Should Apple Continue to Ban Rival Browser Engines on iOS?

[I7guy]

Probably referring to either the EUs Digital Markets Act or the USAs Open App Markets Act.

Both these bills require gatekeepers of mass market consumer operating systems to allow third parties to offer software unrestricted to consumers subject to security/privacy/law protections. Importantly the gatekeeper must prove that any restriction is actually needed for security/privacy/law with convincing evidence.

The UKs Competition and Markets Authority state in their report that they believe that there are two main possible motivations for Apple's Webkit Restriction.
1. Protect their $15 billion a year search deal with Google by preventing other browsers being able to compete with iOS Safari

2. Protect their $72.3 billion a year App Store revenue but not allowing the Web to effectively compete with Native Apps by both banning other Browsers and by not supporting key Web App features.

https://www.gov.uk/government/publications/mobile-ecosystems-market-study-interim-report/interim-report

The flip side with multiple browsers or unrestricted access is the large door it will create for zero day vulnerabilities, imo. Apple will no longer be able to fix issues with one update, it will now be up to the customer to update every browser they use, manually.

 

[I7guy]

Steve was a product guy - Tim only cares about money. Does this seem like a valid reason why Apple diesn‘t fix bugs to you?

And it is well known that Apple doesn‘t fix bugs

https://www.forbes.com/sites/andygr...security-engineer-to-apple-fix-your-sh-t/amp/

Opened the link and said thus article is more than 8 years old. Ok, not worth the time.

So Steve was a product guy that didn’t care about money and Tim is a money guy that doesn’t care about product?

 

[Sodium Chloride]

Can anyone give an example of a website that looks great with Windows or Mac but looks horrible or at least less functional with iOS?

 

[KevinN206]

The flip side with multiple browsers or unrestricted access is the large door it will create for zero day vulnerabilities, imo. Apple will no longer be able to fix issues with one update, it will now be up to the customer to update every browser they use, manually.

Can you define what unrestricted means for rendering engines? Wouldn't they have the same access to API and sandbox and isolation that Safari has?

Safari is updated with iOS since it's not a standalones app. Apps on the App Stores can be updated anytime with even more frequency than Safari on iOS.

 

[KevinN206]

Yes it is harder. But would website developers bother to test properly if it was available? Many of them didn't bother when Firefox still had >10% marketshare as it was still work. Would they bother to do it for Safari if they can force users to an alternative browser?

Firefox is not a default browser on Windows, Android, iOS, ChromeOS, and macOS. I can see a lot less incentives back then. But Safari now accounts almost 20% of all browsers worldwide, 38% in mobile, and a whopping 55% in the US. I don't know if developers would test it or not but Apple is not making it any easier. Heck, Apple could roll out a headless service that dev can freely use, but they don't.

Mobile Browser Market Share United States Of America | Statcounter Global Stats

This graph shows the market share of mobile browsers in United States Of America based on over 5 billion monthly page views.

gs.statcounter.com

 

[ja']

no

 

[I7guy]

Can you define what unrestricted means for rendering engines? Wouldn't they have the same access to API and sandbox and isolation that Safari has?

Safari is updated with iOS since it's not a standalones app. Apps on the App Stores can be updated anytime with even more frequency than Safari on iOS.

Zero days have been possible in the past through safari…by clicking on malicious links. With browsers using their own rendering engines, imo, the number of vulnerabilities is going to be like whack-a-mole.

 

[webkit]

What’s in it for Apple?

It could give Apple control over how more users navigate the internet, privacy and data collection matters, etc.

It would also be an opportunity for them to potentially benefit from or (further) monetize default settings like search engine and home page, browser extension royalties, etc. The more users Safari has, the more money Apple can potentially make.

However, as I stated, how meaningful or beneficial it would be can depend on how other players like Google react.

 

[chucker23n1]

It would also be an opportunity for them to potentially benefit from or (further) monetize default settings like search engine and home page, browser extension royalties, etc. The more users Safari has, the more money Apple can potentially make.

I think we might be at the tail end of that deal.

 

[v3rlon]

​

Google and Epic agree that Apple should change something?

It should be a no brainer to be on the other side of that argument. I am not sure how, but history would indicate that they have found a way to track you in Chromium based browsers. Look for the fine print in the EULA

Do you want us to track you and sell every bit of information we can scrape from this device to anyone with a credit card and/or paypal account?

• Yes
• Of Course
• Please, and charge me $4.99 a month, too please
• No, of course I do not want you to not track me.

 

[lcubed]

two flavors of iOS. One that's basically what we have now and one that's iOS Low Security AKA Android that has the ability to side load, load alternate browsers, etc. The license and terms would be different between the two and the messaging could be very clear what costs/benefits there are for both. Let the user decide which platform to go on.

seems like the choice is already presented

 

[jole]

How about allowing other engines, but making performance, security and privacy compromises visible by:

1) Reporting individual app impact to battery life with more granularity and alerting when the impact is significant

2) Reporting individual app impact to memory usage and consequent impact to removing other apps from memory transparently, as well as alerting user when the memory usage is significant

3) Requiring users to opt-in to allowing apps to dynamically create executable pages as required by just-in-time compilation in javascript engines. Clearly stating that allowing app to create executable pages has security implications that Apple cannot protect the user device against. Force user to choose: a) Do not allow the app to create executable pages (limiting JS engine to interpreted more vs JIT), b) allowing app to create executable pages, but ask Apple to remotely disable this whenever Apple becomes aware of security holes in the application, c) opt out of all Apple security measures regarding application and giving the app free access to creating executable pages.

4) Asking users to opt-in to use of non-system browser engine that may allow browser to track user activity more widely than user have given a preference for Safari to track. In case users choose not to opt-in, apps can then continue using system based browser engine.

This way users would have full freedom of choosing the browser engine, but would do the choice with somewhat better understanding of the implications of that choice to performance, security and privacy.

 

[michelb76]

It would be an immediate threat to the app store, since Chrome's PWA support is far, far ahead of Safari's.

 

[Realityck]

It would be an immediate threat to the app store, since Chrome's PWA support is far, far ahead of Safari's.

Why would apple ever prefer to allow PWA over native apps in iOS?

Consider PWA if:​

• You’ve just started and want a simple app for your user: PWA requires no download and lets you interact with the user via push notifications;
• You have time and budget constraints: PWA takes less time and money to develop and publish;
• You want to improve brand awareness and SEO: PWA is similar to any website and reaches a wide audience.

Consider a native app if:​

• You want to build credibility for your brand: Publishing apps on app stores increases reliability and native apps have more security options;
• You want to utilize advanced smartphone features: If geofencing and sensor/detection are essential to UX or your product requires great computing power.

 

[threesixty360]

I don’t think Apple gets it. We just want iOS to be more like Mac OS and not Android.

Maybe they get it and just don’t want to acknowledge.

iOS on big screens sucks big time. Such capable machines crippled by restricted software capabilities.

I think they get it. They designed iOS on purpose to NOT be more like macOS. That’s where everyone gets it wrong. Because there are inherent flaws in macOS that cannot be fixed that in apples mind make it not suitable for a personal and essential communication device.

 

[DFZD]

I think they get it. They designed iOS on purpose to NOT be more like macOS. That’s where everyone gets it wrong. Because there are inherent flaws in macOS that cannot be fixed that in apples mind make it not suitable for a personal and essential communication device.

Well they can at least work on releasing pro apps for iPad Pro if they are going to call it Pro and not make it Pro friendly.

 

[rp2011]

Well of course we know why a minority browser may be a problem now. Google and Facebook would love to continue to do whatever they like without Apple getting in the way.

 

[opeter]

This whole application/technology banning on Apple devices reminds me of the actual situation in Europe.

 

[ponzicoinbro]

I remember mobile Firefox and then deleting it.

 

[webkit]

I think we might be at the tail end of that deal.

I mentioned a few items in that sentence (home page default, search engine default, browser royalties, etc.) but the "deal" I assume you are referring to is the Apple deal with Google? It will be interesting to see what is revealed from the class action lawsuit as far as the full breadth of the Apple/Google deal. Is Apple really just being paid to make Google the default search or are they also being paid to stay out of the search engine business? Is Apple also possibly even being paid to stay out of the Android/ChromeOS browser business?

I am suspicious that the Apple/Google deal is about more than just making Google the default search. Mozilla (Firefox) has a similar type of search default deal with Google but doesn't get paid nearly as much as Apple even after factoring in Apple's much greater browser share.

 

[chucker23n1]

I mentioned a few items in that sentence (home page default, search engine default, browser royalties, etc.) but the "deal" I assume you are referring to is the Apple deal with Google?

Yes — the search engine default, mainly.

Is Apple really just being paid to make Google the default search or are they also being paid to stay out of the search engine business? Is Apple also possibly even being paid to stay out of the Android/ChromeOS browser business?

Maybe. The former seems conceivable to me. For the latter, why would Google care? I don't think Apple would get a particularly big share among Android users.

I am suspicious that the Apple/Google deal is about more than just making Google the default search. Mozilla (Firefox) has a similar type of search default deal with Google but doesn't get paid nearly as much as Apple even after factoring in Apple's much greater browser share.

Maybe Mozilla isn't as good at negotiations.

In any case, I think the deal is a bit dirty, even if nothing further comes to light.

 

[chucker23n1]

Can you define what unrestricted means for rendering engines? Wouldn't they have the same access to API and sandbox and isolation that Safari has?

A big one is JIT.

Modern JS engines rely on JIT for a significant performance boost, but JIT means that the same memory addresses need to be writable and executable at runtime, which creates a vector for security issues. Thus, platforms increasingly try to lock down who gets to run a JIT. On iOS, it's basically only Apple's, and in particular the one in Safari/WebKit/JavaScriptCore. For example, while you can run .NET apps in iOS through Xamarin, those are AOT, not JIT, which is unusual for .NET.

On macOS, you can opt in to using a JIT with an entitlement. On iOS, that entitlement gets your app rejected.

So that's a huge factor right there. If Chrome shipped with Chromium/Blink/V8, they'd have to disable JIT to get through App Review, and if they did that, they'd have a significant performance penalty compared to using WebKit.

 

[kc9hzn]

Based on Chrome for macOS’s poor battery/efficiency performance, I wouldn’t trust Google to do a great job of optimizing Chrome’s performance on iOS (oh sure, hardware optimizations from Android would probably carry over, but I doubt they’d take enough advantage of Apple’s iOS specific performance tools/API). But, since Chrome is used by so many other browsers, it would be absolutely critical for Google to support those optimization features (otherwise browsers on top of it, like Edge, would have no chance of presenting a high efficiency user experience).

 

[huge_apple_fangirl]

I am suspicious that the Apple/Google deal is about more than just making Google the default search. Mozilla (Firefox) has a similar type of search default deal with Google but doesn't get paid nearly as much as Apple even after factoring in Apple's much greater browser share.

I believe it may be construed as a revenue-sharing model, where Apple gets some of the search ads revenue. Safari is a hella of a lot more profitable than Firefox.

 

[webkit]

I believe it may be construed as a revenue-sharing model, where Apple gets some of the search ads revenue. Safari is a hella of a lot more profitable than Firefox.

I realize the "value" here is not just about total search traffic as the various sources of the traffic can be a factor too. For example, search traffic from a wealthier country is presumably going to be worth more than search traffic from a poorer country.

All I was pointing out is that Apple gets paid significantly more than Mozilla even after factoring in Apple's much higher overall browser market share. Perhaps it can be easily (and innocently) explained but does need to be addressed.