Apple confirms it's breaking iPhone web apps in the EU on purpose
techcrunch.com
techcrunch.com
== Begin quote ==
The iOS system has traditionally provided support for Home Screen web apps by building directly on WebKit and its security architecture. That integration means Home Screen web apps are managed to align with the security and privacy model for native apps on iOS, including isolation of storage and enforcement of system prompts to access privacy impacting capabilities on a per-site basis.
Without this type of isolation and enforcement, malicious web apps could read data from other web apps and recapture their permissions to gain access to a user’s camera, microphone or location without a user’s consent. Browsers also could install web apps on the system without a user’s awareness and consent. Addressing the complex security and privacy concerns associated with web apps using alternative browser engines would require building an entirely new integration architecture that does not currently exist in iOS and was not practical to undertake given the other demands of the DMA and the very low user adoption of Home Screen web apps. And so, to comply with the DMA’s requirements, we had to remove the Home Screen web apps feature in the EU.
EU users will be able to continue accessing websites directly from their Home Screen through a bookmark with minimal impact to their functionality. We expect this change to affect a small number of users. Still, we regret any impact this change — that was made as part of the work to comply with the DMA — may have on developers of Home Screen web apps and our users.
== End quote ==
Source: https://developer.apple.com/support/dma-and-apps-in-the-eu/#...
In context 99% of the users I meet don't even know what USB-C is.
The more important context is the legal one, not what laypeople think.
Apple is presenting PWAs as viable alternatives to the app store in a legal context: https://www.accc.gov.au/system/files/Apple%20Pty%20Limited%2...
It's off balance, and it shows now that the tech has to be removed since it wasn't actually at parity despite it being an argument for it unfortunately.
The worst part? This has been the case for 15 years. It's not like there wasn't enough time to fix it. That's plenty of time to hire and develop solutions, yet now look at the reasons for it being taken away.
OH (frequently):
- hey I need to to up, do you have a phone charger?
- yup, which kind?
- not "an Apple"
- oh, so USB?
- yeah the "standard" one, not the "new usb"
That said, I'm surprised many do know about the literal "usb-c" term. Micro USB A though flies over their head, it's "small usb" or "standard usb" every time.
Of note: EU here, and while they by and large don't know about the EU standardising stuff they did notice the effect. I've seen a few refer to USB-C as "universal one" (largely coz it works the same for both phones and laptops)
For one thing, if Apple is complying with the EU’s alternative App Store and browser engine mandate, they’re even less useful than before. Why do I as a user want a PWA when I could have a native app?
Apple’s decision is going to kill businesses and break apps used by hundreds of thousands of people in Europe, many of whom are healthcare workers delivering patient care.
I don’t know if this ironic given that apple originally didn’t want to support native apps and gave in due to developer demand.
Apple both did and didn’t want web apps
This is a trite argument that hasn’t been true ever since Jen Simmons joined Apple in 2020 and changed the course of Safari significantly to the point that PWAs not only are viable, they have been given feature parity with native apps on many fronts.
Simultaneously, the argument completely bypasses the fact that install rates of PWAs are abysmal on any platform. Whether it be iOS, Android or Windows.
Contrary to what PWA developers, industry organizations and other stakeholders proselytize, PWAs aren’t the second coming and the next best thing since sliced bread. At least not when it comes to install rates.
Edit:
Don’t get me wrong, I’m sure they’re great as “websites”.
Lord knows people who sell PWAs[0] love to brag about bounce rates and conversion rates and what not. But there’s a reason why you can find barely anything about install rates other than some vague statistics about individual unnamed PWAs[1] or PWA sellers[2] talking about obviously bogus 10x and 3-5x install rates, and it’s not because the PWA crowd is too shy to brag.
1: https://developer.chrome.com/blog/pwa-install-features
2: https://mobsted.com/pwa_vs_native_mobile_apps_install_rates_...
It's functionality to add an arbitrary webpage. What exactly are you expecting them to "provide"?
30 some million lines of code in chromium browsers.
Thats bigger than the linux kernel.
The HN crowed might not LIKE apples response but they have a very defensible position.
Edit: Its not like we haven't seen this play out on the desktop recently: https://www.theverge.com/24054329/microsoft-edge-automatic-c...
What you link is a case of one app (edge) reading the data of another app (chrome), which is entirely unrelated to PWAs.
You and Apple both are ignoring the fact that these permission APIs exist even if the website isn’t being displayed in standalone/full screen mode. The modern web is built on them, and third-party browser engines WILL provide access to these APIs in Europe.
This is just Apple wanting to avoid people being able to develop a platform on top of their platform without paying a tax.
And if PWAs from chrome are the problem, then it would also be possible to not allow chrome PWA's but still allow webkit PWA's.
If the browser engine can't be trusted to segregate camera access through a PWA then why is it trusted to segregate it in-app?
But a legislator forced their hand so now they gotta cry about it.
If I was not I can choose to leave.
I know this is a divisive comment. Please see my further extrapolation in a child comment.
>Browsers also could install web apps on the system without a user’s awareness and consent.
Couldn't this be entirely solved with an OS permission-like prompt "are you sure you want [progressive web app name] added to home screen?"
Apple does not.
This is essentially saying no-one can build a secure browser.
Does this "minimal impact to their functionality" mean, the app will loose its local data after 7 days of not using the app, like it is for normal websites? That is a pretty heavy impact.
1. The DMA is striking at the heart of their revenue model by targeting the app store. Tim Cook testified before Congress and said that Apple would be "giving up our total return" on their intellectual property if they did not monetize the app store aggressively. So my read is that this move is intended to prevent a shift to PWAs as a way to get around the new policies.
2. Legislation like the DMA, if successful, could spread to other countries, much in the same way the link tax spread from Australia to Canada. I think Apple has an explicit goal to make this legislation as painful as possible, for both the legislators and the citizens, so that other countries do not attempt to pass similar laws.
There was a time between 2007 and 2011 where I bought Apple computers and was a big fan. These days, despite the very cool new processors Apple has released, it's very hard for me to see them as anything other than antagonistic. What a fall from grace.
Couldn’t they allow you open PWAs in Safari, or fall back to opening a URL in another browser?
Is there some part of the DMA which demands full feature parity?
Very likely the EU wouldn't like them prioritizing their own browser for a feature
In a previous comment [1], I considered abandoning Apple. With this official statement, I'll actually switch to Android. I'll welcome the F-Droid store very much.
Apple, I've been your customer since 2006. I started with the iPod. During this time I had a significant fraction of your lineup. I'm not affected by your changes but I'm using some PWAs. With this erratic behavior, I'm afraid you kill features that I'm using.
I'm a little confused. So that long list of requirements is useless for PWAs?
Some people will actually believe this. I'm utterly disgusted by Apple and their arrogance regarding the DMA, and the way they've managed all of this. My perception of them has completely changed. However, they seem very obedient when China asks them to censor apps or, for example, limit AirDrop when there's a protest going on.
1. WebKit has access to special OS-level APIs that allow it to install and power web apps. 2. The DMA requires support for alternative browser engines with the same abilities as WebKit. 3. It is reasonable to assume this requirement extends to PWAs. 4. By taking away WebKit's ability to power PWAs, all browser engines are now on a level playing field.
_Could_ they have done it differently? Maybe, maybe not: software development always takes longer than you think, and throwing more engineers at a problem doesn't always make it go faster. Do I think they saw another chance to be petulant and took it? Yes.
So yeah, I'm disappointed, but no more here than with the rest of Apple's DMA response.
Translation from Apple talk to real talk: allowing competing browser engines will undermine our grip on the market through lock-in to the engine we fully control. We don't want to lose power. As control freaks, we'll do all we can to sabotage it.
Does the rule not allow that? If so... yeah, as a user deep in their ecosystem and once-developer for the platform, hard agree on this. Whatever their other motivations (and Apple are masters at arranging things so that their interests happen to coincide with legitimate concerns about UX) the user-facing issues expressed are worth worrying about.
Apple cannot simply invoke DMA (50) as a free pass. For its arguments to align with the intent of the legislation, here's a roadmap of what they need to do to justify their security-based restrictions on iOS:
Apple must be transparent about the exact security issues posed by alternative browser engines with concrete instances (not merely speculative risks). They need to prove that these are unique to iOS, given the successful use of unrestricted browser engines on macOS (and every other OS).
Before opting for the extreme step of removing functionality, Apple needs to offer documentation of all the methods for managing and mitigating specific threats that were considered and subsequently ruled out as infeasible (sandboxing, enhanced APIs, etc.). This emphasizes that their actions are indeed the last resort and not merely a way to suppress competition.
The company needs to demonstrate how they would proactively work with browser engine developers to establish strong security controls and threat monitoring on par with or exceeding their current practices for native-only experiences. This shifts the focus to building a safe environment rather than merely limiting the scope of capabilities.
Apple must guarantee that if and when these security challenges are met, it will progressively expand support for unrestricted use of web standards for third-party browser engines. This creates the long-term perspective the DMA is designed to protect and gives confidence to developers investing in advanced web app solutions.
Without taking action in these key areas, Apple's reliance on this DMA portion won't hold up to regulatory scrutiny. They cannot cite generic security dangers then fall back on "practicality" arguments without robust, evidence-backed reasoning.
They're likely not lying when they say that it's more difficult to maintain their security standards while at the same time allowing any browser engine to run PWAs. But this is a problem they absolutely could solve, and a company with Apple's size and skill absolutely has the resources to make this work. But they've chosen not to.
Another option would be to actually engage with EU regulators on the issue, and see if they could carve out an exception -- temporary or otherwise -- to allow them to require PWAs to run under their existing WebKit-based framework, regardless of the default browser. But they've again chosen not to do that.
PWA adoption is likely as low as Apple claims. I think they're toeing a line here: because Home Screen Apps are a bit of a niche feature, they can break it without pissing off too many users, but also give a subtle middle finger to the EU. "Poor Apple users, Apple just has to disable a feature some people like because of the evil, overreaching EU and its burdensome DMA!"
This is a shame in that I personally think we all should be relying less on mostly-closed-source, proprietary apps for everything. While the web platform is a bit of a mess, it actually does (or could) offer the same functionality that native apps do, especially if Apple and Google had worked on that sort of thing over the past 15+ years rather than pushing native apps so hard. We'd be in a much better place if that were the case: consider the savings in time and money if every company out there could just write a single PWA and not have to build two completely separate apps for iOS and Android. (Yes, I know there'd be some extra people dedicated to fixing issues caused minor but significant-enough differences between the platforms, but it'd still be a ton less work than two apps for two different platforms.)
Also consider how much easier it would be for other smartphone platforms to break into the space, if all existing apps (as PWAs in my imaginary smartphone-utopia) would run on their platforms without much work. A big reason I will likely never adopt an alternative smartphone platform is because none of the apps I rely on day-to-day exist on them. Even though I'd absolutely love to ditch Android, but don't consider iOS any more palatable.
Anyway, that ship sailed a long time ago. I'm still bitter about it, though.
Ultimately this won't matter much. The number of people using PWAs on iOS is probably a rounding error. Restrict that to only people in the EU and it's even smaller. But Apple still gets in a jab at the EU over this, and most affected users will likely side with Apple on this one.
I beg people making these claims to look outside their web bubble for at least a nanosecond.
> especially if Apple and Google had worked on that sort of thing over the past 15+ years rather than pushing native apps so hard.
Google couldn't care less about "as good as native". If they did, this project wouldn't have been started by devs from Microsoft (of all companies) in 2020: https://open-ui.org
> consider the savings in time and money if every company out there could just write a single PWA and not have to build two completely separate apps for iOS and Android.
Yes, you should be building native apps for each platform unless your "app" is a barely functioning text-only page.
How is this even possible? It's shocking that these APIs even exist for any browser to use.
Apple could add a bunch of new APIs to support this case for third-party browsers. Presumably there's something equivalent that's being done for said web apps currently in Safari. But they're not wrong to say that there's not an existing system in place that said third-party browsers are already written to use. (And, you know, they're clearly not invested in trying to make this law succeed.)
https://www.theverge.com/24054329/microsoft-edge-automatic-c...
Ask MS, they already did it.
They simply could ask browser vendor to follow strict rules, that they can check themselves. This is not like they would have to verify dozens of browsers every day. Only a few per months, top.
The "community note" of HN.
As the governments demand more and more, I predict we will see several monkey paw moments.
They say themselves it would be possible to be compliant with the DMA without removing what is obviously competition they don't like. But they try to take the road which - just by chance, obviously, the security is the real reason - helps them to keep more people away from competition. I don't buy it.
Sounds like Apple is saying webkit is insecure and to not use safari or iOS webviews because if they can't be trusted to run a PWA then they can't be trusted for anything ;3
Everyone's got their "security" to give you. But it ain't your security, and it ain't compatible with noone else's.
Nice app store you got here. Shame if anything might 'appen to it!
history often rhymes and really rhymes on this one.
I am not in the EU but my next iPhone is almost certainly not gonna be an iPhone despite me having used a non iPhone for about 6 months in the last 15 years.
Their throwing their customers under the bus just to throw a tantrum in the EU does not bode well for how they would treat their customers in other situations.
From their perspective it’s not so much throwing a tantrum but clawing and screaming their way into giving up as little revenue as possible.
I also invoke Android again... PWAs exist, Google still holds the lions share. Google has freaked out about it too and is being sanctioned as we speak for it, but most customers simply aren't going to look for an alt app store outside of niche uses.
Did you just subconsciously equate phones to iPhones in your rebuke of Apple?
Next phone, right?
To be honest an iPhone and a phone have been synonymous for me for 15 years. The 6 months was a period of madness (or genius, considering I actually loved it) when I was using a Windows Phone, until basically all the 3rd party apps I used dropped support.
Android is fine but it's not as smooth as iOS. Still, I hate what Apple has become.
This is Apple saying “if it’s important to you dozen folks out there who use PWAs or care about installing a non-web view browser on your phone, that you can continue doing that, we’re not the company for you.”
They won’t blink because who gives a shit?
What I don't like is the little digital fiefdom they created. When we buy stuff, we're supposed to own them. The problem is they just refuse to give us the keys to the machines. So we absolutely should make it a matter of law.
Are you arguing that Apple is lying about how much work it was to execute that?
Some of y'all need to be reminded to be realistic.
While not European in origin, the platform holds and manages tremendous value for us, to the extent where small changes can cause mayor economic disruption, and Apple has not been managing it fairly.
And for a state actor, which exists to serve the common good, it is not acceptable that a single company holds and abuses this kind of power.
I interpret 6 (a) as basically requiring you to be able to install whatever software you like and to provide no mechanism whereby any fee can be demanded for such installation to be possible.
Apple tries to get around this by this core technology stuff, but APIs aren't even subject to copyright protection, and it's also basic interoperability stuff. I don't think the courts will see it the way I interpret your comment.
If they wanted, they could remove the App Store from iOS in EU, or pull the iPhone from the EU market entirely. Apple isn’t required by the DMA to part of a digital market at all.
Huh?
If the EU imposes additional requirements on aquarium lights, and a lighting manufacture decides not to product aquarium lights.....that's violating the spirit of the law?
Web developers like them. That’s it, and their PWA advocacy completely disregards what a privacy and security nightmare they can be without proper safeguards, because this little device I carry around in my pocket is 1) always with me and 2) stores a lot of information about me 3) has a full sensory array installed within it.
Every new feature browsers add for better hardware access gets immediately disabled on any system I manage: cameras, mics, USB access, sensors, location, notifications, local storage, the whole works because the alternative is letting every website access those or getting spammed with access requests on every site I visit and the more crap that is added, the longer it takes me every time I setup a new browser install from scratch. Why disable them at all? Because 99% of these new features are primarily used to build a better supercookie to track and profile people without their consent. The actual marketable reasons are a secondary use at best.
So if it’s not on Apple’s priority list to build out whatever they need to support and allow other browsers to support PWAs in a secure and privacy conscious manner, good for them. Web developers who want to circumvent Apple’s fees entirely don’t need to be anywhere near their top priority and can wait. For Apple: users come before developers, and App developers before web developers.
The only reason PWAs were interesting on iOS was to get an app on iOS, while feeling relatively native, without paying Apple.
It’s not about what PWAs are like in Safari, it’s about what they’re like in third-party browsers that have to by law be allowed to do whatever Safari can do with their own fully enabled rendering engines.
Even if Apple thinks it’s worth doing, that takes time, and web developers aren’t worth prioritizing for them when they have a lot of other ground to cover building out a new system of APIs and entitlements to comply with the DMA’s other requirements.
To think there's a hardware thing in 2024 that does not allow its owner to compile and install arbitrary software while still calling itself a smartphone is just laughable.
It's a good thing people are starting to wake up to this even on legislative level.
The problem I have with that is that they are selling a ContentFilter as an integrated part of their OS, when it can be a separate, optional part, and even offered by a third party.
Also, they equate AppStore == ContentFilter, which are clearly two separate concepts.
"I have an iPhone, and if I move from here and go over there and sit with my Democrat friends, which would make them real nervous, does Google track my movement?" -- Ted Poe
https://www.cnet.com/tech/mobile/google-ceo-pichai-grilled-o...
Frankly, the region needs us far more than we need it.
Hint: neither is/was American. Just to throw some examples.
If that were what companies genuinely felt they'd already have left, but pecunia non olet, even if you have to pay taxes on it
Moreover essentially the only relevant systemic differences between the US and Europe in the tech sector are:
- pre-existing capital
- a better financial system and regulations (of the financial system) in the US (or rather, a combination of quality and size)
- better bankruptcy laws
Even if one of the big companies left the market that'd just leave space for a (at first) slightly worse product/products to fill the niche. Not exactly "shambles"
These sweeping generalizations are pointless, especially because international finance means a lot of things happen at American companies offices in European countries. Does the fact that you’re using Brotli to view this webpage count for Google or Switzerland? A bumper sticker-level political philosophy probably won’t help there.
That's rich, you ought to look in the mirror. Apple and most of big tech started the "rent seeking and legislation" war by screwing over their users and developers, milking them both for every dime and their approach to so-called "innovation" is surprise - legislation. They've decided to simply ban competition from their platforms, neat!
Frankly the US needs it far more than the EU needs it's tech sector.
2) Most of the "bureaucracy" that hits small to medium sized companies is the GDPR, which any business with the slightest of integrity should have no problem to follow
1. PWA is a native wrapper for a web application, not a browser. It is supposed to be limited to the app website. DMA does not tell Apple that every app with embedded WebView should offer users possibility to switch the engine. Why PWA should be treated differently here? I‘d rather clarify this with regulators first, before harming end users.
2. There’s no browser engines currently supporting PWA on Apple mobile devices. Apple has enough resources and time to figure out how to sandbox PWAs on other engines together with the first browser vendor that decides to offer such support and commit engineering resources to this project. In the meantime current solution could stay simply because it does not hinder any competition.
I’m not a legal expert, so maybe I miss something here. But Apple statement does not look convincing to me.
I don’t see how that’s related to the issue being discussed.
> In the meantime current solution could stay simply because it does not hinder any competition.
Why do you think “you can install a third party browser, but if you do, you can’t add PWAs to the Home Screen” doesn’t hinder competition?
PWA is not a browser, it is a native app using a browser engine to render a specific website.
>Why do you think “you can install a third party browser, but if you do, you can’t add PWAs to the Home Screen” doesn’t hinder competition?
I literally explained it in my comment you are replying to, but I can repeat. Competition does not exist yet. Browsers do not offer PWA support out of the box, it is a feature to be implemented separately from rendering engine. See Firefox on Windows for an example — it doesn’t support PWA out of the box. This feature has to be built: if Apple were to hinder the competition, they would resist it by not offering the APIs. But they can offer them through the cooperation with vendors, even if those APIs do not exist yet. Say, Mozilla comes and asks for APIs: Apple starts negotiating and proposes the compatibility requirements and a reasonable timeline. They both work on their part and eventually Firefox is released with PWA support. Who would fine or sue them if it worked this way? How the violation of DMA could be proven?
Because you can't add PWAs to the Home Screen if you use the first-party browser, either. The whole point of this article is they're turning off PWAs for Safari so that they're all on the same feature footing.
Is there any reason that you couldn't just install a third-party browser and add PWAs to the home screen that use WebKit as a rendering engine?
Why would these two different things affect each other?
As I understand it, this is specifically not allowed by the DMA, since it would be considered an unfair advantage to Safari, if that browser/engine was the only one allowed to run PWAs.
https://eur-lex.europa.eu/legal-content/EN/TXT/?toc=OJ%3AL%3...
If Apple demonstrates that the entry barrier is sufficiently low by cooperating with other vendors, how one could possibly build a legal case under DMA against them? On the contrary, by disabling PWA in Safari Apple acts as a gate keeper complicating access to the platform for business users. THIS is what DMA forbids.
Also it has to be taken into account that the less PWA engines exist the lower is actually the entry barrier. We only need 2-3 competing solutions max to support innovation without harming PWA developers.
It's a rational choice. Apple isn’t a charity, so why would they spend resources on extra work that they didn’t want to do in the first place, given that work is not required for legal compliance. The security spin is clearly nonsense, but other than that I can't really fault Apple for their position on this, even if I wish it were different.
Translation: Apple hates developers who believe in open tech, despite being built on mountains of foundational open tech, like every other company.
> It's a rational choice. Apple isn’t a charity, so why would they spend resources on extra work that they didn’t want to do in the first place, given that work is not required for legal compliance.
I mean, the obvious answer would be that it actually is required. And the outcome of that would be that Apple gets a bunch of bad press, pays a ton in fines, and ends up with a consent decree that restricts them more than just acting in good faith would have.
It feels like a really stupid gamble. There's so little to gain from it, in comparison to the cost if the gamble fails. Apple owns their users, lock, stock and barrel. Basically none of them is going to switch to a competing app store or browser even once those exist. And when the users don't move, neither will the developers.
Since smartphones are new railroads, they should be treated as a platform on that the actual innovation happens. They should be robust (so that users can rely on them), neutral (concentrate on their own layer in the stack), adhere to standards (for cross border cooperation) and provide as little friction to competition on top of them as possible.
(If you disagree, can you name one of the APIs you think the EC has told Apple to implement? Or name the APIs Apple was forced to implement to allow, because allowing competing browser engines would not have been at all possible without them?)
But that'd actually allow competition, and Apple seems to be very insecure about their ability to compete on a level playing field. I don't really understand why. Those 600 new APIs? They're 600 new restrictions.
I wouldn't say that Apple is well within their rights to break the law, and it's surprising to me that anyone would say so. But if they don't want to follow the laws, they are well within their rights to leave the market. (Now, there's of course no chance that Apple leaves the EU. After all, they still continue to operate in China and cooperating with the Chinese authorities, because they make a lot of money there.)
Yes, I agree here. To me, this feels like the cookie legislation all over again, in the sense that the end result was a lot of annoying cookie banners instead of websites stopping the usage of cookies. And yes, I know that answering 'no' in these banners reduces the amount of cookies used, but I am seeing more and more websites where things like videos don't work unless you accept cookies.
As a possible workaround to fullscreen PWAs in iOS in the EU, I propose a convention to append some hash to the Web App Manifest start_url, e.g. #__pwa__, then set the default iOS web browser to e.g. Firefox, then add the PWA to the home screen from it with this special hash. When a user clicks on a PWA icon in the home screen, it would open in the default browser (e.g. Firefox), the browser then checks if the newly opened tab is opened from external source and its URL ends with #__pwa__ and if so, then hides the UI providing a fullscreen viewport for the opened PWA.
Someone moving of iOS should just pick up a Nokia device with a stock standard Android OS. It will serve them fine without all the hassle of flashing.
If they want a higher end device with stock Android, go for a Pixel.
Plus Nokia is no more: https://www.gizchina.com/2024/02/01/mobile-phone-brand-trans...
Specifically, I like its battery life, its camera, and that it has a headphone jack.
If you care about a sanely sized phone and not a phablet, then double absolutely none — as in there’s no option in Apple’s stable either. Been using my 14 for some 9 months after 12 mini and every time I look at this monstrosity I regret moving to iPhones because I kinda knew they’d stoop down to be like Androids eventually.
Anyway, so no option really. Again, I have looked.
Did you mean to replace 13 mini without any such criteria I have mentioned above? Well, then go to any phone listing site or Amazon and filter Android devices based on cost and features and just buy the one that fits the bill. Because you didn’t say anything else.
https://lemmy.world/post/12001569
(I develop https://github.com/aeharding/voyager)
Certainly feels great to have your livelyhood kicked to the curb by some rich american megacorporation throwing a tantrum.
The worst part is that probably 40 percent of the development time has been trying to wrangle my way around weird rendering quirks in safari, never again. My next site will have a banner suggesting safari users open the site in firefox..
Previously, Safari handled these requirements because it's a modern browser (isolated storage has been a cornerstone of browser security for a long time), and had special privileges in iOS to configure per-site user permissions, whereas normal apps only had app-wide permissions.
Luckily, Chrome already has isolated per-site storage because it's also a modern browser. If it didn't, the world would probably explode.
That leaves per-site permissions as the only real problem. I'm sure the Chrome-on-iOS team would do whatever it takes to make this a good user experience, but let's assume for the sake of argument that this would actually be a burden for Apple to support.
How does disabling PWA functionality change the security situation whatsoever? Users preferring Chrome would just load the sites in Chrome as a bookmark, which has no meaningful difference from a "security" perspective. Users strictly using Safari obviously have a strictly-worse experience. Who does this help? What is made more secure by disabling this?
Hypothetically, without apple doing this, opening a PWA1 app can caused its data to be siphoned off by PWA2, up to isolation of the browser.
Whether or not that is a legitimate enough concern is up to each individual.
If it all boils down to "Apple users expect Apple to have control over everything, and if that expectation is violated, it will be really bad", then I'm sure EU regulators will handle it. Is there anything I'm missing from a security perspective?
If a browser can add PWA, they can claim they’re installing an app, and it would not be clear to a user that they have a web app, not an isolated app.
Now, none of these pseudo apps are guaranteed to be sandboxed from each other but the user cannot differentiate between apps that do provide security.
The only exception is an iPad Pro (M1) because there aren't good competitions in the market. Over the time I'm starting to think about replacing it with an Android tablet but I'm still yet to find one with a decent pen and memory.
Alas, to quote Benjamin Franklin, "Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety". You gave up your liberty to be colonialized by Apple, and now you get neither Liberty nor Safety in the future eventually.
I don't have one, so take with grain of salt, but I've seen reviews of the Galaxy Tab s9 Ultra are pretty good [0]. Super expensive though. Also as a bonus, android is possibly getting a VM [1], so in the future you might be able to install full fat linux on high quality tablets.
[0] https://www.youtube.com/watch?v=sl0UUhmaiDU
[1] https://source.android.com/docs/core/virtualization/architec...
Huh? Buy the Galaxy Tab S6 Lite with 4GB RAM for $250. Plus a pen for another $20.
I don’t believe they are trying to abide by the spirit of the EU law and are trying their best to behave extremely poorly towards it in how they are complying, choosing the most user hostile interpretations possible. I hope the EU issue the maximum fine.
I hate this outcome as much as the next guy and I'm sure Apple could have continued to support PWAs if they wanted to. And they should have done it.
That being said, I'm tired of the argument that OSS maintainers are being owed anything (beyond gratitude). They publish their software under licences they themselves choose. As long as someone follows the license, they are good.
If you don't want your work to be used for commercial activities in exchange for nothing, then don't publish it under a license permitting that.
I’m a Linux geek with macOS and Windows in the house and I’ve never used a PWA.
I just can’t get excited over this one.. technical, political.. Apple is doing what I’d expect from a company being told how to build and change their product.
And since I don’t want to live in a Dell world running Windows paired to an Android phone of any kind, I personally am inclined to give them a pass on their obstinance. There’s very little in the tech world that runs as cleanly as iOS on an iPhone.
(And yes I’d love to run Linux on my mobile desktop but it’s all really terrible and not even close to a whisper of a starter. And I’ve tried them all.)
Not an Apple apologizer, just ranking them against the performance and quality of the alternatives.
I'm pretty techy and I'm pretty baffled myself. I don't think I've ever even seen anyone else use a PWA, let alone used them myself.
And honestly, I'm not sure how I feel about them. Replacing native apps with web-only cloud services sounds like a bad case of 'out of the frying pan and into the fire'.
I've come to hate what Apple has done to computing, but I'm sceptical that PWAs are the solution here, so I'm struggling to get too fired up about this.
For example, the argument that one web app could steal the permissions of another web app is predicated on the assumption that a non-Apple browser engine will fail to sandbox the apps. But *the exact same* threat vector will exist for non-Home Screen web apps accessed through third party browsers. That’s because ordinary websites ALSO have the ability to request access to microphones and cameras, and it will be up to the developers of the browser engines to ensure that these permissions are properly sandboxed. Apple won’t be able to eliminate this risk without breaking vast numbers of sites that people use every day.
In truth, a PWA is no different from a website. It’s built using the same technologies and APIs. The main difference is that it can run in full-screen mode like an app, and it has its local storage cleared less often. These are nice extras that benefit users who choose to “install” such apps, and they carry no special security risks.
Private right of action? March 8th?
This step makes it much less possible for me to do this kind of “home cooked” development, and it makes me sad.
I think Apple would do well to offer a solution for folks like me, maybe a significant discount (or free?) developer accounts for folks with apps with fewer than 50 users or no App Store access, etc.
But I guess they don’t really care, which is sad.
Hit the nail on the head there.
Currently they care about protecting their iOS monopoly. I'm not sure there is much they care about more.
PWA, alternative browsers, alternative app stores are all just little pawns in the iOS/Android duopoly game
I too was very excited that PWAs are finally here and work everywhere. I thought being open web technology they wouldn't go away easily - guess what Apple always finds a way.
They really just are the new Microsoft from the old days
EU is only sixths of world GDP and shrinking.
Perhaps your best bet would be to loudly proclaim Apple's user-hostile behaviour as the reason you're switching to another brand of phone, so non-tech people also learn about Apple's hissy fit, but I doubt it'll do much to their bottom line.
I think what the EU has done to Apple is unfair. It is unfortunate in my opinion that they can’t just tell them to get stuffed. They have had to build probably 100-million LOCs just so EU have the right to pick their own browser, and yet Safari works just fine. In fact the great thing about Safari (and Apple knew this) is that compatibility was really good precisely because everyone on mobile was using the same browser. Now I’m just waiting to get those stupid “only supported in Chrome” pop ups on my mobile phone too..
Their core strategy has always been to keep cost low by supporting one hardware, one browser engine, one App Store. That’s how they kept things lean and integrated. The EU has forced them to take an approach that is fundamentally different to what made them successful. Some might say - who cares? It only affects the EU right? That’s to be seen.. we all might be affected globally from the security bugs caused by the unhardening of the OS required to conform to EU standards. And this huge code base is going to cost something to maintain and I doubt we won’t pay for that either.
What a weird take.
Safari is the minority browser that takes so much work because of its quirks. The largest mobile browser by far is Chrome (65% vs 25%) and while it might be different in your particular bubble (probably the US? it's the only market where Apple is dominant afaik) it's well known that Safari is the equivalent of Internet Explorer in the bad old days.
Have you seen the price of Apple devices?? They're anything but low. If Apple has to reduce a bit their margin because they lose their monopoly I won't be shedding tears for them.
No, it does not. It is the old Internet Explorer of our day. It is by far the worst of all the browsers. This is like saying "this car from Apple with square wheels work just fine" and not at all acknowledge that every single road in the world had to be made bumpy to allow for this and made them worse for everyone else. Try developing for it.
I laughed. Clearly you've never tried building a halfway complex web app.
> Their core strategy has always been to keep cost low...
You realize this is Apple we're talking about right, the company with the most outrageous pricing strategies?
No-one is asking them to support more than one browser engine or App Store.
Just to stop blocking them
haha are you serious?
Obviously long-term what should happen is that Apple should build out those necessary APIs, then re-introduce PWA support to Safari and 3rd party browsers, but I personally feel like the EU trying to legislate an entirely new platform feature into existence like that would be a step too far.
Some of the other concerns with Apple's recent moves (like them trying to charge developers for installs that don't go through Apple's App Store, and that Apple therefore has nothing to do with) are a far bigger issue.
Apple has become the IBM in their famous 1984 ad. "A garden of pure ideology", indeed.
Apple cannot simply invoke DMA (50) as a free pass. For its arguments to align with the intent of the legislation, here's a roadmap of what they need to do to justify their security-based restrictions on iOS:
Apple must be transparent about the exact security issues posed by alternative browser engines with concrete instances (not merely speculative risks). They need to prove that these are unique to iOS, given the successful use of unrestricted browser engines on macOS (and every other OS).
Before opting for the extreme step of removing functionality, Apple needs to offer documentation of all the methods for managing and mitigating specific threats that were considered and subsequently ruled out as infeasible (sandboxing, enhanced APIs, etc.). This emphasizes that their actions are indeed the last resort and not merely a way to suppress competition.
The company needs to demonstrate how they would proactively work with browser engine developers to establish strong security controls and threat monitoring on par with or exceeding their current practices for native-only experiences. This shifts the focus to building a safe environment rather than merely limiting the scope of capabilities.
Apple must guarantee that if and when these security challenges are met, it will progressively expand support for unrestricted use of web standards for third-party browser engines. This creates the long-term perspective the DMA is designed to protect and gives confidence to developers investing in advanced web app solutions.
Without taking action in these key areas, Apple's reliance on this DMA portion won't hold up to regulatory scrutiny. They cannot cite generic security dangers then fall back on "practicality" arguments without robust, evidence-backed reasoning.
Like I won't be buying the Vision Pro because I'm not really sure I want to get further locked into their ecosystem if they're this hostile towards the will and rights of the people who buy their products.
Phone is ungoogled Android.
It should bring hope to the hearts of all device owners that are currently firmly under the bootheel of device manufacturers.
It's okay that Apple doesn't like a European law. As a US-based company, it makes sense that it feels like a foreigner is meddling in their affairs... It's okay that they continue to have the hubris that Apple, and Apple alone, knows what's best for everyone.
However... the democratically-elected institutions of the EU represent a total of 447 million people. Most technologists I know in the EU are pro-DMA.
It doesn't feel like Apple has ever engaged in any kind of external discussion around this, or any kind of acknowledgment that there may be an issue with their current policies.
It's like walking it the courtroom with bloody hands and screaming in an obviously fake British accent "MURDER?!? THAT IS RIDICULOUS, Your Honor. I AM WEARING A TUXEDO."
Apple's arguments at every single junction have been nothing short of ridiculous. My favorite one:
"Apple operates 5 distinct App Stores: the iOS App Store, the macOS App Store, the iPadOS App Store, etc..., and only the iOS one is big enough to be a "gatekeeper"." [0]
COME FUCKING ON. HIRE BETTER LAWYERS.
[0]: https://ec.europa.eu/competition/digital_markets_act/cases/2...
Apple (and by extension it's product line), is monopolistic. And they know it.
The EU is going to absolutely see this as Apple spitting in its face.
But it isn't.
As an owner of the device, you can install anything you want on it, from any source you'd like.
Flamewars be damned, the conversation needs to take place.
Apples pivot kill PWAs shows their true intention. Web apps are ready to disrupt their monopoly and industry wide 30% tax.
But if you want to move that website into a PWA that runs on iPhone that uses some other browser engine that requests permission to use the camera then, that browser engine can't be trusted?
I can imagine an architecture where every pwa does not run a whole Safari instance but just a tab. Then all those ‘app looking’ pwas run in the same actual app.
Or they just dont trust google to make no native apps anymore for the app store…
Just more evidence of their Anti-Competitive practices, giving preferential access to Safari to the system.
Where Apple are providing the 'platform' (i.e AppStore) and are competing against other users of that platform, those departments should be treated as any other user of the platform.
Safari/iMessage/etc.. should only be able to use the same API's that every other developer can access and should have the same level of access to the AppStore as every other developer.
It's not a position of strength; and I wonder whether this is a sign they're now very firmly on the back foot.
I love Apple's hardware, but iOS is such a turd, I'm stuck on Android even though the rest of my eco-system is Apple (MacBook, AirPods, AppleTV)
Sadly, it seems like if given the choice, most companies want you to install a Real App, probably for better snooping.
This was linked in a similar discussion today. Either they knowingly provide backdoors for state actors or they are being so incompetent that it is laughable. Zero interaction remote exploit of hardware features designed to circumvent their own security measures? Why ?
Seriously, find someone worthy of your trust, because that isn't Apple
https://www.kaspersky.com/about/press-releases/2023_kaspersk...
I expect 3rd-party engines in the EU may choose to allow this, for example by launching in Chromium in full screen w/ additional permissions, but I'm glad this attack surface is reduced at least for right now.
If you work at Apple and are reading this, it's time to start asking serious questions about why your company is happy to lie to the public and lawmakers to try and juice their revenue.
the name "install" is bad and the wording is NOT a web standard, NOTHING is installed
the question is web capabilities
one core capability is caching and offline via service workers
no need for "install" for this
"installing" a web app does not even need anything anymore, not even offline or service workers... it is ONLY switch to standalone and get a launch button or be integrated into app launchers on OS
behind "install" is a bad and immature web app manifest api, it is a draft... the wording install must go
it is one of MANY possible web capabilities for a web domain to be able run standalone and get a button
apple cannot ban this since a shortcut to chrome cannot be deemed unsafe, where then CHROME decides to run standalone or not
the real problem is NOT that safari kills standalone
they try to kill a lot of web capability, like service workers, and NOT JUST FOR SAFARI
I mean this will not stand, you CAN stay apple-level-safe (whether it is more or less than other platforms) by CHOOSING safari
it is an obvious CHOICE to be granted to trust google, mozilla or microsoft and their web security model to stay safe with THEM on the web
no argument why this should not be allowed if other native apps are allowed
and come on, even mac os is safe with service workers in chromium
FUD
See? Not hard to say, even when it is Apple and not Microsoft. The concept that browser allow one web site to read the storage of other sites is ludicrous. SuuuuuUUUuuure Apple can't /guarantee/ that the browser has no bug... which assumes Apple can somehow prove their own browser is bug-free. Plus, what prevents Apple from launching separate instances with separate data permissions for WPA? That's is 99% certainly what they did with their own WebKit-based solution.
FUD FUD FUD
Why is it not the case with apple? They undermine the entire concept of free market capitalism by forcing companies to do unprofitable things instead of letting consumers vote with their wallets by using alternative products of which there are many.
There is no anti-competitiveness or harm to consumers. No one is telling car makers to allow standardized engine parts. Ferrari can make every part of the car unique and incompatible with other car makers so long as it meets safety standards, so why is apple special?
My theory is the EU has benefited a lot from fining rich US tech companies, they get votes from european techies who don't get capitalism and extra revenue. And the US is docile because they need EU support against China.
This is complete nonsense. No-one is forcing Apple to make their screen compatible with a Samsung phone, or a part inside an AirPod fit inside a Bose headset.
The owner of a car can by law use third-party shops and retain warranty 100%. The third-party shops can buy parts for the car. They can access the data of the car with the tools that are needed, and they can install similar parts made by a third-party factory without voiding the warranty. Your example is as far away from Apple ecosystem as you could possibly get.
For an example, I have always used a third-party shop for my cars and when the engine needed to be replaced in one because of a known weakness showing up, I got the new engine as I should even though the car had never seen an authorized dealer since the day I bought it. Try doing that with an iPhone.
What you are describing is the opposite of what you claim. You are describing anti-competitiveness and monopoly abuse.
You absolutley can replace parts in apple products. You can even use unauthorized third party parts (and if you can't that should change). What you cannot do both with apple and car makers is force them to make parts that are compatible with some standard. A car maker can do whatever they want with the car design so long as it functions safely.
> one is forcing Apple to make their screen compatible with a Samsung phone, or a part inside an AirPod fit inside a Bose headset.
They are forcing apple to make their charging and interface ports USB so that it is compatible with what samsung uses. They are forcing apple to have 3rd party app stores so it is like Samsung.
> You are describing anti-competitiveness and monopoly abuse.
No, you are. State sponsored anti-competitiveness is no better. IPhone users like how iphone works, those who don't can switch to android phones with third party app stores and usb ports. Keep in mind also how android phones in europe are much more popular than iphone.
The EU is coming up with anti-american company rules.
> They undermine the entire concept of free market capitalism by forcing companies to do unprofitable things instead of letting consumers vote with their wallets by using alternative products of which there are many
If this truly forces unprofitable behavior, we should expect Apple to pull out out Europe. But I would bet my life that doesn't happen.
Users already have freedom and apple has a minority market share in europe already.
> If this truly forces unprofitable behavior, we should expect Apple to pull out out Europe. But I would bet my life that doesn't happen.
Less profit does not mean no profit. You essentially expect companies who can't compete because of rules made to prevent them from competing to pull out? Instead of users not buying their product forcing them out? I hope america never catches that nanny state disease. The one good european phone maker nokia lost because users stopped liking it. Now all Europe does is try to profit by unfair laws. Don't europeans who like apple products deserve to use them as apple designed? It is absolutley deranged to think that forcing design choices on a company gives users choices. As if their wallet isn't good enough to vote with or there aren't alternatives.
This is a terrible outcome, again caused by "well meant" but unpractical EU regulation.
It’s obvious Apple is having a temper tantrum about being regulated, but it’s not wise for a company to behave like this.
[citation needed].
PWAs give Apple an out from having certain apps (for example, FetLife) on the App Store without making the phone a non-starter for people who want to use them. As much as Apple likes its walled garden, it likes the walls just fuzzy enough to not piss people off into migrating.
Apple just want to make the regulation itself annoying.
I don't have an answer for you. But I want to recommend this talk from 7 years ago: https://www.youtube.com/watch?v=BLGFriOKz6U
That alone convinced me. Apple knows what it is doing when it comes to device security. Today, I trust them with my most sensitive data and sleep peacefully at night.
That's what operating systems are for.
Just give native apps what made the web popular in the first place:
• Ability to instantly launch any app just by typing its "name"
• No need to download or install anything
• Ability to revisit any part of an app just by copy/pasting some text and sharing it with anyone.
That's what ultimately matters to end users.