cap is ~$2,300,000,000,000 and it's not a war.
Underhanded? It's pretty clear that your stated goals don't align with your real goals here.
Edit: I have a hard time putting into words why your arguments seem so deceptive to me. It is like whataboutism: the arguments you are making are technically functional but they just completely fall apart with any reasonable weighing of the pros/cons because it betrays the "intrinsic" goals (choice, browser competition, functionality, security) for "extrinsic" goals (browser diversity, but mostly the success of safari). This makes me think that you're secretly misaligned and that you actually hold those "extrinsic" goals as your intrinsic goals.
We started OWA with a group of primarily Safari first developers, in that iOS Safari is our primary target platform. We've had over a decade of major issues from rendering bugs, to lack of functionality to our apps breaking for months at a time waiting for a patch. The severe underfunding of Safari/webkit coupled with a ban on competition meant that it was never going to be viable to ship Web Apps to iOS. So the question is, how do you convince the worlds richest company to invest a extra few hundred million/year into their own browser?
The answer is competition. Competition provides Apple a deep incentive to produce a capable, feature risk browser at risk of losing users to the other vendors. Each 1% of Safari users is worth 150m/year in google search revenue, a number so large it would make even Apple take notice.
As web developers we see the value in having browser engine competition, many of us lived through the IE6 era and know the risks of the monopolistic competitive behavior like we're seeing from Apple (Side-point: At no point did Microsoft ever ban the competition).
The status-quo where Safari/Webkit was both stifling the Web and Web Apps and providing no competitive pressure on Chrome/Edge/Firefox + the severe underinvestment from Apple meant that a regulatory solution was needed.
OWA members have actually been actively reporting WebKit bugs and interacting with the Safari team to help prioritise features and bug fixes on Twitter and elsewhere, showing the goal is to improve the overall web experience on iOS, not allow Chrome to become dominant. Here is one of their detailed bug report: https://github.com/web-platform-tests/interop-2022/issues/84.
All Apple achieve with this is to slow down the inevitable, especially if the smaller players can't catch up because of it.
It's like prohibitions against importing some aggressive plant or animal species. It's a way of protecting local diversity.
Android is only the bare OS, and actual devices come either with Google bindings everywhere (mostly from direct contract with each phone maker in exchange to let them have the Play Store), or no Play Store at all (which usually means no commercial license for stuff like Felica as well, same situation as when wiping clean a phone basically).
To me it feels a lot like in the 90s when 'viable' alternatives to Windows were either overpriced and obsoleting Macs, or "every year is year of linux on the desktop" linux boxes. And getting shouted from every camp when complaining the situation really sucks.
If android did not exist and Apple controlled the market it would be a different story, but that is far from the case.
We've written about the harms in detail here: https://open-web-advocacy.org/files/OWA%20-%20Bringing%20Com...
Numbers I found say on desktop Chrome is at 70%. Include the 7.75% for Edge (because it’s basically Chrome) and that’s almost 80%. FF at least exists and is similar to Safari.
On mobile it’s at 65%. Safari is the only other browser above 5%.
Chrome is dangerously close to total monopoly.
So there is a good chance that even if competition where allowed on iOS, Safari, which currently has more than 90% market share, would at the very least not fall down below 60%, preventing Chrome from becoming dominant. It is even more likely because most users on iOS actually believe they can install the real Chrome, so nothing will change in their eyes.
I would actually expect the most likely outcome is Apple would fight hard to build a better browser to stem any losses to other browsers. They'll have at least 2 years to do it, so they can catch up in that time with enough investment.
It's preinstalled on MacOS and you can't uninstall it, just choose not to use it.
Apple needs to open up their ecosystem to other browsers. This is not a suitable excuse.
So why do we need to make things worse to make them better?
Let’s make them better (fix the Chrome issue) and then make them better again (the Safari issue) instead of the other way around.
We give microsoft plenty of flak for anti-competitive behavior. It deserves it too. Its not hard to see why.
But so does Apple.
Now why can't I install my silly joke app? Oh that's right Apple won't let me install my joke app on my devices or friends for more than a week or so for reasons. Even though it can be easily tracked to me, its signed etc.
Why is that? Control.
Why can't I have a linux vm chugging away on ipados? Apple says no. Why? Control.
If Apple wants to exert this much control then it really needs to accept liability. So those security defects? Where's the service level agreement to time limit those glaring holes?
Its therefore unacceptable for Apple to be slow to fix an issue when its competitor could have already fixed it. Oh wait, there are no competitors on ios since no one is allowed to compete. You must use webkit. How is that not anti-competitive?
Many people, myself included, choose to use Apple products in part BECAUSE of how those products work and function, today. I don't want to install additional browsers, app stores, or other crap on my phone, I just want it to work well, out of the box with reasonably high security. For my needs Apple products provide that today.
If Apple's products don't fit your needs, the solution is trivial - don't buy Apple products.
You've shown me the door. Guess what? We took it. We've opened a new door right through the wall. Hello there!
Lightning cables from Apple are equally bad. Guess what? Competitor cables are more resilient in real world use. But yes, bring on usb.
If you don't want to install alternative app stores or browsers, then you should simply choose to not install them.
With the new digital markets act being passed in the EU, everyone will be able to install whatever app store or browser that they want.
And you can't complain because you should listen to your own advice by not installing those other app stores or browsers.
I don't see these as mutually exclusive.
That’s what they did on desktop.
[0] https://gs.statcounter.com/browser-market-share/desktop/worl...
That’s kind of the point I was trying to make.
You need to do that stuff before, or at the same time as, opening iOS. Otherwise we’ll just have a disaster.
- Antitrust proceedings are slow. The Microsoft case (which was a much more cut-and-dry antitrust case) was filed in May 1998 and settled in November 2001 -- three and a half years. Given that Google today moves faster than Microsoft in the late 90s, 3.5 years is enough time to drive a critical mass of users away from other browsers, which effectively kills any market.
- What antitrust behaviors could be forced that would restore a competitive browser market? I could see Google being forced to spin off Chrome into its own company or donate the code to a third-party, open-source organization, but these only shift the problem around, they don't get at the root issue of there not being a competitive browser market.
That's the whole purpose of this post. Instead you want to fear monger and deflect from a sore subject for Apple.
I’m saying even if they’re right about security (which I doubt) the fallout will be so much worse we shouldn’t do it.
This is not something you can look at in a vacuum. There are serious ramifications to their suggestion and they need to be realized.
Part of the reason Chrome dominates on Android is because it's the default browser. How many people on iPhone are we expecting will change their default browser? As far as I know, most users don't change their messenger clients on iOS.
You know that would immediately become real Chrome.
Once it’s possible to have real Chrome my fear is Google would start breaking things on Safari (or just refusing to fix things) to drive people to it.
And the stats make me curious -- given that Chrome on iOS is just a wrapper around Safari, are people just switching because Google Docs tells them to, and that's enough? I'm having a hard time of thinking of a functionality reason to switch to Chrome in iOS (maybe browser/bookmark sync, I guess). I'm surprised to see a number that high.
Yes. From Google's apps already asking you to open links in Chrome to Google actively sabotaging competition https://twitter.com/johnath/status/1116871231792455686
Obviously this means that they need to give up on their iron grip on app developers so they didn't do that even if that was the exact path Steve envisioned. But that's not a good excuse either.
First, IE was bundled onto virtually every computer at the time and Microsoft went out of their way to stop you from replacing it (eg system actions would use IE).
Second, Microsoft's anticompetitive IE behaviour was aimed at protecting its Window monopoly. Microsoft was worried that the Web would become a device-indepndent platform and that would obviate the need for Windows at all.
Third, is Chrome actually bundled to any large degree? There's enterprise bundling but how significant is it? There are Chromebooks but I feel like they're not a huge factor. I guess there's Android. Chrome's desktop share seems to be 68% [1]. That's impressive for an action people have to take to change the default.
Fourth, Google doesn't have the same motivations as Microsoft (in regards to protecting another platform). There are other much more real issues (eg favoring their other properties like Youtube) but crippling Chrome doesn't seem to be something that aligns with any of their interests. It seems way more likely that Youtube (etc) will work better in Chrome. While that's bad for other browsers, it doesn't have the same negative effects as what Microsoft tried.
Fifth, the core of Chrome (ie Webkit but also V8) is both open source and the core of other browsers (notably Safari and Edge) so it's less likely Web developers will end up in a situation where they effectively have to implement something twice, once for Chrome and once for the rest. That was pretty much the situation with IE.
Will it be a big deal in the future? Maybe. I don't really see this being a big problem anytime soon however.
Apple is in the wrong to tie Safari to iOS and block the installation of other browsers. They're wrong to do it for the sake of keeping control of the OS. They're right to do it, because that's the only thing that's keeping Chrome from a near-monopoly of the browser space.
Apple was successful in that regard though; the contracts they made with Big 5 remained intact and Apple didn't have to compete with Amazon on price. Apple's strategy was not better for the market as a whole because Apple never cared about the market as a whole. Due to Apple's anti-competitive behaviour we are still stuck with a Publishing industry decades behind on digital
It wasn't until after they had dominance that IE really withered.
This just isn't a serious stance, I'm sorry.
You did apologize though, so I forgive you.
Why is that? I’ve never heard anyone argue that point before so I’m curious what you think the downsides would be to Google.
The most natural implementation of the EU directive would be to have a place in User Settings where users can go and enable targeted advertising if they want it.
And why would we assume that these companies would follow the "most natural implementation"?
The very predictable response of the industry to the EU directive was to make the cookie banners as annoying as invasive as possible, such that users would consent to tracking out of apathy. No, it's not what the EU intended to happen, but it was a consequence. Which brings me back to my original point: often times idealic and well-intentioned measure have negative consequences.
In hindsight, perhaps the EU should've legislated that the UX for the tracking content cannot be unreasonably annoying. I don't know how I'd go about codifying that into law though.
It's the EU's cookie banners. Despite the EU's best intentions, the end result is worse. It was a naive move and we're all suffering for it. One of the biggest pieces of evidence that you can't just naively mandate something without also thinking through edge cases and "malicious compliance."
Sorry what ? Can you point me to the place where I can download Safari for Linux and Windows and Android ? If they actually had those builds, I would believe what you say.
But no - All they are doing is protecting their turf by hitting every other browser with sticks so folks prefer native apps over web apps.
Yes, Safari is only on Apple platforms.
I’m saying Chrome is already dominant on Windows, Linux, Android, and Chromebook.
The only one where it’s not is iOS (Mac is kinda close, but small in terms of users).
If real Chrome can go on iOS my supposition is Chrome will become dominant there too.
Leaving no platform not dominated by Chrome.
I know one: Anti-trust enforcement.
For instance, in these patch notes Chrome lists "Various fixes from internal audits, fuzzing and other initiatives" and doesn't even look to have a CVE:
https://chromereleases.googleblog.com/2022/05/stable-channel...
Or for Firefox, there's a dozen or so bundled together in a single CVE under "Memory safety bugs fixed in Firefox 101":
https://www.mozilla.org/en-US/security/advisories/mfsa2022-2...
But in the grand schema of things, who cares how many CVEs a project has, when it can take almost 2 months for the project to ship updates fixing exploits that happen in the wild already? That's just out of control and unbelievable.
Possibly a CYA-esque liability statement, but the principle seemed sound.
The EU's digital markets act bans the only Safari lock on IOS, so this is gone whether apple likes it or not. (1 - sorry couldn't find a better source)
Safari is the new IE, there is a difference between a monopoly while still being able to use a competing product (like chrome in other platfroms), and forcing Safari(WebKit) while hindering the web because of Apples interests.(2-3)
1. https://www.fudzilla.com/news/54763-apple-loses-out-in-the-d...
Ehm. Chrome is the new IE. Apple is using anti-competitive methods but its far far away from market domination.
Microsoft is doing even more, by pushing so much Edge-only stuff.
On iOS Apple forces the Webkit rendering, but for normal user it does not even matter much. They can download Chrome and get the UI they want.
Apple Safari has, literally, 100% marketshare across the entire iPhone market. Its App Store also has 100% marketshare and enforces the Safari marketshare.
I have an iPhone 13 Pro Max. I love the hardware, but I'd love to install other browsers; why can't I? I'd also love to run real PWA's or run WebRTC without major issues. Why shouldn't I be able to do these things?
Apple enforces its own browser, which it carefully and deliberately hamstrings, in order to force web apps to not bypass the App Store, so Safari also enforces the App Store marketshare.
They're tightly tied together (so tight that the Windows-IE tying isn't even in the same galaxy) in order to enforce the other's marketshare. At least Microsoft allowed third party browsers and installing apps from other locations. This is tying on a completely different level.
Safari is one of the worst browsers in terms of compatibility, like PWAs and notifications, they are unsupported on purpose to push developer to develop apps and give apple a cut. And when they do adopt new technologies, they are often super late like webp.
Please die WebKit.
Also many have now spoken up against it:
### Electronic Freedom Foundation (EFF) Apple’s restrictions on third-party browsers, and the limitations it puts on Safari/WebKit (its own browser tools) have hobbled “web apps,” which run seamlessly inside a browser. This means that app makers can’t deliver a single, browser-based app that works on all tablets and phones - they have to pay to develop separate apps for each mobile platform.
That also means that app users can’t just switch from one platform to another and access all their apps by typing a URL into a browser of their choice.
### Mozilla Mozilla believes that major platforms should be under an on-going duty to:
Stop practices that distort competition on the merits and inhibit consumer choice, such as: ● interfering with consumer selection of alternative browsers and use of those browsers to access the internet from links and queries on their devices; and ● dictating or controlling browser components, such as browser engines, which prevent consumers from accessing and using their preferred browser across all operating systems and devices.
### Google By contrast, PWAs—and the web writ-large—receive a small fraction of this support on iOS. This is primarily because of Apple’s requirement that all browsers use its proprietary WebKit browser engine. Not only does this prevent browsers from differentiating from Safari—Chrome is unable to access the user’s camera, preventing users from using products like Google Lens—it also harms user security. A recent study from Google’s Project Zero security research team found that WebKit is significantly slower than other browser engines to fix reported bugs.
### Microsoft Apple requires that any mobile browsers on iOS, including those offered by Apple’s competitors (e.g., Google’s Chrome app), use Apple’s own WebKit browser engine. This restriction harms competition and consumers.
### Meta Apple requires all web browsers on iOS to use WebKit, a degraded version of Apple’s Safari browser, to render web pages. Apple thus sets Safari as a functionality ceiling for mobile browsers on iOS. The restrictions on Safari’s and other iOS web browsers’ capabilities prevent web pages and web apps from providing consumers with robust, cross-platform experiences that would lower switching barriers
### Telegram We suspect that Apple may be intentionally crippling its web apps to force its users to download more native apps where Apple is able to charge its 30% commission
That is not true. WebKit is opensource, there are other browsers that use it (GNOME Web), it is used in a lot of other applications, like GNOME Builder, Devhelp.
On iOS third party browsers: ● Can't pick their own browser engine ● Can't pick which version of Webkit they wish to us ● Can't turn browser engine features on or off using flags ● Can't add entirely new browser engine features ● Can't edit browser engine features ● Can't entirely remove browser engine features ● Don't even get all the features of Webkit that iOS provides Safari ● Get a more restricted version of Webkit than the one iOS provides Safari Safari and the WebView that browsers use do not get the same level of access) ● Use a version of Webkit provided that is tied to iOS system updates as opposed to packaged with the third party browser
On Android third party browsers: ● Can use their own browser engine ● Can pick which version of Blink they wish to use (if they are using Blink at all) ● Can turn browser engine features on/off using flags ● Can add entirely new features to Blink ● Can edit existing features in Blink ● Can completely remove features from Blink ● Don’t have to use Blink at all
* PS4
* PS Vita
* 3DS/New 3DS
* Wii U
* Wii
Also maybe PS3/PSP and likely also PS5 will get the webkit exploit treatment at some point.
Note that, while earlier JailbreakMe exploits were patchable if you installed a patch[2], the readme in the TotallyNotSpyware repo explains that, in general, there's not a patch for the exploit post-jailbreak, so you could still be pwned by a third-party website should they deliver this exploit with a spyware payload.
0: https://en.wikipedia.org/wiki/JailbreakMe
1: https://github.com/JakeBlair420/totally-not-spyware
2: https://www.idownloadblog.com/2011/07/06/pdf-patcher-2/ (use an ad-blocker, this website is super ad-infested)
The jailbreakme app wasn’t exploit on WebKit. It was iOS native pdf rendering Library. WebKit was used to deliver the exploit.
Firstly, this is not a webkit-specific problem - It's just that webkit is the most commonly embedded browser engine.
I have personally jailbroken my LG smart TV using a V8 n-day exploit (details not public, yet).
For any modern browser engine that is left unpatched, it is only a matter of time before it can be exploited using publicly-available techniques - and console manufacturers know this. Which leads me to my second point:
Console manufactuers assume that the browser will be compromised, and sandbox it appropriately. It is not a meaningful security boundary, by design. Exploiting the browser on a console, on its own, doesn't get get you very far. You'll need to chain it with additional exploits (a sandbox escape, a kernel exploit, etc.) to do something useful.
What have you done with your jailbroken TV?
I was considering jailbreaking my LG Smart TV too as I _hate_ the Home screen with a passion and was hoping to replace it. But I use the Game Mode all the time, so I was hesitant to jailbreak in case that interfered.
I'm just curious why you've jailbroken yours and whether or not I should.
Yes, webkit is somewhat to blame, but I bet, as we can see the number of exploits in the graphs from the original post, that any outdated Chromium version would end up with the same fate.
And good lord this line of argumentation is extremely disingenuous even if you think the actual analysis is good (counting CVEs is not exactly the best measure). One because no one except nerds are going to switch browsers in response a random CVE and two because it doesn't even establish what Apple actually means by security and instead goes off on a rant "well if Apple really cared about [my personal view of] security you would blah blah" -- literally zero effort to understand the opposing view or evaluate other possible ways of addressing the security concerns.
But ya know, "Safari lags behind other browsers in RCE mitigations and mean time to patch" doesn't grab headlines and doesn't prescribe a single solution that is also motivated by more than just security ;)
Why is running other applications somehow secure?
If I can run firefox instead, and that javascript sandbox exploit was already patched in firefox, the iOS app sandbox escape won't do them any good. They can't get through the earlier layer to exploit it.
The claims being made here is that the first layer, the browser exploit, is easier with safari/webkit, and the second layer, the iOS sandbox escape, is identical. Even if it only changes one layer of security, that is still a meaningful change and is more secure.
There are additional factors too.
Right now, if you have a webkit vuln, but no iOS sandbox escape, you can still steal cookies from other sites, browser history, exfiltrate passwords, etc. The browser engine is a valuable target on its own, even ignoring the rest of the system.
These two things can't both exist. The fact that the sky isn't falling on macos leads me to believe that this position of apple's, while spoken in terms of privacy and security publicly, is really all about dominating what software runs on their devices which i remind you have to pay a hefty fee on profits to apple in order to be installed on users devices through official means. That is pretty user hostile, but obviously shareholder friendly, which explains why it perpetuates and why apple share prices have reached the stratosphere since the iPhone.
Last I heard then officially defend this apparent contradiction, the Apple rep asserted that people's phones are in fact the more important/personal devices, as well as being more common, and as such security on iOS is more important than on macOS.
But I think they draw the line at native (read: unsafe) code, which, is not totally unreasonable
[1]: https://apps.apple.com/us/app/pyto-python-3/id1436650069
The vast majority of users don't know or understand why they see decreased battery life when they do, they just see that their phone doesn't last as long. Google has such a complete monopoly in the browser market that one can argue that there's a pretty good incentive for Google to make tradeoffs in Chrome that decrease battery life on the iPhone to hurt the iPhone's battery life, and most people would not realize or understand that its not the iPhone's fault but Chrome.
Not really. Maybe in the early days they had an edge with ObjC when hardware was primitive and java slow, but nowadays it's the same or buried behind synthetic slowdown animations. The battery life isn't especially good in my personal experience.
• There's a place for closed platforms if open ones are a reasonable choice. A closed platform must not be the only choice available to the customer, but it should be allowed to exist given a healthy market. It's hard to argue that iOS is a monopoly, and if so, than a browser engine and JS interpreter with access to the open web is a very powerful thing that the owner of the platform may deem too powerful for its own good.
• Chrome's dominance of the Web is very scary. Not as scary as IE's, since it's open source, but still, it's such a huge beast that it's almost proprietary through complexity. I don't know if there's an easy solution out of this.
• The time it takes Apple to patch security flaws is not the main issue here and should not be the core argument. What if Apple steps up its game and gets really good at this? The issue is the strategic decision Apple is making and the discussion should be if a company that powerful should be allowed to make such decisions and impose them to the user.
• Apple could avoid this discussion by giving the user a one time only toggle switch to sideload any binary. It should be buried under many menus and preceded by lots of scary dialog boxes. It could even void battery warranty or something. Maybe keep a constant orange menu bar as a reminder that you are on your own and can't blame Apple for anything.
If you have a way to effectively and efficiently blame the bad behavior of your ecosystem on a third party, then there are whole industries waiting for you to sell them consulting services. If the king of Reality Distortion Fields couldn't figure it out, probably nobody here has either.
Nobody is going to notice that Chrome is eating their battery. They barely notice on desktop. The tools are even less grandma friendly on mobile.
Both Chrome and Android are open-source bases for proprietary platforms. Google very consciously blurs the line between functionality available across all Android devices or across all web browsers, and the functionality which you only get with their products (e.g. licensed Android with Play services, or Google Chrome).
Would it really have made a difference if Internet Explorer 6 was open source? Most of the features in Internet Explorer were copyable by other browsers, just as most of the Chrome-only API are copyable today. There's other reasons why Firefox and Netscape on Windows didn't support ActiveX controls and XML Data Islands, such as both those features being lousy ideas.
I'd say that Chrome's dominance is much scarier than IE's. One reason has to do with user data.
When IE was dominant, user data was not nearly as valuable. Today, user data is how Google makes money, so they are strongly incentivised to harvest it. While I understand Chrome isn't exactly the source of the harvesting, it reinforces reliance on Google services for the vast majority of users.
Apple bundles the three levels (hardware, OS and Apps) and sells you the hardware. But Safari is tied to iOS and not to the hardware itself. So would you argue about an option to replace iOS instead of installing other browsers on iOS itself?
This is illegal in a variety of places. They need to prove that these actions caused damage to the battery.
- Always-running daemons to perform internal bookkeeping tasks, provide network access, which are not reaped by lack of user focus or the needs of other applications
- Ability to download, generate and run arbitrary native code (for running Javascript and WebAssembly)
- Ability to register arbitrary URLs, see installed third-party applications and execute them arbitrarily
- Ability to modify the Home Screen to install additional applications (such as native-wrapped PWAs)
Without full system level access, Apple's store restrictions don't matter. You are not going to see resourcing to port Gecko or Blink to iOS if it means the javascript and webassembly engines are interpreted, push notifications only work when the browser is in the foreground, SPA applications can't be added to the Home Screen, etc.
And by full system access, I mean _more_ access than Safari currently has. After all, many of the features people complain about MobileSafari not shipping are features that are also not supported by the underlying OS.
If you allow Chrome to be installed as a regular app (even if Apple allows JIT), it will not work. Therefore for a viable Chrome Browser Apple would have to provide APIs they probably stripped from the OS itself and putting it back will for sure hinder security.
And after they have like 50%, they won, as they will inexpensively make their market dominant products (search, meet, etc) worst on Safari, by just neglecting to fix issues due to higher cost of making it work on two browsers. We've seen that before. I am posting this from Brave because many sites in Brazil neglect Safari on desktop, so I got used to alternatives.
You can read more here: https://www.gov.uk/cma-cases/mobile-ecosystems-market-study
And their new market investigation here: https://www.gov.uk/cma-cases/mobile-browsers-and-cloud-gamin...
or our tweet thread summary here: https://twitter.com/OpenWebAdvocacy/status/15395035090783887...
Edit: Apple is also not claiming what the title suggests (source would be needed), the author of the tweet seems to just interpret it this way.
Instead Apple has forced them to produce separate browsers around a locked WebView that they exclusively control. Mozilla, Microsoft and Google have all spoken out against the ban in regulatory submission, and browser engineers at each vendor consider it a ban.
The REAL browsers have been banned.
No they haven't! You can download each one here: [0], [1], [2]. They have been forbidden from using their own rendering engines. But they can still add all the chrome they want to the UI and do all their usual tracking like they do on the desktop.
[0]https://apps.apple.com/us/app/firefox-focus-privacy-browser/... [1]https://apps.apple.com/us/app/microsoft-edge-web-browser/id1... [2]https://apps.apple.com/us/app/google-chrome/id535886823
https://apps.apple.com/us/app/firefox-private-safe-browser/i...
https://apps.apple.com/us/app/microsoft-edge-web-browser/id1...
https://apps.apple.com/us/app/google-chrome/id535886823
https://apps.apple.com/us/app/brave-private-web-browser/id10...
https://apps.apple.com/us/app/duckduckgo-privacy-browser/id6...
https://apps.apple.com/us/app/opera-browser-fast-private/id1...
Etc.
You and I both know the headline means allowing other rendering engines.
Building a general purpose web browser is one of the most challanging software development projects. This may not be the case if one is cloning Chromium/Firefox where you get both the rendering angine and the browser app for free. If you are using WebKit, you are writing the browser application from scratch.
The rendering engine determines pretty much everything related to we standards.
Third party iOS browsers are little more than third party themes/skins.
See this comment https://news.ycombinator.com/item?id=31897294
The iPhone is a general purpose smartphone, and your TV is not. The "smart" part of the smartphone makes it useful without Safari. See apps that integrate with health devices or simpler uses like offline Google Maps. Neither are functioning as a "phone" but instead as a general use computer.
With the exception of the iPhone, no other general computing device is currently enforcing a single browser.
(And the "smart" in the "smart tv" does not get even close, as their apps can do almost nothing in comparison.)
And it is hard to see how counting numbers of bugs has much to do with the severity of the bugs. Not every bug allows a jailbreak, but the ones that do are of much greater concern.
Also, I'm skeptical of the notion that every type of app except web browsers can be meaningfully screened for security. How can one not interpret this as a tacit admission that the screening process is close to worthless?
Are you under the impression that Chromium and Gecko are not written in C++? Mozilla has been using _some_ Rust but the modern browser engines are some of the largest, most complicated C++ codebases in existence and your statement applies to all of them.
Also, a security issue with safari is far more devastating if you don’t have other browsers.
1. You have to wait for apple to release a system update, not just update the app.
2. You now have no safe browser to use while you wait for #1.
I wish they'd open up just a little. Plus iMessages.
Is this true? I could have I sworn I’ve updated Safari many times without needing to update macOS.
I don't think Apple has banned other browsers at all.
"Apple's ban of third party browsers on iOS is deeply anti-competitive, starves the Safari/WebKit team of funding and has stalled innovation for the past 10 years and prevented Web Apps from taking off on mobile."
Anti-competitive? Perhaps? Yes? Starves the Safari team of funding? I don't know what this means. Stalled innovation for the past 10 years? Maybe. Prevented Web Apps from taking off on mobile? whoah. These are some pretty loose claims.
So they don't have it on the AppStore? Who cares?
I'm pretty sure that approximately zero normal users are bothered by this, but a lot of webdevs really, really want to be able to use things like web push messaging on iOS.
I think many normal users are bothered by this and don't realize it.
The restrictions on browser engine are the main reason that Firefox can't ship addons for iOS (like it does for firefox on android). I bet a ton of iOS users would appreciate being able to install firefox addons, like uBlock origin, on their iOS firefox.
And this is not different from Google creeping their services in other browsers, Microsoft imposing limits on Windows or any other company doing whatever they want with their products.
I don't really understand why the walled garden seems to still surprise so many people.
They're '...doing it for the children!'
Mmmhm.
Mine is different. The security I'm interested in for my use case is that there is one egress point from the operating system as far as a browser goes. That means I don't have apps shipping their own browser engines to circumvent the system block lists and screen time whitelist controls.
Also comparing CVE rates is pointless as that's exploits and vulnerabilities that were identified and patched, not ones that are in active exploit or publicly unknown which is a metric you cannot measure.
And of course if every app ships a browser or you change it, how many CVEs do you have from unpatched browsers shipped in apps?
This twitter post feels like the old political adverts: "vote for us because the other guy is shit" (not because we have a better solution).
As for system block lists and screentime whitelist controls, that sounds like something any browser could plug-in to via a OS provided API.
I'm in somewhat agreement with you that you can't identify the number of security flaws by vulnerability count, but when you combine that with the big delay in patching + patches not being delivered to the current (most popular) version of the OS it brings a lot of doubt to Apple's claims of both being able to patch faster and have better security.
We're not advocating that apps should not be allowed to ship a browser unless they receive a browser entitlement which should be subject to some approval process / vetting etc. i.e. Browsers with strong security track records should be allowed to bring their browsers along with the engines with some affordance given to browsers that run from soft-forks of those engines.
Second the thread pointed out that many iPhones remain vulnerable and unpatched to openly disclosed security holes WITHOUT an option to update them. One must assume at that point that they are being exploited. The fact that alternate browsers don't have this problem is a significant version.
But you do have a good point that it is bad for third party apps to bundle their own browsers to bypass controls, and then leave them vulnerable.
The mechanism for banning third-party browsers is rejection by the App Store reviewer, correct? Supposing Apple allowed third-party browsers but disallowed embedded browsers in non-browser apps, how would this security model change at all?
This isn't rocket science.