Apple confirms it's breaking iPhone web apps in the EU on purpose

Is there some flaw in iOS that makes it harder to secure than the desktop?

I know it's used as an intensifier, but this feels like a particularly bad place to use "literally" that way.

> They acknowledge that 1) Safari already has all the integrations required to support PWA securely

Not really sure how to respond to this. An airliner already has all the controls required for being piloted. Why am I not allowed to pilot my next commercial flight?

But my more serious point:

> 2) they can't be bothered to provide the same API's for third party browsers because it's not "practical".

Why are you glossing over "practical" there and putting it in sarcastic quotes?

This sounds like a huge change in the security model given how tightly Safari is integrated with the rest of iOS. Heavily restricting permissions and sometimes functionality to prevent security threats is very consistent with what I've seen from Apple in the past (and is one of the reasons I prefer them).

Even if they intended to open this stuff up, I can't imagine this is a change which wouldn't require massive changes to iOS and a long review and testing process.

> They built their PWA support in an anticompetitive manner assuming App Store & WebKit would be a monopoly forever, and now as a result the baby is going out with the bathwater.

They built their PWA support for the architecture they've had since the iPhone's release. Why should they have wasted time building affordances for a world in which they were forced to support other browsers?

I cannot see this as anticompetitive. If you want open, you have that choice in Android.

> They built their PWA support in an anticompetitive manner assuming App Store & WebKit would be a monopoly forever, and now as a result the baby is going out with the bathwater.

They built it in such a way that it was sustainable and sensible for the time it was made (iOS 2.0). That's a really long time ago in the software world. More than a dozen versions of the OS have been built on top of this. Saying "they should have just figured it out back then" is completely ignoring the reality of what was offered by the OS and the mobile space entirely at the time.

Now laws have been passed that say "you must provide alternatives." OK. They can choose to spend an ungodly amount of time refactoring the OS to undo 16 revisions of the OS of assumptions for zero benefit for the company, or they can say "Sorry we can't comply with that for your market."

It sucks. But it's a result of reasonable business decisions and their evolutions from a significantly different era.

And if they don't, they have at least a chance of circling back and catching them later.

They want that.

With apps that they cannot review such as PWA apps, they have no such ability.

Like I said, Apple could totally make APIs so that Chrome could know it was being launched in a container with data isolation and should behave as a web app. Google could then adopt those APIs, with the alacrity that it's famous for showing with new iOS system APIs. But the behavior Apple is implementing here is probably how any default-browser that hadn't yet opted into those new APIs would have to behave.

(To be clear: I think Apple is being petty here by not having those APIs announced. But "we're going to regress everything to bookmarks" is probably more DMA-compliant than "things are better when you use Safari, and we promise we'll extend that to other browsers someday".)

This strikes me as the way to go, there’s no good reason for anything else to be copied and it reduces the amount of data that integrated privacy-compromising ad and analytics services can readily glean from users.

This seems to be over-generalization? Users are using Apple devices because those are good products, not because they want to delegate every single trust problem to the Apple ecosystem. That might be a great proposition for people like you, but there is a significant number of people who consider it a compromise rather than a value.

We do this all the time. I don’t uniquely depend on Microsoft for stuff that runs on Windows. Same for stuff that runs on macOS. And on Linux I’m not even sure who I’m trusting from the ground up other than a huge and disparate collection of people.

So what makes iOS so unique that it can’t run PWAs, which is little more than adding some chrome and a handful of APIs to already pre-existing browser capabilities.

What an F’ing joke. And the bigger joke are the Apple fans who are going out of their way to defend Apple sticking it up their nether parts.

Apple has no interest in working with public institutions that have a close relationship with the people they serve. That's a big red flag in my book. You cant trust a company that serves content and hardware and at the same time trust them with security. It's too many eggs in one basket, to easy of a target for rogue entities (NSA) even if they have good motives .

What Apple and some users here are saying that users don't have intelligence to judge it and so will have to trust only Apple.

Trusting Apple is nice in the US where it's probably a net contributor to the country's development. Elsewhere, not so.

Except that's exactly what Apple is saying. Their engine -- and their brand depends on it -- offers users assurances arbitrary engines do not offer. Apple says PWAs are safe because Safari is safe, while not-Safari PWAs are not-safe.

And, if not safe, Apple is at least accountable.

Google's brand, for instance, does not depend on it: https://www.engadget.com/the-morning-after-google-will-settl...

Since when was loading web pages ever considered safe, at least by those who actually breathe computer?

It's frankly alarming how much trust we (must) give to Arbitrary, Remotely Executed Code(tm), especially given how many attack vectors are remote code executions.

In this case they have to change the integration and sandbox model to allow the security policy to remain intact for people who want and need it. That breaks a few things but it stops the integration from being used for exfiltration among other things.

Note that they're not completely breaking it, just ensuring that the security model stays intact when browser engines have to coexist on the same device. That means sacrificing some convenience for security.

Not everything is a conspiracy.

The real issue, however, is that Apple is not saying “we need more time to implement the APIs”, which the EU would very likely concede, but “we don’t think it’s worth it for us”.

I don't think that's the only solution. A simple alternative is to declare that "apps that run in other apps don't get to do anything at all."

I.e. in this case, in response to a EU requirement to support alternative browser engines, Apple could — rather than disabling PWA integration altogether — drop all additional privileges that PWAs have that regular webpages don't.

Make installed PWAs in the EU market into just "webpages, but with a home-screen icon, a separate task-manager card, and no address bar." Which is 99% of the reason anyone installs a PWA anyway. No camera/microphone, no extra storage, etc. Not for Chrome PWAs, not for Safari PWAs; not for any PWAs (on these devices.) They're just webpages presented differently. No "meta-security" required!

so, Apple? Since Apple has also required browsers for years to use their own safari backend, this isn't even an issue of "oh well it doesn't work on Firefox".

Sounds like they cornered themselves there.

But browsers already have this security features that isolates websites from each other? How come PWA, which essentially just placing a website shortcut in the home screen and hiding browser ui, affect browser's existing security features?

It's all just code sandboxed by the OS. Apple is just being pathetic because they couldn't force legislators to do their bidding.

Yes, and Apple now (against their will) allow me to select this browser myself to browser the web with.

Whether I use this to load a webpage normally or as a PWA does not change the risk I was exposed to. PWAs just let a web application ask the browser to run "fullscreen" without browser chrome, to set its badge and colors, to register as a handler for certain URL types, and to open the share panel. All actions already taken regularly by said browser.

Even if we assume Apple's statement that other browsers are insecure is correct, there is no value in blocking PWAs and requiring me to instead use bookmarks: I am still loading said application in said browser that implements and uses all this functionality itself. To the OS, a PWA is nothing more than a type of bookmark for a browser.

So, no - this is not reasonable and their argument makes no sense. If it was true that Safari was actually safer, then Apple should instead spend energy sharing how so that other apps can be equally safe - it would be incredibly irresponsible for the platform owner to keep security as secret sauce - rather than handicapping other apps.

https://web.dev/learn/pwa/tools-and-debug#using_physical_dev... at "Firefox Remote Debugging" says there's a way to debug Firefox for Android PWAs.

So I'm fairly sure the PWA is running using Firefox for Android.

I also never accepted the terms and conditions for Chrome on this phone.

https://developer.mozilla.org/en-US/docs/Web/Progressive_web...

Yes: https://developer.mozilla.org/en-US/docs/Web/Progressive_web...

I tested just now in Firefox with an app from https://appsco.pe and it does indeed work!

I can do the same with the Android version of Brave.

> If you install Firefox it uses Gecko but still has native app look feel?

That depends on your definition. Making an app _feel_ native is a matter of implementation. But the opposite is also true: A native app is free to feel non-native if the app creator makes it that way.

The app does show as a distinct entry in the app switcher, but still has a Firefox icon when I tested it just now.

Instead of siding with Apple, why would I side with anonymous and random internet commentators who have never made devices I want to buy?

Looking at these things as sides is a mistake. Instead of just being tribal, it's better to look positions on their merits.

I wish Apple'd held a hard line on the "no apps that should be a web site" rule(s) for similar reasons. Alas, they did not.

I don't think it's about Google, I think they assume consumers won't care, and they're probably right.

Does it live up to that? YMMV. It's probably fine for very simple apps, probably comes apart at the seams for anything trying to look modern or have fancier functionality.

On iOS you need to use the Share > Add to Home Screen which normies have no clue about. You’ll find out if the site supports PWA features AFTER you add it to your Home Screen. This of course is done entirely on purpose to make them harder to find and less appealing than the revenue generating App Store.

For me, I use iPhone entirely because pixel doesn’t support cardav and caldav out of the box…if I can’t use PWA’s on my phone then I’m going back to android cause I can solve the email problem easier than I can solve the productivity tools not being available via PWA’s.

In some regards yes. In practical regards they're a threat to app store margins (on all app stores, not just Apple), so there's no incentive to truly support them other than developers being loud about it.

>I don’t even know where to find one.

Because Apple has crippled the ability for you to use them, so developers can't really spend time working on them. Chicken and egg problem.

>if Apple is complying

They're not really, they're twisting and turning as much as possible to look like complying but make the desired outcomes even more difficult to achieve.

I agree that's not as good as a native install prompt but I don't think it's a strange incantation/utterly unintuitive. I know that icon originally meant 'share' but these days it means a wider range of things - basically "take this thing somewhere else".

In a similar vein, a startup will be very happy to talk about how valuable it is, except when it comes to talking to tax authorities, whereupon suddenly their shares are borderline worthless.

The kind of deep user information you can gather by installing a full blown app compared to a more sandboxed web app is worth way more than the 30% royalty cut.

That’s not true, nor what I posited. PWAs have almost all the native features, if not all, depending on the platform. Plenty of “pro-PWA” people go out of their way to demonstrate this[0].

I’m talking about install rates and usage by end users in a way similar to using a native app.

Whether you agree on parity or not, you seem to concede that PWAs aren’t wildly adopted the way native apps are.

As such, it makes sense that Apple wouldn’t want to waste engineering resources on it by rewriting the underlying architecture, which is the topic at hand.

That in and of itself ends the debate.

You then go on, OT, about whether Apple should or shouldn’t position websites and PWAs as legitimate alternatives.

Saying:

> but Apple's platforms are the only ones where it is being positioned as a legitimate alternative

Specifically, Apple states[1]:

> If the App Store model and guidelines are not best for your app or business idea that’s okay, we provide Safari for a great web experience too.

An alternative isn’t, as you seem to imply, an identical option; instead, it is simply understood to mean a different choice, usually a choice different from what is usual.

One might say, "In the absence of a better alternative, we’ll have to proceed with our original plan.” This use in and of itself implies that one option is better than another, thus not identical.

Whether something is “legitimate” or, more specifically, a “legitimate alternative” entirely depends on the person making the consideration and the value judgment they make based on their needs and wants.

I might consider soda a “legitimate alternative” to coffee because I’m just looking for a beverage, whereas a different person might not deem it a legitimate alternative. After all, they are solely interested in a warm beverage.

With that in mind, I consider web pages, particularly PWAs, a legitimate alternative to native apps because most native functions are available to PWAs on iOS. You might not because your need might be one of the few things PWAs can’t provide.

That doesn’t make it a bad-faith argument on Apple’s part; they never claimed that PWAs are an identical option to native apps via their App Store. They offered up an alternative that can provide some, if not most, of what a native app can provide.

You continue with your OT by presenting a false equivalence

> Android has "sideloading", Windows has REGULAR loading.

It’s a false equivalence because neither Google nor OEMs present sideloading as a legitimate alternative; it simply exists, but it’s not promoted as an alternative option.

Google specifically likes to write copious amounts of words in blog posts[1] and whatnot, talking about how great PWAs are while wearing their Chrome hat. Meanwhile, the PWA experience on Android is marginally better than that on iOS, provided you use Google’s browser. Where is your indignation for that? They’re promoting PWAs harder than Apple will ever do.

For that matter, Microsoft also doesn’t call “regular loading” a legitimate alternative, so again, your equivalence makes no sense.

> It doesn't matter who joined Apple when and did what

Of course it does; if you don’t go OT, that is. Whether Safari is or isn’t suitable for PWAs is essential to assess if PWAs are used in meaningful quantities.

If someone posits that Safari doesn’t properly support PWAs when that isn’t true, like GP did, then it’s important to point that out and provide context on when that changed.

It doesn’t matter to you because you’re having an entirely separate discussion.

> PWAs on iPhone are not like native apps

Yes, they are.

As stated above, they’re not identical, but they are similar to, or if you prefer, “like” native apps.

> it's not even really close

This is a value judgment because it requires that you and I agree on the definition of “close.” I argue that they’re pretty close because they can do about 90% of what native apps can do.

> It's good that this pathetic line of argument wasn't much of a deterrence for the EU.

Let’s keep it classy and within HN guidelines.

> What people want isn't PWAs

Hence, the low install rate of PWAs and why it’s not weird that Apple didn’t decide to spend engineering resources on rewriting the underlying architecture for PWA installs.

Again, that, in and of itself, ends the debate.

> they just want the kind of capabilities that computers have had for decades, including many of Apple's current computers for sale today. To be able to install an application and run it.

I’m not sure what you base this on.

From here, it looks like you’re projecting your own wants onto the average iPhone user base at large. Do you have anything that expands on how many iPhone users share your vision?

The commercial success of iPhones suggests that not many seem to care for this.

I suppose alternatively, you could argue that the fact that Android dominates globally indicates there is a demand for this in the smartphone market[2]. Still, the obvious question then becomes why those iPhone users wouldn’t just join in Android’s dominance and switch over, particularly those who feel so strongly about this that they’d spend their time online lamenting its absence.

0: https://whatpwacando.today

1: https://developer.apple.com/app-store/review/guidelines/#int...

2: This is simplified, of course; one feature wouldn’t be the sole driver of Android’s dominance

However, I'm on their side in this case. I run a business. If having a feature comply with some regulation meant implementing a whole infrastructure I don't have to serve a minority of customers, I would also abandon the feature.

The crucial PWA feature here is being able to display them in full screen, without Safari's navigation bar.

A solution. The solution is to make them to do what's good for us by force of law. We can't afford to wait a century for some open mobile hardware platform to become available to us. We want good products now. Apple computers are good products and we should have every right to run whatever software we want on them now.

There is no technical impediment to it, the only reason they don't let us do it is it would destroy the little digital fiefdom they have created for themselves. Digital fiefdoms should not be allowed to exist in the first place. Society should actively work to dismantle them. Giving us the keys to the machine will swiftly put an end to them.

> The problem is network effects.

Absolutely. Network effects should work to our advantage, not theirs. Basically anything that lets corporations "own" users should be straight up illegal.

> A user cannot just choose to use Android, because half their friends use iOS and cannot have a decent group chat experience outside iMessage.

We should mandate interoperability there too. Why is it that every corporation gets to have their own messaging system? They should all work with each other via the same protocol. Just make sure that end-to-end encryption is fully supported and there will be no problem.

Actually here's an even better idea. Just make it legal to reverse engineer and interoperate regardless of what contracts say. People will do it adversarially if they need to. Make it so you don't need their permission. Make it illegal for corporations to retaliate against users for using things like an alternative messaging client. Get rid of nonsense like anti-circumvention laws. Then all of this will just happen on its own via market forces with no need to actually regulate anything.

https://www.eff.org/deeplinks/2019/10/adversarial-interopera...

> In this case "giving you the keys" is really about giving app developers more freedom to choose how to reach users.

It's really not. Developers can't reach users because Apple owns them. User freedom means developers can bypass Apple and reach them directly.

Trying to "break up Apple" is simply not within the EU's power as Apple is worth more than the EU's whole tech industry combined. Apple would simply leave and the whole region would be left with shiny bricks.

If the EU pursues this with big tech at large it will find itself in the 80s. It needs US big tech far more than US big tech needs it.

That's a question for regulators and lawyers. But in general yes: trying to evade a law instead of complying with its intended application is generally not viewed as unquestionably legal. In criminal law it's sometimes even taken as evidence of guilt!

> If they wanted, they could remove the App Store from iOS in EU, or pull the iPhone from the EU market entirely. Apple isn’t required by the DMA to part of a digital market at all.

And if the EU wanted, they could ban Apple products entirely. The point is that no one does stuff like this because there's a general sense that healthy competetive markets are good for everyone, and that the capitalist market will enforce this by punishing actors that try to cheat (in this case, by "trying to make more money by making your product worse").

But sometimes that market enforcement breaks down, in the face of trust/monopoly activities like (in this case) control over a computing platform. And when that happens it's routine for regulators to step in to try to right the ship.

And that ship is listing pretty badly right now. Apple is dancing as close to the edge of predatory monopolism as is possible. Again, they literally think they'll make more money by deliberately breaking their own customer's web apps. There's no way at all that's a healthy market. QED.

A long time ago? You can't sell a product under the pretense that it does X and then remove X after the fact, at least not in any country with decent consumer protections.

Depends on the laws and advertising. Sony got dinged for removing the "Other OS" option on the PS3. A feature you can definitely argued "nobody used" (and as someone who tried, the experience for anything but basically headless Linux was atrocious. You had access to almost none of the hardware for this). Still lost the case.

I wouldn't bet on Apple losing on that specifically. But it sounds like this is all adding up towards another big slap in a future Case.

Are they going to provide full refunds for anyone wanting to return their iPhone, along with any apps they have purchased on the App Store?

I doubt Apple wants to scam all their users by taking their money for a smartphone and then taking away the smart parts.

The justice system is not a computer following logical instructions.

You'll have plenty of shiny consumer items to select from (most if not all actually designed and manufactured over seas to keep costs down of course).

And if you are good litle drone you might just keep the current job long enough to scrounge together enough to buy the shiny item, so that it will signal to everyone that you are truly one of the pack that everyone around you so desperately needs to feel as being a part too.

This isn't some scifi reality that won't come to pass.

What worker protection do tech workers in the US actually have? How about the conditions in Amazon's 'fulfillment centers' (this term is down right Stalin-esque btw)? UPS drivers?

How many mergers have there been in the aeronautical sector since WW2 (hint, used to be 50+ companies and now there are 5).

And what is currently happening with the US airline manufacturer (the singular other manufacturer of its size compared to the EU' Airbus)?

I could go on, and on, and on but am hoping that you are smart enough to get the point I'm making.

Have you somehow missed all the genuine horror stories coming out of Amazon warehouses, right there on American soil? Or the thousands upon thousands of people getting laid off with impunity on a dime at the beginning of this year?

In a decade from now these megacorps will be sucking everyone in the US dry to make the scumbags C-levels a couple of cents a year richer at everyone else's demise, and yet you're glorifying this as some sort of "progress". Well no thanks, I'm happy with the EU and a lot of what they're doing to keep these psychopathic, comic-book tier villainous megacorporations from wrecking havoc upon everyone in the name of making stakeholders marginally wealthier.

Just have a look: https://media.licdn.com/dms/image/C4E12AQFqW-dnIUTj2w/articl...

Majority of educational software is European. That list above is missing Duolingo. A giant undoubtedly. Hey, did you know Gitlab was European, too? Or Skype? Or Waze? Or Booking.com? Or Skyscanner? Or even flightradar?

PS. I didn’t limit this to EU only.

This is an especially interesting time to discuss it because the current layoff bloodbath has not been evenly distributed and the European side which never flew so high isn’t getting hit as hard by the end of free money, either:

https://www.economist.com/business/2023/12/07/europes-techno...

The U.S. scene has more companies, of course, but in terms of impact an awful lot of those have been me-toos which haven’t produced durable value.

Compared to the iPhone 13 mini the Zenfone 10 is 15mm taller, 3.9mm wider, and 1.75mm deeper.

One webpage accessing the resources and data of another webpage is among the most basic of things globally known to be disallowed. This sandboxing reasoning is extremely bad faith.

Except they are! Any browser worth their salt have been doing isolation since the dawn of time.

Or do you really think bing.com can manipulate google.com cookies and storage?

Also, to what do I owe the honor of you creating a username based on mine, specifically to reply to me?