Comment by SllX | Hacker News Reader

Comment by SllX | Hacker News Reader

Parent Full thread

I’m going to be level with you: there is nothing so great about PWAs that they’re worth mandating or protecting by law in any jurisdiction and the EU doesn’t owe it to you to try.

Web developers like them. That’s it, and their PWA advocacy completely disregards what a privacy and security nightmare they can be without proper safeguards, because this little device I carry around in my pocket is 1) always with me and 2) stores a lot of information about me 3) has a full sensory array installed within it.

Every new feature browsers add for better hardware access gets immediately disabled on any system I manage: cameras, mics, USB access, sensors, location, notifications, local storage, the whole works because the alternative is letting every website access those or getting spammed with access requests on every site I visit and the more crap that is added, the longer it takes me every time I setup a new browser install from scratch. Why disable them at all? Because 99% of these new features are primarily used to build a better supercookie to track and profile people without their consent. The actual marketable reasons are a secondary use at best.

So if it’s not on Apple’s priority list to build out whatever they need to support and allow other browsers to support PWAs in a secure and privacy conscious manner, good for them. Web developers who want to circumvent Apple’s fees entirely don’t need to be anywhere near their top priority and can wait. For Apple: users come before developers, and App developers before web developers.

There is little difference on iOS between a PWA and a website which has a WebKit view and hosts a website.

The only reason PWAs were interesting on iOS was to get an app on iOS, while feeling relatively native, without paying Apple.

Apple can make security guarantees about their own rendering engine that they can’t for any other rendering engine.

It’s not about what PWAs are like in Safari, it’s about what they’re like in third-party browsers that have to by law be allowed to do whatever Safari can do with their own fully enabled rendering engines.

Apple could just say something like, "This app comes from a 3rd party browser engine, and it may not be secure. Are you sure you want to install this app?". Not too much effort, but still keeping the functionality.

I mentioned this in another comment but they built out over 600 APIs and a system of accompanying entitlements to comply with the DMA, they’re clearly not at this point just for PWAs going to throw up their hands and a scare sheet and say “good enough for government work, devs: do what you want now”. EU iPhone customers are still iPhone customers. The security and privacy considerations don’t go away just because a new law was passed.

Obviously, those considerations must be considered. However, as I said, adding a simple confirmation prompt would be plenty enough.

I think what is happening here, is that Apple is going like, "I don't get my market control, you don't get your shiny new features." Other phone platforms allow you to do things, that may be unsafe or insecure, but still plenty useful.

Also, running a PWA really isn't that unsecure/unprivate as visiting a website. They both can access and ask for the same information or permissions. Really not that different.

By your logic that PWAs are unsecure, then should iOS not support rendering webpages due to "security concerns"?

> However, as I said, adding a simple confirmation prompt would be plenty enough.

That would be enough for you. That is apparently not enough for Apple, and you can tell that isn’t enough for Apple by their actions because despite the fact that there were less expensive and time consuming ways they could have complied with the whole rest of the DMA, the only feature regression they’ve had is PWA support in the iPhone version of Safari.

> By your logic that PWAs are unsecure

That is not what I said. Here’s what I actually said not that long ago:

> Apple can make security guarantees about their own rendering engine that they can’t for any other rendering engine.

> It’s not about what PWAs are like in Safari, it’s about what they’re like in third-party browsers that have to by law be allowed to do whatever Safari can do with their own fully enabled rendering engines.

Yes, so rather than allowing other browsers to have PWAs with a warning, they instead don't allow anyone to do it.

Allowing so may be insecure, but at least provide a way.

Correct. Maybe one day they’ll return, but probably not without a brand spanking new security and privacy architecture tailored for PWAs.

And yet Safari is often less secure than Chrome or Firefox. So this is all about control, not security.

I'm not a fan of PWAs either, but disabling them instead of allowing them to continue to run is an incredibly bad faith response to the DMA.

Not if the alternative is allowing other browsers to install them without a privacy and security architecture in place first.

Even if Apple thinks it’s worth doing, that takes time, and web developers aren’t worth prioritizing for them when they have a lot of other ground to cover building out a new system of APIs and entitlements to comply with the DMA’s other requirements.

The user is warned already on the App Store that installing apps from third-parties comes with certain risks via 'scare screens'. There's no reason they can't do the same for PWAs.

They probably will if they ever re-enable it in the EU, but they also built out over 600 new APIs and an accompanying system of entitlements to go with that scare sheet such that even if it’s “riskier”, they’re not just throwing up their hands and saying “alright devs, we scared them a little, so now go do whatever the hell you want”.

EDIT: I should also add that of those 600, that includes APIs Apple built out specifically for third-party browsers.

I think PWA developers are going to be pretty unsympathetic to 'your PWA is going be available again in the EU at some unspecified time in the future, when some Apple product manager decides to prioritize it for a given year's roadmap and it's all in the interests of protecting users from unspecified privacy and security threats that nobody seems to be able to define'. Most importantly, the EU may feel the same way.

Well to correct you, my position is more “Apple might re-enable this” more than “will”, which from their perspective I’m guessing is even worse and they will be more unsympathetic to it.

Personally I think Apple will, but I have enough doubts that I don’t want to make that claim.

> Most importantly, the EU may feel the same way.

That’s the rub. The EU has been arbitrarily writing new laws which mostly target foreign tech companies that don’t quite read “show me your bellies so we can pick out the choice cuts” but they’re pretty close. So the EU might do a lot of things, but if there’s an argument against them doing that, it’s what I said in my first comment above: it’s not worth any jurisdiction’s time to do so. That includes the EU.

You might need to support some technologies to get government contracts, but nobody ever mandated you had to support POSIX or J2ME or whatever to sell a computer or phone to regular people. That would be asinine, and a PWA mandate would also be asinine.

The arbitrary laws that the EU has been writing are the one of the last bulwarks consumers have against the creeping power of tech giants and these companies are making more money than ever in spite of regulation, so it doesn't seem to be affecting them too adversely.

The biggest abuses in tech come down on the adtech side of things where in order for them to make money, they need to know who you are, and they will do everything within their power to make sure that they do with or without your consent.

Telecoms companies (in which I am including carriers) also often fall within this because they are often envious of adtech companies and want what they have and can theoretically make better guarantees about who somebody is.

Not supporting PWAs isn’t in the same league, but I would also add to that: running a popular messenger, running a popular search engine, and controlling distribution of software on a popular phone platform. Spinning up new laws around terminology designed to have bad PR (“gatekeepers”) is pretty damn arbitrary as far as lawmaking goes.

No one meads “scare screens”.

I’m. It sure what I think about this yet, but I’m pretty sure I’m going to land on “allowing less privacy aware browsers to run web “apps” with heightened privileges seems like a recipe for disaster.

Maybe in the long term ther is a way to do it well. But for now I’m not sure.

Every app on iOS is sandboxed and the damage they can do is very limited. There's risks involved in opening up to third-party apps, and PWAs are only marginally more dangerous. Non-WebKit based browsers don't even exist today, this is not a real problem and won't be for some time.

The obvious solution for now is to enable WebKit PWAs and turn on PWAs for other as-yet uninvented custom browsers as they release, testing for privacy as they get released.

I think the pwa arch might be different. Running in the same app (safari) with multiple open screens, but with soft sandboxing like tabs have.

They would need new apis and architecture around PWA to support this for any browser I think.

Also, they are not allowed to have Safari-only OS features anymore due to DMA so allowing PWAs only in safari would be against the law

Reply on news.ycombinator.com