Hacker News Reader

Comment by appplication | Hacker News Reader

> Without this type of isolation and enforcement, malicious web apps could read data from other web apps and recapture their permissions to gain access to a user’s camera, microphone or location without a user’s consent. Browsers also could install web apps on the system without a user’s awareness and consent.

I’m not sure I fully understand the ire at Apple here. If any of this is true, killing PWAs sounds like the right move.

Everyone who is pissed off at Apple is just fine with this? The fact that this can all happen without user consent completely throws away any arguments of “I’m a responsible user who should be able to choose what apps run in my phone, not some big company”. Because if you really believe that, then you would also not want apps like this to exist under the new EU rules.

I’ll be honest I just don’t get it.

View on HN

> I’m not sure I fully understand the ire at Apple here. If any of this is true, killing PWAs sounds like the right move.

Well, that’s just it: it’s a lie.

Full-screen web apps are using the same web APIs that websites in browser tabs use. The exact same hypothetical security risks exist for ordinary browser tabs. Full-screen web apps pose zero additional security risks.

All Apple has done is to harm the usability of web apps. Not one user will be made safer by this move.

in a hypothetical spy browser maybe :) not in any of the modern browser engines like Gecko/Firefox

just be responsible and use Safari if you want the status quo or use a trusted browser engine like from a big company like Firefox/Edge/Chrome

do not be fooled, you people use web capabilities including service workers on websites in all OS, you even did it with Safari on iOS

if iOS had some vulnerability vs. android, windows, linux, mac that made this possible in other browser engines than webkit then Apple has to make the changes

you really think it is an effort if every other OS does this, including macOS?

and if with more information you see Apple tried something fishy here, do not forget like most LLMs most of the prompts in the past... never trust Apple again in this regard!

but you can use other browser engines in macOS (where no app store revenue originates) and Apple never had a problem implementing it and never fear mongered... this should be some kind of implicit proof

but of course Apple will have to prove this and they will fail to do so... they are just pushing the boundaries

> in a hypothetical spy browser maybe :) not in any of the modern browser engines like Gecko/Firefox

But that's the whole point of security -- you're protecting precisely against the disguised malware, not the well-behaved software.

To say that this isn't necessary because there exist browsers that are well-behaved misses the point of security entirely.

And remember that iOS was built with a new model of security in mind from the start. They don't want their security guarantees becoming undone because suddenly third-party browsers can start installing things on the home screen that look like familiar apps and inherit all sorts of permissions.

people who are these children you are describing SHOULD all stay by Safari and never download a browser app...

other adults may still want to stay by Safari

some people will just use Gecko or Chromium based browsers, as far as I know Chromium and Brave are totally open source :)

I would not recommend chinese or russian developed browsers but heck is America not a free country?

iSpyBestBrowser shall apple users download, I do not think anybody would blame Apple if their iPhones get compromised

hold back your long protective arms and concentrate on: 1. Safari security, providing a secure Apple-Level security choice 2. You may want to prompt users and tell them who owns the company and who develops the browser they are trying to download and what could happen if...

I mean do you really think somebody has to fear Microsoft Edge or Google Chrome?

That explanation doesn't make sense. Apple is not permitting arbitary browsers on the platform.

> To help keep users safe online, Apple will only authorize developers to implement alternative browser engines after meeting specific criteria and committing to a number of ongoing privacy and security requirements

Given Apple is going to continue gatekeeping browsers, the malware excuse just doesn't work. Malware browsers wouldn't get on the stores in the first place, unless Apple fucks up. And even if that happened, it would be quickly revoked.

This is one of those places where Apple's restrictons conflict with their scaremongering. If they'd only done one or the other, one could buy it. But when the combination of the two is nonsense, it becomes clear that the scaremongering has no basis in reality, and is just a justification made up after the fact and the real motivation is something else.

> [it] would require building an entirely new integration architecture that does not currently exist in iOS and was not practical to undertake given the other demands of the DMA and the very low user adoption of Home Screen web apps

So it can be done, DMA doesn’t require this, even according to Apple.

Reply on news.ycombinator.com