Apple's claim is that it bans other browsers for security
twitter.com
twitter.com
Chrome has dominance similar to IE at the height of its popularity.
Whatever you think of their decisions, Apple is the only thing stopping a 90%+ Chrome web. (Note: not why they’re doing it, just a side effect)
People keep arguing Apple is being anti-competitive. But no one seems to recon with the possible consequences of what they’re asking for. And I fear we may get a pyrrhic victory if these groups/governments keep pushing.
No, I don’t know a good solution. But I don’t think letting Chrome totally own the web is a good outcome.
We've written about the harms in detail here: https://open-web-advocacy.org/files/OWA%20-%20Bringing%20Com...
Numbers I found say on desktop Chrome is at 70%. Include the 7.75% for Edge (because it’s basically Chrome) and that’s almost 80%. FF at least exists and is similar to Safari.
On mobile it’s at 65%. Safari is the only other browser above 5%.
Chrome is dangerously close to total monopoly.
I would actually expect the most likely outcome is Apple would fight hard to build a better browser to stem any losses to other browsers. They'll have at least 2 years to do it, so they can catch up in that time with enough investment.
It's the same problem that developers were talking about with Chrome's Manifest V3 -- to the point where popular adblockers for Safari like Adguard actually run outside of the browser so that they're not quite as limited as they otherwise would be by Safari's apis.
Partial source: https://github.com/el1t/uBlock-Safari/issues/158
And none of them work as well as uBlock Origin on Chrome.
Trust me, I tried. I even paid money to try a few extensions out on Safari in the hopes I would get a better experience, but even that doesn't work.
Also been trying out this webkit based browser for macos: https://browser.kagi.com (supports ublock origin)
So there is a good chance that even if competition where allowed on iOS, Safari, which currently has more than 90% market share, would at the very least not fall down below 60%, preventing Chrome from becoming dominant. It is even more likely because most users on iOS actually believe they can install the real Chrome, so nothing will change in their eyes.
I disagree. There are already plenty of sites that are broken on macOS Safari because it's a niche platform. The only saving grace is that websites still have to support iOS Safari. If vendors were able to say "we only support Chrome" on iOS as well, I think that 60% macOS Safari marketshare would drop rapidly due to necessity.
However in the IE era, even though Netscape/Firefox was free for everyone to test on, many large companies made their sites for "IE Only" because it's easier and cheaper. What I worry about is that, even if Safari kept up with web standards and was mostly compatible in terms of the basics, sites would start requiring APIs that only Chrome wants to support (e.g. FLoC). This would give Google a lot of leverage to push its own technologies on users (Amp also comes to mind).
I support an Open web, I test my websites on Firefox and Chrome, I even occasionally do Edge testing, and I develop my websites often primarily in Firefox. But I'm not buying an iPhone or a laptop just to test websites, so I don't test in Safari.
Every other browser has a way to emulate in Linux, I can even download free VMs from Microsoft to test IE11 in Windows (and Edge now runs in Linux). If Apple isn't willing to make its operating system available to me to test on then I don't see why I should feel obligated to test on it.
And given that there is some Mac-specific behavior for Safari/Firefox that I've run into (differences in how blur works), and I generally can't assume that all of my stuff is going to work perfectly, I'm either going to fall back on progressive enhancement or (in the case of a complicated webapp) I'm going to tell users that Safari is unsupported and they're continuing at their own risk.
I'd love to support Safari. All Apple has to do is give me a way to.
Unfortunately that's not enough, for two reasons:
1. Safari is the only browser that is still tied to OS release versions, the WebKit version used by Epiphany is rarely the same, so results will likely differ
2. Epiphany has no mobile emulation mode. (E.g., I had to work around around an annoying input zoom bug in Safari/iOS by blindly applying the least stupid solution I found searching the net)
Edge is literally built off a relatively recent version of Chromium. It’s not a separate engine.
I would hope mobile browser share numbers already take this into account, though I don’t know.
It's preinstalled on MacOS and you can't uninstall it, just choose not to use it.
That’s kind of the point I was trying to make.
You need to do that stuff before, or at the same time as, opening iOS. Otherwise we’ll just have a disaster.
Wut? Independent browsers existed before Google, and still do.
The browser is such a key element of the web experience that the possibilities for commercial exploitation are fundamentally endless; the number of players in the space is kept low only by the amount of resources required to really compete with the biggest IT companies on the planet. If you could forbid such players from being in the market, you'd see a plethora of new entrants.
> if Chrome is removed from Google they could create another alternative based on Chromium
The point is not to remove Chrome, the point is to forbid web-giants like Google from being in the browser market, because it enables monopolistic practices towards their web properties. So they would obviously be forbidden from restarting the project as "ReChrome" or whatever.
- Antitrust proceedings are slow. The Microsoft case (which was a much more cut-and-dry antitrust case) was filed in May 1998 and settled in November 2001 -- three and a half years. Given that Google today moves faster than Microsoft in the late 90s, 3.5 years is enough time to drive a critical mass of users away from other browsers, which effectively kills any market.
- What antitrust behaviors could be forced that would restore a competitive browser market? I could see Google being forced to spin off Chrome into its own company or donate the code to a third-party, open-source organization, but these only shift the problem around, they don't get at the root issue of there not being a competitive browser market.
That’s what they did on desktop.
A Chrome-only web will edge out not just up to date competing browsers but any older iOS and Android devices that can't run top of tree Chrome.
You have a bunch of other options including security keys, TOTP, and existing device verification flow.
I doubt most users are using a dedicated third-party authenticator.
It’s clearly on purpose to force me on their apps.
[0] https://gs.statcounter.com/browser-market-share/desktop/worl...
This just isn't a serious stance, I'm sorry.
You did apologize though, so I forgive you.
IE shipped on (almost) every machine, had a ton of lock in features like ActiveX, etc. MS actively abused their monopoly position to make it so preventing default installation of Netscape by OEMs, incentivising ISVs to ensure web based enterprise products shipped with "Works best in Internet Explorer" etc. Netscape lost market share to IE not because it lost users but because while the userbase was massively expanding they were buying Wintel boxes that shipped with IE on them so they never learnt that Netscape existed.
Chrome is something users install because it's their preferred choice. We can argue as to why it's their preferred choice but the point remains that users actively download and install Chrome - usually as one of the first things they do when they purchase a new computer.
That to me puts things on an entirely different level. To compete reasonably with Chrome you need to compete for users directly. You could argue that Google abuses it's monopoly position to market Chrome and that would probably be a valid argument but again, it doesn't change the active decision users are making.
If anything Safari (especially on iOS) is more like IE. In that it serves Apple more than it serves users. Apple wants PWAs to remain gimped, by simply dragging their feet or refusing to implement certain web standards/proposals they effectively gimp PWAs. This forces apps to be written for their platform which in turn is where they generate the vast majority of their scalable growth/profit.
"The Reddit experience isn't complete in your browser. Please download the official app to continue:"
The android OS has no knowledge of chrome and it doesn't get any special handling or abilities like iOS/Safari.
By contrast iOS is ~50% of mobile OS market share (in the US, I think it's less elsewhere). Hardly a monopoly. If using a different mobile browser is important to you, there's a competing, popular mobile OS that can provide that.
Ecosystems exist. Throw away your phone and every piece of software you've ever bought for it just so you can install a particular app? Ridiculous.
The specific term here would be duopoly.
And a duopoly still has a large ability to engage in anti-competitive practices that harm the market.
50% of a market is with the realm where you can cause significant harm to competition.
If governments give corporations with such overwhelming market dominance completely free rein then developers are nothing more than sharecroppers and consumers are going to pay the price either financially, in terms of privacy or through limited choice.
They also control 100% of the OSes that run iOS applications, and allow iOS purchases to be redeemed.
That sounds a lot like a monopoly to me.
you could have saved time and just said "I disagree but refuse to explain my disagreement"
It's good for Google when Chrome is good. So Google has a great incitament to improve Chrome. The only drawbacks would be proprietary functionality others can't use.
[1] https://www.howtogeek.com/724441/what-is-googles-floc-and-ho...
Google makes most of their money from search ads -- I've heard upwards of 80% -- and search ads supposedly don't even use targeting information.
And what proprietary functionality is that? Chromium exists and does all the same things.
None of the future IEs were very good though, IMHO.
It’s only what MS let happen later that turned IE into the pariah it is today.
Ah yes.
The preferred choice advertised by dominant web search.
The preferred choice that is forced by Google apps when clicking on links that actually conveniently forget about said choice.
The preferred choice when Google sabotages competition across its dominant platforms https://twitter.com/johnath/status/1116871231792455686
And so on
Chrome is getting bundled with a buttload of software. So many software that comes with an ‘installer’ has a hidden checkbox somewhere that if you don’t uncheck it, it will install Chrome on your windows machine.
Also Edge is now the default on Windows which is also Chromium. So a Chromium-only future doesn’t sound so distant anymore.
Namely an engine isn't a product and most value-add is in the porcelain of the browser, implementation of web standards -shouldn't- be a competitive advantage because doing leads the the sort of fragmentation that we don't want.
If all the major browsers shared and worked on a single engine collaboratively (similar to PostgreSQL and Linux) I think the web would be a -much- better place as a result for a number of reasons.
1. Aforementioned standards could be relied on by developers.
2. Browser vendors could spend less time duplicating efforts on low level standards implementation that aren't product differentiation.
3. Platform specific performance optimisation could be shared across browsers instead, i.e Safari like energy performance for everyone.
4. Plugin architecture could potentially be shared across all available browsers which would help plugin authors out significantly.
5. The engine could be linked as a dynamic library so that multiple browsers could be installed without duplicating the engine binaries if they are using the same version (probably only viable on Linux distributions but would be nice)
6. Fuzzing and security efforts wouldn't need to be duplicated across engines. This is important because of just how gnarly the sorts of code you see in browsers. Namely XML/SGML parsers, JS runtimes/isolation, etc. Also with every vendor chipping in this infrastructure could likely be greatly expanded.
This is a utopian view and most of this probably wouldn't come to pass because the world sucks at doing the "right" thing but the potential is there.
On the other hand the downsides mostly amount to Chromium governance could be bad and Google could abuse their position to make it hard to create new browsers based on Chromium/Blink. However they would be incentivised not to in order to prevent a return to the current fragmented situation.
This somewhat prevents browsers from implementing fully proprietary tech that canät be replicated by anyone else. It does lead to problems like WebSQL being scrapped (the idea was to basically run sqlite in the browser, Mozilla said they donät want to reverse-engineer sqlite behaviour for an independent implementation, the idea was scrapped).
However, with Google dominance we see more and more things appearing in Chrome only and based on Chrome's own goals, and then advertised as standards.
There's an ideal state somewhere, but I don't know how we could reach it.
If Chromium was to become the same thing we could have just had WebSQL assuming maintainers agreed it was worth landing and maintaining.
Underhanded? It's pretty clear that your stated goals don't align with your real goals here.
Edit: I have a hard time putting into words why your arguments seem so deceptive to me. It is like whataboutism: the arguments you are making are technically functional but they just completely fall apart with any reasonable weighing of the pros/cons because it betrays the "intrinsic" goals (choice, browser competition, functionality, security) for "extrinsic" goals (browser diversity, but mostly the success of safari). This makes me think that you're secretly misaligned and that you actually hold those "extrinsic" goals as your intrinsic goals.
Instead what happens is this internecine warfare where everyone shits all over FF for political reasons (most of which have no relevance to their day to day use of a web browser) and uptake of Tor/Brave is miniscule and most everyone sticks with Chrome.
Why ? Open up the platform first.
1) Firefox cannot compete against Google endless resources m. Google will win, not a matter of it but will.
2) The time it takes to decouple chrome from google will be too long. It may just kill Firefox before any action can really be done.
If you force Apple to open up iOS then Chrome just takes it over and Safari will take such a hit that Apple will probably have to kill it. Then Google will own 99% of the portal to the web.
I think I'm arguing with a bunch of Libertarians though who think that an unregulated market is some kind of magic sauce that will conjure up a Chrome competitor out of thin air, and not a recipe for monopolization.
How much would it cost for them to fund firefox development to make it a stronger competitor?
Okay, Apple: do that. Also open up the walled gardens. You can make it a setting if you want to keep the beginner computer users safe.
If you want to force Apple to allow different browsers without addressing this problem, then you are trading one company's monopoly on a single platform for another company's monopoly globally. And there is no reason to believe that Google will behave any better than Apple has. It's not like Google hasn't tried to skip the standards process before.
So when people argue that "it's for browser diversity" I have to consider them as 1.) naive, 2.) actually working for Google. 3.) just developers who are tired of being forced to target multiple platforms.
Do I think it's ethical that this is how this stalemate is handled? No; taking away user choice is limiting the freedoms of users.
Do I think Safari is amazing? No; I think Chrome on Android, today, is better than Safari on iOS. I may be harming users today by forcing them on Safari.
Would I fold if Apple only allowed Firefox/Lynx/Netscape? Yes; My problem is with Chrome, not with other browsers. But I think the number of people who genuinely want to Firefox is tiny in comparison to the number of people who would just install Chrome.
My worst fear is that once Chrome is allowed on iOS, then there is no reason for Google, or anyone else, to target anything other than Chrome; and that would ultimately be harder to fix. A year of Chrome dominance, where developers only target Chrome would fully entrench Chrome and make it difficult for anyone to build a browser that wasn't just a Chrome fork that emulated all of Chrome's bugs and unspecified behaviors. The alternate solution, where the Chrome problem is addressed first, then the fix is "just" passing legislation that opens up iOS. One fix involves just changing the behavior of one company. The other fix involves changing the behavior of thousands of companies.
We started OWA with a group of primarily Safari first developers, in that iOS Safari is our primary target platform. We've had over a decade of major issues from rendering bugs, to lack of functionality to our apps breaking for months at a time waiting for a patch. The severe underfunding of Safari/webkit coupled with a ban on competition meant that it was never going to be viable to ship Web Apps to iOS. So the question is, how do you convince the worlds richest company to invest a extra few hundred million/year into their own browser?
The answer is competition. Competition provides Apple a deep incentive to produce a capable, feature risk browser at risk of losing users to the other vendors. Each 1% of Safari users is worth 150m/year in google search revenue, a number so large it would make even Apple take notice.
As web developers we see the value in having browser engine competition, many of us lived through the IE6 era and know the risks of the monopolistic competitive behavior like we're seeing from Apple (Side-point: At no point did Microsoft ever ban the competition).
The status-quo where Safari/Webkit was both stifling the Web and Web Apps and providing no competitive pressure on Chrome/Edge/Firefox + the severe underinvestment from Apple meant that a regulatory solution was needed.
There is no competition. There is only Chrome.
This is what I was talking about. There will only be one result to opening iOS and it scares me.
FF/Opera are too small. Edge is small and really just Chrome anyway. If we had a healthy browser market I’d be fine. But we don’t.
Apple is, for the wrong reason, the only thing keeping us from total Chrome dominance.
I want one of these “just open iOS” calls to include the consequences of what they’re calling for and how they plan to deal with it.
> I want one of these “just open iOS” calls to include the consequences of what they’re calling for and how they plan to deal with it.
OWA has taken into account anti-competitive practices used by Google to gain browser market share, and made recommendation to mitigate or prevent them. In there submission to the japanese regulator [1], they include:
- 3.1.7: No Chrome Preferencing: > Google should not use their control over the operating system to provide unfair preference to their own browser, Chrome, either through the operating system or agreements with partners.
- 3.1.8: Website Transparency Obligations: > OWA suggests that where a Gatekeeper’s website does not support a browser which has above a 2% market share, they be compelled to publish a document containing detailed reasoning that prevents support of certain engines.
[1]: https://open-web-advocacy.org/files/OWA%20-%20HDMC%20(Japan)...
Edge could just not compete with chrome, despite throwing hundreds of engineers at the problem. They tried, and tried, and tried.
In the end “edge doesn’t work” was just code for “edge is not chromium”
Electron was and is still a separate beast, Microsoft doesn’t even need to deal with that: third party developers do, they have to ship the binary.
Why? Does Apple not have the resources to build a competitive browser? Do they not have the motivation? Do they not have the engineering skills? Do they not have a large and extremely desirable user-base who prefer to stay as much as possible in Apple's ecosystem?
Given all the advantages Apple has, how could it possibly be true that they can only get users by literally banning all competition on their main platform?
Ignoring much of the fact how Google would leverage it's existing properties to make sure you couldn't open a single web page without being nagged about installing Chrome; it would take a large amount of effort for anyone to compete to where Chrome is today and the result is that people would just Chrome.
And fine, I understand that as developers you don't want the burden of testing multiple platforms or being beholden to one platform that doesn't move as fast as Chrome. But to pretend this is about the "browser diversity" is where I have the problem. Just say you want Chrome and don't buy Google's framing that this about "open standards" when Google doesn't even hold Chrome to that standard.
So then your answer is that Apple's browser is significantly worse than competitors, and that users wouldn't use this much worse product if it were not for Apples anti-competitive behavior?
> But to pretend this is about the "browser diversity
> Just say you want Chrome
I think most open web supporters would be a lot happier if Apple even simply allowed Firefox.
That would still be massively better than the status quo.
Are you saying that all someone would have to do is argue for allowing just Firefox, and you would no longer do this thing where you attack some alleged secret motivations?
I love and support Firefox, and I even use it on my iPhone (yes, it’s reskinned WebKit, but it syncs my stuff).
Yes. I hope it's exceedingly clear that I don't think Safari is God's gift to mankind.
>Are you saying that all someone would have to do is argue for allowing just Firefox
Yes. In fact they could be upfront and just say "just allow Chrome because I like developing for Chrome." But that's not what happens; it's "Apple is stifling competition because I want to use Netscape Navigator", when in actuality it's just developers that want to target a single platform, or Google who wants protect itself from Apple's power.
Maybe OWA is the exception here, but what I've found is the people making the most visible noise about this are connected to Google in some way. Consider this HN post from a couple days ago [1], where the author in his six-part series about browser choice, neglects to ever mention Chrome's dominance. Unsurprising that he was also a platform strategist at Google. You're telling me the guy who's job it is to make sure Google is an entrenched as possible doesn't like Apple's position on Safari? What a surprise. Then he tells you "don't worry about Chrome, this is about open standards!" - sounds underhanded to me.
At the very least, the cohort of users on Safari who can't switch prevents Google from just outright breaking some sites like Gmail and YouTube on every browser except Chrome.
[1] https://infrequently.org/2022/06/apple-is-not-defending-brow...
They do. They did. It’s called Safari. That’s how we got here.
What they DON’T have is any care about Windows/Linux/Android users. Apple makes their browser to make their platform the way they like.
If you want Apple to provide the competitive alternate browser on other platforms you’re asking the wrong company.
> Given all the advantages Apple has, how could it possibly be true that they can only get users by literally banning all competition on their main platform?
Google pushes Chrome with the #1 OS in the world (Android). With the #1 site, google.com. And the #2, YouTube.com. And gmail. And Google Maps. Maybe Waze. Chrome OS. GSuite.
They have an INSANE amount of power to push people to Chrome and off other browsers.
I’m not arguing pro-Apple. I’m arguing anti-Google.
Yes, opening browser engines would be good for the competition. But you missed one point: You assume all players will play fair in the competition. If all browser engines would be allowed over night, what would happen: Google will probably play really unfair. E.g. sadly the layout of Google will be messed up in Safari, youtube videos stutter/have lower resolution, everything is a lot slower, the performance will be sabotaged, but on Chrome everything will be working fine. There was even a precedent for something similar: [1]
This will probably come alongside with "Try it in Google Chrome", a lot of users would probably switch, thus the monopoly of Chromium would be unstoppable by pure market forces.
Yes, having only one browser engine is bad for the choice of the user, but it does have significant downsides.
Damned, if you do, damned if you don't
[1]: https://www.theverge.com/2019/5/4/18529381/google-youtube-in...
No there wasn't, unless you mean killing a 10 year old version of Internet explorer with a banner to a newer version of Internet explorer is somehow playing unfair.
Our suggestions were covered in sections: 3.1.7 No Chrome Prefrencing 3.1.8 Website Transparency Obligations
https://open-web-advocacy.org/files/OWA%20-%20HDMC%20(Japan)...
That seems like it creates perverse incentives for Apple to keep Safari "broken".
Regulation on Apple only is the opposite of encouraging competition, it’s literally calling shots against the only fighter that’s pushing back on Chrome in a significant way - on market share, and maybe more importantly, on privacy and avoiding bloating web standards to further avoid total lock-in on V8.
Second, Apple has been accelerating greatly Safari development for years now and I worry your entire organization can’t admit it’s actually a great browser and has rapidly caught up in terms of correctness and features, and is now in fact leading in many ways. That it rejects some proposals isn’t inherently wrong, by the way, and the reasoning for many is just. I’m afraid if you admitted that, it’d pop a bubble in one of your core tenets, and given you made this mission driven thing with a single purpose, you’re sort of now forced into an intellectually dishonest place.
Because as a long time web develop myself who went from IE to Firefox to Chrome to Safari as my main browsers over the years, there’s simply *no doubt* that Safari as of a year or two ago started whooping Chromes ass. Like not even close, it feels like a different type of thing. It’s insanely fast, across so many dimensions, lighter, and I don’t get incompatibility almost ever anymore.
Your mission would achieve the opposite of what it wants - Apples platform isn’t a monopoly, Google's are. Google has a monopoly on Search, Browsers, and influence on the web. This would only strengthen the worse/stronger fighter. And it's all premised on a fundamentally unsound critique of Safari.
I don't see anyone explaining what will force Google to continue supporting Safari once they have Chrome on iOS.
The reality is that they probably won't. Safari will break for Google services and pixels, and the only answer will be "switch to Chrome, things don't break there." Bye bye competition.
OWA members have actually been actively reporting WebKit bugs and interacting with the Safari team to help prioritise features and bug fixes on Twitter and elsewhere, showing the goal is to improve the overall web experience on iOS, not allow Chrome to become dominant. Here is one of their detailed bug report: https://github.com/web-platform-tests/interop-2022/issues/84.
That’s why I originally commented. If you focus on just one of those I believe there will be terrible unintentional consequences.
I find this very hard to believe. Everyone you know uses Firefox?
>With full control of the rendering engine on all platforms, Google can stop engaging with standards bodies. Web rendering standards will become simply what Google says they are, even if it is to their benefit. Imagine AMP but on steroids. When Safari stops rendering mobile sites correctly, there will be lots of helpful friends and family (and ads) telling folks to "just switch to Chrome, it's a better browser anyway."
>Google could also ship their own root certificate list and take control of Web PKI. Imagine Symantec but entirely at Google's option. Play ball or get security warnings. This would allow an end run around the democratization afforded by Let's Encrypt, for example. Controlling 99% of the client end of TLS confers just as much power as controlling the CA end.
All of these items are built into how Chromium renders the web. The other Chromium derivatives will be forced to swallow these changes because what are they going to do? Fork and maintain their own browser engine? Bisect patches from upstream forever? How many of these Chromium forks will have the resources to maintain their own fork of something as complex as Chromium?
Following Chromium upstream is an extremely hard effort if you have done any kind of non trivial changes to it. There are constant refactors and changes. This means that your chromium using browser can't be anything more than just a reskin of Chrome, which means that you don't have the agency to support some feature that Chrome chose to not support, and the features you do support are likely going to be implemented 100% the same due to using the same code, including the bugs. This leads to the same "code assuming the bug" issues that if everyone used Chrome.
Furthermore, Google has a monopoly on Chromium developers, with only few people contributing from the outside. Your Chrome reskin team will likely be very skilled in maintaining a Chrome reskin but if Google ever decided to stop the Chromium project in favour of a closed source Chrome, there would be nobody who knows how to properly maintain the fork going forward, neither at your company, or available for hire.
You are 100% at the mercy of Google if you do a Chrome reskin.
except the issue here is the rendering engine and who controls in at the top level.
I don’t wanna live in the world we’re 90% of the Internet only supports chromium, yet everything from Edge to Opera use it now. Firefox and Safari the last holdouts keeping google from dominating all web standards.
And it is being pointed out, repeatedly, that the only actual real competition is Chrome. When Chrome becomes an option then websites will abandon any pretense of adhering to standards and just code to Chrome. You can't pretend the mobile browser landscape won't just end up mirroring that of the desktop.
The total browser share of iOS shifting to Chrome, even if Chrome only got 50% of iOS users, would put the total browser share of Chrome over 90%. There would be no impetus for any website to write for anything but Chrome.
All Apple achieve with this is to slow down the inevitable, especially if the smaller players can't catch up because of it.
It's like prohibitions against importing some aggressive plant or animal species. It's a way of protecting local diversity.
Android is only the bare OS, and actual devices come either with Google bindings everywhere (mostly from direct contract with each phone maker in exchange to let them have the Play Store), or no Play Store at all (which usually means no commercial license for stuff like Felica as well, same situation as when wiping clean a phone basically).
To me it feels a lot like in the 90s when 'viable' alternatives to Windows were either overpriced and obsoleting Macs, or "every year is year of linux on the desktop" linux boxes. And getting shouted from every camp when complaining the situation really sucks.
If android did not exist and Apple controlled the market it would be a different story, but that is far from the case.
The most natural implementation of the EU directive would be to have a place in User Settings where users can go and enable targeted advertising if they want it.
And why would we assume that these companies would follow the "most natural implementation"?
The very predictable response of the industry to the EU directive was to make the cookie banners as annoying as invasive as possible, such that users would consent to tracking out of apathy. No, it's not what the EU intended to happen, but it was a consequence. Which brings me back to my original point: often times idealic and well-intentioned measure have negative consequences.
In hindsight, perhaps the EU should've legislated that the UX for the tracking content cannot be unreasonably annoying. I don't know how I'd go about codifying that into law though.
Simply make the DNT-Header a legally binding thing. If the user sends it, it means that only technically necessary cookies can be used.
This would require no UX from the side of the website, thus defeating all dark patterns at once
I wish the EU had gone with this solution rather than the current regulations. However I can’t help but feel that the “loopholes” in the current regulations were intentional. Politicians have a history of rolling out regulations that have giant loopholes for their corporate friends to exploit.
They at least give you some measure of control, or legal standing, or at least visibility into how bad the web actually is.
It's the EU's cookie banners. Despite the EU's best intentions, the end result is worse. It was a naive move and we're all suffering for it. One of the biggest pieces of evidence that you can't just naively mandate something without also thinking through edge cases and "malicious compliance."
On desktop I personally use Firefox because I find it to be a good blend of performance and resource efficiency, plus it has excellent support of content blocking add-ons.
[To clarify, I had intended to refer to Safari on iOS specifically, vis a vis complaints about the lack of engine choice on iOS. But I recognise that my post didn't say what I had intended.]
Yes it was. You're ignoring all the other things proprietary about IE and only considering the OS bundle one. JScript, VBScript, and ActiveX were the real problem. There we so many proprietary extensions to IE that were not even remotely supported elsewhere. Hell, C# even came out of the hell that was Microsoft's JVM, J++, and J# thanks to those trials
What? Why? I assure you that's not how Google thought of it when they were facing off against Firefox and IE. They were putting Chrome installers in every SourceForge download and telling you to install Chrome when you searched Google. Why should their competitors lie down and let Chrome roll over them?
Lots of people use non-Safari browsers on iOS (Chrome, Firefox, Edge, Opera, Brave, DuckDuckGo), and iOS lets you choose your default browser. I know you know Safari <> WebKit, but 99.99% of users don't know or care about the plumbing.
Chrome went from WebKit to Blink.
Safari spiritually went from KHTML to WebKit.
IE went from Trident to EdgeHTML to Blink.
Opera went from Presto to Blink.
The identity of the browser is the chrome, ba dum tiss.
https://www.reddit.com/r/antivirus/comments/on99mk/avg_antiv...
And they were pushing it at a time when Safari for Windows was slower than Internet Explorer.
The aftermath could be the complete death of the open web. Unwinding that may be nearly impossible.
There needs to be a plan in place before Pandora’s box is opened.
Short term, it's decidedly not good, but long term? How can we know?
If the approach is so inherently flawed that this result is an inevitability, maybe it deserves to die and be replaced by something else.
History.
> If the approach is so inherently flawed that this result is an inevitability
Only an inevitability due to attitudes like yours. Please stop contributing/pushing for the end of the open web.
Your perspective is as insane to me as mine is to you. Don't let a corporation make decisions about your computing freedom for you.
Anti-competitive behaviour from both sides is why we're in this situation (Apple/Safari/Chrome) to begin with.
Safari was created so Apple wouldn’t be totally dependent on MS for a web browser. They’ve been in that situation many times before (and since). Apple is allergic to depending on someone else for something really important.
Why does Chrome exist? Same reason. Google didn’t want to depend on being at the whims of Microsoft. They wanted to ensure they would have a browser that would do what they needed.
Both existed to open the internet more from what was going on at the time.
Now people want to kill one to let the other become triumphant.
That’s what makes no sense to me.
Don't underestimate the inertia of defaults. Safari will still be the default browser.
A way more likely scenario is that Apple no longer will be able to drag their feet, holding the web back, but instead will actually have to keep Safari up to date and competetive with other browsers.
These are all systems and projects created and run by human minds. Nothing is "inevitable" and nothing "deserves" to die. These are just outcomes of choices by users, vendors, and regulators. I think many people here are advocating for choices that would keep some kind of competition to Chrome alive. You seem to be advocating for the opposite. That's not necessarily wrong or bad, but Chrome becoming a total monopoly is not "inevitable" either.
In my head the flowchart looks like this: Closed/censored web only -> People giving up hope/being caught trying to escape oppression -> increased human suffering and untimely death
I'll agree with what you're saying about long-term consequences, but you could argue the same thing about the death of nations/states, couldn't you? And how many times in history have nations collapsed without periods of wanton destruction and looting due to the power vacuum?
I predict the App/Play Store duopoly will take over the web.
If the regulator does not step in they are choosing the status quo which by itself also is a deliberate choice. Inaction is always also a form of action.
That’s not what I see. I see people constantly calling for the ability to run other browsers (really Chrome) on iOS.
I almost never see people trying to get Google’s massive browser share reduced.
If you do one without the other I expect disaster.
That was the point of my comment. I want the “open web” people (in general, not just this org) to call for BOTH. But I don’t see that.
Section 3.1.7 - No Chrome Preferencing and section 3.1.8 - Website Transparency Obligations.
This is how we end up with the death of uBlock origin (in a few months from now) on January 2023.
Firefox has resisted this thus far but I am pretty sure Google will eventually twist their arms enough to either kill it, or at the very least _severely_ handicap it.
Google is a threat to the open web, it needs to be heavily regulated and punished for all its despicable behaviors: from harvesting user data without consent to tracking our every move and selling it to anyone who wants it for pittance.
I am very well aware of the fact that many of the HNers are partaking in this and am not going to pretend that I wouldn't be tempted had I been in their shoes but I think it's time to for the smoke and mirrors to clear: Google is nothing more than a giant spyware and an adware company because their core business model _literally_ requires it. This is why they keep fighting against privacy regulations, lobby the governments, punish Adblock extensions and come up with clever ways to circumvent your privacy protections.
So no, I for one am glad that at least Apple exists to thwart this. They may not be doing this because of their "ethics" but given the choice, I'd rather side with Apple on this one.
So I don't know that seeing Safari as a bulwark against Chrome really makes sense here.
Apple is in the wrong to tie Safari to iOS and block the installation of other browsers. They're wrong to do it for the sake of keeping control of the OS. They're right to do it, because that's the only thing that's keeping Chrome from a near-monopoly of the browser space.
Apple was successful in that regard though; the contracts they made with Big 5 remained intact and Apple didn't have to compete with Amazon on price. Apple's strategy was not better for the market as a whole because Apple never cared about the market as a whole. Due to Apple's anti-competitive behaviour we are still stuck with a Publishing industry decades behind on digital
Imposing an artificial limit on iOS isn't how the web will move forward.
> Whatever you think of their decisions, Apple is the only thing stopping a 90%+ Chrome web.
I don't see Apple making any effort to diversify the browser ecosystem by making their browser available on other operating systems, so their inaction on other fronts isn't going to reverse the trend either.
It denies you from using Gecko. You can use an actual Mozilla Firefox web browser on iOS.
So no, using the proper names for things is not a semantic nitpick. The commentator didn't not try to invalidate the parent's point, just show the language issue.
- it protects what's important
- you can "Personalize your experience with new colorways."
- has Facebook Container
- syncs across your devices
Mozilla knows the actual engine isn't the deciding factor when trying to get people to change browsers.
Regarding mobile browsers specifically, their advantage over Safari here is blocking cryptominer scripts and autoplay videos: https://www.mozilla.org/en-US/firefox/browsers/mobile/compar...
* For some degree of "works", ublock origin is way better
- don’t allow it to browse the web (https://developer.apple.com/app-store/review/guidelines, section 2.5.6: “Apps that browse the web must use the appropriate WebKit framework and WebKit Javascript”)
- compile Gecko to JavaScript and run it in Safari.
If you serve the compiled Gecko from a web server I don’t see them stopping you from doing the second, but of course, it would just be Gecko, not FireFox, and performance ‘might’ be somewhat subpar.
You can read Mozilla's submission about the #AppleBrowserBan here: https://www.regulations.gov/comment/NTIA-2022-0001-0131
Also, if Apple allowed other browser engines with better support for new features, then web developers might stop caring about supporting Safari. This might be another reason why Apple doesn't want other browsers on their devices.
Like take the alternative world where the first thing you have to do after setting up your iPhone is installing Chrome because developers found it less effort to just target Chrome. Are we better off?
The only pages that don't work in it are developed by people who believe that Chrome-only APIs are standard.
Truly, truly a horrible browser that is impossible to use (even though I've been using it for over 10 years now)
Or Shared Web Workers that were originally implemented in Safari version 5? No idea why they got removed to re-appear later, and I honestly can't care: I prefer browsers to be careful with standards than just rush forward.
Why is it that these "examples" are never actual examples?
At the same time, most desktop computer users are able to use Firefox and we can see how often they choose to do so.
https://github.blog/2022-06-10-how-we-think-about-browsers/
Of course this is just part of the story. In every country it's different. In some EU countries Firefox is up to 20%. In UK it's almost non-existent. Local markets shape the browser support. If a few major websites are too lazy to support a browser properly, users will leave, and then others can say "there are no users, so we can stop supporting!".
1. Whether this is an overt policy or simply choosing to skimp on testing, it's a choice.
The workarounds are to use Chrome, download files in tiny batches (much fun with 500 photos in the folder), or work out through trial and error that Google wanted the Safari tracking prevention disabled before it would download a file.
Desktop-using software engineers can write software for desktop users in a ton of different ways. There's so much freedom and there exist multiple mechanisms and platforms to deploy your code.
Desktop-using software engineers are not free to choose how to deploy software to mobile audiences. They've got to go through Apple to reach 50+% of the US market. Apple sets unreasonable rules.
Unfortunately, Americans spend most of their time computing with mobile devices now. We've been forced into this situation.
Both Apple and Google have made our industry worse and more locked down than Microsoft in the 90's and 00's, and they both deserve to the the target of smartphone and browser antitrust lawsuits.
How? As a user I’m able to do the things I want with reasonable guarantees of privacy and security. Most developers that release iOS software seem to be doing ok with those “unreasonable” rules. And the user benefits. If I wanted Android, I would have bought Android. I bought Apple specifically because I see value as a user to those unreasonable rules.
Surely given survivorship bias that means very little though?
If you did a survey today of living people you'd discover a 0% death rate, clearly humans are immortal.
https://open-web-advocacy.org/files/OWA%20-%20Bringing%20Com...
without data, we can't assume either of our justifications are what go through buyers minds
Why would you post a document refuting your own point?
I explicitly do. not. want. my web browser to have access to the bluetooth and NFC APIs. Nor the screen orientation lock and full screen APIs. I absolutely do not want website notifications.
I don't know how to be more explicit. Those are things developers want. Those are not things users want. And no amount of gaslighting about invisible harms is going to convince us that what you want is what we want.
They can tax it. They can starve the entire landscape of innovation capital and prevent other companies from ever growing large. They set the rules, and they have enough human and financial capital to keep the game going forever.
That's not good for capitalism, the free market, entrepreneurs, or innovation. In the ten years since smartphones came about, we've seen a contraction of other forms of computing. A contraction in the number of smartphone manufacturers, too! The world is worse for it.
This type of duopolistic advantage also creates a system where Apple and Google can grow close to governments and become a surveillance and control apparatus. That's scarier than anything a developer could do to slight you.
The status quo is great for Apple and Google shareholders, but bad for those trying to innovate and those wanting personal freedom and privacy.
Almost all of computing connects to these two companies now, and that's a fragility that benefits these two giants to the rest of our detriment.
> I explicitly do. not. want. my web browser to have access to the bluetooth and NFC APIs. Nor the screen orientation lock and full screen APIs. I absolutely do not want website notifications.
Easy enough to turn all of these things off. You're describing a setting.
Can you turn off all of these in Chrome?
Google Play puts $50 billion into devs’ pockets, and Apple App Store delivers another $85 billion. Mobile gaming puts another
“Overall independent app developers’ average monthly revenue is $1,500, medium-size company developers make $7,500 a month and large studios developers teams generate on average $44,000 monthly.”
Seems like capitalism is hale and healthy in this duopoly.
https://www.businessofapps.com/app-developers/research/ios-a...
I don’t understand why everyone is like OMG apple is crippling iOS they don’t have push notifications on safari.
God the last feature I ever want on safari is push notifications. I want less notifications. Not more.
Both Firefox and Safari are against most hardware APIs for many reasons including technical ones. Only Chrome is reckless enough to enable them even though no consensus has been reached on them.
Those specs are nowhere near to being standard. They are "Draft community reports". And yet you list them there as if they were standards and as if Apple absolutely had to implement them for greater good (and not because the dominant browser implemented them)
Edit. I can't even begin with the laughable "Edge differentiates from Chrome" because it removed a few Google-specific things like Google Pay.
OWA was formed to ensure that mobile Web Apps become viable, if you disagree with that as the premise, all the best.
Ad hominem is not as good as argument as you want it to be.
> If you start from a position that Web Apps should not be able to compete on mobile devices
If you start with ascribing thoughts and words to your opponent that your opponent never thought or said, you're not arguing in good faith.
> OWA was formed to ensure that mobile Web Apps become viable, if you disagree with that as the premise, all the best.
That is literally not what I said. However, you can't even see beyond Google's propaganda to understand what I wrote.
We’re trying to fix real world problems caused by anti-competitive behavior. Any debate needs to start with the premise that web apps are not competitively viable on iOS and that Safari is in a poor state.
Then the next step is to discuss potential solutions.
Yes, you keep copy-pasting that. As if that absolves you of factually incorrect statements.
> We have an exceptionally detailed understanding of the bugs and functionality issues of the browser.
And yet you fail to understand that hardware APIs are opposed by BOTH Safari AND Firefox. And yet you include them in your lists as if they were actual standards that Safari absolutely must implement. They are not. Same for a bunch of other Chrome non-standards.
In a recent discussion it turned out that you didn't even know what actual objections BOTH Safari AND Firefox have against them.
Same for pretending that Edge is different from Chrome because it removed Google-only services from it. It's not. It's a re-skin with very minor modifications.
You've listed over thirty things that Edge removed from Chrome to make a "different browser". Can you name 10 or 5 of them that are actually relevant to actual web?
Your entire OWA isn't arguing in good faith and is basically parroting Google's propaganda word for word.
> Any debate needs to start with the premise that web apps are not competitively viable on iOS and that Safari is in a poor state.
No. Any debate in good faith has to start with discussing the state of the open web and Chrome's utter dominance of it. As the top comment rightly said, "People keep arguing Apple is being anti-competitive. But no one seems to recon with the possible consequences of what they’re asking for." [1]
Should Safari be better? Yes. Should it be "better" by blindly implementing whatever Google throws over the wall and gullible developers eat up as if it was heavenly manna? No.
> Then the next step is to discuss potential solutions.
Breaking the web forward: https://www.quirksmode.org/blog/archives/2021/08/breaking_th...
Instead let’s focus on the core issues: 1. Severe underfunding of Safari 2. Bugs 3. Install Prompts/Banners 4. Push API
1. Apple has no incentive to fund their browser while they are not at any risk of losing market share to the competition on their primary OS.
2. Because of the underfunding and the fact users/developers can’t shift to other browsers, bugs that are either impossible to work around (or require a very high level of skills) have not been fixed. Some which were reported 7 years ago.
3. Users do not know web apps exist. They have no way to install them.
4. Notifications arrived for native apps in 2009, in 2022 they still are not available for web apps even though they are essential for many different types of apps. Apple has promised them in 2023 likely as a result of our advocacy work.
Without a viable web ecosystem on iOS mobile web apps are dead and the entire ecosystem gets shifted to native apps and webkit applies no competitive pressure on chrome/edge or Firefox. The status quo is the worse case scenario.
The fix for this scenario is competition. With a 60% market share on MacOS (the on my comparable market where Safari is the default), as long as apple meets developer needs then I can’t see them losing a majority market share on iOS.
A highly funded Webkit be able to contribute to the web ecosystem instead of holding it back.
I focused on some APIs I know about. There's nothing strawman about facts that you misrepresented in your diatribe. How can I be sure that you represented everything else correctly?
Oh. I can't. Because I also saw your section on "Edge differentiation".
Should I go through everyting else and discover same misrepresentation and falseness? I think I won't, these two are quite enough, thank you.
> Instead let’s focus on the core issues
You keep skipping from goal post to goal post, and each next argument you make isn't made in good faith.
> 1. 2.
I'm not even going to dignify this speculation with an answer
> 3. 4.
And again and again all comes down to literally one or two standards. That's it. That's all you really have.
Well, sometimes you have more, but then it's just a random dump of random standards that you are absolutely sure are actual standards (and not "Draft comunity reports" by Google) and that everyone must implement them now.
> Without a viable web ecosystem on iOS mobile
Please define a "viable web ecosystem". So far it looks like to you "a viable ecosystem" is "anything that Google implements, others be damned".
> web apps are dead
Yes, they are dead. For many reasons that have nothing to do with notifications.
> The fix for this scenario is competition. With a 60% market share on MacOS
Yes. Let's talk about competition. There is none, it's fully dominated by Google: https://news.ycombinator.com/item?id=31905404
Oh wait. You don't really care about that.
> A highly funded Webkit be able to contribute to the web ecosystem instead of holding it back.
Webkit is contributing to the web ecosystem, and isn't holding it back. For the obvious reason that your definition of a viable web is taken straight out of Google propaganda, and has nothing to do with making the web viable.
Factual points I started with:
- Both Firefox and Safari are against most hardware APIs for many reasons including technical ones.
- The section "Edge differentiates from Chrome because it removed a few Google-specific things like Google Pay" is laughable
Your "response" is, "oh, you don't believe in web apps" and "Our group was initially formed by a group of people who develop for iOS Safari on daily basis".
These are not factual points. These are attempts to dodge a conversation. And when the conversation seemingly starts happening, it's "the facts you provided are not facts, they are strawmen".
Yes. It truly is pointless discussing this. There are many, many, many issues we can discuss about Safari. With people who have done their research and don't willingly assume the role of Google's propaganda amplifier. Thankfully, as the comments to the original link show, more and more people are starting have a more sober outlook on what's happening.
tl;dr if you think your dignity is above responding to someone, don't.
Just as an example: do you believe web apps are currently treated by apple in a lower tier than native apps?
if so, do you think they should be n-class citizens, where n is the same class as native ios apps?
if you do not, then I can see why you do not personally want the things that come with it, like your other conversation partner said
Does this have anything to do with anything I said in my thread? No. So, this question is not in good faith, so why should I engage with it?
> if so, do you think
Do you think that ascribing thoughts and words to your opponent that your opponent never thought or said is a good argument?
It doesn't matter what I think or what I don't think when my argument literally began with finding incorrect arguments made in actual bad faith with no research in the "paper" made by OWA. Both you and OP couldn't care less, and you both try to deflect with "do you believe blah blah blah".
I could go with a not-so-fine-comb through the document and point out every misrepresentation, incorrect assumption and outright lies. I picked two. What followed is now open for the world to see.
https://open-web-advocacy.org/files/OWA%20-%20Bringing%20Com... (Section 5.6 and 5.8)
2. Safari is missing core functionality and significantly lags behind Firefox and Chrome / Edge. Sections 5.3 5.4
If you want to focus on specific functionality, then the ability to install a web app (Section 5.4.3.1 and Section 5.4.5 go into that in detail).
For evidence that Safari is significantly behind Firefox and Chrome/Edge see 5.4.1.
You clearly don't understand what "good faith" is, and certainly are not an unbiased judge of it, being 1 of the 2 people involved in the accusation. It means asking because you are legitimately interested in the answer. It does not mean "I, as self-appointed judge of this discussion, unilaterally deem your question irrelevant". Indeed, if the question and answer are actually irrelevant, you can trust the smart posters here to be the judge of that, so you need not fear answering truthfully and candidly.
In any case, _I_ am legitimately interested in the answer, but even without my admission, you are supposed to assume good faith on this forum (HN), versus your current, combative, antagonistic, almost litigious (OBJECTION, RELEVANCE! SUSTAINED, I RULE IN MY OWN FAVOR!) attitude towards your fellow posters.
you are the one who called him a google shill.
They both need to be stripped of their extraordinary powers so that user freedom and proper capitalistic competition can be restored.
It's likely that any regulatory action taken against Apple and Google will force the companies to innovate more and become healthier themselves.
The companies who should be punished for anti-competitive behavior are the telecom companies. Not only do they restrict what devices can be activated on their networks, but they force Android users to wait months, years, or forever for them to dribble out a garbage-laden, proprietary version of the OS for every specific model of phone, one at a time.
And then there's the idiotic locking of phones; it's not just that it should be illegal, but it's also backward: U.S. phone companies lock the phones of people who are UNDER CONTRACT. Talk about stupid. These people are contractually obligated to keep paying, so who cares if they take their phones to another network? That's a net win for the phone company, since they're paying for NO service!
Apple and Android are.
But Android is far more diverse than just Google's distribution.
I use different browsers for different things so I want to chose how to open external app links.
I would install a shim browser that does just that if I knew of one.
https://github.com/TrianguloY/UrlChecker
It also integrates ClearURLs functionality (https://gitlab.com/KevinRoebert/ClearUrls) to let you remove tracking from links before sending it to the browser or app. This feature is optional.
Previously,
1. you had the choice of activating the "tab queue" system for links opened with Firefox, i.e. the URLs would then only be saved in a list in the background instead of launching the full browser.
2. when sharing an URL with Firefox, you had the aforementioned choice of "actually open the link", "bookmark it", or "use Firefox Sync to send the URL to some other Firefox instance in your Sync account". The latter two choices happened in the background, so you didn't have to wait for the full browser UI+engine to start first, the page to load, etc. etc.
Garbage.
As far as I’ve ever been able to tell it only existed to help people test the fake “apps” and their sites without buying an iPhone.
As real apps were allowed and the iPhone became more popular (so devs had them for testing sites) that need went away. And so did Safari.
https://9to5mac.com/2014/06/03/ios-8-webkit-changes-finally-...
I’ve always assumed the Windows version ran on a port of all of Apple’s libraries on top of the Windows libraries, making it so much slower.
Much like how iTunes/QuickTime on Windows was way slower than iTunes/QuickTime on Mac.
Also while an independent entity having a larger presence is better than Apple at least Apple having a large market share makes Google need to consider what happens in safari before they do something particularly shady with web standards
Desktop-based extensions integrate pretty seamlessly, which I love
They've grown from 0.5% to 0.85% over three years[1]. I don't see how they're going to increase beyond that.
[1] https://www.statista.com/statistics/272664/market-share-held...
Today is the first day of the rest of your life :)
Also Mozilla is fighting this as well, they wouldn't unless they thought it was in their interest.
I am No one, we are legion. Have been using FF on mobile since it became viable, many years ago. I just like my ads blocked and my data mine, that's why.
It was blocked in Chrome too until I toggled desktop mode on.
What are they doing, blocking based on the user agent string? How mediocre. They're clearly not doing feature detection.
On desktop it doesn't even list Firefox as an option at all.. It's pretty annoying for me because I use that portal a lot for work and I use FF on everything. Safari is not an option for me because I use Mac, FreeBSD, Windows, Linux, Android all mixed and I need the sync.
And yeah I think they're just blocking the agent. I haven't tried bypassing it. I kinda was afraid something would go wrong (I don't want to wipe 10.000 iPhones from the portal instead of 1 - lol)
What about Webkit?
Forcing users to a prebuilt Webkit, that they cannot change is definitely not the same.
If Chrome became as dominant as IE was then using Firefox on any platform might become impractical.
That's the whole purpose of this post. Instead you want to fear monger and deflect from a sore subject for Apple.
I’m saying even if they’re right about security (which I doubt) the fallout will be so much worse we shouldn’t do it.
This is not something you can look at in a vacuum. There are serious ramifications to their suggestion and they need to be realized.
Apple needs to open up their ecosystem to other browsers. This is not a suitable excuse.
So why do we need to make things worse to make them better?
Let’s make them better (fix the Chrome issue) and then make them better again (the Safari issue) instead of the other way around.
Part of the reason Chrome dominates on Android is because it's the default browser. How many people on iPhone are we expecting will change their default browser? As far as I know, most users don't change their messenger clients on iOS.
You know that would immediately become real Chrome.
Once it’s possible to have real Chrome my fear is Google would start breaking things on Safari (or just refusing to fix things) to drive people to it.
And the stats make me curious -- given that Chrome on iOS is just a wrapper around Safari, are people just switching because Google Docs tells them to, and that's enough? I'm having a hard time of thinking of a functionality reason to switch to Chrome in iOS (maybe browser/bookmark sync, I guess). I'm surprised to see a number that high.
Of course I have no way to prove that at all.
Yes. From Google's apps already asking you to open links in Chrome to Google actively sabotaging competition https://twitter.com/johnath/status/1116871231792455686
Sorry what ? Can you point me to the place where I can download Safari for Linux and Windows and Android ? If they actually had those builds, I would believe what you say.
But no - All they are doing is protecting their turf by hitting every other browser with sticks so folks prefer native apps over web apps.
Yes, Safari is only on Apple platforms.
I’m saying Chrome is already dominant on Windows, Linux, Android, and Chromebook.
The only one where it’s not is iOS (Mac is kinda close, but small in terms of users).
If real Chrome can go on iOS my supposition is Chrome will become dominant there too.
Leaving no platform not dominated by Chrome.
The blog post at the top of this thread talks about CVEs and other measures of resistance to 3rd party bad actors. It does not engage with the concept of Google themselves as a bad actor.
With full control of the rendering engine on all platforms, Google can stop engaging with standards bodies. Web rendering standards will become simply what Google says they are, even if it is to their benefit. Imagine AMP but on steroids. When Safari stops rendering mobile sites correctly, there will be lots of helpful friends and family (and ads) telling folks to "just switch to Chrome, it's a better browser anyway."
Google could also ship their own root certificate list and take control of Web PKI. Imagine Symantec but entirely at Google's option. Play ball or get security warnings. This would allow an end run around the democratization afforded by Let's Encrypt, for example. Controlling 90% of the client end of TLS confers just as much power as controlling the CA end.
Google also has no incentive to make Chrome secure or performant on iOS devices; they run the competing mobile OS platform. If Chrome/Blink is forced into iOS, it won't be long before complaints crop up and we start seeing "Android runs Chrome better than iPhone" ads.
The fundamental fight is not about browsers, it is about defining the platform: "commoditizing your complement." Google wants Chrome to be the platform, and commoditize the computer. This will let Google centralize profits to itself. This is why Android is free (as long as you ship Google's services too).
They will spend as much as they must to achieve this. It is existential.
Lots of folks in this thread talking about Firefox. In this context, Firefox is a strategic front-end for Google. Google is essentially paying for Firefox to continue existing, so that people will use Firefox as an ideological cudgel against Apple.
Also seeing some comments about antitrust. So the plan is to get the government to step in to quash the competition that exists, wait for all the predictable bad things to happen, and then get the government to step in again to re-establish competition.
Does anyone actually think this is a good idea? Or is "antitrust" just a convenient way to dismiss legitimate fears and objections.
You could say this is less about Apple vs Google, and more about users vs advertisers.
The fundamental fight is always about eyeballs. Apple is holding the better cards because control over hardware gives you control over software which gives you control over eyeballs.
Apple's market cap is ~$2,300,000,000,000 and it's not a war.
Why is that? I’ve never heard anyone argue that point before so I’m curious what you think the downsides would be to Google.
It wasn't until after they had dominance that IE really withered.
We give microsoft plenty of flak for anti-competitive behavior. It deserves it too. Its not hard to see why.
But so does Apple.
Now why can't I install my silly joke app? Oh that's right Apple won't let me install my joke app on my devices or friends for more than a week or so for reasons. Even though it can be easily tracked to me, its signed etc.
Why is that? Control.
Why can't I have a linux vm chugging away on ipados? Apple says no. Why? Control.
If Apple wants to exert this much control then it really needs to accept liability. So those security defects? Where's the service level agreement to time limit those glaring holes?
Its therefore unacceptable for Apple to be slow to fix an issue when its competitor could have already fixed it. Oh wait, there are no competitors on ios since no one is allowed to compete. You must use webkit. How is that not anti-competitive?
Many people, myself included, choose to use Apple products in part BECAUSE of how those products work and function, today. I don't want to install additional browsers, app stores, or other crap on my phone, I just want it to work well, out of the box with reasonably high security. For my needs Apple products provide that today.
If Apple's products don't fit your needs, the solution is trivial - don't buy Apple products.
If you don't want to install alternative app stores or browsers, then you should simply choose to not install them.
With the new digital markets act being passed in the EU, everyone will be able to install whatever app store or browser that they want.
And you can't complain because you should listen to your own advice by not installing those other app stores or browsers.
Generally speaking, the purpose of anti-trust law is not to effect small players, who do not control any markets.
Instead, the purpose of anti-trust law is to prevent multi-trillion dollar companies who control half of a duopoly, from doing anti-competitive actions.
So, for the examples that you gave, if those markets became multi-trillion dollar markets, in 2 company duopolies, then there would be laws created that would apply to them.
But before that happens, there is no need.
I wonder, is the EU promising to replace Apple's effective private regulatory environment around privacy control with something its equal or better? Given that "open markets" in software isn't a concept that respects national borders, I don't see how they could. Or are they just going to crack the nut open at the behest of lobbying efforts by other (mostly foreign) multi-billion dollar companies who stand to gain?
> compete with open competition
They can compete all they want. They simply can't use their market power to anti competitively prevent users from installing other app stores or browsers, of their own choice.
A user is free to not install other app stores or browsers, if they don't want.
> let's have governments decide how my phone works
It is actually the user who will now be free to decide which app stores or browsers run on their own phone. Feel free to not install them, if you don't like those options.
Anyways this conversation doesn't much matter because the laws are about to be passed. I look forward to people crying about being unable to prevent other people from doing what they want with their own phone in the future.
Because there is nothing you or apple can do now, to prevent people from installing other app stores or browsers, on their own phone, pretty soon.
The app store/browser war is over. Apple lost. And users will soon be able to actually do what they want with their own phone, and Apple will no longer be able to force users, against their will, from install other app stores or browsers.
The user will be free to decide? Really? The user, most of whom are understandably ignorant to and/or disinterested in the nuances of privacy and tracking, won't remain captive to decisions implemented by programmers, hidden in code, concealed behind encryption and not exposed as a choice?
Free to decide. I can't fathom that anyone actually might seriously believe this overly simplistic fairytale. This kind of freedom doesn't exist and the kind of rules the EU plans to implement don't change that. All they do is shuffle around influence from one set of global billion-dollar companies to another set of global billion-dollar companies.
Or are you telling me that the EU will require mobile operating systems, app stores on those operating systems and all third party apps running on those operating systems to give users absolute freedom to control all aspects of how their privacy is handled?
At least now we have Apple in a position to (and motivated to) enforce privacy standards on behalf of its ecosystem. It's not often that capitalistic forces are so squarely focused at the consumer interest; dismiss it at our collective peril.
Yes, they can choose to not install whatever app store or browser that they want.
> or disinterested in the nuances of privacy and tracking
It sounds like you just don't like the user's choice. You could have just said that you disagree with what the user will do, and want to take away their choice to install whatever browser or app store that they want.
Don't pretend like you care about user choice, if you are then going to pivot and say that you disagree with the choice of the user, because you think the user is dumb, or would choose different than your personal preference.
Thats the problem. Just own your position. If you hate competition, and hate giving power to the user to choose whatever they want, and think that there needs to be a monopoly that anti-competitively controls everything that the user does, against their will, then just say that.
Just take your mask off, and say that you think that you know better than everyone else, about their own property, and want to force everyone else to do what you want, and you want to take away their ability to choose for themselves.
Don't dress it up like you were doing previously, like pretending like you care about markets. Just say that you hate the user's opinion, and you want to take away their freedoms to choose what they want to do with their own device, and stop hiding behind fake arguments that you don't believe in.
> to give users absolute freedom to control all aspects of how their privacy is handled?
Users will be given the choice to install whatever browser or app store that they want.
If a user prefers whatever it is that you are talking about, then they are free to not install those app stores or browsers, and continue to use the Apple recommended choice.
But once again, I look forward to people crying more about this soon. Because there is nothing you or Apple can do to stop users from installing alternative app stores and browser in the future, as the laws are about to be passed.
Apple lost. You can't change that.
Your first misunderstanding is this assumption that competition and user choice hinges on the axis of "browsers and app stores". This isn't an objective fact, it's an opinion. A different and (at minimum) equally valid opinion is that user choice can hinge on the axis of phone ecosystems. Yet another axis could hinge on apps themselves — perhaps none of us are "free" until Facebook, Instagram, etc are all required by the EU to allow anyone to write fully featured native front-ends. Perhaps the freest of all is a marketplace with a diversity of axes, which is precisely what laws tend to demolish.
Your second misunderstanding is your continued smuggling in of the concept of "user choice" in a marketplace where users do not and cannot have anything remotely resembling real freedom of choice, no matter how many browser engines or app stores are available. Open source ecosystems aside, >99% of "choices" are made by the software developer exclusively. Choosing to acquire the same corporate-capitalist closed source spyware from vendor A or vendor B is an illusion of choice.
Your third misunderstanding is this absurd and self-evidently false claim that people who like the status quo will be able to simply ignore the new alternative app stores and browsers. If loading alternative app stores really does become seamless, companies like Facebook and Google will have absolutely no incentive to list their apps in Apple's store. In fact given that Apple's pro-privacy policies (like App Tracking Transparency) are causing these companies to lose enormous amounts of revenue, they have a MASSIVE commercial incentive to abandon the Apple App Store.
You say these laws are about to be passed. I haven't seen how any of these EU laws get around the reality of Apple's ownership of its own intellectual property. I can't imagine how the EU could force Apple to supply its intellectual property to app developers under different terms. So even if the EU does force open iOS to alternative stores, I'm really not sure how developers are going to legally build apps to put in those stores.
As for your continued barbs implying that I oppose user choice, I'm wearing a "mask", that I hate markets, that I hate opinions, that I'm taking away freedoms, that I am offering "fake arguments" which I "don't believe" and will be "crying" about EU laws. All I can say is that rejecting the possibility that someone can sincerely hold a different opinion to you is disappointing — and represents a barrier to intellectual curiosity.
It is pretty simple. Companies that want to operate in the EU have to follow certain laws, or pay a huge fine.
Technically speaking, these are requirements to operate in the market. So I guess if Apple wants to pull out of international markets, and never sell an iPhone again in the EU, that would also be an option. But, my guess is that they don't want to lose those billions of dollars.
> I'm really not sure how developers are going to legally build apps to put in those stores.
Its simple. Either Apple follows the law and gives app developers the ability to build apps, pays a huge fine, or leaves the entire EU market. Those are Apple's only 3 choices. And if they try a clever way to get around the law by using some sort of intellectual property strategy that you are hinting at, then they pay the huge fine, which is calculated based on a large percentage of global revenue.
Enjoy thoses laws that you cannot stop! They will likely come into effect in less than a year. They can't be stopped. Apple should have addressed its own anti-competitive behavior before it got to the point where this was necessary. Its way too late now though.
We pretty much do know how things will work out, actually. That's why people made these laws.
The laws were made to force Apple, and similar, to open up their app stores.
And if Apple doesn't follow the law, then they will be fined billions of dollars. Because that's why they made these laws in the first place.
You saying that people don't know, is cope on your part, because you can't handled that Apple lost, and cannot win against governments.
I’ll say again, your version of future events doesn’t even align with mainstream analysis of the DMA.
The point of all of these laws are to open up these app stores. That is the direct goal. And clever attempts to get around them, will result in billions of dollars in fines to Apple.
I am happy to come back to your posts, months later when the laws are in effect, and make fun of you for being wrong on that though.
Really, I am more of a "I told you so" kind of person, though.
Because when I come back, and say "I told you so", you won't be able to make any cope/reaching/bad counterarguments. You'll know, definitively, that you were wrong, and you won't be able to hide from that.
These are falsifiable claims about how things will turn out. And since they are falsifiable, I can make fun of someone, when the statements are falsified, and the laws are in effect.
And there will be no hiding from how bad your predictions were, when I can show it to your face, when it happens.
Happy to wait.
In the meantime it seems you're operating under a misapprehension that any of that has occurred when in fact none of that has. Even the most optimistic reading of DMA doesn't support your fan fiction.
You've shown me the door. Guess what? We took it. We've opened a new door right through the wall. Hello there!
Lightning cables from Apple are equally bad. Guess what? Competitor cables are more resilient in real world use. But yes, bring on usb.
I don't see these as mutually exclusive.
First, IE was bundled onto virtually every computer at the time and Microsoft went out of their way to stop you from replacing it (eg system actions would use IE).
Second, Microsoft's anticompetitive IE behaviour was aimed at protecting its Window monopoly. Microsoft was worried that the Web would become a device-indepndent platform and that would obviate the need for Windows at all.
Third, is Chrome actually bundled to any large degree? There's enterprise bundling but how significant is it? There are Chromebooks but I feel like they're not a huge factor. I guess there's Android. Chrome's desktop share seems to be 68% [1]. That's impressive for an action people have to take to change the default.
Fourth, Google doesn't have the same motivations as Microsoft (in regards to protecting another platform). There are other much more real issues (eg favoring their other properties like Youtube) but crippling Chrome doesn't seem to be something that aligns with any of their interests. It seems way more likely that Youtube (etc) will work better in Chrome. While that's bad for other browsers, it doesn't have the same negative effects as what Microsoft tried.
Fifth, the core of Chrome (ie Webkit but also V8) is both open source and the core of other browsers (notably Safari and Edge) so it's less likely Web developers will end up in a situation where they effectively have to implement something twice, once for Chrome and once for the rest. That was pretty much the situation with IE.
Will it be a big deal in the future? Maybe. I don't really see this being a big problem anytime soon however.
Obviously this means that they need to give up on their iron grip on app developers so they didn't do that even if that was the exact path Steve envisioned. But that's not a good excuse either.
I know one: Anti-trust enforcement.
For instance, in these patch notes Chrome lists "Various fixes from internal audits, fuzzing and other initiatives" and doesn't even look to have a CVE:
https://chromereleases.googleblog.com/2022/05/stable-channel...
Or for Firefox, there's a dozen or so bundled together in a single CVE under "Memory safety bugs fixed in Firefox 101":
https://www.mozilla.org/en-US/security/advisories/mfsa2022-2...
But in the grand schema of things, who cares how many CVEs a project has, when it can take almost 2 months for the project to ship updates fixing exploits that happen in the wild already? That's just out of control and unbelievable.
Possibly a CYA-esque liability statement, but the principle seemed sound.
The EU's digital markets act bans the only Safari lock on IOS, so this is gone whether apple likes it or not. (1 - sorry couldn't find a better source)
Safari is the new IE, there is a difference between a monopoly while still being able to use a competing product (like chrome in other platfroms), and forcing Safari(WebKit) while hindering the web because of Apples interests.(2-3)
1. https://www.fudzilla.com/news/54763-apple-loses-out-in-the-d...
Also many have now spoken up against it:
### Electronic Freedom Foundation (EFF) Apple’s restrictions on third-party browsers, and the limitations it puts on Safari/WebKit (its own browser tools) have hobbled “web apps,” which run seamlessly inside a browser. This means that app makers can’t deliver a single, browser-based app that works on all tablets and phones - they have to pay to develop separate apps for each mobile platform.
That also means that app users can’t just switch from one platform to another and access all their apps by typing a URL into a browser of their choice.
### Mozilla Mozilla believes that major platforms should be under an on-going duty to:
Stop practices that distort competition on the merits and inhibit consumer choice, such as: ● interfering with consumer selection of alternative browsers and use of those browsers to access the internet from links and queries on their devices; and ● dictating or controlling browser components, such as browser engines, which prevent consumers from accessing and using their preferred browser across all operating systems and devices.
### Google By contrast, PWAs—and the web writ-large—receive a small fraction of this support on iOS. This is primarily because of Apple’s requirement that all browsers use its proprietary WebKit browser engine. Not only does this prevent browsers from differentiating from Safari—Chrome is unable to access the user’s camera, preventing users from using products like Google Lens—it also harms user security. A recent study from Google’s Project Zero security research team found that WebKit is significantly slower than other browser engines to fix reported bugs.
### Microsoft Apple requires that any mobile browsers on iOS, including those offered by Apple’s competitors (e.g., Google’s Chrome app), use Apple’s own WebKit browser engine. This restriction harms competition and consumers.
### Meta Apple requires all web browsers on iOS to use WebKit, a degraded version of Apple’s Safari browser, to render web pages. Apple thus sets Safari as a functionality ceiling for mobile browsers on iOS. The restrictions on Safari’s and other iOS web browsers’ capabilities prevent web pages and web apps from providing consumers with robust, cross-platform experiences that would lower switching barriers
### Telegram We suspect that Apple may be intentionally crippling its web apps to force its users to download more native apps where Apple is able to charge its 30% commission
That is not true. WebKit is opensource, there are other browsers that use it (GNOME Web), it is used in a lot of other applications, like GNOME Builder, Devhelp.
On iOS third party browsers: ● Can't pick their own browser engine ● Can't pick which version of Webkit they wish to us ● Can't turn browser engine features on or off using flags ● Can't add entirely new browser engine features ● Can't edit browser engine features ● Can't entirely remove browser engine features ● Don't even get all the features of Webkit that iOS provides Safari ● Get a more restricted version of Webkit than the one iOS provides Safari Safari and the WebView that browsers use do not get the same level of access) ● Use a version of Webkit provided that is tied to iOS system updates as opposed to packaged with the third party browser
On Android third party browsers: ● Can use their own browser engine ● Can pick which version of Blink they wish to use (if they are using Blink at all) ● Can turn browser engine features on/off using flags ● Can add entirely new features to Blink ● Can edit existing features in Blink ● Can completely remove features from Blink ● Don’t have to use Blink at all
Ehm. Chrome is the new IE. Apple is using anti-competitive methods but its far far away from market domination.
Microsoft is doing even more, by pushing so much Edge-only stuff.
On iOS Apple forces the Webkit rendering, but for normal user it does not even matter much. They can download Chrome and get the UI they want.
It's also technically more correct, the best kind.
Then at least you’ll be able to tell all your customers that you recommend switching to Chrome for all browsing. What a great victory for browser diversity and the open web!
Safari is one of the worst browsers in terms of compatibility, like PWAs and notifications, they are unsupported on purpose to push developer to develop apps and give apple a cut. And when they do adopt new technologies, they are often super late like webp.
Please die WebKit.
By "compatibility" you mean "support all of the Chrome's no n-standards it pushes at breaking speed"?
Which is THE single selling points that brings everyone to make 2 native apps instead of one URL. It hs been available on Android for a decade, and is still undetermined when it will actually land in iOS.
Web push notifications
Adds support for opt‑in notifications on iOS. Coming in 2023.
Apple Safari has, literally, 100% marketshare across the entire iPhone market. Its App Store also has 100% marketshare and enforces the Safari marketshare.
I have an iPhone 13 Pro Max. I love the hardware, but I'd love to install other browsers; why can't I? I'd also love to run real PWA's or run WebRTC without major issues. Why shouldn't I be able to do these things?
Apple enforces its own browser, which it carefully and deliberately hamstrings, in order to force web apps to not bypass the App Store, so Safari also enforces the App Store marketshare.
They're tightly tied together (so tight that the Windows-IE tying isn't even in the same galaxy) in order to enforce the other's marketshare. At least Microsoft allowed third party browsers and installing apps from other locations. This is tying on a completely different level.
And that’s the big difference between Safari dominance and IE at the time. Safari is only on iOS/iPadOS dominant not in the entire market like IE was
IE had a nearly 100 % percent marketshare and Safari is far away from 100 % marketshare.
Outside of legal-land this seems like a BS argument, and even more so now. But legal-land is what matter first I suppose.
Feel free to debate the end result. If you presume motive, you can be proven wrong.
Why don't you actually refute the points they made instead? If it's so obviously "conspiracy theory brain poison"
Webkit quite literally has 100% market-share on the iOS platform, as no other browser engine is even allowed. Same goes for the App Store, 100% market-share.
There's no such market as devices of a single manufacturer.
But if you buy an iPhone, you can only download browsers that are using Apples own browser.
Just because smartphones have traditionally been locked down, doesn't mean that it should be like that.
PCs were also pretty locked down the beginning. And Windows have tried a couple of times to move in that direction. But fortunately, we have a relatively open ecosystem when it comes to devices we use for "producing" things on. It's just missing that the devices we "consume" on works similarly.
I used to wish for Firefox on my iPhone too. But after a while I got skeptical this would benefit me or other users. Apple was the one to make the hard decision to kill Flash, and Firefox is known to have done their missteps too. So what if they are right in their decision and Safari does have a role in the reason you and so many others consider the iPhone the best phone to buy?
I'm running GrapheneOS on the Pixel. It is perhaps ironic that the best phone to de-Google is actually a Google, and that Google both allows this and explicitly supports it, but it's not possible to de-Apple any iPhone.
We are supposedly talking about Safari, yet Safari is tied to iOS not to the hardware. People can install Brave or Firefox on Android. But they are not ever satisfied. I don't have the numbers, but I suspect the sum of GrapheneOS and other de-Googled Android distributions might be bigger than the sum of Firefox and Brave on regular Android.
In the end, maybe Apple should just allow you to download some software that voids your warranty and roots the iPhone, while removing iOS. People can then reverse engineer and do whatever they want. But Apple's drivers and some of the chips are proprietary, and that I don't see a way people would convince regulators to enforce them to open-source those.
* PS4
* PS Vita
* 3DS/New 3DS
* Wii U
* Wii
Also maybe PS3/PSP and likely also PS5 will get the webkit exploit treatment at some point.
Note that, while earlier JailbreakMe exploits were patchable if you installed a patch[2], the readme in the TotallyNotSpyware repo explains that, in general, there's not a patch for the exploit post-jailbreak, so you could still be pwned by a third-party website should they deliver this exploit with a spyware payload.
0: https://en.wikipedia.org/wiki/JailbreakMe
1: https://github.com/JakeBlair420/totally-not-spyware
2: https://www.idownloadblog.com/2011/07/06/pdf-patcher-2/ (use an ad-blocker, this website is super ad-infested)
The jailbreakme app wasn’t exploit on WebKit. It was iOS native pdf rendering Library. WebKit was used to deliver the exploit.
Browsers can download and execute arbitrary code in the form of JavaScript or WASM. Your options for poking at the sandbox are far more plentiful when it is parsing and executing turing-complete instructions rather than a markup languages or other static data.
Firstly, this is not a webkit-specific problem - It's just that webkit is the most commonly embedded browser engine.
I have personally jailbroken my LG smart TV using a V8 n-day exploit (details not public, yet).
For any modern browser engine that is left unpatched, it is only a matter of time before it can be exploited using publicly-available techniques - and console manufacturers know this. Which leads me to my second point:
Console manufactuers assume that the browser will be compromised, and sandbox it appropriately. It is not a meaningful security boundary, by design. Exploiting the browser on a console, on its own, doesn't get get you very far. You'll need to chain it with additional exploits (a sandbox escape, a kernel exploit, etc.) to do something useful.
Console users will deliberately withhold security updates, so that they can later hack their devices. Console security updates protect the vendor from their users.
Mobile users (who care) will always be on the latest updates. Fresh browser exploits are exponentially more expensive, generally speaking.
Allowing users to use different browser engines doesn't necessarily widen the remote attack surface, it just changes it. But yes, ultimately I think Apple cares more about losing their walled garden, than they do about security.
What have you done with your jailbroken TV?
I was considering jailbreaking my LG Smart TV too as I _hate_ the Home screen with a passion and was hoping to replace it. But I use the Game Mode all the time, so I was hesitant to jailbreak in case that interfered.
I'm just curious why you've jailbroken yours and whether or not I should.
Yes, webkit is somewhat to blame, but I bet, as we can see the number of exploits in the graphs from the original post, that any outdated Chromium version would end up with the same fate.
And good lord this line of argumentation is extremely disingenuous even if you think the actual analysis is good (counting CVEs is not exactly the best measure). One because no one except nerds are going to switch browsers in response a random CVE and two because it doesn't even establish what Apple actually means by security and instead goes off on a rant "well if Apple really cared about [my personal view of] security you would blah blah" -- literally zero effort to understand the opposing view or evaluate other possible ways of addressing the security concerns.
But ya know, "Safari lags behind other browsers in RCE mitigations and mean time to patch" doesn't grab headlines and doesn't prescribe a single solution that is also motivated by more than just security ;)
Why is running other applications somehow secure?
But I think they draw the line at native (read: unsafe) code, which, is not totally unreasonable
> but I think every native dev has done some form of dynamic code at some point
This is a little ambiguous; theoretically a VM - even a custom one - would still be above-board because the native code is static. My understanding was that the main problem with third-party browsers is third-party JS engines, but only because any modern JS engine has to JIT in order to perform the way people expect; the app developer takes responsibility for generating unsafe native code, which has the potential to wreak all kinds of havoc on the user's system in a way that dynamically-updated JS code for example can't
It would be interesting to try and submit a fully-custom browser with a non-JIT JS interpreter to the App Store. I bet they'd allow it; just, nobody would use it because it would be slow as mud
And to be clear when I say a handrolled VM, I mean that the VM knows how to interpret dynamic things into native things. This is a lot more powerful in Objective-C since it uses message passing anyways so you could theoretically build a full app in some JSON payload. So sure your native code is static, but thats because its just 1 function called 'eval'. This is still possible in Swift but requires more explicitness since it doesn't have the same dynamicism built in.
It doesn't have to be entire apps that are custom though. Most app devs use it for things like customer-editable content. Think of things like the ability to update home screen layouts, or tab layouts/behavior. Depending on how much baked-in customization you build this can be extremely robust.
Having said that, I strongly suspect concerns around arbitrary code escaping kernel control only applies to older iPhone running substantially less sophisticated SoC than you find in a modern iPhone. Certainly any Apple SoC during the M1 era, and a good few generations before, have all the modern accoutrements needed to allow arbitrary code execution, while ensuring the kernel can always intercede and halt execution or block dangerous calls. If they didn’t have these abilities, then there’s no way an M1 Mac could efficiently run a VM, or be considered a secure platform by modern standards.
[1]: https://apps.apple.com/us/app/pyto-python-3/id1436650069
For example you can write a mini-app that connects to bluetooth. It's essentially loading dynamic code that bridges to native code.
https://developer.mozilla.org/en-US/docs/Web/API/Web_Bluetoo...
https://apps.apple.com/us/app/bluefy-web-ble-browser/id14928...
So what? Apple has never required review of every web page you load with safari, regardless of which browser APIs they use... the browser is the browser. That is the farthest Apple goes on "dynamic content" but yes, it is potentially a pretty wide net given the various APIs and extensions. But from Apple's perspective it is also a defined boundary.
The only exception they've crafted is for educational purposes.
2.5.2 Apps should be self-contained in their bundles, and may not read or write data outside the designated container area, nor may they download, install, or execute code which introduces or changes features or functionality of the app, including other apps. Educational apps designed to teach, develop, or allow students to test executable code may, in limited circumstances, download code provided that such code is not used for other purposes. Such apps must make the source code provided by the app completely viewable and editable by the user.
> Dynamic testing includes everything from battery usage to file system access and privacy requests to access device hardware like the camera and microphone, while static analysis checks app size, entitlements, in-app purchases, keywords, descriptions, and more.
> In 2015, Apple discussed acquiring SourceDNA, a company that made a tool to allow companies to see the code inside apps. Apple did end up purchasing the company and using its engineers to design a new tool for app oversight.
https://forums.macrumors.com/threads/apple-rejected-approxim...
We know this because when dev submit apps that call private APIs they get very quick rejection. But hiding private API call behind obfuscated blobs of dynamic code can get you through app review, provided you don’t expose the functionality in your UI.
Additionally the modern App Store deployment process involves uploading you app in an intermediate format, only partially compiled, so apple can dynamically recompile your app to target new CPUs, and optimism your app to use new hardware without intervention by the dev.
If I can run firefox instead, and that javascript sandbox exploit was already patched in firefox, the iOS app sandbox escape won't do them any good. They can't get through the earlier layer to exploit it.
The claims being made here is that the first layer, the browser exploit, is easier with safari/webkit, and the second layer, the iOS sandbox escape, is identical. Even if it only changes one layer of security, that is still a meaningful change and is more secure.
There are additional factors too.
Right now, if you have a webkit vuln, but no iOS sandbox escape, you can still steal cookies from other sites, browser history, exfiltrate passwords, etc. The browser engine is a valuable target on its own, even ignoring the rest of the system.
These two things can't both exist. The fact that the sky isn't falling on macos leads me to believe that this position of apple's, while spoken in terms of privacy and security publicly, is really all about dominating what software runs on their devices which i remind you have to pay a hefty fee on profits to apple in order to be installed on users devices through official means. That is pretty user hostile, but obviously shareholder friendly, which explains why it perpetuates and why apple share prices have reached the stratosphere since the iPhone.
Last I heard then officially defend this apparent contradiction, the Apple rep asserted that people's phones are in fact the more important/personal devices, as well as being more common, and as such security on iOS is more important than on macOS.
That said, I consider that all the more reason that people should be able to run whatever software they wish on their phone. The present paradigm of such a personal device's operation being totally out of the hands of its owner is troubling.
The vast majority of users don't know or understand why they see decreased battery life when they do, they just see that their phone doesn't last as long. Google has such a complete monopoly in the browser market that one can argue that there's a pretty good incentive for Google to make tradeoffs in Chrome that decrease battery life on the iPhone to hurt the iPhone's battery life, and most people would not realize or understand that its not the iPhone's fault but Chrome.
Not really. Maybe in the early days they had an edge with ObjC when hardware was primitive and java slow, but nowadays it's the same or buried behind synthetic slowdown animations. The battery life isn't especially good in my personal experience.
• There's a place for closed platforms if open ones are a reasonable choice. A closed platform must not be the only choice available to the customer, but it should be allowed to exist given a healthy market. It's hard to argue that iOS is a monopoly, and if so, than a browser engine and JS interpreter with access to the open web is a very powerful thing that the owner of the platform may deem too powerful for its own good.
• Chrome's dominance of the Web is very scary. Not as scary as IE's, since it's open source, but still, it's such a huge beast that it's almost proprietary through complexity. I don't know if there's an easy solution out of this.
• The time it takes Apple to patch security flaws is not the main issue here and should not be the core argument. What if Apple steps up its game and gets really good at this? The issue is the strategic decision Apple is making and the discussion should be if a company that powerful should be allowed to make such decisions and impose them to the user.
• Apple could avoid this discussion by giving the user a one time only toggle switch to sideload any binary. It should be buried under many menus and preceded by lots of scary dialog boxes. It could even void battery warranty or something. Maybe keep a constant orange menu bar as a reminder that you are on your own and can't blame Apple for anything.
If you have a way to effectively and efficiently blame the bad behavior of your ecosystem on a third party, then there are whole industries waiting for you to sell them consulting services. If the king of Reality Distortion Fields couldn't figure it out, probably nobody here has either.
Nobody is going to notice that Chrome is eating their battery. They barely notice on desktop. The tools are even less grandma friendly on mobile.
I don't know what logical leap you're trying to make, but if people don't notice the impact of Chrome on their battery then what makes it worse than Safari?
Doesn't iOS have similar functionality?
iOS tends to make it significantly harder for applications to justify background processing, so I myself tend to find battery statistics less useful - you have apps which have a more voracious appetite than others, but typically only when you are actively gaining value from them.
This is illegal in a variety of places. They need to prove that these actions caused damage to the battery.
I'd say that Chrome's dominance is much scarier than IE's. One reason has to do with user data.
When IE was dominant, user data was not nearly as valuable. Today, user data is how Google makes money, so they are strongly incentivised to harvest it. While I understand Chrome isn't exactly the source of the harvesting, it reinforces reliance on Google services for the vast majority of users.
Bootloader should be doable once you can run unprivileged arbitrary code, but some support could be offered as well, like they do with the M series Macs
Apple bundles the three levels (hardware, OS and Apps) and sells you the hardware. But Safari is tied to iOS and not to the hardware itself. So would you argue about an option to replace iOS instead of installing other browsers on iOS itself?
Both Chrome and Android are open-source bases for proprietary platforms. Google very consciously blurs the line between functionality available across all Android devices or across all web browsers, and the functionality which you only get with their products (e.g. licensed Android with Play services, or Google Chrome).
Would it really have made a difference if Internet Explorer 6 was open source? Most of the features in Internet Explorer were copyable by other browsers, just as most of the Chrome-only API are copyable today. There's other reasons why Firefox and Netscape on Windows didn't support ActiveX controls and XML Data Islands, such as both those features being lousy ideas.
- Always-running daemons to perform internal bookkeeping tasks, provide network access, which are not reaped by lack of user focus or the needs of other applications
- Ability to download, generate and run arbitrary native code (for running Javascript and WebAssembly)
- Ability to register arbitrary URLs, see installed third-party applications and execute them arbitrarily
- Ability to modify the Home Screen to install additional applications (such as native-wrapped PWAs)
Without full system level access, Apple's store restrictions don't matter. You are not going to see resourcing to port Gecko or Blink to iOS if it means the javascript and webassembly engines are interpreted, push notifications only work when the browser is in the foreground, SPA applications can't be added to the Home Screen, etc.
And by full system access, I mean _more_ access than Safari currently has. After all, many of the features people complain about MobileSafari not shipping are features that are also not supported by the underlying OS.
If you allow Chrome to be installed as a regular app (even if Apple allows JIT), it will not work. Therefore for a viable Chrome Browser Apple would have to provide APIs they probably stripped from the OS itself and putting it back will for sure hinder security.
And after they have like 50%, they won, as they will inexpensively make their market dominant products (search, meet, etc) worst on Safari, by just neglecting to fix issues due to higher cost of making it work on two browsers. We've seen that before. I am posting this from Brave because many sites in Brazil neglect Safari on desktop, so I got used to alternatives.
You can read more here: https://www.gov.uk/cma-cases/mobile-ecosystems-market-study
And their new market investigation here: https://www.gov.uk/cma-cases/mobile-browsers-and-cloud-gamin...
or our tweet thread summary here: https://twitter.com/OpenWebAdvocacy/status/15395035090783887...
Edit: Apple is also not claiming what the title suggests (source would be needed), the author of the tweet seems to just interpret it this way.
Instead Apple has forced them to produce separate browsers around a locked WebView that they exclusively control. Mozilla, Microsoft and Google have all spoken out against the ban in regulatory submission, and browser engineers at each vendor consider it a ban.
The REAL browsers have been banned.
https://apps.apple.com/us/app/firefox-private-safe-browser/i...
https://apps.apple.com/us/app/microsoft-edge-web-browser/id1...
https://apps.apple.com/us/app/google-chrome/id535886823
https://apps.apple.com/us/app/brave-private-web-browser/id10...
https://apps.apple.com/us/app/duckduckgo-privacy-browser/id6...
https://apps.apple.com/us/app/opera-browser-fast-private/id1...
Etc.
Mozilla believes that major platforms should be under an on-going duty to:
Stop practices that distort competition on the merits and inhibit consumer choice, such as: ● interfering with consumer selection of alternative browsers and use of those browsers to access the internet from links and queries on their devices; and ● dictating or controlling browser components, such as browser engines, which prevent consumers from accessing and using their preferred browser across all operating systems and devices.
No they haven't! You can download each one here: [0], [1], [2]. They have been forbidden from using their own rendering engines. But they can still add all the chrome they want to the UI and do all their usual tracking like they do on the desktop.
[0]https://apps.apple.com/us/app/firefox-focus-privacy-browser/... [1]https://apps.apple.com/us/app/microsoft-edge-web-browser/id1... [2]https://apps.apple.com/us/app/google-chrome/id535886823
Then why doesn't it target Chromium as the vastly dominant engine that has ~80% of global market?
Or in the case of Chromium the cardboard wrapping like Edge etc. are different engines all of a sudden?
Because WebKit sucks!
I don't intend to be vitriolic here, but this really is the status quo of rendering engines. You have Blink, which is capable of making complex webapps and fully-featured browser experiences, and then you have WebKit, which is almost exclusively capable of breaking them. I'm not mad that WebKit sucks though, we need sucky browser engines! Sucky browser engines like WebKit run great on terrible hardware like Smart TVs or WiFi Fridges or portable game consoles that wouldn't be running a browser engine otherwise. The problem is that Apple forces mobile users onto a browser that's behind the rest of the world's web technologies. They can make sucky browsers all day long, and they won't hear a peep out of me as long as I can replace it with a Chromium-based browser. WebKit is holding Safari, and by extension the rest of the internet, back.
That's the problem, and arguably an abuse of market position considering Apple directly profits off the failure of webapps.
Of course it doesn't suck
> the status quo of rendering engines. You have Blink
And so we've immediately arrived at the core of the matter: all you want is Chrome. Which is a) the dominant browser and b) whose "capable" is a bunch of Chrome-only non-standards
So yeah, I'm willing to stick it to Apple for being the largest company in the world, and criminally negligent towards their first-party browser. Obviously they're doing this because they directly profit off the failure of the web.
Have you ever tried developing for consoles or releasing games through Steam? It's probably "but it's different"?
> and criminally negligent towards their first-party browser.
And that "criminal negligence" manifests itself in not implementing all of Chrome's non-standards the moment Chrome comes up with them?
But at the moment, Apple is the company that is abusing control of their platform and most web-devs and many educated users look forward to having real choices.
How is giving the web completely over to Google a real choice?
Chrome is ~80% market share of browsers. Google search is dominant, and pushes Chrome heavily. Google's own apps and platforms push Chrome, and on mobile they ignore user choice and offer to open links in Chrome by default. Google is known to have repeatedly sabotaged Firefox [1]
Google fully dominates web standards committees. Google already barrells through with their proposals with complete and utter disregard to input or objections from other browser implementers.
The web is already given over to Google.
More comments and discussions from other people: https://news.ycombinator.com/item?id=31899606, https://news.ycombinator.com/item?id=31897396, https://news.ycombinator.com/item?id=31899214
Why can't Apple make an exception for Firefox and non-Chrome browsers ? Disallow Google Chrome, but allow the use of OSS browsers (with their native rendering engines).
Hint: They will not, because they are not afraid of Chrome as much as much as they are afraid that their complete stranglehold over native app development gets threatened.
How do you imagine such a ban? And how much worse Apple will look in this scenario?
https://pbs.twimg.com/profile_banners/1129987795651399682/16...
You and I both know the headline means allowing other rendering engines.
Building a general purpose web browser is one of the most challanging software development projects. This may not be the case if one is cloning Chromium/Firefox where you get both the rendering angine and the browser app for free. If you are using WebKit, you are writing the browser application from scratch.
But we are not a good example. Take Firefox or Chrome on iOS, teams with hundreds of engineers. They are terrible mobile browsers. They feel completely out of place on an iPhone. Not because WebKit is bad, but because building a good, native, iOS browser is incredibly hard.
To bring it back to Kagi, if I'm reading your FAQ correctly for instance, you would not be able to support firefox/chrome extensions on iOS since you had to fork Webkit. Now imagine you are a browser with over a decade of use and features that now has to target a static other engine. How great of an experience do you really think you are going to get out of that?
The rendering engine determines pretty much everything related to we standards.
Third party iOS browsers are little more than third party themes/skins.
See this comment https://news.ycombinator.com/item?id=31897294
The iPhone is a general purpose smartphone, and your TV is not. The "smart" part of the smartphone makes it useful without Safari. See apps that integrate with health devices or simpler uses like offline Google Maps. Neither are functioning as a "phone" but instead as a general use computer.
With the exception of the iPhone, no other general computing device is currently enforcing a single browser.
(And the "smart" in the "smart tv" does not get even close, as their apps can do almost nothing in comparison.)
And it is hard to see how counting numbers of bugs has much to do with the severity of the bugs. Not every bug allows a jailbreak, but the ones that do are of much greater concern.
Also, I'm skeptical of the notion that every type of app except web browsers can be meaningfully screened for security. How can one not interpret this as a tacit admission that the screening process is close to worthless?
Are you under the impression that Chromium and Gecko are not written in C++? Mozilla has been using _some_ Rust but the modern browser engines are some of the largest, most complicated C++ codebases in existence and your statement applies to all of them.
Also, a security issue with safari is far more devastating if you don’t have other browsers.
1. You have to wait for apple to release a system update, not just update the app.
2. You now have no safe browser to use while you wait for #1.
I wish they'd open up just a little. Plus iMessages.
Is this true? I could have I sworn I’ve updated Safari many times without needing to update macOS.
I don't think Apple has banned other browsers at all.
"Apple's ban of third party browsers on iOS is deeply anti-competitive, starves the Safari/WebKit team of funding and has stalled innovation for the past 10 years and prevented Web Apps from taking off on mobile."
Anti-competitive? Perhaps? Yes? Starves the Safari team of funding? I don't know what this means. Stalled innovation for the past 10 years? Maybe. Prevented Web Apps from taking off on mobile? whoah. These are some pretty loose claims.
So they don't have it on the AppStore? Who cares?
I'm pretty sure that approximately zero normal users are bothered by this, but a lot of webdevs really, really want to be able to use things like web push messaging on iOS.
I think many normal users are bothered by this and don't realize it.
The restrictions on browser engine are the main reason that Firefox can't ship addons for iOS (like it does for firefox on android). I bet a ton of iOS users would appreciate being able to install firefox addons, like uBlock origin, on their iOS firefox.
And this is not different from Google creeping their services in other browsers, Microsoft imposing limits on Windows or any other company doing whatever they want with their products.
I don't really understand why the walled garden seems to still surprise so many people.
They're '...doing it for the children!'
Mmmhm.
Mine is different. The security I'm interested in for my use case is that there is one egress point from the operating system as far as a browser goes. That means I don't have apps shipping their own browser engines to circumvent the system block lists and screen time whitelist controls.
Also comparing CVE rates is pointless as that's exploits and vulnerabilities that were identified and patched, not ones that are in active exploit or publicly unknown which is a metric you cannot measure.
And of course if every app ships a browser or you change it, how many CVEs do you have from unpatched browsers shipped in apps?
This twitter post feels like the old political adverts: "vote for us because the other guy is shit" (not because we have a better solution).
The mechanism for banning third-party browsers is rejection by the App Store reviewer, correct? Supposing Apple allowed third-party browsers but disallowed embedded browsers in non-browser apps, how would this security model change at all?
Second the thread pointed out that many iPhones remain vulnerable and unpatched to openly disclosed security holes WITHOUT an option to update them. One must assume at that point that they are being exploited. The fact that alternate browsers don't have this problem is a significant version.
But you do have a good point that it is bad for third party apps to bundle their own browsers to bypass controls, and then leave them vulnerable.
As for system block lists and screentime whitelist controls, that sounds like something any browser could plug-in to via a OS provided API.
I'm in somewhat agreement with you that you can't identify the number of security flaws by vulnerability count, but when you combine that with the big delay in patching + patches not being delivered to the current (most popular) version of the OS it brings a lot of doubt to Apple's claims of both being able to patch faster and have better security.
We're not advocating that apps should not be allowed to ship a browser unless they receive a browser entitlement which should be subject to some approval process / vetting etc. i.e. Browsers with strong security track records should be allowed to bring their browsers along with the engines with some affordance given to browsers that run from soft-forks of those engines.
All browsers have vulnerabilities, and it's hard to measure. Although it's easy to spot browsers that aren't patching known vulnerabilities fast enough. Negligent browsers should be warned and then have their entitlements revoked.
As for hardware protections like APRR or Pointer Authentication Codes (PAC) Apple should be forced to provide access to the third party browsers. I would steer clear of mandating exactly how the browsers should keep their users secure because that can be a point of debate and can be done both at a software layer or a hardware layer. Firefox has also introduced Site Isolation, Chromium has proven that adequately staffed security teams are able to mitigate hardware level security issues like Spectre & Meltdown with novel, system-level mitigations and these mitigations reached users before OS and hardware updates were able to fully remove the vulnerabilities.
This isn't rocket science.