Rotten Apple

https://adactio.com/journal/20888

205 190 2 years ago

Angostura3• 2 years ago

A lot of this article appears to be based on the belief that the security architecture of iOS and MacOS are identical. This seems ... an unlikely assumption

rickdeckard4• 2 years ago

If the argument is that in reality the security architecture of iOS is much much worse than MacOS, I'd be interested to hear the details of that rationale...

Retr0id• 2 years ago

The security architectures of both are reasonably well documented[1] by apple, do you have any relevant distinctions to point out?

[1] https://help.apple.com/pdf/security/en_US/apple-platform-sec... [PDF]

Angostura3• 2 years ago

I suspect that there are too many differences for me to really list., but for starters MacOS supports multiple user accounts and has beeen built from its inception to allow people to install software from anywhere.

bjornsing2• 2 years ago

I think a more problematic assumption is that iOS and MacOS users are equally aware and knowledgeable about potential security threats. It’s true that the sky hasn’t fallen because MacOS users are exposed to these risks. But they are not new risks on MacOS. They will be on iOS.

pretext-13• 2 years ago

Maybe people on this site are aware but I can assure you average Joe has no clue.

addicted4• 2 years ago

They don’t need to use a different browser engine.

You’re talking about a user who has gone out of their way through multiple scary Apple warnings to change their browser engine.

And even once they do that, they’re likely to be installing one of Firefox, Chrome, or Edge, all of which have as good if not better security histories than Safari.

devnullbrain9• 2 years ago

The sky hasn't fallen for the 70% of smartphone users who have an Android.

bryanrasmussen2• 2 years ago

No the article is under the belief that because something has not been a security problem for Mac it will not be a security problem for iOS, this does not necessarily have to be because the security architectures of both are the same.

makeitdouble3• 2 years ago

Parent's point is that Apple successfuly maintains two different security levels for mac and iOS, and claiming that it absolutely can't lower iOS at any cost is just Apple's opinion.

For sure Apple doesn't like the macos security model and would want way tighter control on what's allowed to run, if it could get away with it. But it's not about what Apple wants, it's about what they're asked to do.

mouzogu2• 2 years ago

fighting to sustain a monopoly

it indicates to me a lack of ideas about the future

reacting rather than preparing

api• 2 years ago

It's particularly silly given their cash horde that they are not investing. Speaks to a highly conservative corporate culture almost to the level of stockpiling canned food and shotguns.

MiscIdeaMaker99• 2 years ago

A monopoly of what, exactly?

mouzogu2• 2 years ago

app store monopoly

did you read the article?

rickdeckard4• 2 years ago

I think their idea of the future is very much centered around selling the attention and purchasing power of their customers.

That's not meant to be rude "Anti-Apple", that's what their business strategy is obviously based on, including implementing lots of features to prevent their users from voluntarily providing attention or sharing valuable information for free to anyone without Apple's involvement.

If that's your strategy, someone forcing you to allow your customers to roam free is quite a big threat. Something you might be willing to spend one of your trillion dollars to fight against.

So I believe we haven't seen the peak of this yet...

christkv2• 2 years ago

I think that’s coming fast as slumping sales will put the focus on making more money from services and probably soon selling data

sneak3• 2 years ago

With a soon to be nonexistent middle class in the USA (as well as big growth in comparatively poor countries) getting Apple-style huge profits in the next 2-3 decades is going to be much more about getting $20-50/mo/user in perpetuity and less about selling premium price $1k-3k devices. The AVP (at like version 3 or 4) is the endgame for “Apple should make a TV”. It’s the ultimate passive content consumption device.

Apple is now existentially committed to recurring revenue like a crackhead loves crack.

It was obvious to me when I bought a $1600 iPhone and within 5 minutes of setting it up it began nagging me for $5 for iCloud storage. When even Google has figured out how to not nickel and dime your most profitable customer segment and Apple hasn’t, you know something’s wrong.

Expect one of the most clever companies in the world to put a majority of their mental energy into rentseeking of all kinds, from cloud storage to content rentals (music and tv and movie subscriptions) to AppleCare and every other possible thing (Fitness, Arcade, the perpetual iPhone upgrade thing, etc). It’s going to be subscriptions forever.

I expect them to be wildly successful from a revenue standpoint with this plan. Their products (that ugly-ass Ultra watch and tiny bass-free Homepod mini, for example) and nag-filled no-privacy UX have taken a hit and will continue to do so. They’re just consumption devices for Apple Music and iMessage (your attachment history for which drives iCloud storage upgrades). I’m surprised they haven’t figured out a way to charge something for FaceTime yet.

This is why they are fighting the DMA - their position as rentseeker is directly responsible for a double digit percentage of the profits of the most valuable company in the world for the next two dozen years. We are talking about literally trillions of dollars hanging in the balance here. How much fight do you think they will bring to bear on this for that much revenue?

There is zero product UX that is insanely great coming out of Apple these days. The actual engineering behind things like Homepods, AVP, the watch, AirPods, and the Mx silicon is absolutely insane, but it doesn’t inspire users in the UX anymore - it’s all in the background. The AVP is literally the cutting edge of hardware at that price point and all people say about it is that it’s too heavy. The products can’t exist without the engineering, but the users don’t know or care and don’t get the elation and delight that Apple used to be explicitly known for. It’s just “GPU performance and battery life go up and to the right again this year (and sometimes new colors)”.

It’s all just scaffolding to play back consumer media (the marginal cost of which asymptotically approaches zero) so they can extract the recurring rents.

I wouldn’t be surprised if they ever do make a car that they offer it as lease-only.

amadeuspagel5• 2 years ago

Any organization is committed to recurring revenue because it has recurring costs, most importantly salaries.

devnullbrain9• 2 years ago

A wise man once said:

'If you don't cannibalize yourself, someone else will'

kalyantm• 2 years ago

Now they've stopped supporting PWAs in Europe - dark times for web indeed...

rickdeckard4• 2 years ago

Good post, but a bit turbulent to read:

"If you’ve ever built a web app, then your users will suffer. Remember, it’s a world wide web, including the European Union."

"Create a PDF with the following information:"

(me, reading that paragraph: '...what? why?')

[Edit]: I concluded from the bullet-list on why that is requested, but it would help to introduce that intention before instructing me to do something

velcrovan2• 2 years ago

It seems obvious that they’re collecting submissions to include in an official complaint. PDF isn’t unreasonable for that use.

bryanrasmussen2• 2 years ago

you're creating a pdf to send a complaint to EU regulators about Apple behavior.

everydaypanos2• 2 years ago

Why Safari can’t just launch from a Home Screen bookmark even if the user has chosen another “default browser”?

PWAs are already a separate “island” of storage and share nothing with Safari App…

Microsoft does it all the time with Edge on Windows.

endemic• 2 years ago

This is actually what I want tbh

thimp10• 2 years ago

Perhaps this is just "all we could deliver by the compliance deadline without compromising platform security"?

The truth is usually a lot less interesting than the hypothesis.

actionfromafar3• 2 years ago

Maybe ... but a large company implementing compliance in the most self-serving way possible isn't exactly a shocking idea, either.

Fischgericht8• 2 years ago

How would suddenly disallowing users to run a PWA that worked for years improve platform security? How would having Spotify be able to use their own subscription system compromise platform security?

Being able to install software without needing an OK from the hardware manufacturer has been standard for over 40 years now. People do it on Windows PCs, on Linux PCs, on MacBooks and on Android phones, and that very clearly has not caused the extinction of the dinosaurs yet :)

The document Apple has published to me reads like it's written by a 5 year old that just was served too many sweets shortly before bed time.

IMHO this is about revenge, not about platform security.

makeitdouble3• 2 years ago

Is it the strategy of handing in homework half finished while crying about how the world's been unfair to you lately ?

zer00eyz2• 2 years ago

> Microsoft does it all the time with Edge on Windows.

Edge on windows, the same edge on windows that got caught slurping up chrome tabs recently?

Browsers are now the same size code base wise, as operating systems. They are in fact tiny OS's with permissions models and execution environments.

I think the author makes the point that safari made a lot of progress, they paid for a lot of work, that they are throwing away. Spite is a reason, but security is also a reason... We have seen how bad things can be when browsers cohabitate on desktops, putting up hard walls now solves the problem before it starts. Phone users aren't loosing (much) of anything, taking away something that they didn't have and didn't exist MIGHT be for security reasons...

See MS stealing chrome tabs.

NekkoDroid2• 2 years ago

Aren't apps already sandboxed from eachother on both major Phone OS', unlike on Windows? So on that end something like Edges snooping around other browsers isn't even possible.

mass_and_energy• 2 years ago

I feel like the reason most users don't care if they lose access to PWAs is because they haven't had much expose to them. Apple would prefer people continue to use stuff from their app store instead of PWAs and so they're squashing our opportunity to get to know and like them. It's yet another attempt to lock us into their app store

Aaargh203183• 2 years ago

Why Safari can’t just launch from a Home Screen bookmark even if the user has chosen another “default browser”?

IIRC this is exactly what it does after the change. It now just launches the bookmark in a normal browser instead of a browser with the UI hidden.

everydaypanos2• 2 years ago

By Safari, I meant the engine, not the app.

Are there any people who actually prefer no PWAs at all over Safari-engine PWAs?

beardyw3• 2 years ago

No. A PWA has exactly the same storage access, code etc as a normal web page. A PWA is set apart by having a manifest, which defines how it should act as an app. It has certain extra capabilities like accepting shares and so on, but it is not radically different from a web page.

amadeuspagel5• 2 years ago

A PWA has exactly the same storage access, code etc as a normal web page.

This is not the case in Safari[1].

[1] https://news.ycombinator.com/item?id=38606328

SigmundA2• 2 years ago

The argument Apple is making from my understanding is that to comply with the law the system must allow other browsers and have a system setting of the default browser.

Currently PWA's open in an app that wraps Safari's engine to display the content and provide features but is not normal Safari. They interpret this to violate the browser choice law.

Their solution is to turn that feature off and go back to the icon just spawning the system default browser just like any link since that feature already existed.

To support true PWA's they probably have two choices:

1. Implement a standard WebView API that any engine can support then use that web view api for the PWA shell.

2. Do what Android seems to do and have a api that allows an app to create new launcher icons separate from the main app that starts the main app with parameters like url=https://pwa.com mode=pwa. Then if you create a PWA from Chrome it spawns Chrome if created from Safari it spawns Safari with whatever PWA UI they want. On Android it seems to make a little icon bottom right letting you know the parent app.

#1 is arguably more complex than #2, both are new api's for iOS that don't exist. #2 is on most desktop OS's like MacOS but not on iOS as far as I know.

Apples position is they don't want to put any resources in to creating a new api that could introduce new security surface area unless mandated to. Obviously their motives are not pure but it is a defensible position.

I think #2 would be a good feature adding flexibility to many apps, but the various shenanigans that apps could cause with that would need to be considered.

xandrius3• 2 years ago

It's a shame, Apple is in a place to be the leader and decent, instead it decides not to be both.

jadbox• 2 years ago

I love apple for the hardware, but they would be a better company if they released their iron grip over the software. One day I dream I can install Linux on iOS devices.

hahamaster• 2 years ago

But why? What does an iPhone have, hardware-wise, that a Samsung or Xiaomi phone does not?

this_user• 2 years ago

Apple is the new Microsoft, except worse. Windows was at least still a reasonably open platform.

devnullbrain9• 2 years ago

Crucially, that's not because Microsoft are more ethical - it's because they didn't figure it out first. The solution to this is not a better company, it's better adherence to and implementation of the existing laws.

thimp10• 2 years ago

Ah yes, the poor end users suffering and the security being bullshit.

I really can't wait to clean the first malicious browser out of a relative's iPhone and try and unsubscribe from Tim Sweeny's app store with his own 30% margin to spend on blackjack and hookers.

The new status quo will be worse than the old one.

pretext-13• 2 years ago

Somehow this is not a problem on Android even though they have sideloading and alternative app stores even beyond what Apple is going to allow. (Apple still requires apps to go though a review process, even if distributed outside of the App Store, and will enforce this using digital signatures.)

amadeuspagel5• 2 years ago

It is somewhat of a problem for android when it comes to sideloading, and this is an additional advantages of PWAs. PWAs are the freedom of sideloading, without the security risk.

thimp10• 2 years ago

This is actually a big problem on Android. My ex father-in-law literally had his bank account ripped off (£18000) from rogue app installed from outside the app store. And Google's stewardship of the play store is terrible.

Note I'm mostly an Android user.

pcdoodle• 2 years ago

Apple is so full of shit (I'm a user BTW).

We're getting to the point where browsers can do really cool things and they're scared of losing their 30% mafia like tax.

It's the browser wars all over again.

algesten• 2 years ago

Call me old fashioned, but I prefer it when web pages open in a web browser and don't pretend to be native apps.

revscat• 2 years ago

Sometimes, sure. Sometimes not, though. I have a PWA for studying kanji that very much benefits from the increased real estate and more focused feel.

I like having that choice.

velcrovan2• 2 years ago

Don’t use PWAs then.

asadotzler6• 2 years ago

You aren't required to install PWAs and can generally keep using the site that created the PWA just fine. PWAs are most often a courtesy for mobile users, not a requirement. Don't need or want that courtesy, don't take it. That you spent time to post here without understanding that is some kind of indictment.

sneak3• 2 years ago

Competition is good. This isn’t a new thing for Apple, however - even when Jobs was alive, he personally conspired with Google, Adobe, Intel, Intuit, Pixar, Lucasfilm and eBay to price-fix wages lower than a normal competitive market would allow.

When the companies reached a settlement over it, the judge threw it out because it was so hilariously low compared to the three billion dollars that these companies stole from their employees.

https://en.m.wikipedia.org/wiki/High-Tech_Employee_Antitrust...

This isn’t some new development. Apple has long been without a moral compass, even when Jobs was at the helm. It continues today.

wouldbecouldbe2• 2 years ago

What is really fun about working with Apple is their Appstore connect platform is buggy & slow as hell.

Few times I couldn't submit an app because of it.

Every time I submit a bug, there first reaction is try it on safari; most of time it was server issues so it didn't resolve it. But sometimes it actually did where I didnt expect it.

pretext-13• 2 years ago

They have no reason to improve it as there is no alternative (yet).

wouldbecouldbe2• 2 years ago

Well there is enough reasons: giving back to developers, because it's the right thing to do, saving support costs, etc. Just in their DNA not to care about developers. However even from such a monopoly position it would benefit them in the long run.

zitterbewegung• 2 years ago

Why is it a bad response from Apple to disable a feature that they deem as a security risk if you allow for alternative browser engines?

Browsers represent a significant attack surface since they can run code and also transmit data across the network. So when they are allowed to exist now Apple has either two options. One is to do the simple way and remove progressive web apps or extensively test and perform security analysis on all of the new browser engines.

A better compromise would be to make new browser engines have extensive testing by the developer themselves. So, what's the point ? It feels similar to the GDPR where I get a popup and I click disallow all cookies except for essential ones.

This seems the best way to actually implement the directive because it is not only low effort but most secure. We would have a better compromise for testing to be done by the browser engine developer or Apple but its more likely security holes would fall through.

actionfromafar3• 2 years ago

As said elsewhere, the PWA apps could open in Safari.

But would this have legal implications? Could the browser vendors argue they are discriminated against if PWA apps do not open in their browser?

I think this whole thing puts the finger on how fluid the borders have become. What is an app, what is an API, what is a service? Is Safari an Apple API for PWA apps? Or is a PWA app running by mandate on Safari when the user has selected another browser as default somehow wrong legally or ethically?

jsnell• 2 years ago

Apple has been abusing their dominant market position for more than a decade, blocking browser competition with security being one of their excuses. They can't be trusted to be honest about what's a legitimate security issue, and what's just them using security as a smokescreen for anti-competitive behavior.

And in fact, they are not being honest in this very case. Their entire spiel is based on the idea that the 3rd party browsers will be malicious, and permit data sharing between different PWAs. It's a risk they've just made up, because they're already making all kinds of other security requirements on 3rd party browsers before allowing them on the platform. They could just have made this one of those requirements.

xbar2• 2 years ago

The Apple response is false, thus dishonest and greedy at the expense of consumers.

janandonly2• 2 years ago

If I want my PWA to continue working, can I solve this by selecting "country" -> "UK" or "USA" ?

janandonly2• 2 years ago

Also, will all the people worldwide that changed their country setting to "France" because it prevents their iPhone from slowing down[1] now also experience broken PWA's?

I guess so?

[1] Untrue, apparently, but nonetheless something some people did: https://appleinsider.com/articles/21/08/25/dont-set-your-old...

Keyframe4• 2 years ago

I have an ipad through which I subscribed for Apple arcade. I don't use it / play at all on it and there was recently an email that price is going up. Sure, I'll just cancel subscription I said. I don't have my ipad on me, nor any other apple device (I don't use them anymore), nor windows. I have linux machines and android phone. Ok, so how do I cancel subscription? icloud login? no. subscription place of sorts? it wants me to install itunes, which I can't.. ok, no. After googling around, turns out there's actually no way except to call Apple in USA or wherever. I'll just wait a week untill I get a hold of my iPad and Apple won't be seeing my money for a long time. Disgraceful to say the least.

disgruntledphd23• 2 years ago

Apple always assume that you use their devices as primaries. It can be very annoying. When I wanted to get my wife a replacement MB, I ended up checking out as a guest as they insisted on sending my 2FA code to my iPad (which mostly just annoyed my toddler).

randcraw• 2 years ago

No. The user base for Apple Music on Windows is huge. Apple devices are secondary. Using the AM app is primary, once you've been successfully sucked into the Apple ecosystem, Borg-like.

worksonmine• 2 years ago

Apple always assume that you use their devices as primaries

Assumes or tries very hard to make the alternative as difficult as possible? From a company that prides itself in improving and simplifying UX the dark patterns aren't mistakes.

xandrius3• 2 years ago

Your toddler gets annoyed that you need a 2FA code on your iPad?

mobilemidget• 2 years ago

So when you sign up for Apple Arcade, which strangely you dont use? Why sign up for it? But then it's okay that you need to have your iPad to signup, but when you want to cancel it is strange that you need your iPad.

I understand it would be nice if you can login to a website and cancel, but reads as if you make your mistake of not taken your iPad, or cancelling in time a fault of others.

alias_neo• 2 years ago

but when you want to cancel it is strange that you need your iPad

Come on, of course that's ridiculous.

Of course a reasonable person would expect to be able to cancel a subscription without needing the device it was created on when they used an account that you can log into from basically anywhere.

If I bought an iPad and subscribed to something, and then accidentality dropped it off a cliff, or out of a plane, or lost it in the sea, and I decided you know what, I don't want any more Apple stuff, you can be damn sure I'd expect to be able to cancel any subscriptions I had on that account (you know, the account you can log into from any computer or device), from somewhere other than on the device itself.

Suggesting anyone should expect otherwise is insanity.

rickdeckard4• 2 years ago

I agree, at the core it was obviously his fault because he signed up for an online subscription-service and now expects it to be somehow maintained online /s

devnullbrain9• 2 years ago

Why sign up for it?

Because, when you buy an Apple device, they shove free trials for subscription services down your throat in the hopes that you'll do exactly this. And it's not strange that they don't use it: the first thing you discover after starting the free trials is that they're useless and full of shovelware.

Keyframe4• 2 years ago

Actually, I signed up for it when my daughter and I wanted to play some puzzle games on my iPad. Turns out A TON of games we browsed through / tried out via AppStore on it are pure scam / and really shady-looking. I thought maybe if I just click official Apple subscription and played games they went through all that sewer can be avoided. We played maybe once or twice and I kind of forgot about it; We played fruit ninja anyways. Insisting on having an iPad or any other apple device again to unsubscribe is absurd. What if iPad was my only apple device (which it was/is) and it fell down the black hole? I'm then supposed to pay until end of universe or call Tim Apple across ocean and ask for favors? It's unacceptable, no matter which company it is. ESPECIALLY since they do have web interface you can log into and do stuff regarding billing (see iCloud).

tl;dr; I paid to get away from scam, turns out I fell into one.

icebergonfire• 2 years ago

You could use iTunes in Windows https://support.apple.com/en-us/HT202039

If you don't have a Windows license, you can get a trial VM from here https://developer.microsoft.com/en-us/windows/downloads/virt...

Yes it is a pain that Apple doesn't offer a simple webpage for subscription management.

ubermonkey4• 2 years ago

A feature of the Apple platform is aggregation of control, but they put the control within iOS.

This is awesome. I don't have to chase down fifty-eleven other sites to manage the things I subscribed to on my phone or iPad, including the services I buy from Apple itself. It's an extremely consumer-friendly aspect of the platform, and one I would miss very much if I switched to something else.

But yes, to use this feature of the platform, you need to have access to the platform. As you have discovered, though, Apple DOES have a phone option as well, though I'm sure it's less convenient to use.

Honestly, it just seems like you were primed to be annoyed about Apple, and have failed to realize your complaints look pretty thin.

Keyframe4• 2 years ago

I'm not sure if Apple pays your sandwiches or what, but it's not hard to imagine a reasonable expectation one could login to an apple-owned web platform to manage their subscription. Not third-party. Apple one. Especially after considering two facts; One - they have that platform via iCloud where you can manage billing and subscription, but apparently not for everything and second which is more important - I got alerted to this after receiving an email from Apple titled "Your Subscription Price Increase" and within that email there was this: "To learn more or cancel, review your subscription." of which latter part is a link which when clicked opens up a page saying you need itunes. itunes which I cannot install on my phone nor computer. No other info. I had to dig and dig through google to find that I could probably call someone at Apple to cancel. If that's not shady, it's at least sloppy.

sgt• 2 years ago

I’m going to get a lot of emails from confused users wondering why their app is broken, now opening in a regular browser window.

Newsflash incoming for you.. Just about none of your users will (1) care (2) used the "PWA" in the first place.

It's really not that common to add apps to the home screen. Among very technical users, it's a fair bit more common though.

actionfromafar3• 2 years ago

For random web pages which have a PWA mode, sure. But there are bona-fide industry specific PWA "apps". The confusion will be real. Probably minor enough for Apple to barely register, but tell that to the users.

cageface2• 2 years ago

From the article:

There is no native app for The Session, but you can install it on your phone nonetheless. Lots of people have done that. After a while they forget that they didn’t install it from an app store: it behaves just like any other app on their homescreen.

Maybe you don't believe this but it was addressed.

iainmerrick• 2 years ago

I thought PWAs already didn't work well on iOS, though?

Apart from opening in a browser window rather than as a full-screen app, is this going to behave significantly differently from before?

macguillicuddy• 2 years ago

It's a single data point but the Xbox Cloud Play (game streaming service) works on iOS through a PWA since Apple required that any service like that submit a seperate app for each game that it permitted to be streamed.

robenkleene6• 2 years ago

This is a terrible argument:

You can read Apple’s announcement on being forced to comply but as you do you so, I’d like you to remember one thing: every nightmare scenario they describe for the security of users in the EU is exactly what currently happens on Macs everywhere in the world.

There's 1.5 billion iPhone users vs 100 million Mac users, Apple believes that at least part of the reason for that difference is the security model of iOS. E.g., arguably the largest changes Apple has made to the Mac since introducing the iPhone is implementing security measures based on iOS.

addicted4• 2 years ago

There's 1.5 billion iPhone users vs 100 million Mac users

It’s beyond hilarious, after years of seeing Apple users fight back against the idea that the Mac’s better security relative to windows Windows has anything to do with its smaller user base, to see Apple users insist that the Mac’s smaller user base relative to the iPhone is what makes it more secure.

stetrain2• 2 years ago

Those are probably different groups of people. I'll definitely agree that the Mac would see more security issues if it had the install base of Windows or iOS.

robenkleene6• 2 years ago

I don't really understand your argument, e.g., "seeing Apple users fight back against the idea that the Mac’s better security relative to windows Windows has anything to do with its smaller user base".

Are you saying there was some dispute between where folks were saying Mac's tigher security someone made the platform less popular? I've never heard this. (Also for the record, I personally wouldn't make any case about Mac's security being better than Windows.)

Also side point, I said this is what Apple believes, not "Apple users". I.e., I don't think anyone cares what I think, but Apple behavior on a number of fronts points to Apple believing this (e.g., sandboxing in Mac App Store, reading between the lines of the App Store restrictions, notarization).

xbar2• 2 years ago

That's a terrible argument. The MacOS security model has not suffered as Apple asserts.

addicted4• 2 years ago

For the sake of argument lets take as given that the Mac was unacceptably insecure (John Hodgman smirks at Justin Long “I knew it!”) until the iOS security model was applied.

It’s also not clear that the EU requires the PWA engine to also be replaceable but I’m personally in favor of that so we’ll stipulate that’s the case as well.

The term “security model” is doing all the work here.

The EU has no requirement for the “security model” to be changed. They require the browser engine to be replaceable.

The argument that Apple’s security model is the only one that can provide security is not sufficient. Those making this argument need to also prove that the browser engine can only be secure when made by Apple.

And yet the entire history of computing, and especially the history of browsers, browser engines, and app engines in general, have consistently shown that no one company has a monopoly in being able to make secure browser engines, competitive pressure has helped security across the board, and non first party browser engine makers have often made far more secure browser engines than the first party makers.

Apple fans are obscuring the issue by shouting “security model”. The real question is why this security model is irrecoverably damaged by replacing a first party browser engine by a third party one.

And why Apple, at a time of much greater computing power, much more advanced computer science, and far more advanced in browser engine theory and technology, is unable to do what Microsoft was forced to do 2 decades ago.

robenkleene6• 2 years ago

"The MacOS security model has not suffered as Apple asserts." What does this mean? macOS security has radically changed on a number of fronts since the introduction of the iPhone. E.g., sandboxing, notarization, script execution/Apple Events, file-system access, microphone access, video access. I have no idea what your statement means.

devnullbrain9• 2 years ago

You are conspicuously not noting how much Apple value the $89 billion they made on app store commissions last year.

robenkleene6• 2 years ago

I don't think that's some big secret, but also irrelevant to the point I'm making. I said Apple believes that they're security model on the iPhone is important to it's popularity. Apple making a bunch of money on the App Store does not contribute to the iPhone's popularity, therefore it's not relevant to my original statement.

What you are really trying to say is that Apple doesn't actually believe the security model is important, instead it's just about collecting money from the App Store, that's a valid interpretation, I just believe that Apple values the iPhone's long-term popularity higher than it values the short-term profits from the App Store. The fact that they can have both is mighty convenient for Apple.

christkv2• 2 years ago

I don’t understands why this would be such a security issue other browsers are sandboxed. PWA would just dispatch to the chosen browser with whatever parameters are passed along and it would be up to that browser to do the right thing. How would this be a security risk worse than the current existing setup with deep links?

apples_oranges• 2 years ago

Perhaps we have reached peak Apple. I was a fanboy for a long time but when USB-C came to the iPhone something clicked for me. There was no good reason except money making why they didn't do it sooner. Perhaps the magic spell is broken. Yes, their computers may be good, but maybe the company that makes them, isn't.

wavemode• 2 years ago

I remember having this exact conversation with a girlfriend who though it was dumb that Apple was being forced to change their charger port.

One day she was like "ugh! I forgot my phone charger at home" and I was like "your phone uses USB-C now. I have dozens of those lying around."

She kind of tilted her head and said "huh. that's convenient." Like, she'd simply never thought about it that way before.

will5421• 2 years ago

Do you have to check which way round a USB-C connector is before you plug it in?

asadotzler6• 2 years ago

neximo64• 2 years ago

What tarnish to the brand. What a gamble.

frizlab3• 2 years ago

Instead of graciously acknowledging that this is what’s best for users, Apple are throwing a tantrum.

I’m a user and a developer and I’m convinced this is not what’s best for users.

t00ny• 2 years ago

I am a developer and user, and I think it is better for me at least.

frizlab3• 2 years ago

To each his own. All I’m saying is his statement is presented as a fact when it is, in fact, not that simple.

withinboredom3• 2 years ago

I'm just looking forward to have a pornhub app.

myaccountonhn• 2 years ago

It's better for me, a user of an iPhone.

frizlab3• 2 years ago

Good for you. All I’m saying is the original statement is given as a fact when it is actually highly debatable whether it actually _is_ best for the user. I don’t think it is and I’m not alone.

dwighttk8• 2 years ago

Sure this situation already exists on Mac OS but that is a much smaller user base and there are plenty of alternatives where you can go and install arbitrary software.

I deal with weird stuff my parents have installed on their Macs every time I visit… so far I haven’t had to do that with their phones. If I wanted them to use a Firefox browser engine on their phone I’d get them an Android.

Lacusch• 2 years ago

Yeah but then they just won't chage the browser enginr and nothing will change. I don't think your parents would go out of their way to change the browser engine or am I missing something?

dwighttk8• 2 years ago

They don’t go out of their way to install anything on their macs… every time I ask them about how their computers get this way and they do not know.

I suspect my dad is just clicking anything that gets in the way of his puzzle games. Not sure what gets mom.

devnullbrain9• 2 years ago

It's so funny that every HN post on this topic produces more and more contrived reasons for why having less choice is better, actually. Today: my parents need to be coddled like children, so you don't get to install a new browser.

It's only because Apple's legal wrangling failed that Android even exists today.

dwighttk8• 2 years ago

You do get to install a new browser, on a platform you’d prefer, one that is open and supports choice, go over there.

asadotzler6• 2 years ago

This site stopped being for actual hackers at least 5 years ago, maybe more. These people are the opposite of hackers, literally begging for and defending walled gardens and closed systems. What a joke this community has become over the years.

JKCalhoun• 2 years ago

Yeah, I thought the Mac comparison was easy to digest, but ultimately left me feeling still a little hungry. I'm thinking those that would install malware are obviously going to target the platform that is always online and that sells millions of units.

I remember how few Mac viruses there were back in the 90's vs. the PC platform. I don't think it had anything to do with System 7 security. ;-)

I'm not sure though if it wouldn't in fact hurt Apple's brand to give up the fight and instead install a big lever you can throw when you set up your iOS device that says, "Turn off security". Apple seems to be saying instead, you have choice — buy an Android.

I've never owned an Android though so I can say, is it rife with malware and other security compromises? Is the platform as hardened as iOS? Or it another case where the market is not as appealing as the iOS market to malware developers?

bluesign• 2 years ago

I think the main issue is attribution. Especially when a lot of stuff breaks even on web, when you change the browser.

Imagine I have some PWA at home screen now, working with Safari engine. I changed my browser to Chrome, let's say it stopped working. 90% of the users will blame Apple software update instead of the Chrome choice.

Fischgericht8• 2 years ago

We luckily are finally living in a world where browser incompatibility is not a big issue anymore.

And as a developer, you'd simply check that your PWA works with Safari, Firefox and Chrome.

asadotzler6• 2 years ago

Nah. Those kind of incompatibilities are rare and users will generally place the blame on their last change, more likely the Chrome install than a check for updates.

everyone• 2 years ago

Good, hopefully even less people will buy apple shit.

monkin3• 2 years ago

I wonder how the EU will respond when high-ranking politicians fall victim to third-party app store scams or experience significant data leaks exploited through other browsers. Given that they're not particularly tech-savvy, it raises questions about their preparedness for such situations, and who they will blame for it.

matsemann• 2 years ago

You don't have to wonder, as Android has had this model for years. So that should help you predict. Hint: not an issue.

SigmundA2• 2 years ago

Seems like an issue, such that they are testing ways to disable certain side loaded apps: https://techcrunch.com/2024/02/07/google-starts-blocking-use...

monkin3• 2 years ago

Never seen high-profile politician with an Android device.

jmull• 2 years ago

(1) Why assume Apple's browser is more secure than the likely alternatives, Chrome and Firefox?

(2) Those high-ranking politicians almost certainly already make heavy use platforms that allow "side-loading" and alternative browsers. That means the attack surface doesn't change much from where it is right now.

Hizonner2• 2 years ago

So Apple needs total control over the entire world, because high-ranking politicians are too stupid to take care of themselves?

I mean, if they had the choice not to buy Apple, they might buy something that they're unprepared to handle, so what you're saying necessarily implies that they have no non-Apple choices at all, or at least no choices that aren't just as locked down as Apple and run in just as hidebound a way.

With all sincerity, fuck you and fuck everybody who thinks like you.

monkin3• 2 years ago

With all sincerity, fuck you and fuck everybody who thinks like you.

Thank you.

smoldesu5• 2 years ago

It already happened. Except, well, the blood's on Apple's hands: https://en.wikipedia.org/wiki/Pegasus_(spyware)

I wonder how Apple will respond when high-ranking politicians acknowledge that security is a personal responsibility that Apple was unfit to provide in the first place. That will be a fun discussion, albeit further down the proverbial line.

asadotzler6• 2 years ago

Like Pegasus that infected all those iPhones of world leaders?

anon373839• 2 years ago

The best thing everyone can do is to keep making noise and Streisand Effect the hell out of this. Make Apple’s arrogance cost them something. Don’t just sit by quietly while they dismantle the future of computing to protect their revenue streams.

s1k3s• 2 years ago

risks from installing software that compromises system integrity with malware or other malicious code

Sorry, what? Are they implying that iPhone's security isn't built inside the OS itself, but somehow depends on having every app pass their 30 second review on the store? That doesn't seem right.

exposure to illicit, objectionable, and harmful content due to lower content and moderation standards, and increased risks of scams, fraud, and abuse

Like the deepfake video ads of politicians trying to sell me crypto that I constantly see on YouTube or Meta's apps, all coming from the official store?

nuker• 2 years ago

Get ready for “This website works in Chrome only. Please install Chrome on your iPhone”. This will be the day Google has won the Internet.

manderley• 2 years ago

Not going to happen.

ubermonkey4• 2 years ago

Ah, another article on HN complaining about Apple. Groundbreaking!

lobito14• 2 years ago

I've never had an Apple product and I never will. I hate their fan base, shallow virtue signaling, and business model.

Rotten Apple

Related Stories