Hacker News Reader

Comment by joshu | Hacker News Reader

i don't understand why apple allows in-app browsers.

You mean custom ones, right? WebViews are incredibly useful, but it definitely seems like implementing your own browser gives people a false sense of security, like they've been sandboxed when they haven't.

What would be nice here is a permission requirement if you're injecting code into a browser view.

webviews for clicking arbitrary links in apps like instagram or gmail are absurdly restrictive. i lose my context, cookies, and regular tools (bookmarks are gone, sharing often overridden, etc)

This is why https://developer.apple.com/documentation/safariservices/sfs... exists and why the blog post advocates for using it.

That was a great update, but still not a true browser. No tabs, no bookmarks. Why should the website be restricted to one tab? Just open Safari and be done with it.

exactly

If you want a true browser there's always the option to move the current page from the in-app Safari View to the full browser.

In many cases I'd like to stay within the app. Those in-app Safari Webviews allows that. And if it is a website I'd like to browse in my usual, more permanent browsing evironment I always have th eoption to do so.

This two step approach is more useful to me than always opening links in the browser.

They're supposed to be restrictive as to not confuse the user. An in-app browser isn't there to give you a full browsing experience, it's there to do a quick web-only task that somehow cannot be done in the native app itself.

since years ago apple added the little back button to return you to your previous app, even webview is dead weight. apple should only allow one, in some special context, that's so counterintuitive to implement that only frameworks e.g. react native can justify the effort

And yet, we're normally seeing Apple === BAD because they limit everything to just the one Apple thing. Am I actually seeing requests for Apple to limit willingly?

Most of Hackernews doesn't understand why Apple is the #1 tech company in the world -- they're still in the "no wireless, less space than a Nomad, lame" mindset.

in 2015 i got an iphone for a job, then i made it my daily driver because i liked the restrictions. now my phones last four years instead of one

How is the walled garden allowing a phone to last for four years? Where you getting new phones because you polluted your non-walled garden device with so many bad apps that you chose to get a new device? Not really following your point, but maybe I am?

i was getting new phones mostly because my devices were getting bogged down by android updates and capabilities. the os allowed developers to do more and more things, and offered more and more customization, faster than the pace of hardware improvements supported, to the point i'd have to get a new phone if i wanted something both up-to-date and fast. if i kept a phone longer much longer than a year, i'd have to worry about software updates as well, OR replace the OS and deal with instability.

and i'm not talking about bad phones here — htc one s, nexus 4, nexus 5, nexus 5x. admittedly, degradation of shitty NAND is still a factor in higher-end android phones, so it's not all about the android ecosystem being a free-for-all

an iphone xr will still run everything fine, including the latest version of ios. hundreds of dollars saved and a whole set of problems avoided over the life of the phone. i only replace my phones when they're smashed to bits now

anecdote: someone in my family just had to replace their android phone because a software update caused the radio to stop working for calls. so the ecosystem issue is not just a userland thing

I'm on an iPhone 6s+, so yeah, I'm a fan of the not needing a new phone all the time. I am pleasantly surprised with each new iOS that my phone is still not deprecated. At that point, I will have to look at updating.

Do you want to cripple the entire app industry? Apps built using React Nativ / Flutter e.t.c use the WebView to render themselves. So they’re basically already running “in-app browsers”

But then how do you differentiate when the app is rendering its own view rather than another website? You could apply some restrictions like <iFrame> has nowadays where you need extra security privileges (I think) to render pages / execute scripts not on the same domain

Otherwise you can always open safari from all of these in-app browser views and they could implement a toggle which forces all of them to be opened in Safari automatically

Thats not how react native or flutter work at all. They use native views, not a browser. You are likely thinking of cordova (phonegap) et al.

oh damn! I just went and looked into depth and indeed my knowledge was wrong. Well, TIL

Honestly it is pretty fascinating how these cross-platform frameworks work.

It's a big difference between browsing your own pages in-app, and opening any link in an in-app browser and tracking it.

I am not defending the practice. Maybe, Apple can addd it in their app store policy

it’s a bad experience for opening external links. i don’t care that it’s not easy to get to.

and no, not all apps do this. tiktok does not offer an escape, and instagram hides it behind two clicks.

Huh, TikTok is one of the first apps I have seen which do not allow you to open an external website in Safari. I am going to do a bit more research and try to find other apps that do the same

I think the clear answer is to only allow local/whitelisted domains that you can prove you own. I work on Capacitor/Cordova apps regularly and only allowing local code would allow for them to continue to work and close this loophole. Anytime I open an external page I do it in SFSafariViewController which doesn't have the ability to inject code or snoop.

That sounds like a plausible solution

At the very least webviews should treat contents as a subframe and respect the frame option headers.

Last I heard (years ago), iOS forced everyone to use Safari for webviews, which lots of people also complained about. Did that change? Or is the Safari webview the subject of this story?

Safari webview (WebKit) is what it's describing

The key aspect here is that Instagram's app is using a Safari Webview but somehow it is injecting its own tracking pixel on the HTML body wether the target website had it or not.

Which honestly does not surprise me, what surprises me is that Apple allows this. I think there was a time where certain Javascript capabilities were present in Safari but not in Safari Webview and there was certain outrage.

Perhaps a solution would be to run the webview through Safaris content blocker engine?

To what? Disable the ability to inject JavaScript into the web view?

Yes. Is there a legitimate use case for injecting arbitrary Javascript by the native app? (Honest question)

Apps that use html for their UI and JS hooks to trigger touch ID, access the keychain etc.

Thanks!

its the same. any browser (or app otherwise) on entire system has to use it for web rendering

Every webview on iOS is Safari internally. The issue is if an app presents a webview, they can inject whatever javascript they want. This is what allows frameworks like Ionic to work in the first place, the webview runs the "app" and any interface back to the OS is communicated through a bridge to the native world.

Reply on news.ycombinator.com