<story><title>Apple confirms it&apos;s breaking iPhone web apps in the EU on purpose</title><url>https://techcrunch.com/2024/02/15/apple-confirms-its-breaking-iphone-web-apps-in-the-eu-on-purpose/</url></story><parent_chain><item><author>zer00eyz</author><text>Without this type of isolation and enforcement, malicious... camera, microphone or location ... Browsers ...&lt;p&gt;30 some million lines of code in chromium browsers.&lt;p&gt;Thats bigger than the linux kernel.&lt;p&gt;The HN crowed might not LIKE apples response but they have a very defensible position.&lt;p&gt;Edit: Its not like we haven&amp;#x27;t seen this play out on the desktop recently: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.theverge.com&amp;#x2F;24054329&amp;#x2F;microsoft-edge-automatic-chrome-import-data-feature&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.theverge.com&amp;#x2F;24054329&amp;#x2F;microsoft-edge-automatic-c...&lt;/a&gt;</text></item><item><author>LeoPanthera</author><text>Since the article doesn&amp;#x27;t actually repeat what Apple has said, here&amp;#x27;s what Apple says:&lt;p&gt;== Begin quote ==&lt;p&gt;The iOS system has traditionally provided support for Home Screen web apps by building directly on WebKit and its security architecture. That integration means Home Screen web apps are managed to align with the security and privacy model for native apps on iOS, including isolation of storage and enforcement of system prompts to access privacy impacting capabilities on a per-site basis.&lt;p&gt;Without this type of isolation and enforcement, malicious web apps could read data from other web apps and recapture their permissions to gain access to a user’s camera, microphone or location without a user’s consent. Browsers also could install web apps on the system without a user’s awareness and consent. Addressing the complex security and privacy concerns associated with web apps using alternative browser engines would require building an entirely new integration architecture that does not currently exist in iOS and was not practical to undertake given the other demands of the DMA and the very low user adoption of Home Screen web apps. And so, to comply with the DMA’s requirements, we had to remove the Home Screen web apps feature in the EU.&lt;p&gt;EU users will be able to continue accessing websites directly from their Home Screen through a bookmark with minimal impact to their functionality. We expect this change to affect a small number of users. Still, we regret any impact this change — that was made as part of the work to comply with the DMA — may have on developers of Home Screen web apps and our users.&lt;p&gt;== End quote ==&lt;p&gt;Source: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;developer.apple.com&amp;#x2F;support&amp;#x2F;dma-and-apps-in-the-eu&amp;#x2F;#dev-qa&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;developer.apple.com&amp;#x2F;support&amp;#x2F;dma-and-apps-in-the-eu&amp;#x2F;#...&lt;/a&gt;</text></item></parent_chain><comment><author>arghwhat</author><text>It really doesn&amp;#x27;t make sense. By that logic, I shouldn&amp;#x27;t be allowed to load web pages because it&amp;#x27;s impossible to secure a browser. PWA&amp;#x27;s only need a few extra integration privileges like badge- and window control, rest is just a web as usual.&lt;p&gt;What you link is a case of one app (edge) reading the data of another app (chrome), which is entirely unrelated to PWAs.</text></comment>
<story><title>Apple confirms it&apos;s breaking iPhone web apps in the EU on purpose</title><url>https://techcrunch.com/2024/02/15/apple-confirms-its-breaking-iphone-web-apps-in-the-eu-on-purpose/</url></story><parent_chain><item><author>zer00eyz</author><text>Without this type of isolation and enforcement, malicious... camera, microphone or location ... Browsers ...&lt;p&gt;30 some million lines of code in chromium browsers.&lt;p&gt;Thats bigger than the linux kernel.&lt;p&gt;The HN crowed might not LIKE apples response but they have a very defensible position.&lt;p&gt;Edit: Its not like we haven&amp;#x27;t seen this play out on the desktop recently: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.theverge.com&amp;#x2F;24054329&amp;#x2F;microsoft-edge-automatic-chrome-import-data-feature&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.theverge.com&amp;#x2F;24054329&amp;#x2F;microsoft-edge-automatic-c...&lt;/a&gt;</text></item><item><author>LeoPanthera</author><text>Since the article doesn&amp;#x27;t actually repeat what Apple has said, here&amp;#x27;s what Apple says:&lt;p&gt;== Begin quote ==&lt;p&gt;The iOS system has traditionally provided support for Home Screen web apps by building directly on WebKit and its security architecture. That integration means Home Screen web apps are managed to align with the security and privacy model for native apps on iOS, including isolation of storage and enforcement of system prompts to access privacy impacting capabilities on a per-site basis.&lt;p&gt;Without this type of isolation and enforcement, malicious web apps could read data from other web apps and recapture their permissions to gain access to a user’s camera, microphone or location without a user’s consent. Browsers also could install web apps on the system without a user’s awareness and consent. Addressing the complex security and privacy concerns associated with web apps using alternative browser engines would require building an entirely new integration architecture that does not currently exist in iOS and was not practical to undertake given the other demands of the DMA and the very low user adoption of Home Screen web apps. And so, to comply with the DMA’s requirements, we had to remove the Home Screen web apps feature in the EU.&lt;p&gt;EU users will be able to continue accessing websites directly from their Home Screen through a bookmark with minimal impact to their functionality. We expect this change to affect a small number of users. Still, we regret any impact this change — that was made as part of the work to comply with the DMA — may have on developers of Home Screen web apps and our users.&lt;p&gt;== End quote ==&lt;p&gt;Source: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;developer.apple.com&amp;#x2F;support&amp;#x2F;dma-and-apps-in-the-eu&amp;#x2F;#dev-qa&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;developer.apple.com&amp;#x2F;support&amp;#x2F;dma-and-apps-in-the-eu&amp;#x2F;#...&lt;/a&gt;</text></item></parent_chain><comment><author>summerlight</author><text>Why should we trust Apple for security in that context? Apple also provides all those functionalities via their proprietary API, which is not even audit-able. If Apple really believes in that argument, they should disable their own API as well.</text></comment>