Apple appears to be breaking iPhone web apps in the EU | Hacker News Reader

Apple appears to be breaking iPhone web apps in the EU

theverge.com

79 pointsagust39 comments

Here we are, being monopoly fucked right in the face.

https://realness.online is my PWA only application, So, I've got a front row seat to apple's monopoly fulcrum killing all desenters.

if you install https://whatpwacando.today/ on a phone or ipad today you can see how they already barely support standards.

Only basic things work. filesystem access is only halfway. no Contact picker, no background sync. They will destroy the user experience for everyone in order to disable other browsers more robust implementations of the spec.

They have been monopoly gaming us for years The EU is forcing them to go out in the open with it

Why should websites, which are the least trusted form of code, be allowed to get filesystem access or contacts?

We all know that nontechnical users click through those and won’t understand the risks. So how do browser devs deal with the ethics? “Our browser presented them a dialog, not our fault, they should have read it?” We know many won’t, I don’t care whose fault it is if I’m in that address book.

If we want to imagine a world where websites have equivalent capabilities to native apps, first imagine a world where people install hundreds of new random native apps every day, both unreviewed and unsigned. Or, accept Microsoft requiring each website publisher to verify their identity with MS and sign their sites, like app developers? What’s the solution to avoid rolling back the security model 10-15 years?

This argument is not new - "they don't know any better than us" is what was used to deny the poor, the minorities and woman their right to vote for a long time. And these rights were won after a hard struggle. Apple also shouldn't be allowed to take away our consumer right with similar fear mongering. A balance where the user is in control of the device they rightfully own versus protecting the technologically illiterate from their own ignorance is possible. Just because some alcoholics ruin their own lives or even others with their addiction isn't a good excuse to ban alcohol for everyone. Just because terrorists are able to exploit a weakness in internal security, and cause harm to the State doesn't mean that the State can demand that everyone should blindly give up all their rights to a nanny state for "security". It's all about finding the right balance.

Right now Apple devices don't offer that and violate our consumer rights by limiting and dictating what software we can run on it. It also uses this control to exploit us - by forcing us to install software only from the app store, we are unnecessarily forced to pay extra for every paid software because Apple expects a hefty app store commission on it.

> Just because terrorists are able to exploit a weakness in internal security, and cause harm to the State doesn't mean that the State can demand that everyone should blindly give up all their rights to a nanny state for "security".

Tell me you haven't been through an airport post-2001 without telling me.

I'm happy to earn your trust. Apple makes that impossible for me to do.

It's on demand contact pickers and file pickers, not indiscriminate access to all your contacts and files, where do you have that from?

technically nothing is installed, it is just bad wording and bad decision to call it install... just standalone mode with an app button

what is "installed" is js, css, html etc. files downloaded the second you go to a web site, service workers are silently "installed" before and without "install web app"...

so if your device survived the last 10-30 years having "installed" thousands of websites already then you will stay safe if your favourite monopoly after 3 years of prolonging app store revenue hit finally lets you run your website standalone and with the push of a button

you can run LastPass native clones on ios store but really, you should not run a chrome/firefox native code (from Google, Mozilla) that is governed by an open source readable js code that a service worker is?

the whole web app is a website run in standalone by the browser without browser UI and with access to some things IF you say so... and of course competition is that safari will not let web bluetooth or file picker or whatever and if people learn that another chrome feature led to this big security issue they will use safari...

The right for entrepreneurs to make a profit trumps users’ rights to privacy and security.

So your complaint is essentially "Safari doesn't default enable a bunch of experimental features and doesn't blindly adopt whatever half-assed features Google pushes".

Looking at the CanIUse stats for the features you complained about made me wonder if your whole post is meant to be sarcastic.

- the contacts api spec is draft, and can be enabled as an experimental feature in Safari 17

- the file system access api is a Google-sponsored draft and not "fully supported" by any browser; Safari and chrome both support the same thing on mobile: "Origin private file system".

- the background sync api is yet another Google-sponsored unofficial draft.

I should be allowed to build a relationship of trust with my customers without a walled garden. Apple isn't keeping you safe they are keeping you to themselves

That doesn't respond to my comment, at all.

I didn't even read it. You conflated spec adoption with developer need.

Android exists.

As a long time user of both operating systems - this doesn't help the discussion. Large numbers of users are brand loyal, so only targeting one OS removes huge swathes of potential customers from your business as a publisher.

It helps from law point of view.

please do not call it install, nothing is installed, it switches to standalone mode and you can start it from the os directly (app button etc) very bad wording... all that is to "install" has long been downloaded and was "installed" before the thingy you call install will be triggered... this wording must go and better when we IT people start with it...

There is a chance that this is still a “disabled for now” feature.

My understanding of the third-party browser requirements in the DMA is they have to be able to do anything Apple’s Safari can do if they want to, and while Apple’s built out a bunch of entitlements for browsers and other DMA requirements, they haven’t done the same work for PWAs. Yet?

So given that, it would actually violate the DMA if Safari supported them but Chrome and Firefox couldn’t, and they’re not going to allow that until they’ve taken the time to figure out how they want to proceed, if at all, with allowing it for third-party browsers.

Crippling PWAs would benefit their baseline through their App Store or Core Technology Fee though

PWAs aren’t exactly great on iOS to begin with, and if that was their aim, it would make more sense to disable it worldwide rather than just the EU. They may well not bring it back for all we know, but if they are going to, it’s not going to be without figuring out exactly what it is they want PWAs to be able to do and what resources they’ll be allowed access to which probably means additional APIs and entitlements for third-party browsers.

It works quite well for some use cases

Sure, but from the perspective of web developers advocating for PWAs it was already crippled. Now it’s just disabled in the EU.

Sigh. This is really the perfect storm, because the “this has happened because Apple is evil” blog posts really write themselves after this change dropped. But really, let’s not forget that this is beta software. Apple routinely ships betas with features half-complete. The people that regularly use Apple betas know that. Drive-by drama bloggers don’t. If the final version ships with this change, I’ll be right there next to presumably everyone else railing against the ridiculousness of the change. For now though, I’m not, and I see absolutely zero point in anyone else doing so.

I think it's reasonable to expect something like a communication be made on the intent to fix before shipping and that no commentary is an implicit denial of that. After all, if you only stand in the outrage line after it breaks in GA then you're essentially agreeing it's fine for it to be broken for a while and not everyone will see it that way.

Bloggers could be less sensational about it for sure though.

And it seems that warning applied directly in this case: https://news.ycombinator.com/item?id=39388218

Had Apple not been pressured into a communication update on the matter the conversation would be starting at 0 a month from now.

Maybe if Apple gave a damn about PWA developers or users they could just communicate with them? Maybe journalists wouldn't have to make such a big stink (i.e. doing their jobs) about breaking functionality if Apple simply acknowledged it was a "known issue" in the beta release notes [1]?

You are simply giving far too much credit to a company known for its vague communications and underhanded tactics. Also note that the exceedingly detailed documentation for building "alternative browser engines" [2] has literally zero mention of progressive web apps. All the signs are in the air: it's busted and going to stay that way.

[1] https://developer.apple.com/documentation/ios-ipados-release... [2] https://developer.apple.com/support/alternative-browser-engi...

> If the final version ships with this change, I’ll be right there next to presumably everyone else railing against the ridiculousness of the change. For now though, I’m not, and I see absolutely zero point in anyone else doing so.

Sounds like the comfy position of someone with nothing to lose from such a thing shipping in a finished build.

It seems it's not "this happened because it's beta":

https://twitter.com/mysk_co/status/1758196103470628983

Some previous discussion: https://news.ycombinator.com/item?id=39299007

Is this "Just" in the EU?

yes

is that something demonstrable in a similar version for the us?

Now that alternative stores can be used I guess there's not much point to PWAs.

The conditions for those alternative stores are so onerous that it's not an effective alternative. There are significant financial costs and every app in that alternative app store has to be notarized by Apple after a security review.

Nobody's really thinking that, here, right?

Uhm yes? You don't have to develop them specifically for iOS, maintain a separate codebase, pay their extortion fees, or need to buy their Computers to develop

On the contrary, the weird rules around alternative app stores make PWAs a lot more interesting.

the biggest alternative store is the web

the website you use can be an app if well written

"install" is not needed, the bad wording "install" is just a switch to standalone mode from tab view (and get a direct launch button etc.)

by web apps (standalone websites) the browser stays as the running environment on top of OS, the web security model and trust stays intact

competition law will demolish anything with time that hinders web apps

it is sad we have to fight for this to happen

I think under steve jobs apple would have the best web browser beating chrome and they would have converted app store monopoly revenue to other sources of revenue based on excellence, not monopoly

Being able to have thirdparty stores and sidelining is horrible. I can no longer trust any app because it could now come from any source with no way of knowing its privacy or security settings. All I know is it isn’t being checked by Apple anymore.

You can opt to just not use the third party stores. Nothing is changing about the Apples App Store submission guidelines.

Reply on news.ycombinator.com