It really doesn't make sense. By that logic, I shouldn't be allowed to load web pages because it's impossible to secure a browser. PWA's only need a few extra integration privileges like badge- and window control, rest is just a web as usual.

What you link is a case of one app (edge) reading the data of another app (chrome), which is entirely unrelated to PWAs.

> By that logic, I shouldn't be allowed to load web pages because it's impossible to secure a browser.

Indeeed, and 'whatever browser engine you picked here' is responsible for correctly implementing these additional security features.

That's the argument; if you write an app that lets you run other apps inside it how do we make sure your app does security correctly?

When you look at it from that perspective, you can see that unless at an OS level you provide additional 'meta-security' features that allow apps that run in other apps to have fine grains access control that is managed by the OS, it's pretty much "security? Well, whatever...".

Right? I mean, whether you agree or not, it's a pretty reasonable position to take and it entirely makes sense.

> you can see that unless at an OS level you provide additional 'meta-security' features that allow apps that run in other apps to have fine grains access control that is managed by the OS, it's pretty much "security? Well, whatever...".

I don't think that's the only solution. A simple alternative is to declare that "apps that run in other apps don't get to do anything at all."

I.e. in this case, in response to a EU requirement to support alternative browser engines, Apple could — rather than disabling PWA integration altogether — drop all additional privileges that PWAs have that regular webpages don't.

Make installed PWAs in the EU market into just "webpages, but with a home-screen icon, a separate task-manager card, and no address bar." Which is 99% of the reason anyone installs a PWA anyway. No camera/microphone, no extra storage, etc. Not for Chrome PWAs, not for Safari PWAs; not for any PWAs (on these devices.) They're just webpages presented differently. No "meta-security" required!

Then everyone will just bitch PWAs can't do anything.

The Peapod grocery delivery app was already just single webview to their website. Worked fine.

But only in the EU, and only on iOS. They'd still get enhanced capabilities elsewhere. (On iOS on any other continent; on Android anywhere; on ChromiumOS anywhere, or just Chrome on desktop anywhere; etc.)

And the nice thing about PWAs, is that there's no way for a PWA to know or care that it's being run "installed", and change its expectations/requirements — as there's just no web API for that. Instead, a PWA must just attempt to talk to each of these permission-gated APIs it wants to use, and find that it's now being [prompted for and] given access to them, rather than silently refused them.

So, unlike tightening the security model around regular native apps, tightening the security sandbox around PWAs shouldn't actually fundamentally break them — they should be designed to gracefully degrade when refused these capabilities. Presuming these PWAs were already ordinary fully-functional web-apps, which have just been progressively enhanced with these features when and where available, they'll just act like they do "on the web" — which should still deliver on the app's use-case. That's what the "Progressive" in "Progressive Web Apps" is supposed to mean!

Of course, some PWAs 1. will have been designed from the ground up as PWAs, and 2. will have a purpose/use-case that's very specific to the use of these high-integrity web APIs, such that they're completely useless without these PWA-only permissions. A video-chat PWA, for example, won't do much without access to your camera + microphone. There's no point to using these webapps as webapps — and often they don't even let you do so (i.e. they attempt to access the specific API they need on launch; if they succeed, they render the app UI; if they fail, they render a prompt to install the PWA.)

I don't know if you'd really call these PWAs, since there's nothing progressive about them — there almost needs to be a different term for these apps that need the high-trust APIs to do anything-at-all. For the sake of discussion, I'll refer to these as "Elevated Web Apps" (EWAs), since they require elevated permissions to be useful.

It's only these Elevated Web Apps that would benefit from having what the GP called "meta-security": the ability to interact with the OS security on a per-webapp basis, through e.g. an Android-like install-time gate where the app presents a capabilities manifest (displayed to the user as a set of permissions it wants) and the user makes a decision of whether to accept that.

And, if Apple simply neutered PWAs rather than removing them, it's only these Elevated Web Apps that people would "miss out on."

As cool as PWAs are as a technology, these Elevated Web Apps are a true minority or them — maybe 1% or so.

And — at least as far as I know — almost all Elevated Web apps only exist for one of two reasons:

1. to serve use-cases that users with access to native apps from an app store, just have no reason to care about. (Specifically, they were developed to allow users to accomplish native-app-equivalent things on OSes that don't support any kind of native apps — like FirefoxOS nee KaiOS, or early ChromiumOS.)

2. to benefit the developer at the user's expense, by forcing the user to give the developer permissions that allow the developer to spy on the user more effectively, before the app will work — but where the app doesn't actually do anything with these permissions to serve the use-case. (I've seen a few scammy Chinese dating sites demand to be installed as a PWA for this reason.)

In other words: on iOS, at least, you probably won't miss them! (Especially with the third-party App Store ruling also in place in the EU! Things like emulators don't need to be relegated to "WASM running in a PWA" any more; in the EU, they can just be third-party-store apps!)

This would run foul against the DMA, unless they make safari PWA also less capable.

That’s what I meant/said — they’d neuter the PWA framework itself, which would mean that any PWA (including Safari PWAs) would just become “regular webpages but standalone.”

>and 'whatever browser engine you picked here' is responsible for correctly implementing these additional security features.

so, Apple? Since Apple has also required browsers for years to use their own safari backend, this isn't even an issue of "oh well it doesn't work on Firefox".

Sounds like they cornered themselves there.

Apple’s hand has been forced to implement changes that didn’t fit their vision and roadmap.

I imagine that if you’re on HN you are close to developers or are a developer yourself.

And if so, I imagine that you have already had an important customer (to who you cannot say “no”), completely change your plans and architecture with a new feature request while setting an aggressive deadline (ie, you don’t have time to implement everything and must make choices)

Now replace you with “Apple” and “important customer” with EU.

That is simply just nonsense.

They had 1,5 years from the time of being identified as gatekeepers to work on this.

The DMA was voted on by the EU parliament and then the council in july 2022, Apple was identified as a gatekeeper in september 2022, the law became legally implemented in november 2022, with gatekeepers required to comply with it by march 6th 2024.

I do not buy for a second that the richest tech company on the planet, that owns, designs and manufactures the whole tech stack their product uses was unable to respond in due time to the legally required changes and so 'just had to go this route due to time constraints'.

The simple answer is that it’s not worth it to them.

They don’t see money with PWA at this point in time and therefore decided that breaking support was not a big deal.

It obviously outrages everyone on HN, but HN is not your average customer of Apple.

Oh I don't care one iota about PWA's on iOS.

However the parent argument was a weak one, and so had to be answered with facts.

>I imagine that you have already had an important customer (to who you cannot say “no”), completely change your plans and architecture with a new feature request while setting an aggressive deadline

Sure. I sure do wish the demands were actually consumer centric, and not "force all these advertising tracking into your site, tank performance, and grab a bunch of unneeded user data".

And of course, if I maliciously complied and "oops the tracking only gets 1% of user data", I would simply be fired instead of get another strongly worded letter leading to meetings re-defining what "grab a bunch if unneeded user data" is.

You are confusing the “important customer” with “other customers”.

EU is the “important customer”, the users of PWA are “other customers”.

Using your example, you would implement tracking for that important customer (and comply 100% to the requirements as Apple did) but because of this additional bloat, the website would load 2 times slower.

After a discussion with your colleagues, you would realize that:

- Most users won’t care about the slow loading (including the important customer)

- Re-architecturing the website to keep the same level of performance while adding the necessary tracking required by the important customer would delay shipping the tracking by 1 year, past the 2 months deadline required by the important customer.

Back to your desk, you start implementing the tracking that will incur a 2x slower load time.

>You are confusing the “important customer” with “other customers”.

I'd love to one day work for a place where I can dismiss monetization as "the other customer". But alas, my career hasn't been that friendly.

>Using your example, you would implement tracking for that important customer (and comply 100% to the requirements as Apple did) but because of this additional bloat, the website would load 2 times slower.

Given how the topic is:

>Following developer complaints and press reports about how PWAs were no longer functional in the EU after installing the most recent iOS betas

I fail to see how the EU is the "important customer" here. And not the powers that be in Apple telling me to maliciously comply.

The EU said "allow other app stores to exist" and my theoretical manager at Apple is saying "okay, PWAs can exist but they don't have to run well. Add in unnecessary security (because the NA version doesn't have it) that disables functionality". I don't even see how it has to do with complying with the EU, unless it's soke long term OS lock down for future app stores.

Tell me how the EU here is the one telling me to slow down my OS/browser?

I don't see how this refutes GP's point. Yes, it's a big challenge but when they are allowing other browsers, the challenge is met already. The "install to home screen" feature adds but very minute extra features.

I guess the issue is that PWA is more deeply integrated… so instead of having this integration within the OS using their WKWebView component, they need to make it a user choice which browser component is used. This component then has to be installable through the App Store. This then also means an ‘app’ is hosted by another ‘app’, and to do this properly that host app needs to many permissions

My understanding is that Apple can provide security guarantees only for their own browser, because it's tightly integrated with the rest of their stack.

> if you write an app that lets you run other apps inside it how do we make sure your app does security correctly?

But browsers already have this security features that isolates websites from each other? How come PWA, which essentially just placing a website shortcut in the home screen and hiding browser ui, affect browser's existing security features?

It doesn’t, of course. Apple’s real concern is that if Chrome is allowed to host standalone PWAs, it can also remove some of the unnecessary pain pointed that Apple’s Safari maliciously injected to kneecap PWAs in the first place. For example, Chrome could make it easy for users to install a PWA. Chrome could support more web standards. Etc. This would create a true alternative to the App Store, with no Apple tax, and of course Apple isn’t going to let that happen without kicking and screaming.

Yes because PWAs are so popular on Android

They’re not as necessary on Android because Android has alternative App distribution methods.

Right. Because downloading from alternate app stores or from the web is really easier than creating a PWA and is easier for discoverability.

But that is a new retort when I ask that same question most of the time. Often it’s because of mean old Apple that PWAs aren’t more popular on Android.

But since now that there will be alternate means of distribution in the EU, you should be okay with no PWAs in the EU?

Do you have a coherent point you're trying to make? We're discussing Apple here. These wanna be "gotchas" aren't nearly as clever as you think.

> But since now that there will be alternate means of distribution in the EU, you should be okay with no PWAs in the EU?

I see, a hardened Apple defender. Nice show of cards! There are no alternative means of distribution in the EU that don't involve paying large sums of money to Apple, but you already knew that.

My points are the same neither consumers or the companies that make most of the money from mobile care about PWAs

My second point is if it just Apple and Safari holding back the adoption of PWAs, then why aren’t they more popular on Android if Chrome is so much better?

Why aren’t companies creating PWAs for Android to avoid the same 30% cut? Are they okay with paying “large sums of money” to Google?

Why aren’t they using third party app stores on Android or letting users download directly from them?

(And the HN gods are mad at me for some reason)

I thought the whole point of PWAs was that they could access user files directly, which they wouldn't be able to as a webpage inside a browser's sandbox? If that's not the case it's just a bookmark.

Nah, it's secure because the OS is secure. No difference between an app itself and an app running "other apps".

It's all just code sandboxed by the OS. Apple is just being pathetic because they couldn't force legislators to do their bidding.

> Indeeed, and 'whatever browser engine you picked here' is responsible for correctly implementing these additional security features.

Yes, and Apple now (against their will) allow me to select this browser myself to browser the web with.

Whether I use this to load a webpage normally or as a PWA does not change the risk I was exposed to. PWAs just let a web application ask the browser to run "fullscreen" without browser chrome, to set its badge and colors, to register as a handler for certain URL types, and to open the share panel. All actions already taken regularly by said browser.

Even if we assume Apple's statement that other browsers are insecure is correct, there is no value in blocking PWAs and requiring me to instead use bookmarks: I am still loading said application in said browser that implements and uses all this functionality itself. To the OS, a PWA is nothing more than a type of bookmark for a browser.

So, no - this is not reasonable and their argument makes no sense. If it was true that Safari was actually safer, then Apple should instead spend energy sharing how so that other apps can be equally safe - it would be incredibly irresponsible for the platform owner to keep security as secret sauce - rather than handicapping other apps.

> What you link is a case of one app (edge) reading the data of another app (chrome), which is entirely unrelated to PWAs.

In one sense, sure.

But in another sense Edge taking Chrome's tabs means Microsoft is getting insight into Google's data. A lot of Apple's defenses seem really targeted at reducing the ability of Microsoft, Google, and Meta to extract value from Apple's users. Apple sees the union of all the app data, but their competitors can't put together that picture. So in that sense, Edge eating Chrome data may be the sort of thing they're looking to prevent.

After all, Apple users are the product. They even pay for the privilege!

They are a cash flow generating financial product, like a bond ETF. Apple packages users, resell them to the highest bidder, and interest is collected as return on investment from the payments users make.

Ofc, like a bond, a user pays for a reason: he gets something out of the facility provided by Apple, in kind.

Apple users are not products. That would be Google/chrome/android users

In my experience even "a few extras privileges" can take many months to implement, especially for a company as large as Apple.

The EU gave them six months after being designated as a gatekeeper. The regulation already entered into force an additional ten months earlier, so Apple arguably could have already prepared for their likely designation.

The real issue, however, is that Apple is not saying “we need more time to implement the APIs”, which the EU would very likely concede, but “we don’t think it’s worth it for us”.

Is that teally an issue? From a legal perspective (as a layman) Apples decision seems fine for me. So how can we say "bad Apple" if they're legally doing it correct?

That does not mean that their decision is the proper one, just that it's legally ok.

Why are you limiting this to the legal perspective? They are not doing what is in the interest of their users (and the spirit of the DMA), for petty reasons. As a user, that’s obviously bad.

Why should we trust Apple for security in that context? Apple also provides all those functionalities via their proprietary API, which is not even audit-able. If Apple really believes in that argument, they should disable their own API as well.

You have to trust someone if you're using a computing device connected to the Internet. The point of being in Apple ecosystem is that you trust Apple, and then (supposedly) you can not trust anyone else. To many that's a very strong proposition.

Why can’t I choose to trust Apple for iOS and another developer for other functionality that runs on iOS?

We do this all the time. I don’t uniquely depend on Microsoft for stuff that runs on Windows. Same for stuff that runs on macOS. And on Linux I’m not even sure who I’m trusting from the ground up other than a huge and disparate collection of people.

So what makes iOS so unique that it can’t run PWAs, which is little more than adding some chrome and a handful of APIs to already pre-existing browser capabilities.

What an F’ing joke. And the bigger joke are the Apple fans who are going out of their way to defend Apple sticking it up their nether parts.

It’s not unique to Apple. It’s an inherent problem to securing Turing machines.

If you are not an Apple user not an Apple fan why do you care so much about Apple and its users?

> The point of being in Apple ecosystem is that you trust Apple,

This seems to be over-generalization? Users are using Apple devices because those are good products, not because they want to delegate every single trust problem to the Apple ecosystem. That might be a great proposition for people like you, but there is a significant number of people who consider it a compromise rather than a value.

Users trust Apple because Apple is ultimately accountable for security breaches on iOS devices. If a 3rd party app causes a data breach it does not matter if the breach was made possible by compliance with regulations like the DMA, Apple will still take the blame.

> Users trust Apple because Apple is ultimately accountable for security breaches on iOS devices.

As a long time user of Windows which historically had an incomparably large amount of security incidents, I can assure you that Apple won't get blamed that much for 3rd party data breach unless it involves Apple's own service and user data.

Since you’re a commenter on HN I’m going to assume you’re a tech person. I’m not talking about tech people, who through their discussions try to find the correct person/company to blame for issues.

I’m talking about the general public. If a story about a data breach in a 3rd party app — affecting iOS users — hits the news cycle, Apple will take the blame and their brand reputation and sales will be impacted. It doesn’t matter whose fault it really is, Apple is the face of the iPhone and through their walled garden they have accepted final responsibility for everything that occurs on iOS.

I don't see how this matters to the GP's argument. Windows was a virus hotbed for decades and that does not appear to have affected its reputation in a meaningful way.

That’s because Windows’ reputation was already mud. Microsoft made their business on corporate users anyway. Apple is a consumer brand. A data breach on iOS is like nudity in a Disney movie: utterly brand-destroying.

Windows was both. If you were buying a computer in the early 2000s, it was almost certainly a Windows PC.

Right, but Apple built their brand on being the alternative to Windows for people who didn’t want to deal with security issues, viruses, crashes, bundled junkware, etc.

You can draw a direct line between Apple’s original marketing pitch (easy to use, simple, secure, appliance-style computing) and the iOS walled garden. Just as you can with Disney and their family-oriented brand. It’s not a compelling argument to say that other film studios have nudity in their films when Disney is the brand at issue.

That was because Microsoft abused their monopoly in operating systems at the time to force OEMs to use their OS on all their computers in order to maintain the industry discounts on OEM licensing.

Also because there weren’t really any credible alternatives

Back in the day MSFT bolted IE into the operating system to a greater degree than Apple has done with Safari - a ton of the DLL's relied on IE for a lot of UI components and IE had ActiveX that literally hosted executable content in a browser window. It's almost like they hung out a sign on every PC and Windows server that said "please p0wn this machine" and lots of the bad actors in the world came knocking.

They didn't take security seriously when they were laying down the architecture for Windows because they didn't think they had to. Apple is taking the exact opposite approach. They're fairly obsessed with security and privacy because that's one of the big selling points for the whole iOS ecosystem. They miss things because they (like us) live in the real world but they do pay a lot of attention to it and the number of updates for things like 0day defects that arrive within days of the defects being reported tells me that this continues to this day.

Apple doesn't have a monopoly. Per https://gs.statcounter.com/os-market-share/mobile/worldwide Android has twice the market share that iOS has. The reason for all of this generated drama is found in https://www.businessofapps.com/data/app-revenues/. The key bullet points are:

"App Revenue Key Statistics

* Mobile ad spend in 2022 reached $362 billion, a 7.7% increase on the previous year * Android and iOS app consumer spending increased to $135 billion in 2023 * iOS was responsible for 66% of app consumer spending in 2023 * Games accounted for 60% of consumer app spending in 2023. Google Play contributed 41% of the total amount * Subscription revenues increased to $45.6 billion in 2023, iOS was responsible for 76% of that revenue"

The real reason for all this foolishness can be found in these bullet points. 66% of $135 billion is $89.1 billion, and lots of people would love to get a piece of that pie without dealing with Apple (who built and owns the stack). It isn't a monopoly, though, and all of that monopoly talk is misdirection.

Windows doesn’t have a reputation. It’s the default. Nobody actually likes using windows you just have to. Do you really think there are people out there asking for advertisements in their start menu?

To this day, I prefer windows, and I have to switch between Mac and windows all day every day.

What was the last 3rd party breach Apple took the blame for?

Fappening. Apple took all of the blame and then we got mandatory MFA. The logjc works even if it’s the own users fault for getting scammed.

I as an Apple user will blame Apple for design choices that lead to 3rd party breaches of my data and privacy.

>there is a significant number of people who consider it as a compromise rather than a value.

I suspect that from Apple's perspective, it is definitively not a significant number.

For Apple, ownership of the "trust problem" is an intrinsic part of "making good products".

> For Apple, ownership of the "trust problem" is an intrinsic part of "making good products".

Yes, this might be true. And the majority of elected officials in EU fundamentally disagrees with that statement.

> And the majority of elected officials in EU fundamentally disagrees with that statement.

Well, EU can and will force, fine, or ban US companies as they see fit but there is not some fundamental correctness to their viewpoint

Any fundamental correctness of their viewpoint is by virtue of them representing more people (EU citizens) than Apple's CEO represents (himself and, I guess, the Apple corporation, if you count that). On moral issues, the fundamentally "correct" viewpoint (if there is one) is, by definition, the one that more people say is the fundamentally "correct" viewpoint.

Governments in other countries have come to a different view, and it's for Apple to determine how worth it is for them to conform to the view come to by the representatives of the EU citizens versus catering to markets with other regulatory regimes.

What you should be comparing is the percentage of the market the EU represents in the total market available to Apple. EU politicians are accountable to their population. Apple’s CEO is accountable to every Apple customer. The EU does not now, nor has it ever, constituted a majority of Apple revenue.

I'd argue that's not the case. CEO's are accountable to share holders, not its customers. And before you say its the same thing, there are a lot of pubically traded companies who get away with unlawful actions that direct effect its customer's for a long, long time without their bottom line being effected.

I don't believe the concept of a market has any fundamental place in morality, and my morality isn't limited to any particular "market".

Indeed, who apple is or isn't able to sell to, doesn't affect what people think is moral or immoral.

As for Apple's CEO representing Apple's customers: Are you sure? We didn't elect him. We just bought stuff made by an organization he currently runs.

So you think government can prove morality, but markets cannot? If you don't think government is a marketplace where the currency is political capital, then you have a naive view of how governments work. Also, I don't believe the EU is a direct democracy, so the representative morality is lossy. Have you never disagreed with a decision made by a politician you voted for?

I'm saying that customers decide whether or not to buy from Apple based on whether they resonate with them from a moral standpoint, at least as part of their decision to purchase their products. And I said Apple's CEO is accountable to their customers, not that they represent them. Yes, they're also accountable to shareholders, as your sibling comment points out. But if the company screws up enough to elicit a popular boycott, you can bet the reason shareholders will be exercising that accountability is due to the actions of the customer base.

Yes, a democratic government represents the people, and thus their moral stance. A market sells stuff. There's really no relationship between the two nouns. No reason to compare them. You might as well ask, "So the people can decide what's moral, but a jar of pickles can't?" Yes, that's correct. A jar of pickles is technically a market, so this analogy applies particularly well.

> I'm saying that customers decide whether or not to buy from Apple based on whether they resonate with them from a moral standpoint

I fully believe that you might do that yourself. There's no evidence everyone else does, or even that a majority do. Especially since most people aren't informed of working conditions involved in manufacturing Apple products (or indeed, many others' products).

It's just not believable that everyone thinks that buying a product = agreeing with every single moral stance made by the person currently running the company. And what if he changed his mind tomorrow? Would he offer a full refund to everybody who asked for one?

> And I said Apple's CEO is accountable to their customers, not that they represent them.

He's not accountable to them, only to the board*, but we're discussing representation - that is, speaking on behalf of a people, according to those people, not you or I or the speaker individually. If you mentioned accountability while we were on the topic of representation, and I returned us to the topic of representation, you're welcome :)

[*]: Your example illustrates this: a complex chain of accountability from CEO to Corporation and BoD to Corporation and Corporation to shareholders is required for any action to happen. Being accountable to customers means customers can decide to fire him _directly_.

> you mentioned accountability while we were on the topic of representation

Because they are interrelated concepts. Without accountability you can’t be trusted to faithfully represent someone. “Representation” without accountability is autocracy.

Also, chill with the condescension.

You are right, they may relate, and thus can be easy to confuse for each other when one is being discussed. So we have to be extra careful when bringing one up in a discussion about the other.

In this case, though, the CEO is not accountable to customers, and the CEO does not represent customers, so not too confusing. He is accountable to the BoD (nobody else can fire him) and represents the corporation. The interests of other parties, including customers, are secondary to, and when opposed lose to, the interests of the corporation.

China represents twice as many people as the EU. This is not an enticing argument. Can you at least qualify this with democratic representation?

Which free and democratic election did Xi win?

none, which is what the comment was complaining about.

Thank you for your comment. In the spirit of interpreting it in the most charitable way possible, I assume that when you say "China", you mean the Chinese government. The answer is that Chinese government doesn't necessarily represent people living in China. As you say, it is not democratic. That leaves us with few indicators of representation.

It has control over the people living in China, true, but I do not think controlling a person, being able to put them in jail if they don't obey you, is the same thing as representing them.

Because of course elected officials without any expertise, representing a very small minority of humanity, are the best arbiters of reality.

Non experts have to rule on expert subjects all the time - sometimes this goes hilariously wrong (like the internet being a series of tubes) but usually what happens is that the non-expert relies on the testimony of experts to make their judgement.

Politicians aren't expected to be experts due to the immense breadth of subjects they need to consider - they're expected to consult experts. Whether an individual politician is an expert[1] is pretty irrelevant.

All of these statements are about our general expectations of politicians - whether you think politicians adhere to that point or have comments on specific politicians is beside the scope of my comment. As a less controversial example it might be good to instead consider how judges operate who are expected to provide well reasoned judgements on subjects they know nothing about.

1. Sometimes those former expert politicians are the worst of all since they _think_ they know the way things are and won't listen to actual experts but they've been out of the industry so long that they've lost their familiarity with the subject.

>sometimes this goes hilariously wrong (like the internet being a series of tubes)

That didn't go hilariously wrong, though - the internet is a series of tubes. Not physically (copper cables aren't tubes) but he obviously wasn't talking about specific stuff but broad-strokes analogy (his exact line was "It's not a big truck. It's a series of tubes."), and his description was basically accurate.

Unlike trillion-dollar corporations?

Yeah, as I’ve said before: the root problem here is that the EU wants to outlaw apples business model.

People don’t think of it that way, they tell themselves all the reasons why that’s a good thing, but that’s ultimately what it is - a legislative solution to end the “android vs iOS” debate for all time.

The argument is walled gardens shouldn’t exist, so the solution is to either legislate requirements that apple destroy the walls, or that they exit the market. That is a statement that most android advocates would agree with.

And the EU will largely just keep ratcheting up the legislation until that happens. Driving apple out is the point - walled gardens are (in the EU sense) unacceptable and the option for a walled-garden business model needs to be removed from the market.

Apple is (correctly) perceiving this and pulling out of the market, first by dropping the affected features, and I’m sure there will be a “next compliance requirement” before many years too.

I feel like this is a win for consumers - I'd much rather there remain more OS competition on mobile devices[1] but if Apple wants to pursue a business model that excludes large portions of the world from their customer base that's their decision. I don't believe there exists any maliciousness from the EU towards Apple - they do, after all, benefit greatly from corporation tax revenues from Apple and iPhones are still quite popular in the EU. I think at the end of the day there's just a difference in the social expectation of privacy and freedom between the EU and NA. Apple, being primarily steeped in NA's expectations for freedom, hasn't built an ecosystem that is compatible with the EU's higher expectations.

1. Still hoping to see something amazing RIM!

> NA's expectations for freedom

That'd be "corporate freedom" rather than "end user freedom" yeah?

That's my impression of what the NA model of freedom seems to mean these days.

I don't see how you can call EU having any expectation of freedom when commenting about a law which forces a company to comply to regulation.

This actively reduces freedom, the freedom of running your business. You just don't care about it.

If you don't like walled gardens you can just not use them (I certainly never bought anything Apple for this very reason), there's no need to infringe on the freedom of everyone else who wants to use walled gardens.

The EU is in general becoming increasingly less free, thanks to barely elected bureaucrats who line up their pockets with sponsors money.

I think this is a great example of what I had mentioned as social differences of freedom between the EU and NA - in NA the freedom of businesses is often well protected up until it causes actual harm to human beings[1] - in the EU the freedom of human beings tend to be given priority of those of companies. It's important to remember that there are a lot of freedoms in this world and they often conflict in major ways. A quote that I love is "Your right to swing your arms ends just where the other man's nose begins". Freedoms are extremely easy to guarantee if they're non-conflicting but that's rarely the case. In this case the EU is siding with the freedoms of the customers rather than the freedom of the corporation - whether that makes the society less or more free overall is a matter of opinion.

1. I'd point to a great example from one of our current justices in this regard: https://www.theguardian.com/law/2017/mar/23/neil-gorsuch-sup...

That dissent sent him to the top of the Heritage Foundation SC shortlist for being a corporate kowtowing stooge.

> If you don't like walled gardens you can just not use them (I certainly never bought anything Apple for this very reason), there's no need to infringe on the freedom of everyone else who wants to use walled gardens.

No-one's forcing Apple customers to go outside the walled garden. They can still source their apps from only the Apple App Store.

> line up their pockets with sponsors money.

That's not just an EU problem though. It seems to be well established (and perhaps worse?) in many places.

Companies don't have freedom. People do. Companies are a collection of people that have a responsibility to the people who allow them to operating by charters. In our current age, I'd say that justice in this regard isn't operating as it should, because our governments are allowing selfish individuals within companies to do illegal stuff that go against the original intent of charters. Individuals that would normally be held accountable for their actions are now being protected from being prosecuted for harms they commit while being part business.

Companies are designed and allowed, by characters, to operate within the scope of whats good for society. If it harms the public good then it needs to be reigned in. I have no illusions that companies have the same standing and rights as living beings do. They are lifeless entities meant to be subject to the will of people.

>This actively reduces freedom, the freedom of running your business. You just don't care about it.

In the same way Right to Repair, Minimum Wage, and Disciminatory hiring affects the freedom of running a business, sure. Unfortunately, rules are written in blood and this is happening because other businesses at this point abused the point of labor or customer satisfaction and needed to get dinged for it.

In this case, Blame Microsoft, I guess. Heck, even Google. we already know the result of a closed system abusing its platform and large share to make its product worse. I'm glad we're actually jumping into this before it's too late (like we usually do).

Apple is free to switch to a less fascistic business model.

Is SELinux also fascistic? Grow up.

if someone wants to sell systems where the only supported configuration is SELinux, why should that be illegal?

> Users are using Apple devices because those are good products,..

For general populace good also include secure by default.

"every single trust problem to the Apple ecosystem." is rather technical point that very few people would even understand meaning of it.

> significant number of people who consider it a compromise

How significant compare to iPhone user base?

I'd rather trust a public (not-for-profit) institution that actually had a real incentive to protect user security. Instead we get for-profit companies that have a vested interest (conflict of interest) to do security the way it thinks it should be done. In my experience, that usually is bad for the people that are using the platform because there is no real surety that security is being done for the sake of the users.

Apple has no interest in working with public institutions that have a close relationship with the people they serve. That's a big red flag in my book. You cant trust a company that serves content and hardware and at the same time trust them with security. It's too many eggs in one basket, to easy of a target for rogue entities (NSA) even if they have good motives .

Which public institutions do you find have real concern for their users? In which country?

https://eff.org, https://fsfe.org, https://edri.org.

And to a degree, that’s why developers tend to hate Apple. They paint us as a pack of crims trying to steal from unsuspecting Apple users.

I think you are conflating the relationship between consumers/developers and the corporation (that you work for?).

I don't hate Apple, but rather realise that it's bottom line and fiduciary duty to its shareholders is stronger than what is best for us (consumers/developers).

I do not trust the corporate marketing one bit (and honestly, why should I?).

This behaviour of Apple just further supports that view. As a company, it seems to believe it is somehow above following the rules meant to benefit consumers/developers, something the conpany has been marketing its self with since the 80's.

So lets stop the 'Leave Apple alone (and us that work there)' crying, and just acknowledge what the whole thing revolves around.

It’s possible to hate them and recognize why they’re doing at the same time though…although I do think there’s also a hefty dose of arrogance and self importance in there. I’m old enough to remember when we (devs) felt this way toward Microsoft…so if I was Tim Apple I’d include that risk in my calculus cause what came next was two decades in the penalty box.

Seems like they hate us (developers) back though so it’s a mutual relationship I suppose.

> They paint us as a pack of crims trying to steal from unsuspecting Apple users.

Have you seen the world around you for the past 20 years or so? I'd say this characterises developers (well, companies they work for at least) quite well, don't you think?

No, I’d say the vast majority of reputable developers are not trying to scam you.

But there are some trying to scam you…and some of those are also in the App Store…as long as they use IAP to scam you all is well.

There are two kinds of trust, I may trust Apple to not intentionally steal data. But I may trust Signal to create a more inherently secure messenger, or I may trust Google to create technically a more secure browser.

What Apple and some users here are saying that users don't have intelligence to judge it and so will have to trust only Apple.

But that's what the EU is willing to reform. Apple isnt a EU company, hell it may even not contribute much to the tax base, there's less reason to trust them in exchange for gatekeeping against EU companies trying to generate tax revenue on their plarform.

Trusting Apple is nice in the US where it's probably a net contributor to the country's development. Elsewhere, not so.

Well, while the argument is entirely bogus as "PWAs are unsafe" implies that loading web pages in that browser itself is unsafe and thus stopping PWAs but not loading pages is pointless, you do have to have full trust in Apple for security of your device as they are the sole provider for the core platform providing most of the security primitives used.

That just doesn't exclude trusting others as well.

> Well, while the argument is entirely bogus as "PWAs are unsafe" implies that loading web pages in that browser itself is unsafe

Except that's exactly what Apple is saying. Their engine -- and their brand depends on it -- offers users assurances arbitrary engines do not offer. Apple says PWAs are safe because Safari is safe, while not-Safari PWAs are not-safe.

And, if not safe, Apple is at least accountable.

Google's brand, for instance, does not depend on it: https://www.engadget.com/the-morning-after-google-will-settl...

Apple’s inability to protect its “brand” while doing what nearly every other platform owner in the world does routinely does not justify monopolistic and anti competitive behavior.

Well, that link definitely plays in Apple's favour :)

It doesn’t matter - they are going to support third party browsers anyway.

They are just afraid the browsers will host PWAs better than Safari does, making them a more viable alternative to the App Store.

> Except that's exactly what Apple is saying.

You misunderstand. If a foreign browser engine was to be made available for PWAs, it would be because the user installed the browser and browsed the web with it. In other words, if loading a web page in this browser was unsafe - which is what a PWA is - the user would already be compromised. PWA or bookmark does not matter.

PWAs do not change the risk profile. PWAs only get a few extra APIs, but nothing major. Location, microphone, webcam, bluetooth, usb, etc. are all standard web APIs available to web pages, not PWA specific.

The argument that PWA specifically has a special risk profile is null and void. The only sensible reasoning is that Apple is strongly against opening their platform at all (their way of implementing compliance is borderline malicious), and maybe want to weasel their way out of any effort they can avoid (allowing users to install new types of apps is zero work, changing which app opens a link by default is near-zero, while allowing users to replace the engine for PWAs require a bit more integration).

>implies that loading web pages in that browser itself is unsafe

Since when was loading web pages ever considered safe, at least by those who actually breathe computer?

It's frankly alarming how much trust we (must) give to Arbitrary, Remotely Executed Code(tm), especially given how many attack vectors are remote code executions.

Never, but the world wide web is the one force of nature even Jobs couldn't fight back against. I'm sure he tried, too. So like most "too popular" stuff, it was given an exception that no other type of app would ever dream of.

Well, that's a different argument altogether. Whether you consider browsing the web in any browser safe or not, the fact that PWAs do not change the risk profile of loading such pages remain true.

We don't entirely trust Apple. We just trust them more than other vendors.

Who is "we"?

Probably the folk upvoting my comment.

This is a false dichotomy. Completely trusting any single entity who doesn't really care about you (and only cares about extracting money from you) is riskier than trusting FLOSS, which is being constantly verified by independent actors.

That is not really how it works though. Look at the amount of limping, poorly implemented FLOSS software there is out there where the maintainers show no interest at all or there is no funding to support it. Look at the whole OpenSSL mess a while back.

I honestly prefer to pay a vendor who will (a) complete a product until it's usable (b) be motivated to maintain it because they are paid and (c) be motivated to maintain it because they are scared of the bad PR of not maintaining it.

Apple OSes are insecure by design to aid surveillance (sneak.berlin)

43 points by vitplister 4 months ago | 32 comments

https://news.ycombinator.com/item?id=37875370

Apple fined $8.5M for illegally collecting iPhone owners' data for ads (gizmodo.com)

334 points by nixcraft on Jan 8, 2023 | 134 comments

https://news.ycombinator.com/item?id=34299433

Apple's Cooperation with Authoritarian Governments (jessesquires.com)

468 points by ig0r0 on March 31, 2021 | 291 comments

https://news.ycombinator.com/item?id=26644216

Apple reportedly dropped plan for encrypting backups after FBI complained (2020) (theverge.com)

425 points by samename on Jan 14, 2021 | 137 comments

https://news.ycombinator.com/item?id=25777207

Apple’s business model excludes Clickjacking, stealing personal Information, stealing passwords, commissions from redirects, commissions from gambling sites redirects. Those in that business use browser plugins to get inside your security boundary so your argument maybe over my head or baby bath water thing

Using an Apple device requires trust in Apple even if you run a 3rd party operating system let alone a 3rd party application on their OS.

I don't trust anyone, but historically they seem on par with the big guys like Microsoft and Google. At some point you accept someone's security model or you roll your own system I guess and hope you're better than the security teams at these companies?

If you truly have this view then I all but guarantee that you aren’t using iOS in the first place. This is a thought-terminating bad-faith argument.

Your argument might be only applicable to some sort of fundamentalists. Most people in the real world make informed decision based on lots of different factors. I'm pointing out that Apple speaks like a security fundamentalist but doesn't act like such. They should choose either one of being fundamentalist or realist, not cherrypicking whatever traits that work in favor of themselves.

Not everyone makes their own device choices. Or they didn't know the problems involved yet when they bought the device. Or there could be a thousand other reasons.

I share the GP's view and I use an iPhone because I must have access to iMessage and there is no alternate way to do that.

Android handles this just fine. These are the world's largest corporations we're talking about, not some mom and pop shop that will be crushed under the heel of overzealous regulation.

Suddenly the user respecting innovators are all out of ideas!

First, we should not be content to crush mom and pop shops with regulations.

Second, it’s entirely dependent on the regulation whether it crushes (or even just hurts) a behemoth.

So Android allows alternative rendering engines besides Chrome for PWA? If you install Firefox it uses Gecko but still has native app look feel? I honestly don't know but would be surprised if they did.

> So Android allows alternative rendering engines besides Chrome for PWA?

Yes: https://developer.mozilla.org/en-US/docs/Web/Progressive_web...

I tested just now in Firefox with an app from https://appsco.pe and it does indeed work!

I can do the same with the Android version of Brave.

> If you install Firefox it uses Gecko but still has native app look feel?

That depends on your definition. Making an app _feel_ native is a matter of implementation. But the opposite is also true: A native app is free to feel non-native if the app creator makes it that way.

The app does show as a distinct entry in the app switcher, but still has a Firefox icon when I tested it just now.

> I tested just now in Firefox with an app from https://appsco.pe and it does indeed work!

I tested just now in firefox with an app from https://appsco.pe and it just...opened a browser tab with the website.

So I understand a PWA is just a website but isn't the whole point to have a dedicated window/card for it?

I don't know what your setup is, but it did work for me, creating an app that shows as its own icon on the homescreen, without FF chrome, with a separate app-switcher entry. Using a S24 Ultra with whatever the current OneUI is.

I think it wasn't my setup but the app I tested on (Imgur). Trying another one worked.

It looks like appsco.pe has some incorrect entries in its list of PWA.

Tried with Twitter, worked fine.

I think Android already allowed that 7+ years ago: https://hacks.mozilla.org/2017/10/progressive-web-apps-firef...

Ok so I guess Android has some sort of API for allowing an app to install additional icons on the desktop with specific parameters like a shortcut and it shows the icon with a little icon representing the parent app, makes sense.

So if you install a PWA from Firefox it runs in Firefox and from Chrome it runs in Chrome similar to desktops. Looking at it this way I could see Apple doing something similar with less effort than trying to standardize a web view API and have PWA use the "system default browser".

"On Android, Firefox, Chrome, Edge, Opera, and Samsung Internet Browser all support installing PWAs."

https://developer.mozilla.org/en-US/docs/Web/Progressive_web...

Installing a PWA on Firefox for Android adds the icon to the homescreen with a tiny Firefox icon at the bottom. The look and feel is Android, there's no obvious bits that would look either Firefox or Chrome.

https://web.dev/learn/pwa/tools-and-debug#using_physical_dev... at "Firefox Remote Debugging" says there's a way to debug Firefox for Android PWAs.

So I'm fairly sure the PWA is running using Firefox for Android.

I also never accepted the terms and conditions for Chrome on this phone.

The look and feel of the app itself is a CSS issue. There are web app frameworks that specifically offer themes matching style guides provided by Apple and Google. Framework7 is an example: the demo app on the home page is styled using iOS UI elements, and there is an option for more Android style designs as well.

https://framework7.io/

I wouldn’t say that demo is very convincing…

Android "handles it" if you want to call shrugging it off "handling it," by making different security tradeoffs that do not emphasize security as much as Apple does.

Android zero days are worth as much as iPhone ones.

Both can be true. Google pays as much for zero days, and Google prioritizes security and privacy less than Apple does.

Google's very means of income relies on gathering and to an extent sharing your personal data.

I'm not talking about what Google pays for vulnerabilities. I'm talking about black markets & brokers.

Edit: and "Android" as in the AOSP (where PWAs still function) does not sell data.

isn't this because so many researchers invested their time in apple zero-days there was a flood of vulnerabilities, reducing their value? I always had the impression ios devices were the prime target.

> The HN crowed might not LIKE apples response but they have a very defensible position.

You and Apple both are ignoring the fact that these permission APIs exist even if the website isn’t being displayed in standalone/full screen mode. The modern web is built on them, and third-party browser engines WILL provide access to these APIs in Europe.

But the plain browser already can request camera permissions, in a bad security situation a site that didn't request it still receives it from the browser's system level request.

This is just Apple wanting to avoid people being able to develop a platform on top of their platform without paying a tax.

Browsers can still do that. It's more that PWAs look like entirely separate apps which the user would expect to be sandboxed. While a tab in a browser is clearly part of the browser app.

This is not a meaningful distinction. Users ALSO expect ordinary websites’ data to be sandboxed. Users trust that pornhub.com won’t be allowed to read data entered into irs.gov.

> Users trust that pornhub.com won’t be allowed to read data entered into irs.gov.

Likely, most are worried about the other direction.

There is also a brand rep issue. If there is a Chrome bug that leaks data, it will be seen as a Google issue. If PWAs have the same problem, it will be seen as an Apple security issue. One that they have no ability to fix.

If I gave camera permissions to the zoom website on my browser, it is way worse if a random malicious email link gets them too on a different domain than if a permission spreads across PWAs I hand installed. This is Apple shaking people down.

That’s not the point though because WebKit is already secured by Apple but if you have multiple blink related apps like Microsoft edge or brave or Firefox apple will have to audit those too and be on the hook if something breaks and then Apple will have to take the blame over a security oversight they aren’t responsible for.

So extending this logic to other platforms: if Chrome has a security bug on Windows... you believe people will blame Microsoft? And you think that would be valid justification for Microsoft pushing a "security update" that uninstalls all competing browsers and replaces them with Edge?

If you made a "Microsoft Windows Desktop Citibank App" from Edge, and then in stall Chrome, and the Uber app now uses Chrome, and a bug in Chrome lets someone steal your Citibank info, yes, the user probably would blame Microsoft as it was Windows software which made the Desktop app for Citibank.

And yes, if Windows had this feature and then Europe demanded it work like I described, Microsoft would be acting reasonably if it disabled the Desktop App feature in Europe.

Apple doesn't disable competing browsers, it just doesn't allow different web engines to underly the browsers. You can argue with that but it isn't the same as "uninstalling all competing browsers".

That assumes that Apple would be blamed for Edge/Brave/Firefox's security oversight.

Why wouldn't they be? Especially considering their existing reputation in consumers minds for security and reliabilty?

Because they own and maintain the operating system, not the vulnerable software?

I understand that they've built this image of being a grand infinite protector for all their users within the walls of their garden, but they've had plenty of security issues within their own software, and plenty of cases where application developers have sidestepped their rules.

This relationship of trust with Apple is cultish at best. To say that I can trust Apple but not Mozilla? What are we smoking here?

Because it never ever happened on any other platform including MacOS.

They would absolutely be blamed by users for it.

Like when it happens on MacOS ? Oh wait…

Yes, people blame Apple for it when it happens on a macOS.

Have you ever worked an IT support desk?

If you add a PWA (with Safari) a year ago to your Home Screen and then change your browser to Firefox, and that PWA breaks out and steals some other application data...

Will you blame the software maker that you used to install the icon on the screen? or the one that is seemingly unrelated to the icon on your Home Screen?

Why silently change the underlying browser engine of an existing PWA without the user's knowledge?

That sounds like a bad UX. At least make the existing PWA stay with Safari and provide the ability to switch the underlying engine for each PWA afterwards if migrating is possible.

As I understand the legislation, Apple has three choices for how to comply with the law.

They can either allow third party browsers the elevated system access that Safari currently has in order to be able to access the data for multiple PWAs ... which compromises Apple's security standards, but puts Safari and other browser engines on the same footing.

Or, Apple can remove the additional security permissions that Safari uses in order to access the data of multiple PWAs so that Safari and other web browsers are on the same footing again.

Or, Apple can invest significant time and resources into creating a new sandbox for browser engines (including Safari) such that a PWA running in the browser engine will not be able to escape and access the elevated permissions of the browser engine or the data of other PWAs through a flaw in the browser engine.

Given the amount of effort that the third option would take, the low adoption of PWAs from most users within the European market, and the not going to compromise on the first option - the second option of removing security permissions from Safari (and other browser engines) to run PWAs is the only option to comply with the law in Europe.

> They can either allow third party browsers the elevated system access that Safari currently has

That’s a fable. Apple have a good history in security design. There is absolutely no way Safari have some "system access" that another app can’t have. Safari is probably just as sandboxed by the OS than every other app or else that would be an incredibly stupid decision.

If Apple wanted to implement PWAs correctly, they’d just run whatever engine + the web page in the same solid OS sandbox and there wouldn’t be any more security issue than with any App Store App.

Any iOS dev knows that it’s impossible for any app to gain any useful access without being granted the permission by the OS. The point is Apple is stuck being forced to hide that the security model of iOS is based on this (working well) sandboxing because it goes against their narrative that all the security comes from App Store policies (which they technically can’t enforce because all they’ve got to review is binary code).

It's not the Sandbox between Safari and Bank of America app - its the sandbox within Safari between the Bank of America PWA and Some Game PWA at issue.

Does Safari, as the browser engine running PWAs have access to the data of multiple PWAs?

If so, and Apple has good security - that's not a problem.

However, if Safari does have that access to multiple PWAs local data, and a different browser engine is used and also needs access to multiple PWAs data stores in order to be able to run them, what can Apple do to ensure that one PWA can't break out of its sandbox within the (as an example) Firefox PWA runner and access the data for another PWA?

If Apple cannot ensure that all browser engines have the rigorous design and/or history of security design and promptness of rolling out fixes when 0 days are discovered ... should Apple grant the additional security access for a 3rd party browser engine to be able to access the data of multiple PWAs?

If Apple should not grant that access because the other browser engines may not be as secure, then Apple (according to the law) must not grant its browser engine any favored position within the system.

The way to fill that requirement is to either figure out how to create additional sandboxes within 3rd party code so that PWAs running within FireFox cannot break out of their sandbox to access other PWAs ... or remove the ability for Safari to run PWAs all together.

And you pointed out yourself ... "If Apple wanted to implement PWAs correctly," - they apparently didn't implement PWAs correctly and are using sandboxing within Safari rather than sandboxing the PWAs and Safari combination at the OS level.

Should Apple invest the time to fix Safari and PWAs and 3rd party browser engines? Or given the low adoption of PWAs, is it less work and better security, and only a marginal loss of functionality to remove PWAs from Safari?

I would probably blame the "the software maker" for silently switching the engine used by previously installed PWAs. Why do that?

You think this uneducated me would know that this was a PWA and no app and also remember that it was installed by Safari, an app I apparently don't own anymore at this stage...?

Why wouldn't Safari remove all its PWA icons when I uninstall it, considering that it anyway cannot transfer the data to another browser...?

As an end user who has been fucked over by the other side (MS/Google/crappy app vendors), I am behind their decision.

If I was not I can choose to leave.

I know this is a divisive comment. Please see my further extrapolation in a child comment.

How does removing web apps help anything? To me it seems like part of a ploy to create backlash against this law by removing features

It's a move against the third party browser engines which have been the bane of my existence from a security perspective on other platforms. For example, the about box in an Android app bundled a whole different browser engine which circumvented device policy entirely and allowed data to be exfiltrated. This app change was delivered in an update by clueless or lazy developers. This is not possible on iOS due to the platform restrictions.

In this case they have to change the integration and sandbox model to allow the security policy to remain intact for people who want and need it. That breaks a few things but it stops the integration from being used for exfiltration among other things.

Note that they're not completely breaking it, just ensuring that the security model stays intact when browser engines have to coexist on the same device. That means sacrificing some convenience for security.

> For example, the about box in an Android app bundled a whole different browser engine which circumvented device policy entirely and allowed data to be exfiltrated. This app change was delivered in an update by clueless or lazy developers. This is not possible on iOS due to the platform restrictions.

If this prevention is by OS security, then your complaint is about the OS.

If it us by store guards, then yiu complaint is about the store.

So sorry, but I don't see how your complaint is properly about the browser engines.

I know it is not en vogue to be charitable towards tech companies, but it seems fair to assume that some teams are making a good faith effort to follow the law, and may be forced to accept imperfect design tradeoffs. Like they say, it affects a relatively small number of users, there is a sufficient workaround, and the technical fix would require major investment.

Not everything is a conspiracy.

> it seems fair to assume that some teams are making a good faith effort to follow the law

Equally fair to conclude that one team here is not.

I don’t buy it. Apple build iOS and I’m sure they will sandbox alt browsers as they do with every other 3rd party app on the phone.

It makes absolutely no sense. Apple could have pointed out to the EU that there are major and not - in the given time - fixable security issues with allowing other browsers on the home screen. PWA runtime platform could be seen as imho. other market than general web browsers. PWA serve niche markets (and corporate in-house) and this move may hurt the long tail in the EU but also globally.

If chrome is really the problem, then chrome is already the problem and nothing about PWAs can change that.

And if PWAs from chrome are the problem, then it would also be possible to not allow chrome PWA's but still allow webkit PWA's.

Why can the camera be accessed through third-party browser engines so long as it's in a browser window?

If the browser engine can't be trusted to segregate camera access through a PWA then why is it trusted to segregate it in-app?

Lol, no. They were fine for years but are not throwing a hissy fit. It's all utter nonsense. Third party apps are subject to the same security guarantees the system has been operating on for years.

But a legislator forced their hand so now they gotta cry about it.