Hacker News Reader

Comment by tda | Hacker News Reader

I seriously thought that implementing some site specific custom rendering behaviour was meant as a joke. Why change html/css for a website when you can just implement some hardcoded site specific behaviour straight in the rendering engine? What could possibly go wrong?

But after having a closer look at the PR, the 1900 LOC monstrosity Quirks.cpp actually seems to exist with lots of things like

    if (host == "tripadvisor.com"_s || host.endsWith(".tripadvisor.com"_s))
        m_needsRelaxedCorsMixedContentCheckQuirk = true;

Fixing CORS issues has never been easier

View on HN

That's messed up, why should I put up with CORS when others have a special treatment...

Its used here: https://github.com/WebKit/WebKit/blob/dc1354a1d26db54d17f7d3...

Seems to be specifically for (not) upgrading images and videos from http to https, nothing else.

If a browser has too many compatibility issues, users will switch away. Outreach to the sites in question takes time and is often unsuccessful. Quirks is the pragmatic answer.

WebKit is used by the second most popular browser after Chrome. Don't forget iOS users.

https://gs.statcounter.com/browser-market-share

That's an odd way of saying the third most popular browser.

If you click link, look at chart, you'll see they mean second.

That's always confusing. They should have said "the second most popular browser (after Chrome)", or something like that.

"blah blah blah, *second only to Chrome."

My iOS/Safari is so bad, I have both Firefox and Chrome installed as a backup in case it doesn't work. They should start fixing Safari for real instead of adding Quirks.

what’s wrong with ios/safari? i don’t really ever have issues

Safari on MacOS is really nice, fast and offers everything I need... but every 3 months or so I stumble on a website that refuses to work at all - rendering looks off, buttons don't work etc...

Switching to Chrome usually fixes it - but I always question my sanity for about 10 minutes until I try it in Chrome.

It’s the opposite for me. I keep finding dumb bugs in Chromium, when it comes to correct website rendering and event handling (always regressions). Safari and Firefox on the other hand never have those issues.

The only problem is: Safari has piss-poor ad blockers. Firefox blocks custom system-wide keyboard shortcuts (on Mac).

I have bad news for you. On iOS, Firefox and Chrome use the same WebKit as Safari (because Apple doesn't allow third party browser engines on its App store).

Didn't they allow alternative engines recently?

They even have emulators now. Undoubtedly a change forced on them by the EU.

Apparently you are right, they do since around February on iOS 17.4. In the EU only.

https://developer.apple.com/support/alternative-browser-engi...

Neat, question is if any of the browsers actually have had time to make use of it though?

No.

It's not as simple as that, you're basically asking browsers to target a completely different platform, just for the EU users, where iPhones are nowhere near as popular to begin with.

Google might at some point maintain two completely different Chromes targeting iOS, but I doubt anyone else will (including Firefox). Even with Chrome, I wouldn't bet on it. It's a very difficult technical problem with no clear, easily-marketable benefit to most people.

Apple knew what they were doing, they've "complied", but in a way where nobody would bother.

As far as I know a native Chromium port to iOS is well under way. Whether Google will release Chrome is a different question, but I think it's likely. I think Google would love to bring Blink Chrome on iOS everywhere and there is a decent amount of momentum with developers and regulators to pressure Apple into allowing third party browser engines even outside the EU, but that completely goes away, if no actual engine get's ported to iOS. Blink Chrome on iOS probably gets a lot of enterprise web apps to drop WebKit support. That would probably that Chrome gets way more market share on iOS and with it lot's of telemetry for Google and also less money to Apple for default search engine placement. It's not great for the web as a standardized platform, but it will probably happen anyways.

No I agree, that was exactly my point.

It's not like iOS users care anyway, or they wouldn't use iOS in the first place.

The EU is pretty big. For a population of about 450 million people with decent spending power maybe it is worthwhile.

So Microsoft got dragged through anti-trust hell for just bundling IE with Windows and letting you install whatever browser you wanted after that, but Apple gets away with literally banning you from installing the browser you want on your own device, but that's ok? Make it make sense.

The market shifted, and two decades passed. Most importantly the courts have been packed with jurists from the Federalist society, who are libertarian. As a result there are far more judges willing and able to throw out consumer protection cases such as what happened in the 90’s with Microsoft and IE.

MS went through anti-trust investigation for more than just bundling IE, and at the time commanded a much larger market share¹ of desktop computing than Apple do of the mobile market now.

But while your comparison is flawed, I agree with the assertion² that Apple should not be locking user choice like this. The EU agree too, hence Apple's immature little hissy fit nearly breaking their (already "not quite there") offline-first app support for EU users when they were told so.

[1] Avoiding the word "monopoly" to pre-counter the sort of "well actually" responses I got about dictionary definitions last time I said something like this.

[2] Unless I'm reading you backwards and you are saying MS should have been able to like Apple currently do!

You are not reading me backwards. And MSFT is worse today. I had to make changes at the BIOS level in a new Windows laptop to make it let me install Firefox without creating a Microsoft account. Was an ordeal just to get it to let me log in in the first place with a local only account.

The Microsoft ruling in the US was that Microsoft was forcing third-party OEMs (Dell, HP etc) to ship Internet Explorer, not that they shipped it themselves.

As for the EU, they have already forced Apple to allow third-party browser engines under the DMA, as well as are forcing Apple to show a "browser ballot" like they made Microsoft do.

They didn't totally get away with, the EU has set them to rights at least. It's just a shame they didn't use it as an opportunity to do the right thing globally at that point rather than sharding the market.

> Make it make sense.

Microsoft’s anti-trust lawsuit with the DOJ was 23 years ago. There are people working at Microsoft and Apple who weren’t even alive when that happened.

Times change.

I don't know about quirks specifically, but often it takes many, many months before a WebKit commit actually ships to end users in Safari.

Anyway, Apple engineers aren't known for their outreach.

I hate CORS. Garbage like this is a large reason why. CORS works differently in every browser and every website.

I don't hate CORS when writing my own stuff, to be clear. Adding Access-Control-Allow-Origin: * to my own website's headers is easy enough. I hate when I'm using a website and something doesn't work and I look at the console and see CORS errors. Opening the same website in Chrome usually works.

I hate CORS.

>CORS works differently in every browser and every website.

Do you have some examples of this?

Not anything concrete, just memories of things not working, me looking at the JS console, seeing CORS errors, and seeing it work in Chrome, as I described. And the comment I replied to showed that it works differently between websites, namely:

    if (host == "tripadvisor.com"_s || host.endsWith(".tripadvisor.com"_s))
        m_needsRelaxedCorsMixedContentCheckQuirk = true;

That's a site-specific partial exemption from the same origin policy, as far as i can tell (without further context at the moment). Not a difference in how CORS works generally across Safari.

CORS is frustrating for a lot of developers as it can be tough to gain a complete understanding of the spec, and an understanding of the same origin policy is required. But implementation of the CORS spec(s) isn't notably different across modern browsers, now that IE is out of the picture. CORS was a real nightmare in IE. Microsoft even introduced an XHR cousin named XDR in IE10 to handle cross-origin requests, and it wasn't even a complete implementation of CORS.

This is a great resource to gain a more comprehensive understanding: https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS

I don't hate CORS from a developer perspective, I hate it from a user perspective, and from a broader "health of the web" perspective. Because, as I said, it works differently between browsers and it works differently between websites within the same browser. Mostly these differences just mean I have to use Chrome instead of my preferred browser.

I guess a similar thing is happening with GPU drivers and games.

yes, and drivers (used to at least) check the filename of the exe causing unexpected behaviour like performance degradation or even gains in some cases

In cases like benchmarking software, I guess.

Still now I'd say - Counter-Strike 2's release was foreshadowed by nvidia or ATI having cs2.exe in some config files last year.

I wonder if any of those rules could be (mis)used to workaround or defeat iOs/macOs security features?

Reply on news.ycombinator.com