Most active commenters
  • untog(4)

←back to thread

Apple declined to implement 16 Web APIs in Safari due to privacy concerns

(www.zdnet.com)
428 points coronadisaster | 14 comments | 29 Jun 20 10:16 UTC | HN request time: 1.084s | source | bottom
Show context
msoad ◴[29 Jun 20 17:15 UTC] No.23679601[source]▶
Google's developer relations team have done a good job convincing web devs that those APIs are pushed by Google to enable "Amazing PWAs", yet we haven't seen them used by any major app. People are choosing to download native apps for more sophisticated applications.

However Google is pushing those APIs because they know tracking people without cookies in future is a big challenge for them and they need new ways of tracking people.

So sad that Google has taken over the web. From the most used browser (Chrome) to the content hijacking (AMP) to the standards (PWA). All to sell you to advertisers.

replies(6): >>23679828 #>>23679848 #>>23680171 #>>23680533 #>>23681627 #>>23684654 #
1. untog ◴[29 Jun 20 17:30 UTC] No.23679848[source]▶
You have to build these APIs before people use them, and a lot of what Google has been building into Chrome is stuff native apps can do, so the use-case is clearly there.

IMO native apps are capable of far more invasive privacy violations than the web is. But for some reason they're given a very free pass by comparison.

replies(3): >>23680051 #>>23680053 #>>23680192 #
2. breakfastduck ◴[29 Jun 20 17:45 UTC] No.23680051[source]▶
They're given a very free pass because it's incredibly easy to block a native app from sending data back or even connecting to the internet at all.

You have a lot more control over something that's running locally than something running serverside that simply using the client to harvest data.

replies(1): >>23685118 #
3. jfkebwjsbx ◴[29 Jun 20 17:45 UTC] No.23680053[source]▶
Well, because native apps are intended to be trusted. They do not have a motivation to invade your privacy: proprietary apps are usually paid upfront and risk their future clients, open source can be inspected.

Instead, the overwhelming web business model is "free to use" (akin to f2p in games). That means ads and other monetization side channels become the priority of the app, not the app itself.

And that is for trusted web apps. Let's not even talk about the fact that you are executing random code every time you visit any webpage. That just does not happen with native apps.

replies(1): >>23680114 #
4. untog ◴[29 Jun 20 17:50 UTC] No.23680114[source]▶
That's not true at all! Free native apps abound. Web apps tied to subscriptions are also plentiful.

Open source is neither here nor there: both web sites and native apps can be open source. In fact, the web is unique in allowing you to actually inspect the source that is running on your machine, you have no way of verifying that the code in an open source repo is what actually runs inside your iOS app.

replies(2): >>23680585 #>>23681747 #
5. coliveira ◴[29 Jun 20 17:55 UTC] No.23680192[source]▶
Native apps are not handling my bank account passwords. They're also not collecting data about my consumer behavior with the goal of displaying more ads. This is a big difference.
replies(2): >>23680437 #>>23680484 #
6. CaveTech ◴[29 Jun 20 18:13 UTC] No.23680437[source]▶
> Native apps are not handling my bank account passwords.

You're conflating browsers (Chrome, Firefox, etc) with user applications. User applications are still not handling your bank passwords.

> They're also not collecting data about my consumer behavior with the goal of displaying more ads.

lol? Absolutely wrong here.

7. untog ◴[29 Jun 20 18:17 UTC] No.23680484[source]▶
> They're also not collecting data about my consumer behavior with the goal of displaying more ads

This is my original point. They 100% absolutely are. Look at some of the ad and tracking frameworks for native apps. Somehow no one cares.

8. strbean ◴[29 Jun 20 18:23 UTC] No.23680585{3}[source]▶
> In fact, the web is unique in allowing you to actually inspect the source that is running on your machine

To be fair, this is changing with WASM. On the other hand, there are tons of obfuscation opportunities with native executables that don't exist for WASM.

9. jfkebwjsbx ◴[29 Jun 20 19:45 UTC] No.23681747{3}[source]▶
> Free native apps abound.

Yes? I haven't claimed there aren't free native apps.

> Web apps tied to subscriptions are also plentiful.

Fair, but most of the ones I know are usually technical apps or they offer something else that is not about software (for instance, storage more than the app).

> the web is unique in allowing you to actually inspect the source that is running on your machine

That is not unique, nor true.

Uniqueness: you have apps made in scripting languages everywhere. Even for compiled languages it is a decision not to give you the code, not a technical one.

Truthness: many webs are obfuscated on purpose like native apps are.

> you have no way of verifying that the code in an open source repo is what actually runs inside your iOS app.

False, you can definitely verify that a binary matches the source code in deterministic builds and even provide debugging symbols etc. The fact that many projects don't care about that does not mean there is "no way", it just means the overwhelming majority of users do not care.

replies(1): >>23682434 #
10. untog ◴[29 Jun 20 20:28 UTC] No.23682434{4}[source]▶
What about Facebook? A native app, free, tied to a business and utterly motivated to violate your privacy.

> False: you can definitely verify that a binary matches the source code in deterministic builds

If I want to check an app I have installed from the iOS App Store matches the code provided in an open repo, how would I go about doing that?

>Truthness: many webs are obfuscated on purpose like native apps are.

True. But their underlying behaviour, i.e., what data they send and where they send it, is viewable and blockable by browser extensions.

11. osrec ◴[30 Jun 20 00:19 UTC] No.23685118[source]▶
It's even easier to block a web app - just don't visit its web address.

A native app sits on your device, executing all kinds of code, sometimes without your knowledge. With PWAs, the code is more or less open source - all the JS is there for you to inspect - even after obfuscation, you can see the network requests being made in the dev tools of any browser.

replies(2): >>23686395 #>>23694358 #
12. ◴[30 Jun 20 03:59 UTC] No.23686395{3}[source]▶
13. breakfastduck ◴[30 Jun 20 20:22 UTC] No.23694358{3}[source]▶
I appreciate that and maybe didn't make my point as best as I could.

My point was essentially that you can run a native app without internet access most of the time (and can easily block the app making calls out by switching the internet off or blocking the calls its making) but a web app you have absolutely no control over, you just have to not use it.

replies(1): >>23694830 #
14. osrec ◴[30 Jun 20 21:11 UTC] No.23694830{4}[source]▶
That's not true with PWAs. You can have PWAs that operate offline. The problem is that not enough web developers know how to build good offline-only PWAs. But trust me, they're coming!