6 ms·

Why Safari can’t just launch from a Home Screen bookmark even if the user has chosen another “default browser”? PWAs are already a separate “island” of storage

Why Safari can’t just launch from a Home Screen bookmark even if the user has chosen another “default browser”? PWAs are already a separate “island” of storage and share nothing with Safari App… Microsoft does it all the time with Edge on Windows.

endemic 3y ago
This is actually what I want tbh
thimp 3y ago
Perhaps this is just "all we could deliver by the compliance deadline without compromising platform security"? The truth is usually a lot less interesting than the hypothesis.
- actionfromafar 3y ago
  Maybe ... but a large company implementing compliance in the most self-serving way possible isn't exactly a shocking idea, either.
  - thimp 3y ago
    Well exactly. The point is that both sides of the argument are somewhat more nuanced as they are disingenuously promoted.
- Fischgericht 3y ago
  How would suddenly disallowing users to run a PWA that worked for years improve platform security? How would having Spotify be able to use their own subscription system compromise platform security? Being able to install software without needing an OK from the hardware manufacturer has been standard for over 40 years now. People do it on Windows PCs, on Linux PCs, on MacBooks and on Android phones, and that very clearly has not caused the extinction of the dinosaurs yet :) The document Apple has published to me reads like it's written by a 5 year old that just was served too many sweets shortly before bed time. IMHO this is about revenge, not about platform security.
  - thimp 3y ago
    It's pretty obvious. They're not disallowing it. They are removing the integration with the home screen so that it will run in third party browsers. That limits it to the smallest common API surface which is "open link". Everything else was a luxury. I don't think you work in IT if you haven't had an infested windows, android or macOS box before. Hell I just spent the other day cleaning my father's Mac out of two VPN turds fighting with each other he installed after watching crap on YouTube. My daughter's windows machine got destroyed by unsigned crap from a Sims mod. You just don't get that on iOS apart from the odd calendar subscription turd. As for spotify, they use their own subscription system, not the app store.
    - Fischgericht 3y ago
      Not my intention to brag about it, but I run an R&D company and have invented and patents on quite a lot of network technologies :) The only time in my life where I had an infected devices was in the year 1993 - a boot sector virus on a floppy disk I got from someone. Luckily my wife is a nerd, too, by sister is trained and has not yet fallen for any of the social engineering tricks before. So no, I do not have to deal with other people's infected boxes either.
      - thimp 3y ago
        I envy you :)
        Fischgericht 3y ago
        Well, on the other hand it implies that most of my family is dead and buried already, and therefore would have a hard time annoying me with their IT problems. If that's a good deal is a matter of perspective ;)
        thimp 3y ago
        A very good point.
- makeitdouble 3y ago
  Is it the strategy of handing in homework half finished while crying about how the world's been unfair to you lately ?
zer00eyz 3y ago
>> Microsoft does it all the time with Edge on Windows. Edge on windows, the same edge on windows that got caught slurping up chrome tabs recently? Browsers are now the same size code base wise, as operating systems. They are in fact tiny OS's with permissions models and execution environments. I think the author makes the point that safari made a lot of progress, they paid for a lot of work, that they are throwing away. Spite is a reason, but security is also a reason... We have seen how bad things can be when browsers cohabitate on desktops, putting up hard walls now solves the problem before it starts. Phone users aren't loosing (much) of anything, taking away something that they didn't have and didn't exist MIGHT be for security reasons... See MS stealing chrome tabs.
- NekkoDroid 3y ago
  Aren't apps already sandboxed from eachother on both major Phone OS', unlike on Windows? So on that end something like Edges snooping around other browsers isn't even possible.
  - zer00eyz 3y ago
    In theory, sure. The browser is bigger than the OS in total LOC. No one is auditing that. It is a question of when the video leaks of someone using their phone on the shitter. If its a Samsung... well were gonna hear google and Samsung blame each other and consumers will be confused till everyone forgets about it. If it's an apple, consumers blame apple. The buck stops with them. You have to make a business decision based on this what are you gonna do? Im gonna lock all the doors I can.
    - NekkoDroid 3y ago
      If the video leaks due to shitty (pun not intended) sandboxing that is rightlfully on Apple (when on iOS), if it leaks due to the browser being broken then it is on Google and if it's due to an explicit modification of Samsung (when talking about Android) it's on Samsung. When Facebook has a bug/exploit in their app that results in X hacker being able to gain access to files stored within the sandbox of Facebook noone is blaming Apple for Facebooks bug.
Aaargh20318 3y ago
> Why Safari can’t just launch from a Home Screen bookmark even if the user has chosen another “default browser”? IIRC this is exactly what it does after the change. It now just launches the bookmark in a normal browser instead of a browser with the UI hidden.
- everydaypanos 3y ago
  By Safari, I meant the engine, not the app. Are there any people who actually prefer no PWAs at all over Safari-engine PWAs?
  - stetrain 3y ago
    I think it's less a preference question and more whether Apple thinks saving PWAs with a third party browser and then launching them with Safari is compliant with the DMA.
  - Aaargh20318 3y ago
    Safari is the browser, Webkit is the engine. Personally I don’t care about PWAs at alls. If you want an app, build an actual app.
    - piva00 3y ago
      > Personally I don’t care about PWAs at alls. If you want an app, build an actual app. Are you going to foot the bill for the development cost of building an actual app for a team that doesn't have iOS software dev expertise? Thought so...
      - Aaargh20318 3y ago
        Then don’t offer an app. PWAs are worse than not having an app.
        Anonbrit 3y ago
        Until Apple nerfed them, they weren't for simple cases.
beardyw 3y ago
No. A PWA has exactly the same storage access, code etc as a normal web page. A PWA is set apart by having a manifest, which defines how it should act as an app. It has certain extra capabilities like accepting shares and so on, but it is not radically different from a web page.
- amadeuspagel 3y ago
  > A PWA has exactly the same storage access, code etc as a normal web page. This is not the case in Safari[1]. [1]: https://news.ycombinator.com/item?id=38606328 https://news.ycombinator.com/item?id=38606328
  - beardyw 3y ago
    That is saying it uses a different storage area for the same thing and you presumably end up with different service workers between web and the app. Is that a good thing? My guess is they had no other choice.
    - amadeuspagel 3y ago
      Every browser other then Safari has the same storage for both PWA and website. Apple claims separate storage is "great for privacy" -- forcing you to use the cloud to sync between the PWA and the website.
      - beardyw 3y ago
        Yes, I get tired of that line too.
SigmundA 3y ago
The argument Apple is making from my understanding is that to comply with the law the system must allow other browsers and have a system setting of the default browser. Currently PWA's open in an app that wraps Safari's engine to display the content and provide features but is not normal Safari. They interpret this to violate the browser choice law. Their solution is to turn that feature off and go back to the icon just spawning the system default browser just like any link since that feature already existed. To support true PWA's they probably have two choices: 1. Implement a standard WebView API that any engine can support then use that web view api for the PWA shell. 2. Do what Android seems to do and have a api that allows an app to create new launcher icons separate from the main app that starts the main app with parameters like url=https://pwa.com https://pwa.com mode=pwa. Then if you create a PWA from Chrome it spawns Chrome if created from Safari it spawns Safari with whatever PWA UI they want. On Android it seems to make a little icon bottom right letting you know the parent app. #1 is arguably more complex than #2, both are new api's for iOS that don't exist. #2 is on most desktop OS's like MacOS but not on iOS as far as I know. Apples position is they don't want to put any resources in to creating a new api that could introduce new security surface area unless mandated to. Obviously their motives are not pure but it is a defensible position. I think #2 would be a good feature adding flexibility to many apps, but the various shenanigans that apps could cause with that would need to be considered.

endemic 3y ago

This is actually what I want tbh

thimp 3y ago

Perhaps this is just "all we could deliver by the compliance deadline without compromising platform security"? The truth is usually a lot less interesting than the hypothesis.

actionfromafar 3y ago
Maybe ... but a large company implementing compliance in the most self-serving way possible isn't exactly a shocking idea, either.
- thimp 3y ago
  Well exactly. The point is that both sides of the argument are somewhat more nuanced as they are disingenuously promoted.
Fischgericht 3y ago
How would suddenly disallowing users to run a PWA that worked for years improve platform security? How would having Spotify be able to use their own subscription system compromise platform security? Being able to install software without needing an OK from the hardware manufacturer has been standard for over 40 years now. People do it on Windows PCs, on Linux PCs, on MacBooks and on Android phones, and that very clearly has not caused the extinction of the dinosaurs yet :) The document Apple has published to me reads like it's written by a 5 year old that just was served too many sweets shortly before bed time. IMHO this is about revenge, not about platform security.
- thimp 3y ago
  It's pretty obvious. They're not disallowing it. They are removing the integration with the home screen so that it will run in third party browsers. That limits it to the smallest common API surface which is "open link". Everything else was a luxury. I don't think you work in IT if you haven't had an infested windows, android or macOS box before. Hell I just spent the other day cleaning my father's Mac out of two VPN turds fighting with each other he installed after watching crap on YouTube. My daughter's windows machine got destroyed by unsigned crap from a Sims mod. You just don't get that on iOS apart from the odd calendar subscription turd. As for spotify, they use their own subscription system, not the app store.
  - Fischgericht 3y ago
    Not my intention to brag about it, but I run an R&D company and have invented and patents on quite a lot of network technologies :) The only time in my life where I had an infected devices was in the year 1993 - a boot sector virus on a floppy disk I got from someone. Luckily my wife is a nerd, too, by sister is trained and has not yet fallen for any of the social engineering tricks before. So no, I do not have to deal with other people's infected boxes either.
    - thimp 3y ago
      I envy you :)
      - Fischgericht 3y ago
        Well, on the other hand it implies that most of my family is dead and buried already, and therefore would have a hard time annoying me with their IT problems. If that's a good deal is a matter of perspective ;)
        thimp 3y ago
        A very good point.
makeitdouble 3y ago
Is it the strategy of handing in homework half finished while crying about how the world's been unfair to you lately ?

zer00eyz 3y ago

>> Microsoft does it all the time with Edge on Windows. Edge on windows, the same edge on windows that got caught slurping up chrome tabs recently? Browsers are now the same size code base wise, as operating systems. They are in fact tiny OS's with permissions models and execution environments. I think the author makes the point that safari made a lot of progress, they paid for a lot of work, that they are throwing away. Spite is a reason, but security is also a reason... We have seen how bad things can be when browsers cohabitate on desktops, putting up hard walls now solves the problem before it starts. Phone users aren't loosing (much) of anything, taking away something that they didn't have and didn't exist MIGHT be for security reasons... See MS stealing chrome tabs.

NekkoDroid 3y ago
Aren't apps already sandboxed from eachother on both major Phone OS', unlike on Windows? So on that end something like Edges snooping around other browsers isn't even possible.
- zer00eyz 3y ago
  In theory, sure. The browser is bigger than the OS in total LOC. No one is auditing that. It is a question of when the video leaks of someone using their phone on the shitter. If its a Samsung... well were gonna hear google and Samsung blame each other and consumers will be confused till everyone forgets about it. If it's an apple, consumers blame apple. The buck stops with them. You have to make a business decision based on this what are you gonna do? Im gonna lock all the doors I can.
  - NekkoDroid 3y ago
    If the video leaks due to shitty (pun not intended) sandboxing that is rightlfully on Apple (when on iOS), if it leaks due to the browser being broken then it is on Google and if it's due to an explicit modification of Samsung (when talking about Android) it's on Samsung. When Facebook has a bug/exploit in their app that results in X hacker being able to gain access to files stored within the sandbox of Facebook noone is blaming Apple for Facebooks bug.

Aaargh20318 3y ago

> Why Safari can’t just launch from a Home Screen bookmark even if the user has chosen another “default browser”? IIRC this is exactly what it does after the change. It now just launches the bookmark in a normal browser instead of a browser with the UI hidden.

everydaypanos 3y ago
By Safari, I meant the engine, not the app. Are there any people who actually prefer no PWAs at all over Safari-engine PWAs?
- stetrain 3y ago
  I think it's less a preference question and more whether Apple thinks saving PWAs with a third party browser and then launching them with Safari is compliant with the DMA.
- Aaargh20318 3y ago
  Safari is the browser, Webkit is the engine. Personally I don’t care about PWAs at alls. If you want an app, build an actual app.
  - piva00 3y ago
    > Personally I don’t care about PWAs at alls. If you want an app, build an actual app. Are you going to foot the bill for the development cost of building an actual app for a team that doesn't have iOS software dev expertise? Thought so...
    - Aaargh20318 3y ago
      Then don’t offer an app. PWAs are worse than not having an app.
      - Anonbrit 3y ago
        Until Apple nerfed them, they weren't for simple cases.

beardyw 3y ago

No. A PWA has exactly the same storage access, code etc as a normal web page. A PWA is set apart by having a manifest, which defines how it should act as an app. It has certain extra capabilities like accepting shares and so on, but it is not radically different from a web page.

amadeuspagel 3y ago
> A PWA has exactly the same storage access, code etc as a normal web page. This is not the case in Safari[1]. [1]: https://news.ycombinator.com/item?id=38606328 https://news.ycombinator.com/item?id=38606328
- beardyw 3y ago
  That is saying it uses a different storage area for the same thing and you presumably end up with different service workers between web and the app. Is that a good thing? My guess is they had no other choice.
  - amadeuspagel 3y ago
    Every browser other then Safari has the same storage for both PWA and website. Apple claims separate storage is "great for privacy" -- forcing you to use the cloud to sync between the PWA and the website.
    - beardyw 3y ago
      Yes, I get tired of that line too.

SigmundA 3y ago

The argument Apple is making from my understanding is that to comply with the law the system must allow other browsers and have a system setting of the default browser. Currently PWA's open in an app that wraps Safari's engine to display the content and provide features but is not normal Safari. They interpret this to violate the browser choice law. Their solution is to turn that feature off and go back to the icon just spawning the system default browser just like any link since that feature already existed. To support true PWA's they probably have two choices: 1. Implement a standard WebView API that any engine can support then use that web view api for the PWA shell. 2. Do what Android seems to do and have a api that allows an app to create new launcher icons separate from the main app that starts the main app with parameters like url=https://pwa.com https://pwa.com mode=pwa. Then if you create a PWA from Chrome it spawns Chrome if created from Safari it spawns Safari with whatever PWA UI they want. On Android it seems to make a little icon bottom right letting you know the parent app. #1 is arguably more complex than #2, both are new api's for iOS that don't exist. #2 is on most desktop OS's like MacOS but not on iOS as far as I know. Apples position is they don't want to put any resources in to creating a new api that could introduce new security surface area unless mandated to. Obviously their motives are not pure but it is a defensible position. I think #2 would be a good feature adding flexibility to many apps, but the various shenanigans that apps could cause with that would need to be considered.