[zitterbewegung]

Why is it a bad response from Apple to disable a feature that they deem as a security risk if you allow for alternative browser engines?

Browsers represent a significant attack surface since they can run code and also transmit data across the network. So when they are allowed to exist now Apple has either two options. One is to do the simple way and remove progressive web apps or extensively test and perform security analysis on all of the new browser engines.

A better compromise would be to make new browser engines have extensive testing by the developer themselves. So, what's the point ? It feels similar to the GDPR where I get a popup and I click disallow all cookies except for essential ones.

This seems the best way to actually implement the directive because it is not only low effort but most secure. We would have a better compromise for testing to be done by the browser engine developer or Apple but its more likely security holes would fall through.

[jsnell]

Apple has been abusing their dominant market position for more than a decade, blocking browser competition with security being one of their excuses. They can't be trusted to be honest about what's a legitimate security issue, and what's just them using security as a smokescreen for anti-competitive behavior.

And in fact, they are not being honest in this very case. Their entire spiel is based on the idea that the 3rd party browsers will be malicious, and permit data sharing between different PWAs. It's a risk they've just made up, because they're already making all kinds of other security requirements on 3rd party browsers before allowing them on the platform. They could just have made this one of those requirements.

[actionfromafar]

As said elsewhere, the PWA apps could open in Safari.

But would this have legal implications? Could the browser vendors argue they are discriminated against if PWA apps do not open in their browser?

I think this whole thing puts the finger on how fluid the borders have become. What is an app, what is an API, what is a service? Is Safari an Apple API for PWA apps? Or is a PWA app running by mandate on Safari when the user has selected another browser as default somehow wrong legally or ethically?

[xbar]

The Apple response is false, thus dishonest and greedy at the expense of consumers.