this post was submitted on 26 Feb 2024
97 points (98.0% liked)

Apple

17498 readers
97 users here now

Welcome

to the largest Apple community on Lemmy. This is the place where we talk about everything Apple, from iOS to the exciting upcoming Apple Vision Pro. Feel free to join the discussion!

Rules:
  1. No NSFW Content
  2. No Hate Speech or Personal Attacks
  3. No Ads / Spamming
    Self promotion is only allowed in the pinned monthly thread

Lemmy Code of Conduct

Communities of Interest:

Apple Hardware
Apple TV
Apple Watch
iPad
iPhone
Mac
Vintage Apple

Apple Software
iOS
iPadOS
macOS
tvOS
watchOS
Shortcuts
Xcode

Community banner courtesy of u/Antsomnia.

founded 1 year ago
MODERATORS
MichelleG@lemmy.world
RoyalEngineering@lemmy.world
thisisdee@lemmy.world
97
Apple’s decision to drop iPhone web apps comes under scrutiny in the EU (www.theverge.com)
submitted 8 months ago by misk@sopuli.xyz to c/apple_enthusiast@lemmy.world
19 comments fedilink hide all child comments
top 19 comments
sorted by: hot top controversial new old
[–] abhibeckert@lemmy.world 39 points 8 months ago* (last edited 8 months ago) (1 children)

I think Apple made a serious miss-calculation there. If they're being honest, and removed web apps because they are technically difficult to implement, they should have said something along the lines of "we are working on this and will disable it temporarily to avoid penalties".

But I suspect it's got nothing to do with that. Web apps can run native code with WASM and it would only be a matter of time before someone (google?) releases a "browser" that allows you to run native Android apps. Or worse, native iPhone apps... bypassing Apple's Core Technology fee since it's "just a webpage".

[–] ForgotAboutDre@lemmy.world 0 points 8 months ago (2 children)

It would be a massive vector for malware. Without many options for Apple to fix if the users isn't using safari to access the PWA. One that many more people are likely to fall for as they exist outside of any marketplace, even third party ones.

Apple doesn't want to say this, as it makes iOS sound bad and it's users irresponsible.

[–] FooBarrington@lemmy.world 13 points 8 months ago (2 children)

How so? If they actually have a secure operating system, even a buggy/insecure browser wouldn't allow malware to do anything bad.

[–] 2xsaiko@discuss.tchncs.de 9 points 8 months ago (1 children)

All this theater makes it look like a lot of their security is dependent on App Store verification. I hope it isn't.

[–] Miaou@jlai.lu 2 points 8 months ago

It really sounds like it. And then idiots will say apple was right when exploit come out

[–] ForgotAboutDre@lemmy.world -1 points 8 months ago (1 children)

When you allow an app functionality it can be exploited. Security comes through only allowing apps that are vetted and routinely monitored (apps stored and repositories do this). The only way around this is to extremely limit softwares access to the rest of the system, which impairs functionality. Even access to sensors can be exploited to spy on users and access passwords.

When Apple allows users in the EU to install different browsers PWA would have apple relinquish all control over vetting of how PWA can interact with the system. The new browser would now be responsible for this.

Apple won't be able to control it, but they will be liable in reputation for the damage that happens. Their walled garden doesn't only keep their users in, it keeps hostile actors out (for the most part). iPhone users expect this and may see it as a feature. The same way Linux users see their distros repository as a feature. Remove this security will devalue the device in the minds of many of their customers.

[–] FooBarrington@lemmy.world 5 points 8 months ago (1 children)

I think you're confused on this topic, because Apple has to allow users to sideload full applications soon. This is a much bigger attack vector than PWAs, which are still sandboxed in the respective browser. PWAs need to find a browser exploit + an iOS exploit, whereas native apps only need an iOS exploit.

[–] ForgotAboutDre@lemmy.world 1 points 8 months ago (1 children)

PWAs only need a browser exploit. If alternative browsers are allowed apple no longer controls this mechanism.

It's also easier to slip a PWA by a user, making it confusing for uniformed users who would be targeted.

[–] FooBarrington@lemmy.world 2 points 8 months ago (1 children)

No, they don't only need a browser exploit, because the browser itself is sandboxed too. Otherwise the danger exists for literally every webpage - no need to install a PWA to break out if you have a browser exploit! You understand that a PWA is just a website and nothing more, right?

[–] mnrockclimber@lemmy.sdf.org 1 points 8 months ago (2 children)

You understand that a PWA is just a website and nothing more, right?

This is sort of reductive. Yes, and no. It's more than just a link on your home screen. More than just a set of html pages saved locally. It downloads the entire javascript app, the manifest, the icons, all that stuff and packages it up. When you run one of these you'd have no indication that you're in a website. There is no browser URL bar or any of that. Only the controls in the app. It's not really "just a website and nothing more". It's a javascript program running on a phones javascript engine (which is currently webkit and locked down). An app in just about every sense of the word. https://app.starbucks.com is a great example. Even works offline once you save it.

[–] Miaou@jlai.lu 2 points 8 months ago

You just described a website...

[–] FooBarrington@lemmy.world 1 points 8 months ago* (last edited 8 months ago) (1 children)

This is sort of reductive. Yes, and no. It’s more than just a link on your home screen. More than just a set of html pages saved locally. It downloads the entire javascript app, the manifest, the icons, all that stuff and packages it up. When you run one of these you’d have no indication that you’re in a website. There is no browser URL bar or any of that. Only the controls in the app. It’s not really “just a website and nothing more”.

No, it really is just a website and nothing more. Just because the browser UI is different doesn't mean it's a different thing. All of the technology itself is available to all websites, which is what is relevant for PWAs being "a massive vector for malware", as initially claimed.

It’s a javascript program running on a phones javascript engine (which is currently webkit and locked down).

Yes, just like with any other website that uses Javascript. And Apple will have to allow other Javascript engines - so what's the difference with PWAs specifically?

An app in just about every sense of the word. https://app.starbucks.com is a great example. Even works offline once you save it.

Yes, and the same APIs are available to other websites. Look up service workers.

[–] mnrockclimber@lemmy.sdf.org 1 points 8 months ago (1 children)

I would disagree with the premise. A website and an application aren't the same thing just because they are written in the same language (javascript). PWAs are apps in every sense of the word. Websites are not. I think the comments section on this Ars techinca article cover it pretty well, rather than re-hashing the same. https://arstechnica.com/gadgets/2024/03/apple-changes-course-will-keep-iphone-eu-web-apps-how-they-are-in-ios-17-4/?comments=1&comments-page=2

[–] FooBarrington@lemmy.world 1 points 8 months ago* (last edited 8 months ago)

I presume you're talking about e.g. this comment:

PWAs traditionally have had hardware access not available to web pages within the browser. This makes a PWA more of a security risk than a web page, but also means you can have a PWA compass, or a PWA wifi troubleshooting app, or a PWA government ID app that can use the camera and microphone to validate the user outside Apple's own APIs. It's more than just extra cookie storage and expanded localstorage.
So if a PWA was deployed via Chrome, Apple would also have to give the Chrome PWA instance those permissions, without Apple being able to have intimate knowledge of the consequences on the back end, since Chrome isn't WebKit. And Apple doesn't have the same level of security vetting for third party software (like Chrome) that they do for OS internals (like WebKit).

If this doesn't represent what you had in mind, could you quote specific comments?

I would disagree with the premise. A website and an application aren’t the same thing just because they are written in the same language (javascript).

This isn't what I claimed. You are correct that using the same programming language doesn't mean two things are in the same category, but that's not my point. They are using the same:

  • Programming language
  • Runtime environment
  • Layout engine
  • Style & formatting engine
  • Markup language
  • Style language
  • Browser APIs

The only difference is that a few additional APIs are available and some browser restrictions have different value. That's because Progressive Web Apps are literally meant to be websites that provide functionality and have progressive enhancements (i.e. feature detection, you use what you can without breaking because of what you can't). This means we're talking about the PWA being the same website, displayed in the same application, served from the same server.

Many, if not most, PWAs are websites that provide the same actual functionality with or without being installed, maybe without a couple niceties (e.g. bigger offline storage). Many don't use features beyond what they offer as a normal website. This means all there is to distinguish PWAs and websites is how the user opened them on their phone.

[–] rbits@lemm.ee 3 points 8 months ago

PWAs doesn't change that, though. The users will instead just visit the page through their web browser

[–] Fake4000@lemmy.world 29 points 8 months ago

The fact that they said it's an EU thing made it clear that it was malicious compliance.

[–] SecretPancake@feddit.de 6 points 8 months ago

I wonder if the EU regulation even dictates that web apps on the Home Screen need to be able to run in third party engines. It was mainly about browsers.

[–] silas@programming.dev 5 points 8 months ago

What doesn’t line up is that most other operating systems including macOS support PWAs with different browser engines. That along with the fact that Apple announced this at the bottom of an article hidden under a collapsed menu, it really makes it seem like they’re trying to find an excuse to get rid of them without damaging their brand reputation. It’s no secret how profitable the App Store ecosystem is, and this is one more way they can pressure developers into it while shifting the blame to the EU

[–] aarRJaay@lemmy.world 3 points 8 months ago

FTA: "Introducing web app support for other browsers would require the company to build an entirely new integration architecture" So what? You don't have the money or the talent do to this? Come on Apple. Stop playing the victim here.