Hacker News Reader

Comment by crazygringo | Hacker News Reader

Thanks for posting that. I'm no iOS expert but it actually sounds like a pretty reasonable explanation. It's at least good to hear Apple's side here, and more knowledgeable commenters here can weigh in as to whether it really does seem genuine.

View on HN

It's a massive blow for PWAs. There are a lot of corporate apps that are PWAs as the app stores do not really support "private" distribution of apps (other than via MDM-based solutions which doesn't work for use cases where you don't control the users' devices). Furthermore, by forcing the apps to load in a browser tab (rather than as a full screen home screen app) it breaks the support for push notifications. In my opinion this is malicious compliance.

So much this. I am the author of a barcode scanning library for JavaScript, my customers are mainly SMBs running in-house apps, and they love frigging PWAs.

- No App Store review

- Full control of distribution channel

- Instant deployment from CI/CD

- Single codebase

- Easy to source developers, even in-house

- No administrative burden from having to maintain accounts at Apple/Google.

Adding to home screen is important for non-technical end-users to recognize it as an "app" and not a "website".

Sure it's reasonable ... because of course all these browsers don't have a security model and just allow web apps to do whatever they want.

This is essentially saying no-one can build a secure browser.

No, it’s saying they’re being forced to support at least one insecure browser which would affect the security of an obscure feature so they’re removing the feature.

Nobody can build a secure browser.

Truer words have not been spoken! Maybe only second to nobody can build a secure baseband.

Security is well achievable, absolute security is not. Somehow almost everyone seems to grasp that intuitively, but a subset of IT keeps pretending they're the same thing.

Nobody but Apple has experience building a secure browser. [1]

[1] On iOS.

I know at least Firefox has per-site permissions for location, webcam, and microphone access. Is it a correct interpretation that Safari on iOS does not have this feature?

Safari has those features.

Their argument was they want the system (iOS) to enforce those permissions, not browsers on behalf of apps they've added.

Ideally there should be both browser-level and OS-level controls. Reduces the chances of things slipping through the cracks and it limits the blast radius in case a browser vendor can’t get a hole patched up quickly for some reason.

I don't think they're saying that. I read their statement more like "someone might build an insecure browser", which isn't that invalid a concern I think. I'd like Apple to be a bit more daring and just open up those APIs too, but I kind of get their incentives point the other way. Apart from some landmark design decisions, Apple is an extremely conservative company, and stalling on an issue like this is just what such an org would do.

But they already give the "insecure browser" access to display web pages, access the camera etc. They just don't want "runs best on chrome" pwas eating they're app store cake.

Reply on news.ycombinator.com