Hacker News new | ask | show | jobs
by bangaladore 165 days ago
> Use memory-safe programming languages, or features that improve memory safety within other languages, within the alternative web browser engine at a minimum for all code that processes web content;

There is absolutely zero way to satisfy the latter part here. It's at best non-enforceable. If I'm using C++ and use std::span instead of a c-style array, is that good enough?
1 comments
dagmx 165 days ago
Why not? The wording is “features that improve memory safety”

It doesn’t say that it needs to provide absolute memory safety. Based on the linked WebKit guidelines, it seems like they meet the criteria.

link
bangaladore 165 days ago
That's the commenter, not from the Apple page as far as I can tell.

My point is the requirement is too broad. It cannot be meaningfully enforced.

link
dagmx 165 days ago
It’s literally from their requirements page

https://developer.apple.com/support/alternative-browser-engi...

You have to request explicit permission to be able to be a browser on iOS. You can’t just ship an app. I assume part of that process is that you specifically demonstrate that you try your best to use best safety practices.

Again, it’s also not absolute safety. It’s just due diligence review.

link
bangaladore 165 days ago
Sorry if I wasn't clear. I meant the WebKit guidelines were from the commenter, not from the apple page.

> or features that improve memory safety within other languages, within the alternative web browser engine at a minimum for all code that processes web content;

This can't be analyzed in any real way, so its just another way that Apple will restrict web engines and claim it was due to "not enough use of memory safety language features"

link
dagmx 164 days ago
Why does it matter if Apple themselves don’t link the WebKit docs? It’s literally their project and seems to meet their requirements.

There’s a lot of things in the requirements like funding that Apple cannot verify. I think you’re being too binary in this.

Some of it is very clearly intended to be a “show us you are at least considering these security measures and have practices in place to minimize known issues”. Again, for the third time, it’s clearly NOT a list for ongoing perfect security, given that there are other items on the list that deal with further mitigation strategies.

link
bangaladore 164 days ago
> It’s literally their project and seems to meet their requirements.

This is meaningless. Apple can carve out special exceptions for themselves all day long.

link