In the olden days, other browsers were ported to Cydia, the jailbreak store.
And there is tons of cool stuff people did, you can look back through the history of jailbreaking to see what sideloading would open up.
All you need is a framebuffer, network access, and some form of user input to produce a usable web browser, and they are all there in iOS.
https://twitter.com/TedMielczarek/status/1176864567118483457
It’s mostly developers who care about the engine, end users are going to care far more about the performance.
Without using JIT (just-in-time compilation), your browser’s JavaScript will be terribly slow. But allowing JIT compilation (allowing an app to mark memory pages as executable, i.e. turn data into machine code) will also allow an app to introduce arbitrary new behavior after the app review and make it much easier for it to break out of the iOS sandbox.
Stuff like calling private iOS APIs or security sensitivity APIs using machine code downloaded from an external source that an app reviewer will have no way of foreseeing. This isn’t possible otherwise.
Even if the app/browser with JIT permissions isn’t malicious, it still opens up way more attack surface area. (Of course Safari already has the same risk)
That said, I of course really want more genuine browser options on iOS. But there are real security reasons for Apple’s reluctance, though I’m sure this can solved. But alternative browsers come with different security concerns that don’t apply to just allowing app side-loading (since even now side-loaded apps can’t implement JIT compilation)
Which is the reason the JIT runs in its own sandbox connected through IPC IIRC.
Breaking the JIT isn’t supposed to even get you access to the parent process (Safari), let alone anything more, assuming you don’t have a kernel exploit too.
Apple is perfectly well aware of this and in “lockdown mode”, Apple disabled JIT for Safari.
They'll work, just more slowly --- and if that encourages less abuse of JS, maybe that's a good thing.
That means there is no way to do things current apps can’t. You can’t make a JIT, so no good alternate browsers. You can’t install other apps, so no making your own store. You can’t make background services like a web server that will always run. You can’t make widgets that are more interactive than what exists now. Nor can you get GPS data without or force the microphone on, the user still has to agree.
Side loading gets you side loading. You don’t get expanded privileges without exploits. And expect Apple to be working really hard right now at putting stronger enforcement on private APIs and preventing sandbox escape or limiting access if you do.
> [...]Furthermore, the gatekeeper shall allow business users and alternative providers of services provided together with, or in support of, core platform services, free of charge, effective interoperability with, and access for the purposes of interoperability to, the same operating system, hardware or software features, regardless of whether those features are part of the operating system, as are available to, or used by, that gatekeeper when providing such services. - Digital Markets Act
That seems to be the only restriction being lifted.
Nothing in there seems to say any of the other stuff has to be allowed for side loaded apps. As long as Apple doesn’t let App Store apps do it, they don’t appear to have to allow any new functionality outside that necessary to allow working app stores.
Are there first-party apps that are allowed the JIT entitlement? If the answer is yes, they're done.
Chapter 3, Article 5, Section 7:
> The gatekeeper shall not require end users to use, or business users to use, to offer, or to interoperate with, an identification service, a web browser engine or a payment service, or technical services that support the provision of payment services, such as payment systems for in-app purchases, of that gatekeeper in the context of services provided by the business users using that gatekeeper’s core platform services.
Section 43 :
> Certain services provided together with, or in support of, relevant core platform services of the gatekeeper, such as identification services, web browser engines, payment services or technical services that support the provision of payment services, such as payment systems for in-app purchases, are crucial for business users to conduct their business and allow them to optimise services. In particular, each browser is built on a web browser engine, which is responsible for key browser functionality such as speed, reliability and web compatibility. When gatekeepers operate and impose web browser engines, they are in a position to determine the functionality and standards that will apply not only to their own web browsers, but also to competing web browsers and, in turn, to web software applications. Gatekeepers should therefore not use their position to require their dependent business users to use any of the services provided together with, or in support of, core platform services by the gatekeeper itself as part of the provision of services or products by those business users. In order to avoid a situation in which gatekeepers indirectly impose on business users their own services provided together with, or in support of, core platform services, gatekeepers should also be prohibited from requiring end users to use such services, when that requirement would be imposed in the context of the service provided to end users by the business user using the core platform service of the gatekeeper. That prohibition aims to protect the freedom of the business user to choose alternative services to the ones of the gatekeeper, but should not be construed as obliging the business user to offer such alternatives to its end users.
Disentangling JIT surely hasn't been an easy task, but they have had years to prepare and I don't think Apple will risk a recurring 20% annual global revenue fine.
the biggest possibility i see is chrome 99% market share.
It first will weaken security and privacy for common users. Walled garden is doing pretty good job at maintaining this.
I'd argue that legislation like GDPR had more positive impact on user privacy than any walled garden managed by any for-profit entity. See Uber using the device ID even against App Store policy for years and not getting immediately kicked out after discovery [1]
Apple's clampdown on Facebook came after GDPR and apparently wasn't a problem for years until Apple decided it was beneficial to their marketing and a way to push their own ads better.
Rule of thumb is: when you are big enough, you can do basically anything you want when you don't talk about it.
1: https://appleinsider.com/articles/17/04/23/after-tricking-go...