Japan Law Will Require Apple to Allow Non-WebKit Browsers on iPhone

[jdawgnoonan]

We’ve already had a phone released whose manufacturer said the USB-C port was a limiter on how thin they could make it.

Oppo says Find N5 is as thin as a USB-C port: Here’s what it looks like

Despite its thinness, the Oppo Find N5 may pack a huge 5,700mAh battery.

indianexpress.com

So not even a year into effect and the EU has already unintentionally started dictating design choices! Fantastic job! This is why bureaucrats shouldn’t be making these sorts of decisions for tech companies! They don’t know better - if they did, they’d work for a tech company, not a regulatory agency.

Look, I prefer USB-C. But mandating it in law is incredibly stupid. Especially when it was perfectly clear that Apple was moving there.

Well, I am happy my phone has USB C instead of Lightning. The only non USB C device in my house is my wife’s iPhone 14 Pro and I will be happy when she gets rid of it.

 

[surferfb]

Well, I am happy my phone has USB C instead of Lightning. The only non USB C device in my house is my wife’s iPhone 14 Pro and I will be happy when she gets rid of it.

I’m glad it’s USB-C too! Just wish the EU hadn’t mandated it, because I suspect we’ll never get a better port. Especially because I think it’s very clear Apple was already planning to switch and now we’re almost certainly stuck with USB-C for decades.

Understand many of you disagree on the last point. But the fact the EU tried to mandate Micro-USB, and used the same arguments (unlikely ports will get better, it’s better for the environment and consumers) should give everyone pause about the wisdom of government forcing these sorts of product design decisions.

 

[SnowPenguin]

In 2025, the only people who care about browsers are only incels and the mentally ill. Browsers are not a market, it’s a basic system function today for anything internet connected, and it’s none of the government’s business which (if any) browser is used. If you don’t like it, go buy (for $0, because all browsers are worthless) one of the billion other choices littered with garbage “free” browsers

It's not though. Just like any software, there are difference in what a browser can provide, from customizations, freedom of Add-Ons or privacy.

Not all browsers are equal.

 

[jdawgnoonan]

I’m obnoxious and have some more to say on this than I said previously.

I prefer using the browser version of many things which have apps simply because I do not want lots of extra apps on my phone or iPad (and the privacy invasions that they attempt to trick you into). I only install apps that have no advertising. If an app has advertising or needs to track me for almost any reason (other than local weather forecasts or navigation) then I prefer the browser. Thus I want more than one browser engine, especially considering that WebKit is not the market leader that most web developers develop for.

Secondly, I am a web developer and administrator. Professionally, for web testing, iOS is inferior to Android and I much prefer iOS (and iPadOS) to Android. If my iPad and iPhone are truly “Pro” devices for more than a camera, then I should be able to run a browser engine other than WebKit.

Thirdly, it would be pretty nice to be able to run Visual Studio Code on my iPad Pro, and VS Code runs within a Chromium shell. As long as only WebKit is allowed then that will never happen. My iPad Pro is overall my favorite device, and I would love to be able to code on it with VS Code.

If Apple allowed other browser engines it isn’t as if they would be forced onto people’s phones, thus I feel that the questions regarding security are moot.

To reiterate, browser engines are likely the most important pieces of software on modern computers.

 

[Unregistered 4U]

Fair point. But I think we can agree that the EU has made it significantly harder for one to be developed and popularized. I suspect Apple is the only one who’d do it (but maybe one of the Chinese companies would).

Wonder how EU would react to an iPhone model that wasn’t released in the EU? Although I suppose Apple would be more likely to release a phone without a port at all.

Not really a fair point. Just ask the question “Has there ever been a time when a widely used tech was NEVER improved/supplanted?” Something better than the current USB-C form factor is practically guaranteed and there’s a limited set of options for companies.
Successfully get the EU to drop the USB-C requirement, making any new port available worldwide with no friction
Produce devices that can have their ports (and feature sets) easily swapped and produce two lines, or
Just continue to sell their older products in the EU while selling the new devices to the rest of the world

It’s not a question of if, it’s when.

 

[Unregistered 4U]

then we get sued for "illegal boycotts" 😉

They’re literally saying, “We are 100% assured that no company in our country can make anything even remotely as successful as what the US has made, so we’re just going to remove the profit motive for anyone to even try to compete. It’s not like the US government has a history of forcing companies not to sell products to other countries, so they’ll ALWAYS be available to us, right?”

 

[Unregistered 4U]

“This is why Android is better, this is why Chromium is better.”
“Oh, so you use Android and a Chromium browser?”
“No, I use an iPhone, why do you ask?”

 

[H2SO4]

The government charges taxes on profit made in that country. If the taxes already charged don't cover whatever it is that the government is doing, the government is free to propose/pass new ones. Passing a tax is not "telling them how to run their business." Saying "you have to allow third party browser extensions even though you don't want to and we don't care there are legitimate security concerns with doing so" is telling them how to run their businesses.


Yes, I agree. The racetrack needs to operate safely for drivers and fans. That's a good use of government regulation. Saying "we know the racetrack has never allowed motorcycles, your racetrack isn't designed for motorcycles, allowing motorcycles increases safety risks to drivers and fans alike, the racetrack across the street does allow motorcycles, and many of your patrons choose to come to your racetrack because they like that there aren't motorcycles, but we're still going to make you allow motorcycles because we think it will increase competition" is not a good use of government regulation.


I understand your argument but I disagree this is something the government should be concerning itself with, particularly when there is a market-leading alternative that allows what the government is requiring.

You can disagree all you like. I cannot run a large business from my house, that's because the govt tells me I'm not allowed to. Are they actually telling me how to run my business?

 

[surferfb]

You can disagree all you like. I cannot run a large business from my house, that's because the govt tells me I'm not allowed to. Are they actually telling me how to run my business?

No, zoning laws like “you can’t run a large business from your house” are about where you can operate, not about how you operate (i.e., the technical design of your product or service).

I agree with you that there are a lot of valid reasons for the government to tell you how to operate, but to use a restaurant analogy, there is a big difference between the government saying "you have to keep the kitchen clean" and saying "you’re not allowed to be a vegetarian restaurant." The first is about safety standards; the second forces you to change the very nature of your business. And rules like the one we’re debating fall squarely into that second category.

To further the restaurant analogy, imagine you’re a world-famous chef running said vegetarian restaurant. Your kitchen, staff training, marketing, and customer base are all built around being vegetarian, and many patrons come specifically because you don’t serve meat. Then the government says: "Because your restaurant is so popular, you must also serve steaks. It’s not fair to the butchers that you don’t, and a few customers would prefer it if you did. And no, we don’t care that the bigger restaurant across the street already serves meat. Some customers prefer the design of your dining room, it's not fair they can't eat a steak in your dining room, and some butchers will go out of business if they can't sell in your restaurant too."

That mandate fundamentally changes your menu, increases operational complexity, alters the customer experience, and undermines the very reason many people choose your restaurant in the first place. Saying "people who don’t want meat don’t have to order it" doesn’t change the fact that your restaurant is no longer vegetarian. Meat is now in the kitchen, and cross contamination can occur even with stringent processes and procedures to prevent it, vegetarian customers may order meat without realizing what they're doing because they're used to it being a vegetarian restaurant (Doesn't help that the government added "We don't want to discourage customers from ordering meat, so you're not allowed to ask customers 'are you sure you want to order that? that dish contains meat.' or note that 'undercooked meat can make you sick'.")

That's what's going on here. The vast majority of Apple's customers want Apple to be making safety and security decisions for them. They're going to be made less safe because a tiny minority of tech nerds are upset that a profitable subset of consumers prefer Apple's approach and have convinced government regulators that the free market is wrong and therefore regulators must act.

 

[Samplasion]

The vast majority of Apple's customers want Apple to be making safety and security decisions for them.

I'm sure the "vast majority" of Apple's customers is completely ignorant to these issues or at most indifferent.

They're going to be made less safe because a tiny minority of tech nerds are upset that a profitable subset of consumers prefer Apple's approach and have convinced government regulators that the free market is wrong and therefore regulators must act.

Despite the cross-contamination spin in your analogy, it's just that. In actuality, the subset of users who are die-hard Safari fans can just keep using Safari if they so please without third-party web engines affecting them in the slightest (they don't even have to download other browsers).

 

[surferfb]

Despite the cross-contamination spin in your analogy, it's just that. In actuality, the subset of users who are die-hard Safari fans can just keep using Safari if they so please without third-party web engines affecting them in the slightest (they don't even have to download other browsers).

“We’re banning vegetarian restaurants. Too bad if some consumers want to eat in a place with no meat: if you don’t want meat, don’t order it. Restaurants have to serve it because the government says so.”

Once the regulation forces the kitchen to serve meat, the “vegetarian kitchen” doesn't stay the same while meat-eaters use a separate space. The whole kitchen must be redesigned, staff retrained, and safety protocols rewritten. It changes the risk profile for every customer, even if they never intentionally order meat. Mistakes happen.

Same deal here. Contrary to your claim, every iOS user is impacted whether they download a third-party browser or not. Allowing alternate engines isn’t just adding an app to the App Store. It changes OS-level APIs, the security model, and update cadence. The platform Apple ships to all iOS users is now different, with a larger attack surface.

Part of Apple’s brand promise is controlling key system components so they can maintain a consistent, high baseline of security and performance for every user. The browser engine mandate removes that control meaning updates, security patches, and optimizations now depend on third parties and their timelines, not Apple’s.

Some users downloaded an alternate browser years ago, have forgotten it's still installed, and will get an update that suddenly exposes them to new risks. Others will install Chrome simply because they recognize the name, unaware they’ve traded away battery life, performance, and certain security protections. When their device’s battery life tanks or they get malware, they’ll blame Apple, not Google, and certainly not the regulator that forced the change. Part of Apple’s value proposition is “we help keep you safe.” This mandate strips that away because regulators think they know better. They don't.

In fact, Apple knows its customers and its OS better than Japan or the EU does. There are legitimate security, privacy, and UX reasons for limiting browser engines. Just because you don't agree with those reasons doesn't mean they aren't valid. The more popular completion allows what regulators want. If anyone is that upset about it, they are free to choose the competition. That's how the free market works!

This is textbook over-regulation.

 

[Samplasion]

“We’re banning vegetarian restaurants. Too bad if some consumers want to eat in a place with no meat: if you don’t want meat, don’t order it. Restaurants have to serve it because the government says so.”

Once the regulation forces the kitchen to serve meat, the “vegetarian kitchen” doesn't stay the same while meat-eaters use a separate space. The whole kitchen must be redesigned, staff retrained, and safety protocols rewritten. It changes the risk profile for every customer, even if they never intentionally order meat. Mistakes happen.

Same deal here. Contrary to your claim, every iOS user is impacted whether they download a third-party browser or not. Allowing alternate engines isn’t just adding an app to the App Store. It changes OS-level APIs, the security model, and update cadence. The platform Apple ships to all iOS users is now different, with a larger attack surface.

Part of Apple’s brand promise is controlling key system components so they can maintain a consistent, high baseline of security and performance for every user. The browser engine mandate removes that control meaning updates, security patches, and optimizations now depend on third parties and their timelines, not Apple’s.

Some users downloaded an alternate browser years ago, have forgotten it's still installed, and will get an update that suddenly exposes them to new risks. Others will install Chrome simply because they recognize the name, unaware they’ve traded away battery life, performance, and certain security protections. When their device’s battery life tanks or they get malware, they’ll blame Apple, not Google, and certainly not the regulator that forced the change. Part of Apple’s value proposition is “we help keep you safe.” This mandate strips that away because regulators think they know better. They don't.

In fact, Apple knows its customers and its OS better than Japan or the EU does. There are legitimate security, privacy, and UX reasons for limiting browser engines. Just because you don't agree with those reasons doesn't mean they aren't valid. The more popular completion allows what regulators want. If anyone is that upset about it, they are free to choose the competition. That's how the free market works!

This is textbook over-regulation.

You're again pushing the analogy over its limit while ignoring the fact that it falls apart the moment you try to apply kitchen logic to browsers

Apple can keep developing Safari for iOS the way they've been developing Safari for macOS despite a minority of users using it. If you don't like it, you can download something else. If you do, it's not like it's one kitchen for all users anyway. Your phone is your phone regardless of what other people do with theirs. Apple has developed an OS that doesn't sync every user's settings among all iPhones in the world (shocking!). Besides, it's not like the app store suddenly loses its review process. It's highly improbable that a "rogue update" would suddenly compromise a device with a forgotten third party browser without user input. Apple's review process is what ensures a baseline of security and stability, regardless of third party apps. And if such update does happen, what are Apple's reviewers doing? Should we go back to the old iPhoneOS days, where you couldn't download apps?

To conclude with your analogy, why do you want to force your vegetarianism upon everyone?

 

[turbineseaplane]

Apple's review process is what ensures a baseline of security and stability, regardless of third party apps.

The review process as well as the overall design of the OS and the security model of how it all works.

Apple has confused people into thinking their app review process is where the safety is when it’s actually the design of the operating system and the security model and how it all interoperates.

What people continue to not realize is that Apple app review is actually about reviewing compliance with their business terms more than anything else.

 

[surferfb]

You're again pushing the analogy over its limit while ignoring the fact that it falls apart the moment you try to apply kitchen logic to browsers

Apple can keep developing Safari for iOS the way they've been developing Safari for macOS despite a minority of users using it. If you don't like it, you can download something else. If you do, it's not like it's one kitchen for all users anyway. Your phone is your phone regardless of what other people do with theirs. Apple has developed an OS that doesn't sync every user's settings among all iPhones in the world (shocking!).

Alternate engines aren’t just another app; they require deep OS-level hooks that don’t exist today. Once those hooks are there, they’re on every iPhone, whether or not you install Chrome or Firefox. That’s why it actually is one shared kitchen with new meat-handling equipment bolted in. Even if you never touch it, it changes the workflow, safety protocols, and contamination risks for everyone

Besides, it's not like the app store suddenly loses its review process. It's highly improbable that a "rogue update" would suddenly compromise a device with a forgotten third party browser without user input. Apple's review process is what ensures a baseline of security and stability, regardless of third party apps. And if such update does happen, what are Apple's reviewers doing? Should we go back to the old iPhoneOS days, where you couldn't download apps?

The App Store review process doesn’t fix this at all. Sure, review can block known bad code at submission, but it can’t force Google or Mozilla or whoever to ship security patches at Apple’s cadence. Today, Apple can push a WebKit fix to every iOS browser instantly via an iOS update; with alternate engines, unpatched vulnerabilities sit until the third-party vendor updates (and yes, most people keep rarely-used apps on their devices for years). That means a malicious link or file could trigger an unpatched engine without the user “choosing” to browse with it.

This is about deciding whether Apple should have the ability to control certain high-risk, always-on system components for the sake of consistent security, performance, and privacy across the platform. Apple has a coherent model for that, and always has had the same model. I think they should be allowed to continue that model. Regulators overriding it because they think they know better is exactly the kind of meddling that erodes the value proposition of the product people actually chose to buy, and leads to things like the Crowdstrike outage given to us because EU regulators dictated to Microsoft what access they had to give to third parties.

To conclude with your analogy, why do you want to force your vegetarianism upon everyone?

I don't. Android exists. If alternate browser engines are that important to you then you have an option. You take away Apple's ability to control this, and not only do you take choice away from every consumer, you further entrench Chromium, and instantly open up millions of people's devices to be less safe in exchange for something that has no benefit to the vast, vast majority of Apple's users.

Or in other words, why do you want the government to force the one vegetarian restaurant in town to cook and serve meat?

The review process as well as the overall design of the OS and the security model of how it all works.

Apple has confused people into thinking their app review process is where the safety is when it’s actually the design of the operating system and the security model and how it all interoperates.

What people continue to not realize is that Apple app review is actually about reviewing compliance with their business terms more than anything else.

I agree that Apple’s security story is much bigger than App Review and that the real backbone is the OS design and the security model baked into it.

That’s exactly why I think the alternate engine mandate matters! To allow other engines, Apple has to change that underlying design: new system-level APIs, different process isolation rules, and new update/patch pathways outside of Apple’s direct control. It makes the entire system less safe.

You can argue being less safe is worth it for the sake of choice, but I think it's way outside of the type of thing government needs to come in and mandate, particularly when the OS with 70+% of the worldwide market offers what they want.

 

[bzgnyc2]

That’s exactly why I think the alternate engine mandate matters! To allow other engines, Apple has to change that underlying design: new system-level APIs, different process isolation rules, and new update/patch pathways outside of Apple’s direct control. It makes the entire system less safe.

Apple already added some system-level APIs to comply with the EU requirement though it's unclear it had to do so so much as just not contractually prohibiting browsers from using their own engines. I would have to see strong evidence to believe the previous APIs weren't capable of supporting web engines. Web engines aren't magic and started out on much more primitive platforms than the iOS API that's available to every 3rd party application.

You can argue being less safe is worth it for the sake of choice, but I think it's way outside of the type of thing government needs to come in and mandate, particularly when the OS with 70+% of the worldwide market offers what they want.

Except iOS has about 60-65% market share in Japan, US, and Canada. 45-50% in UK. Granted much less in China and France and much much less in India (guessing country-wide averages mask higher rates in their major metros). Global market share numbers mute local market share numbers. I am guessing Japan's primary concern is the market share of a product in Japan.

In any case it's unclear to me that allowing 3rd-party web browsers to use the web engine of their choice inherently makes the whole platform less safe. It is possible that Apple's approach to meeting these new legal requirements will make the platform less safe.

 

[surferfb]

Apple already added some system-level APIs to comply with the EU requirement though it's unclear it had to do so so much as just not contractually prohibiting browsers from using their own engines. I would have to see strong evidence to believe the previous APIs weren't capable of supporting web engines. Web engines aren't magic and started out on much more primitive platforms than the iOS API that's available to every 3rd party application.

Running a full alternate engine isn’t the same as rendering web content inside the sandbox. It requires OS-level capabilities Apple deliberately restricts (e.g., JavaScript JIT, deeper network/storage hooks, tighter integration with permissions and media, etc. ). I'd note that Apple even disables JIT in Lockdown Mode because it’s an attack vector; they're not doing that just for fun.

Except iOS has about 60-65% market share in Japan, US, and Canada. 45-50% in UK. Granted much less in China and France and much much less in India (guessing country-wide averages mask higher rates in their major metros). Global market share numbers mute local market share numbers. I am guessing Japan's primary concern is the market share of a product in Japan.

My point is there is a very large, mainstream alternative with large market share that offers this. We're not talking Windows with 95% market share in 2000.

In any case it's unclear to me that allowing 3rd-party web browsers to use the web engine of their choice inherently makes the whole platform less safe. It is possible that Apple's approach to meeting these new legal requirements will make the platform less safe.

You can argue the extra risk is acceptable, or the benefit is worth it; you can’t argue there’s no added risk.

Allowing third-party engines increase risk in three serious ways:

1. More privileged code paths processing untrusted HTML/JavaScript (often with JIT).
2. Fragmented patch cadence (i.e., Apple can’t ship fixes for Blink/Gecko; users wait on those vendors’ updates.)
3. New OS-level hooks/isolation models that must be present on every device once enabled.

Those are textbook ways an attack surface grows.

The government isn’t “adding choice”; it is mandating Apple abandon a deliberately integrated security model to mirror a competitor’s, with no clear benefit for most users (but with added risk). And the fact of the matter is that even if you are right and there is no increased risk, it's still a product design decision that belong with Apple, not the government. The bar for interfering in product design decisions should be high; this doesn't come close to meeting it.

 

[bzgnyc2]

Running a full alternate engine isn’t the same as rendering web content inside the sandbox. It requires OS-level capabilities Apple deliberately restricts (e.g., JavaScript JIT, deeper network/storage hooks, tighter integration with permissions and media, etc. ). I'd note that Apple even disables JIT in Lockdown Mode because it’s an attack vector; they're not doing that just for fun.

Except the OS capabilities are already there. JIT isn't even a hard requirement for a browser though practically it would make an alternative browser non-competitive (though as you note this would just be the same as Apple's Lockdown Mode).

In any case, JIT is already possible in iOS -- just not for apps distributed through the app store. iOS already supports enterprise apps that do JIT.

Otherwise I see no evidence that iOS needs additional API to support 3rd party browsers. At best only to support them the way that Apple wants to box them in. Web browsers have been running on far more primitive OS than iOS for decades and there are other iOS apps that do equivalent things that browsers need to do already running on iOS.

My point is there is a very large, mainstream alternative with large market share that offers this. We're not talking Windows with 95% market share in 2000.

Your remark was that the alternative has 70+% of the worldwide market share. However that is misleading in this context since it is Japan making this ruling and the numbers are reversed there.

You can argue the extra risk is acceptable, or the benefit is worth it; you can’t argue there’s no added risk.

You don't have to agree with me but I can certainly argue that iOS without restrictions to run 3rd party browsers has no added risk relative to iOS with those restrictions assuming Apple's OS is properly architected.

Of course mathematically iOS + Firefox (etc) has more risk than iOS by itself but that risk is only imposed on those choosing to add Firefox. Every time anyone loads another app on to their phone they are taking on added risk. As long as the risk is generally tied to the person making the choice I am fine with it.

Allowing third-party engines increase risk in three serious ways:

1. More privileged code paths processing untrusted HTML/JavaScript (often with JIT).
2. Fragmented patch cadence (i.e., Apple can’t ship fixes for Blink/Gecko; users wait on those vendors’ updates.)

For those who choose to run 3rd-party apps. Vice-versa only having the choice of WebKit as an engine means that users don't have the option to choose web engines that make other tradeoffs as far as security/performance/usability that may be more important to them. Apple's Lockdown Mode being an example now available but not previously to everyone and still fairly binary.

1. New OS-level hooks/isolation models that must be present on every device once enabled.

I am still waiting to see specific evidence of OS-level hooks that have to be added to iOS to support 3rd party web engines.

Those are textbook ways an attack surface grows.

The government isn’t “adding choice”; it is mandating Apple abandon a deliberately integrated security model to mirror a competitor’s, with no clear benefit for most users (but with added risk).

Except Apple doesn't have to abandon their security model to support this and what Apple contractually prohibits is possible on pretty much every other OS out there. Then whether or not there is benefit for most users, there is benefit to some users and Japan thinks this is important enough to require it with what by all evidence presented so far is negligible additional risk.

And the fact of the matter is that even if you are right and there is no increased risk, it's still a product design decision that belong with Apple, not the government. The bar for interfering in product design decisions should be high; this doesn't come close to meeting it.

The governments of developed countries are involved in almost every product and service we buy. Whether we see it or not or just go through life like Mr. Magoo doesn't mean it isn't there. Whether or not this turns out to be a wise decision by Japan, they can certainly impose it on products sold there.