Apple confirms iOS 17.4 removes Home Screen web apps in the EU
9to5mac.com
9to5mac.com
It just shows they don't care, they are releasing a whole new platform right now and at the same time show one of the most abusing attitude to developer I think we have rarely seen.
Apple app store condition were already overreaching but this time they really went the extra length with every single of their DMA adaptations.
That's not at all the case. Apple does care, a lot. It's just that their interests are not perfectly aligned with yours (or most developers).
The issue is that Apple needs 3rd party developers because a platform without apps has little value. However, there are so many developers on iOS that individuals have almost no leverage. Thus Apple invests their resources into the fattest part of the curve (developers of highly monetized games, mostly) because it gives them the best returns. It's not economical for them to focus on the elite developer's highly specific needs.
"including isolation of storage and enforcement of system prompts to access privacy impacting capabilities on a per-site basis"
One scenario is that today there is one instance of WebKit owned by the Home Screen process shared amongst all of the PWA apps which is enforcing that prompt. With third party engines that prompt would appear for the first app invocation but not any subsequent ones.
This is only an issue with PWA since for normal apps the browser process is per-app rather than shared.
Now they could rewrite the Home Screen execution environment to support one engine per app but their argument is that it's not worth their effort.
Apple surely does this on purpose to prevent PWAs from being useful. Can't let any App store competition arise.
Allowing PWA to access the camera/microphone without system prompts and install other apps on the device is a little more than just annoying.
Objective-C allows dynamic dispatch to private API methods which would be just fine to do on third party app stores.
As I mentioned above the issue is likely related to engines being able to cache the system prompts approvals across multiple PWAs effectively bypassing them.
On macOS, I already have to both grant Firefox permission to access camera, and then Firefox asks me about every website trying to access it individually, using their own UI.
Or to companies like Google and Meta for advertising purposes.
This isn't any different from how it works already for all kinds of apps: If you grant Zoom the permission to access your camera, you do that once, and have to trust it on a per-call basis to not turn on your camera without your explicit consent.
If you don't trust your third-party browser to respect your choice as to which websites you want to grant access to your sensitive data, you probably shouldn't be using it, or at least not grant it access to that data in turn.
And you may be happy changing the status quo to allow that but I think it is a terrifying proposition.
The same applies to photos. iOS even has an API to let you pick a single photo to upload/share with an app that doesn't grant any access beyond that. And for messages there isn't even an API in the iOS sandbox.
Maybe you could clarify your concern; as far as I understand it, nothing whatsoever is changing on iOS due to the DMA in this regard (and I wouldn't want it to).
For example Apple has `UIWebView` and `JavaScriptCore`. They could have abstracted the implementation so PWA's run in like a `UIHomeScreenWebAppView` which requires a protocol `IWebView` and `IJavaScriptEngine`.
Implementations could delegate OS integration tasks back to the operating system. For example notifications.
The technical approach and legwork is already done with React Native.
I can appreciate that Apple has put in a lot of thought into this but it seems like they are not following the spirit of the DMA laws. And I can understand why.
New features had to be paid for due to accounting requirements.
iPhone costs ~$1000, with the highest profit margins on hardware plus AppStore out of any phone maker = for free lol.
Is this astroturfing HN loves to provide Apple for free? Apple fans will go out of their way to white knightly defend a trillion dollar company who can easily afford do implement any regulatory challenge, gaslighting you for having the audacity to hold Apple accountable to a high standards, as if they're some broke 3 person start-up scraping behind the couch cushions for money, when Apple is absolutely minted with the GDP of an entire country.
And I don’t get why people who don’t like the Apple way care so much. There’s an alternative that’s more open. Go build your utopia there, if the lack of barriers makes it so easy.
A counter to this would be game store sites like Steam have in 30% fees but steam doesn't have a monopoly on the games store. Apple has a monopoly on the app store.
Apple has been taking a lot of actions within the last year against the developer community: 1) Retaliations in the anti-competitive lawsuits against Apple in US (surrounding fees) : * You must request an entitlement now from apple to link to an external payment provider in app. You must still give apple a 27% even if you use external payments. * If Apple feels a lack of compliance with the entitlement program they have the right to look through financial books and bill for if they think their cut was missed.
2) Retaliations in the anti-competitive lawsuits against Apple in EU (surrounding fees) : * PWAs. PWAs were starting to become a form of protest for developer to get around Apple's closed source system. PWAs don't utilize Apple's SDKs. Sure Apple may have some points surrounding the technical inefficiencies surrounding PWAs but it is suspicious that these rules have taken place during these lawsuits.
3) Beeper * Everything going on with Beeper enforces the point that Apples wants to have a stranglehold on their monopoly
Optional 4) The insane markup of the Vision Pro relative to competitors. Making it difficult for devs to test new products.
All of these exemplify Apple's use of their monopoly on the individuals who support their ecosystem (developers). There is strong consumer demand for Apple so their is a strong incentive to develop with Apple. Being an early-stage founder myself I am finding it very difficult to convince myself that developing on Apple for proving product market fit is the way to go.
These rules are hurting the smaller developer teams who can't afford to pay these fees and can't pay for a compliance guy in the beginning to look over Apple specific polices. PWAs being canceled is just another example of Apple over-using their power to hurt the little guy.
Because otherwise your comment is just another "hail Apple, fuck their critics for hating my favorite company".
iOS updates used to be paid in the past (due to Sarbanes-Oxley in the US)!
(Unless you downloaded the update file from Apple's CDN directly and manually updated your iPod Touch via iTunes, not that I ever did that as that would be very naughty ;-))
> to comply with the DMA’s requirements, we had to remove the Home Screen web apps feature in the EU. [...] Still, we regret any impact this change [...] may have.
Regrets all the way to the bank. I'm sure it has nothing to do with the Core Technology Fee whatsoever.
PWA is, as an honest assessment, dead. It was a neat idea - kind of like BeOS or Amiga - but it's dead.
My personal take is this is because PWA had too little to define itself to the everyday Joe with. The appeal of PWA was primarily to developers - because then they wouldn't need to build apps or pay fees. What appeals to developers though, doesn't have any intrinsic appeal to Joe.
If alternative browser engines and PWA is enough to pwn iOS, maybe it was never really secure in the first place.
When there is only browser - Apple can easily push an emergency patch. With 3rd party browsers this isn't possible.
From the point of view of the OS, a 3rd party application using JIT can't do anything more than a 3rd party application not using JIT, which Apple have to allow anyway.
And still it's laughable that the only "mitigation" Apple found was to remove a feature that most people didn't even know about (because Apple made it difficult to even access in the first place!). That surely will have an impact on the security of the 2 people that knew about that feature.
By the way, why isn't MacOS so insecure if it allows all sorts of 3rd party apps, with or without JIT, and even allow apps creating shortcuts on the desktop themselves?
> When there is only browser - Apple can easily push an emergency patch. With 3rd party browsers this isn't possible.
Lot of people don't immediately apply OS updates, and Safari is part of the OS so it cannot be updated in other ways. 3rd party browsers instead can be very quickly updated like any normal apps without even requiring a reboot of the OS. It seems to me that a competent 3rd party app has a better security model than Safari.
This makes me worried Apple will remove PWA support altogether.
Apple is definitely happy about this. PWAs always seemed like a regulatory fig leaf more than something they really care about.
The only place I've really seen them talked about is the Microsoft Store, where they can be sold as apps. They also all have 2 stars or less with people screeching "PWA - not an app!"
It's a dead tech. A neat idea, but dead. I think this is because, for most people - why would they care? Maybe if they have a cheap device that has low storage space. The people who cared most about PWA are developers who don't want to build apps or pay fees - but users don't give a darn about that.
I can't see this as anything but a solid win for end users.
I am fucking tired of non-native, JavaShit-laden "web apps" that each demand a dozen web browser processes and run like drunken dogs on a Friday night.
I first had to add the add to homescreen button to the share menu with the "Edit Actions" option.
If I search add to homescreen button missing I find nothing... or worse actually. They say to restart safari, restart the phone and then reinstall iOS.
https://discussions.apple.com/thread/8345497?sortBy=best
I've considered making a page on my website explaining how to do this but it smells to much like something the user is not suppose to do. It's asking a lot? Very suspicious? Am I getting hacked?
Jobs and Ive are long gone.
I would expect a bit more decency and awareness, but they probably suffer some kind of tunnel vision.
They don't have any fight with the EU yet.
Apple's accountants and lawyer are only engaging in malicious compliance with the EU so that they cause the most annoyance in the EU while still being legally in the green to not have a fight.
It's precisely what accountants and lawyers would do.
They absolutely do. The EU took a step, then Apple took a step, and I fully expect the EU to take further steps in response, both in terms of further regulation and in malicious enforcement. (When engaging in malicious compliance, you'd better be sure you're following the letter of the law to the last detail, including anything a court may be willing to nitpick and might otherwise dismiss or discount for someone not engaged in malicious compliance.)
Frankly, the biggest reason I'm annoyed with Apple for doing this is that it's likely to contribute to the existence of a future worse version of the DMA that overreaches in the course of precision.
Apple didn't need to take any extra steps. They just had to comply, while keeping functionality as is, they didn't need to break it in the process.
Apple's response is the corporate equivalent of that toddler who smashes things out of spite when things don't go his way.
>and I fully expect the EU to take further steps in response, both in terms of further regulation and in malicious enforcement
Bureaucratic politics respond way way slower than wealthy tech companies with 7 figure lawyers on payroll. It's a legal game of whack-a-mole and the likes of Apple are high-score players at this.
And they did comply.
If you regulate something by saying "X and Y must have equal capabilities", a company can comply by reducing the capabilities of X rather than increasing the capabilities of Y. And in the general case that's valid; the alternative would be punishing a company for having more capabilities in X in the first place, where a company that didn't have those capabilities to begin with wouldn't be punished for not adding them.
(To be clear, I don't like in the first place that Apple didn't allow third-party apps or browsers, and I wish they'd opened that up to begin with, and that we'd never had or needed the DMA.)
> Yeah, right. Bureaucratic politics respond way way slower than well funded tech companies with 7 figure lawyers on payroll.
Sure. They've picked a very slow fight with the EU. But when the EU punches back, it may well do so with massive additional legislation with its own unintended consequences, and fines measured in percentages of global revenue.
This doesn't only hurt PWA's, it also hurts very simple webapps that are nothing more than a responsive website with some functionality and data. Made easily accessible by a link (with title and favicon) on the homescreen.
Of course, one can open a browser, wait, click again on some bookmark icon, scroll to the webapp, click it, wait again... and use it just like that.
The world wide web is an evil place. Luckily Apple protects everybody with an iPhone. The year of the Linux desktop, Linux tablet, Linux phone, Linux smartwatch, Linux AR glasses could not come soon enough.
No chance, look at HN, the top comments are defending Apple's stance. If even tech savvy geeks lap up Apple's propaganda, what hope is there for the average user?
I think it's possible. Think of a combination of Jobs's vision of a hub-and-spoke model of computing devices, powered by SBC's and Waveshare components and open source software. For a start.
It won't be premium devices as people are now expecting of Apple devices, but there comes a point where people are willing to trade in nicer hardware for nicer software and functionality.
I don't know who the early adopters are going to be of this, but I know a lot of comment sections on HN with people also fed up about the direction of big tech.
It sounds like it could be a challenge to maintain if multiple regulatory bodies across the globe start asking for their own little changes.
Or that it's in fact straightforward to offer an API for browser engines to integrate with caching, background operations, notifications, etc., and Apple should have held off compliance with DMA until these were implemented?
If so I'd love to learn more. I'm sort of inclined to believe that these currently sit deep in WebKit and it's a nontrivial exercise to pull them out and offer them as an API to other browser engines.
That would have been the least controversial aspect of their first attempt at compliance, in my view.
They could have also just allowed third-party browsers to offer a "PWA home screen" as an intermediate step until the APIs are ready. I can't think of a PWA API that's impossible to implement in a third-party browser other than appearing on the home screen and in the app switcher under its own icon.
They could have also just forced the same upon WebKit PWAs until the API is ready.
So many options. Yes, all of them would have taken some engineering work, but that hasn't stopped them from doing very complicated things in other aspects of their DMA compliance framework.
Yeah but how much work would it be to implement, and is it worth implementing for the 1% of sites that use it?
I'm not saying it's straightforward to build the necessary apis for that but they had years to do it.
a user can download spying native apps from the apple app store but I cannot decide to trust Google, Microsoft, Mozilla with their browser security sandbox?
otherwise why do you specifically care what browser engine choice I make?
Apple could disable web capabilities in safari and let other engines do otherwise
you CAN and SHOULD stay in Safari if you trust only apple browsers to be safe?
what do you care if I use chrome and got fucked? (which I wont)
do you want to tell me that I should not use macos, linux, windows android and firefox or edge or chrome because I may get fucked?
you do not really understand that it is MY choice how I get fucked with a lastpass native app clone on apple or with a real chrome browser
nobody stops you to stay by your webkit engine!
very WEAK arguments from apple, practically lies
mac os users have been safe from service workers and web app capabilities using chrome and firefox and edge in the last 5-10 years
surely apple is able to keep ios and ipados users safe from these scary other browser engines
it is much easier to safeguard 3-10 other browser engines than millions of native apps
in addition, do they really have to pay attention to other than chrome, edge and firefox? if somebody uses a chinese spy browser or a russian, the same when somebody downloads any other spying ot malicious native app
do they even need to care about me optin out from safari on MY 1000 dollar iphone?
what the fuck, I am not a child!
keep safari safe and at max give me some warning before downloading chrome or firefox or whatever!
Since ~nobody uses PWAs, or at least so few people that Apple can’t justify the effort to retain any advantages PWAs confer on its own browser/OS, doesn’t it become a business decision at that point?
it is also an effort to build access for disabled people
the difference is Apple has practically disabled the web as an app store and in the future if it is possible to launch web apps on every platform, there will be 99% web apps
apple is a big company and it is such a vital thing they can and will be forced what android, windows, linux, mac os(!) can do...
it is like claiming not many disabled people wanted to use my services until now (huge stairs without lift or so) so I just do not want this 2 days and 0,000000001% of my monopolisitc budget to build access for them
> Addressing the complex security and privacy concerns associated with web apps using alternative browser engines would require building an entirely new integration architecture that does not currently exist in iOS and was not practical to undertake given the other demands of the DMA and the very low user adoption of Home Screen web apps.
See, Apple? This is how you can implement PWAs so that users do not accuse you of other browser's problems. Then again I assume this is already known in Cupertino but not implemented because it would break down that wall around the garden, brick by brick.
This is quite easier said than done. Simply copying a feature from competitor is not neccessarily easy especially if they challenge deep architectural decisions that have been made in the past.
More discussion yesterday: https://news.ycombinator.com/item?id=39371119