Hacker News Reader

Comment by leotravis10 | Hacker News Reader

Although I appreciate Vivaldi for getting a iOS version out, do keep in mind that it's very inferior to Safari much like all non-Safari browsers on iOS running WebKit because of how very privileged Safari is and sadly their hands are very tied. The only hope is that the EU's DMA and DSA can allow third-party browsing engines on iOS eventually, and this release is a head start type of move toward that goal I feel.

Until that happens, Safari will always be the only browser that truly matters if you use a iOS device and that's a fact.

View on HN

> Although I appreciate Vivaldi for getting a iOS version out, do keep in mind that it's very inferior to Safari much like all non-Safari browsers on iOS running WebKit because of how very privileged Safari is and sadly their hands are very tied. The only hope is that the EU's DMA and DSA can allow third-party browsing engines on iOS eventually, and this release is a head start type of move toward that goal I feel.

This is a double sided coin. 90% of the browsers on Google Play are absolute trash (if not, arguably, straight up malware), and some are apparently very popular.

Give 3rd party iOS browsers more permissions, and devs will exploit every single bit of privilege to the max, and then some, en masse.

Isn't this more of a problem of Google being too permissive about trash browsers on their store than an issue of whether a browser can have its own JIT compiler?

Indeed.

Admittedly lot of the Safari security concerns (like JIT) seem very extreme.

Why would you even look at browsers other than the well known ones?

Chrome, Brave, Firefox, Edge, DuckDuckGo, etc. are used by ~100% people.

> Chrome, Edge

Gratuitous data harvesting, and Edge in particular has gotten really spammy with Microsoft promos.

> Firefox

Very slow/power hungry for me, especially with extensions which I need for dark mode, adblocking and such.

> DuckDuckGo

Probably good?

Firefox on Android is great IMO, fast, not power hungry and the extensions/features are awesome. I love not being bothered by ads, even on YouTube, and having videos play in the background.

Firefox for Android guzzles power like crazy, even slightly more than Chrome

You probably come out ahead if you load it up with a real adblocker though

Being able to browse with uBlock and Privacy Badger is a game changer for me. I basically don't use my mobile browser at all on iOS, and I don't use any social media or news apps either, so you can guess how useful the device is.. haha

Cromite with its native adblock and darkmode is, for me, the bee's knees.

I am on an older Android phone though. If it ain't broke...

Bromite's ad-blocking is very basic, the worst of the bunch. But it's a decent choice nonetheless.

Also, the actual Tor Browser, based on Firefox.

I don’t ink it makes sense to argue against consumer choice because consumers might go out of their way to choose something worse than safari.

Consumers that care whether their phone browser runs WebKit or not (I bet it’s <0.01% of iPhone users) can choose Android.

My mom has an iPhone and I can sleep safe knowing she won’t install some dodgy browser or anything like that.

I’m happy such category of devices exist and I’m happy to pay a premium.

When Android is the only real alternative "just don't buy iPhones" isn't a very compelling argument. Android has tons of problems and likewise, the only alternative users really have is the iPhone. Consumers need more than two options if the free market is going to be effective.

There will not be more than two options anytime soon, and what a lot of people miss here, it’s developer’s fault too.

Microsoft in their last few years tried very hard to incentivise developers to build apps for Windows Phone.

But many didn’t bother. Some even only targeted iOS because of the reach and how amazing the development experience was, including less devices to test and support compared to Android and Windows Phone.

And this made the choice for consumers easier, when (I don’t remember the names) some very popular and big apps at the time were not natively available on Windows Phone at all.

Even Tim Sweeney never brought Unreal Engine to Windows Phone despite their promises and I’d say played part to build the current status quo.

Developers voted with their time to build apps for a 30% fee marketplace that suddenly was a gateway to distribute their work to millions of users worldwide that was not heard of before in the era of Windows Mobile. (pre iPhone)

And now they cry wolf about the system they’ve voluntarily helped to build.

It doesn't really matter how it came to be or who was involved. The point is there are two options now and there is no sign of that changing any time soon. And this affects almost everyone, not just developers. Smartphones are ubiquitous in North America and Europe, and just about everyone uses them to access the web via a browser.

There will always only be two options in all things. Bifurcation is universal. The illusion of more than two options is short lived.

What makes you say this? There are plenty of examples to the contrary. Airlines, cars, gas stations, shoes, beer, bikes, browsers, power tools, pizzas, etc.

Sure, there are plenty of duopolies out there, but there are also plenty of monopolies. That doesn't mean they're inevitable.

This may be the illusion of choice provided by disruption... Eventually all would settle to just two if no further disruption (periods of chaos) challenged the natural order of dominance. Not feasible in reality as change is constant. Just in theory. Occasionally we see a clear bifurcation the more order we nuance out in large complex systems like politics where the stakes are high and attention is great. We settle on left or right. The sage walks two roads in this case.

You can already download alternative browsers, their engine isn't what is stopping them from running spam, it's the app review process. And in any case, I have older relatives on both platforms and I don't see more problems with dogy apps on the pixel than on the iphone, both of them are full of spam notifications but otherwise totally functional.

Most users won't change the defaults anyways, I think this fear is well overblown.

And you should have your separate paid premium service of locking the device for your mom in the future instead of crippling 100% of users

You mean crippling 0.01% of users that want to run something except WebKit.

99.99% of users don’t care.

That’s why iPhone today is still the #1 mobile phone with highest loyalty and consumer satisfaction scores for over a decade.

You don’t become an industry changing leader and stay #1 by “crippling 100% of users”. It’s just what you think is crippling, others don’t care about.

No, I meant 100% since the limitations you support affect literally everyone your misleading stats notwithstanding

> That’s why iPhone today is still the #1 mobile phone with highest loyalty and consumer satisfaction scores for over a decade.

That's just another thing you've made up

> You don’t become an industry changing leader and stay #1 by “crippling 100% of users”. It’s just what you think is crippling, others don’t care about.

That's a rather simplistic view of the real world where leadership and customer satisfaction must depend on the single factor you're currently arguing about. In reality you could easily be a leader across a bunch of areas and then totally fail in others with the overall balance still being in your favor

Yes, it affects 100% of iPhone users, because... they're an iPhone user.

But 99.9% don't care about running non WebKit browser, so it doesn't cripple 100% of users because they are not affected by this.

Same as having no Flash support today doesn't cripple 100% of iPhone users, because they don't care about it.

Go and ask your friends/parents/family/grandparents if they're crippled by not being able to run a non WebKit browser and listen to their answers.

I'm not making up numbers, I'm generalising it.

There's 1.5 billion iPhone users in the world, and there's ~26 million developers in world, that's less than 2% of 1.5 billion. Only a set of ~26 million developers have iPhones, even smaller set know the word WebKit, and even smaller set of those that know what WebKit means even care that their iPhone cannot run a non WebKit browser.

So yes, I can generalise and say that 0.01% of iPhone users care about non WebKit browsers. I can make it 0.1%, 1% or even 2%, it doesn't change the point - a minority of techies who like to tinker with their gadgets (including some business owners who want to increase their revenue) want to force their needs on 99% of people by exposing over a billion people to new security and privacy threats and attack vectors.

All while for the last 15 years they were happily piggy backing in the walled garden that was designed this way since day 1 and playing key role in Apple's success building a marketplace of 1.5 billion people that was unimaginable in 2008. And then suddenly 15/30% became too much, please change the terms we were playing along for 15 years, open up the iPhone!!

FWIW as of a few months ago, Google and Mozilla were already prototyping porting their respective engines to iOS to prepare for this eventuality: https://9to5mac.com/2023/02/07/new-iphone-browsers/ https://9to5google.com/2023/02/06/google-chrome-blink-ios-we... - and Vivaldi would benefit from this work getting to Chromium as well.

I think it’s time to recognize that the web browser engine needs to be a trusted, hardened system-level component to protect user security: these engines deals directly with executing untrusted code being served from potential attackers.

Some interesting research I found through serenity os suggesting jit may not be worth it for most things. https://microsoftedge.github.io/edgevr/posts/Super-Duper-Sec...

Can that be done without disabling JIT for the rest of us? My app would benefit greatly from JIT compilation, and it's always been a bummer that it can't realize its full performance potential on iOS.

No. A JIT requires marking pages of runtime-generated data as executable. It’s an attacker’s dream: https://en.wikipedia.org/wiki/JIT_spraying

The entire compiler and language-runtime using a JIT becomes an attack surface. Securing Javascript is hard enough.

Can you give an example of such privileges?

Support for web extensions as an example (Safari extensions)

Doesn't Kagi for iOS support web extensions already?

Not yet. The support is very limited.

Safari's rendering and JavaScript engines are the only ones allowed to run on, or be distributed to, iOS.

That is technically WebKit, which is open source.

Try to bundle your own WebKit with an app and see what happens.

That's not a fact. All browsers on iOS use the same rendering engine. The differences between them are all in the UI and other front-end features. That doesn't make Safari superior to them, especially since they're all starting off with the same base rendering. Anything outside of that can easily be better than Safari.

Rather than just downvote you for stating incorrect things with such conviction, I'll refer you to Apple's own website :)

https://support.apple.com/en-eg/guide/security/sec15bfe098e/...

> Memory pages marked as both writable and executable can be used only by apps under tightly controlled conditions: The kernel checks for the presence of the Apple-only dynamic code-signing entitlement. Even then, only a single mmap call can be made to request an executable and writable page, which is given a randomized address. Safari uses this functionality for its JavaScript Just-in-Time (JIT) compiler.

In other words, Apple only allows Apple to do Javascript JIT on iOS.

While this is technically true, WKWebView (which I believe is used by all non-Apple browsers on iOS) does allow Javascript JIT, because the renderer runs in a subprocess with these permissions. See: https://news.ycombinator.com/item?id=19379739 .

But there are many other reasons besides JIT to want to have non-Apple-Webkit-based rendering engines (including wanting different JS engines with their own JIT) - and so IMO it's very much a restriction that regulators should force Apple to relax. The security considerations should be no different than those on a desktop platform.

Interesting, thanks. Didn't realise there was ways to embed WebKit views that also got JIT (escaped the walled garden a while ago!)

Still, my original point still stands. As you note, you can't have Spidermonkey running on iOS doing JIT. But you also couldn't have Gecko doing rendering and using WebKit JIT, either. ... Right?

> The security considerations should be no different than those on a desktop platform.

Completely agree. The "it's for your own security" angle is just usual Apple FUD to make their anti-competitive stance seem pro-consumer.

Your control over the web process is very limited, correct.

Third party browsers are forced to use a slower JavaScript engine than Safari. They also can't support extensions or PWA features.

The JIT thing hasn’t been true for several years thanks to WKWebView.

Reply on news.ycombinator.com