Using alternative browser engines in the European Union

[BoppreH]

> Program security requirements

>> You must do the following:

>>> Use memory-safe programming languages, or features that improve memory safety within other languages, within the alternative web browser engine at a minimum for all code that processes web content;

AFAIK all major engines are written primarily in C++. This "features that improve memory safety" is worryingly vague, and we already know Apple goes out of it's way to make these rulings less useful.

I wouldn't be surprised if they rejected both Firefox and Chrome on these grounds.

[mariusor]

Would Safari even qualify?

[EasyMark]

did the judge say it had to be written in a memory safe language? Honest question. Otherwise, this seems just like they're looking for a loophole knowing neither their browser nor chrome or Firefox are written in completely memory safe languages. Seems like grounds for a big fine.

[anal_reactor]

I really think that if they don't allow Firefox they'll get another lawsuit. The way I see it is that they allow Firefox and Chrome, but nothing more.

[timeon]

Time to pour resources to Servo.

[_shantaram]

It's mind-boggling they are doing all these gymnastics instead of just allowing alternative app stores and browsers everywhere.

[Arnt]

I guess it shows that they assume higher support costs per user, and are trying to minimize the number of users with the higher cost.

[Aachen]

(FYI you've submitted this comment twice about 1.5 minutes apart. I've voted for the older one rather than this one. Mods/dang: maybe the two reply sets should be merged?)

[netdevnet]

Allowing alternative app stores and browsers is likely to lead to more security issues, more users using tech support resources because a dodgy app downloaded from a 3rd party app store they installed broke their phone in odd ways and will likely increase expenses without increasing revenue.

Because let's be honest, most of the population does not even understand the idea of "app store" beyond THE app store the same way they don't understand the idea of "search engine" beyond Google Search. If Chrome only allowed you to use Google Search as the search engine, most people wouldn't complain. This is the same. As long as they can download their [insert Big Tech Company here] walled garden app, most will not complain. But if their phone starts misbehaving because of a rogue app from a dodgy app store or phones suddenly get more expensive to compensate for higher costs incurred by Apple for their development and support of third party app stores and browsers most will complain.

UPDATE: getting downvoted for pointing out the reality. Most people are not hackers. They don't want customisation options. They are happy with a default store or browser as long as it is good enough. If you want options, Android is there

[thrdbndndn]

> Requirements

>> To qualify for the entitlement, your app must:

>>> Be distributed solely on iOS and/or iPadOS in the European Union;

I assume this means you have to release a separate App like "Firefox EU" to be able to use Gecko, right? Practically speaking, would any major players actually do it? It just sounds unlikely to me but I may miss something.

[0x073]

And it's bad for the users, they can't rely on the browsername and get different bug and features.

Its a mess, thanks apple.

[AnonC]

> I assume this means you have to release a separate App like "Firefox EU" to be able to use Gecko, right? Practically speaking, would any major players actually do it?

I can imagine browser makers creating names like “Freedom browser, by Firefox”, “Courage browser, by Brave”, “Live on the Edge, by Microsoft”, and so on.

[chongli]

Yes it needs to be a separate binary. You can’t offer an app with selectable browser engines.

[_shantaram]

It's mind-boggling they are doing all this gymnastics instead of just allowing other browsers and app stores everywhere.

[chongli]

If you read their requirements you can infer why they’re doing this: security. They absolutely do not want users’ phones hacked by a 3rd party browser bug. Nor do they want a 3rd party browser phoning home with user data.

Absolutely the last thing they want is Facebook shipping their app as a browser which bypasses all of Apple’s privacy protections.

[rf15]

> To qualify for the entitlement, your app must:

> Be distributed solely on iOS and/or iPadOS in the European Union

These jokers. This is the usual malicious compliance.

[rahkiin]

I think they mean you can not distribute it to the US, as this is a EU mandate-only.

[unglaublich]

> Meet the above test suite requirement if Just in Time (JIT) compilation is unavailable (e.g., if Lockdown Mode is enabled by the user)

Interesting, I wasn't aware that Lockdown Mode disabled JIT. Does it do that system-wide, or only for third party apps?

[Scaevolus]

Yes. It makes JS run at ~30% speed, a worthwhile tradeoff given how often JIT bugs are used in exploit chains.

https://daringfireball.net/2024/06/apple_disables_webkits_ji...

[nnx]

This disables JIT for JSC (JavaScriptCore) system-wide. Third party apps never had been able to JIT on iOS, no permission to write executable pages.

[liamwire]

As far as I’m aware, JIT isn’t available to third-party apps on iOS and iPadOS.

[withinboredom]

System wide. This is documented

[acheong08]

> Program privacy requirements You must do the following: Block cross-site cookies (i.e., third-party cookies) by default

I wonder if chrome will implement their sandbox on IOS first because of this

[nnx]

I'm all for Apple opening up to other browser engines on iOS but at the same time I'm worrying that this is gonna end up in furthering Chrome as "the web" over time.

Especially considering iOS is far from having majority marketshare in EU compared to Android... this feels like forcing a minor player (iOS in EU) to help a major player (Chrome).

[ryanbigg]

This is weasel wording but with actions. I’d expect better from Apple

[apexalpha]

The arrogance of thinking you can take on an entire continent.

Besides that I wonder what happens if I travel outside of the EU. Will they just remotely disable everything I could do while in the EU?

[difosfor]

OK, then Apple should also be transparent and show how they meet all of these requirements no? Actually this should probably be judged by an independent organization. Great idea Apple!

Kind of ironic that they are also requiring WPT compliance while they are the worst scoring major browser there.

[fabian2k]

The main question is whether they will allow Firefox, Chrome and Edge to use their own engine or not. The guidelines leave enough room to deny any potential browser engine if they want to, so it depends entirely on how Apple will decide on actual cases.

[Alifatisk]

Isn’t Chrome and Edge based on same engine? So if one is allowed then the other should be too?

[0x073]

They will, as they are forced by the EU if they don't allow any.

[ilrwbwrkhv]

I just want to use firefox with ublock origin on the iPhone.

[consteval]

Orion on iOS blocks ads. It's made by Kagi. Not sure how they got away with it, and it's not firefox, but it's as close as you can get right now.

[swat535]

FYI as an alternative, if you are stuck with Safari on iOS, you can try AdGuard with Vinegar and Baking Soda apps.

[worksonmine]

You can on Android, why do you need the iPhone?

[lostfocus]

It's honestly weird to me how much work they put into their hissy fits. It's not like their bottom line or their stock price would notice it when they would just open up their OS a bit more.

[willhackett]

Why only in the EU?

[Matl]

Because they're compelled to do so by EU law, they don't want to do this and no one else forces them to.

[chippiewill]

Only the EU is requiring them to do it, but other governments might start pushing for it given the upsides

[fwef64]

Can anyone explain why is Apple so opposed to having different browser engineson iOS? Is it really just about security? I don't understand what is Apple to gain by not allowing 3rd party engines everywhere in the world.

[jsnell]

Controlling the only browser engine on the most important end user OS means Apple has a veto on what can be done with the web platform in practice. If they want to press a pillow on the face of the web and watch it desperately struggle for air, they can.

And of course they want to do that. What is good for the web is bad for Apple. They need web apps to be unviable to maximise the platform lock-in and the rents they can extract via the App Store.

("They" being senior Apple leadership; I'm sure the people working directly on WebKit are doing the best they can given their resource constraints and strategic guidance.)

[andreapaiola]

WebView in app vs PWA (Progressive Web App)

[sharpshadow]

I wonder if WebKit would pass these requirements.

[unglaublich]

So, will Electron apps be an option now, for better or worse?

[hexage1814]

>Apple will only authorize developers to implement alternative browser engines after meeting specific criteria and who commit to a number of ongoing privacy and security requirements

Smells like malicious compliance.

[isodev]

How come Apple is installing itself as the qualified party to judge if a browser is good or not? It's rich coming from the company that has been feeding us Safari for so many years.

I don't mind the expectation for a certain level of quality on the app store, however it should not propagate to alternative stores.

[Sakos]

I want to know if Firefox or Chrome would pass these requirements as is. If not, they're clearly taking the piss and the EU should take a gigantic dump on them.

[sunshinerag]

Why don't apple just dump EU instead of adhering all its bureaucratic regulations?

[beardyw]

Maybe it's because the EU population is more than North America. They do want to sell phones.

[surgical_fire]

I hope they do. I live in EU btw.