It seems obvious that they’re collecting submissions to include in an official complaint. PDF isn’t unreasonable for that use.

you're creating a pdf to send a complaint to EU regulators about Apple behavior.

The argument Apple is making from my understanding is that to comply with the law the system must allow other browsers and have a system setting of the default browser.

Currently PWA's open in an app that wraps Safari's engine to display the content and provide features but is not normal Safari. They interpret this to violate the browser choice law.

Their solution is to turn that feature off and go back to the icon just spawning the system default browser just like any link since that feature already existed.

To support true PWA's they probably have two choices:

1. Implement a standard WebView API that any engine can support then use that web view api for the PWA shell.

2. Do what Android seems to do and have a api that allows an app to create new launcher icons separate from the main app that starts the main app with parameters like url=https://pwa.com mode=pwa. Then if you create a PWA from Chrome it spawns Chrome if created from Safari it spawns Safari with whatever PWA UI they want. On Android it seems to make a little icon bottom right letting you know the parent app.

#1 is arguably more complex than #2, both are new api's for iOS that don't exist. #2 is on most desktop OS's like MacOS but not on iOS as far as I know.

Apples position is they don't want to put any resources in to creating a new api that could introduce new security surface area unless mandated to. Obviously their motives are not pure but it is a defensible position.

I think #2 would be a good feature adding flexibility to many apps, but the various shenanigans that apps could cause with that would need to be considered.

> Why Safari can’t just launch from a Home Screen bookmark even if the user has chosen another “default browser”?

IIRC this is exactly what it does after the change. It now just launches the bookmark in a normal browser instead of a browser with the UI hidden.

Perhaps this is just "all we could deliver by the compliance deadline without compromising platform security"?

The truth is usually a lot less interesting than the hypothesis.

No. A PWA has exactly the same storage access, code etc as a normal web page. A PWA is set apart by having a manifest, which defines how it should act as an app. It has certain extra capabilities like accepting shares and so on, but it is not radically different from a web page.

This is actually what I want tbh

>> Microsoft does it all the time with Edge on Windows.

Edge on windows, the same edge on windows that got caught slurping up chrome tabs recently?

Browsers are now the same size code base wise, as operating systems. They are in fact tiny OS's with permissions models and execution environments.

I think the author makes the point that safari made a lot of progress, they paid for a lot of work, that they are throwing away. Spite is a reason, but security is also a reason... We have seen how bad things can be when browsers cohabitate on desktops, putting up hard walls now solves the problem before it starts. Phone users aren't loosing (much) of anything, taking away something that they didn't have and didn't exist MIGHT be for security reasons...

See MS stealing chrome tabs.

The security architectures of both are reasonably well documented[1] by apple, do you have any relevant distinctions to point out?

[1] https://help.apple.com/pdf/security/en_US/apple-platform-sec... [PDF]

No the article is under the belief that because something has not been a security problem for Mac it will not be a security problem for iOS, this does not necessarily have to be because the security architectures of both are the same.

I think a more problematic assumption is that iOS and MacOS users are equally aware and knowledgeable about potential security threats. It’s true that the sky hasn’t fallen because MacOS users are exposed to these risks. But they are not new risks on MacOS. They will be on iOS.

It's so funny that every HN post on this topic produces more and more contrived reasons for why having less choice is better, actually. Today: my parents need to be coddled like children, so you don't get to install a new browser.

It's only because Apple's legal wrangling failed that Android even exists today.

Yeah, I thought the Mac comparison was easy to digest, but ultimately left me feeling still a little hungry. I'm thinking those that would install malware are obviously going to target the platform that is always online and that sells millions of units.

I remember how few Mac viruses there were back in the 90's vs. the PC platform. I don't think it had anything to do with System 7 security. ;-)

I'm not sure though if it wouldn't in fact hurt Apple's brand to give up the fight and instead install a big lever you can throw when you set up your iOS device that says, "Turn off security". Apple seems to be saying instead, you have choice — buy an Android.

I've never owned an Android though so I can say, is it rife with malware and other security compromises? Is the platform as hardened as iOS? Or it another case where the market is not as appealing as the iOS market to malware developers?

Yeah but then they just won't chage the browser enginr and nothing will change. I don't think your parents would go out of their way to change the browser engine or am I missing something?

Not going to happen.

Sometimes, sure. Sometimes not, though. I have a PWA for studying kanji that very much benefits from the increased real estate and more focused feel.

I like having that choice.

You aren't required to install PWAs and can generally keep using the site that created the PWA just fine. PWAs are most often a courtesy for mobile users, not a requirement. Don't need or want that courtesy, don't take it. That you spent time to post here without understanding that is some kind of indictment.

Don’t use PWAs then.

They have no reason to improve it as there is no alternative (yet).

(1) Why assume Apple's browser is more secure than the likely alternatives, Chrome and Firefox?

(2) Those high-ranking politicians almost certainly already make heavy use platforms that allow "side-loading" and alternative browsers. That means the attack surface doesn't change much from where it is right now.

You don't have to wonder, as Android has had this model for years. So that should help you predict. Hint: not an issue.

It already happened. Except, well, the blood's on Apple's hands: https://en.wikipedia.org/wiki/Pegasus_(spyware)

I wonder how Apple will respond when high-ranking politicians acknowledge that security is a personal responsibility that Apple was unfit to provide in the first place. That will be a fun discussion, albeit further down the proverbial line.

Like Pegasus that infected all those iPhones of world leaders?

So Apple needs total control over the entire world, because high-ranking politicians are too stupid to take care of themselves?

I mean, if they had the choice not to buy Apple, they might buy something that they're unprepared to handle, so what you're saying necessarily implies that they have no non-Apple choices at all, or at least no choices that aren't just as locked down as Apple and run in just as hidebound a way.

With all sincerity, fuck you and fuck everybody who thinks like you.

Apple is the new Microsoft, except worse. Windows was at least still a reasonably open platform.

I love apple for the hardware, but they would be a better company if they released their iron grip over the software. One day I dream I can install Linux on iOS devices.

We luckily are finally living in a world where browser incompatibility is not a big issue anymore.

And as a developer, you'd simply check that your PWA works with Safari, Firefox and Chrome.

Nah. Those kind of incompatibilities are rare and users will generally place the blame on their last change, more likely the Chrome install than a check for updates.

Also, will all the people worldwide that changed their country setting to "France" because it prevents their iPhone from slowing down[1] now also experience broken PWA's?

I guess so?

[1] Untrue, apparently, but nonetheless something some people did: https://appleinsider.com/articles/21/08/25/dont-set-your-old...

I remember having this exact conversation with a girlfriend who though it was dumb that Apple was being forced to change their charger port.

One day she was like "ugh! I forgot my phone charger at home" and I was like "your phone uses USB-C now. I have dozens of those lying around."

She kind of tilted her head and said "huh. that's convenient." Like, she'd simply never thought about it that way before.

Do you have to check which way round a USB-C connector is before you plug it in?

> Apple always assume that you use their devices as primaries

Assumes or tries very hard to make the alternative as difficult as possible? From a company that prides itself in improving and simplifying UX the dark patterns aren't mistakes.

Your toddler gets annoyed that you need a 2FA code on your iPad?

No. The user base for Apple Music on Windows is huge. Apple devices are secondary. Using the AM app is primary, once you've been successfully sucked into the Apple ecosystem, Borg-like.

I'm not sure if Apple pays your sandwiches or what, but it's not hard to imagine a reasonable expectation one could login to an apple-owned web platform to manage their subscription. Not third-party. Apple one. Especially after considering two facts; One - they have that platform via iCloud where you can manage billing and subscription, but apparently not for everything and second which is more important - I got alerted to this after receiving an email from Apple titled "Your Subscription Price Increase" and within that email there was this: "To learn more or cancel, review your subscription." of which latter part is a link which when clicked opens up a page saying you need itunes. itunes which I cannot install on my phone nor computer. No other info. I had to dig and dig through google to find that I could probably call someone at Apple to cancel. If that's not shady, it's at least sloppy.

>Why sign up for it?

Because, when you buy an Apple device, they shove free trials for subscription services down your throat in the hopes that you'll do exactly this. And it's not strange that they don't use it: the first thing you discover after starting the free trials is that they're useless and full of shovelware.

> but when you want to cancel it is strange that you need your iPad

Come on, of course that's ridiculous.

Of course a reasonable person would expect to be able to cancel a subscription without needing the device it was created on when they used an account that you can log into from basically anywhere.

If I bought an iPad and subscribed to something, and then accidentality dropped it off a cliff, or out of a plane, or lost it in the sea, and I decided you know what, I don't want any more Apple stuff, you can be damn sure I'd expect to be able to cancel any subscriptions I had on that account (you know, the account you can log into from any computer or device), from somewhere other than on the device itself.

Suggesting anyone should expect otherwise is insanity.

Actually, I signed up for it when my daughter and I wanted to play some puzzle games on my iPad. Turns out A TON of games we browsed through / tried out via AppStore on it are pure scam / and really shady-looking. I thought maybe if I just click official Apple subscription and played games they went through all that sewer can be avoided. We played maybe once or twice and I kind of forgot about it; We played fruit ninja anyways. Insisting on having an iPad or any other apple device again to unsubscribe is absurd. What if iPad was my only apple device (which it was/is) and it fell down the black hole? I'm then supposed to pay until end of universe or call Tim Apple across ocean and ask for favors? It's unacceptable, no matter which company it is. ESPECIALLY since they do have web interface you can log into and do stuff regarding billing (see iCloud).

tl;dr; I paid to get away from scam, turns out I fell into one.

I agree, at the core it was obviously his fault because he signed up for an online subscription-service and now expects it to be somehow maintained online /s

I think that’s coming fast as slumping sales will put the focus on making more money from services and probably soon selling data

Any organization is committed to recurring revenue because it has recurring costs, most importantly salaries.

app store monopoly

did you read the article?

I don't really understand your argument, e.g., "seeing Apple users fight back against the idea that the Mac’s better security relative to windows Windows has anything to do with its smaller user base".

Are you saying there was some dispute between where folks were saying Mac's tigher security someone made the platform less popular? I've never heard this. (Also for the record, I personally wouldn't make any case about Mac's security being better than Windows.)

Also side point, I said this is what Apple believes, not "Apple users". I.e., I don't think anyone cares what I think, but Apple behavior on a number of fronts points to Apple believing this (e.g., sandboxing in Mac App Store, reading between the lines of the App Store restrictions, notarization).

Those are probably different groups of people. I'll definitely agree that the Mac would see more security issues if it had the install base of Windows or iOS.

I don't think that's some big secret, but also irrelevant to the point I'm making. I said Apple believes that they're security model on the iPhone is important to it's popularity. Apple making a bunch of money on the App Store does not contribute to the iPhone's popularity, therefore it's not relevant to my original statement.

What you are really trying to say is that Apple doesn't actually believe the security model is important, instead it's just about collecting money from the App Store, that's a valid interpretation, I just believe that Apple values the iPhone's long-term popularity higher than it values the short-term profits from the App Store. The fact that they can have both is mighty convenient for Apple.

For the sake of argument lets take as given that the Mac was unacceptably insecure (John Hodgman smirks at Justin Long “I knew it!”) until the iOS security model was applied.

It’s also not clear that the EU requires the PWA engine to also be replaceable but I’m personally in favor of that so we’ll stipulate that’s the case as well.

The term “security model” is doing all the work here.

The EU has no requirement for the “security model” to be changed. They require the browser engine to be replaceable.

The argument that Apple’s security model is the only one that can provide security is not sufficient. Those making this argument need to also prove that the browser engine can only be secure when made by Apple.

And yet the entire history of computing, and especially the history of browsers, browser engines, and app engines in general, have consistently shown that no one company has a monopoly in being able to make secure browser engines, competitive pressure has helped security across the board, and non first party browser engine makers have often made far more secure browser engines than the first party makers.

Apple fans are obscuring the issue by shouting “security model”. The real question is why this security model is irrecoverably damaged by replacing a first party browser engine by a third party one.

And why Apple, at a time of much greater computing power, much more advanced computer science, and far more advanced in browser engine theory and technology, is unable to do what Microsoft was forced to do 2 decades ago.

"The MacOS security model has not suffered as Apple asserts." What does this mean? macOS security has radically changed on a number of fronts since the introduction of the iPhone. E.g., sandboxing, notarization, script execution/Apple Events, file-system access, microphone access, video access. I have no idea what your statement means.