Is WebKit Sabotaging the Future of the Open Web?

Personally, I'd sacrifice every last scrap of additional functionality we've gotten in websites in recent year to have more privacy on the web.

Besides that, I've never seen a web app that was even a half way decent substitute for a native application.

Some of the APIs on that list are frankly frightening. Saying that they can be gated behind privacy controls doesn't take into account inevitable security bugs that allow those capabilities to be taken advantage of by drive-by malware. The best protection against unauthorized sensitive data/hardware endpoint access is to not implement it in the first place.

I'm of the opinion that browsers have long gotten out of control in terms of complexity, with codebases that can sometimes dwarf the operating systems they run on. If the concern is iOS lockdown, lobby for freer native development and support the antitrust investigations. Installing a native app with these features is at least more of a conscious user choice than visiting a website.

I have to admit, I miss when the web was just html (and maybe a bit of css). I couldn't care less about PWAs and have no issue with Apple pushing native over this heavy over engineered open web.

I don't buy in to the idea that Apple is intentionally doing this just to hurt PWAs and push native, but to each their own I guess.

Here's a post from today about Reddit using web features just like these to fingerprint users: https://smitop.com/post/reddit-whiteops/

I can’t beieve anybody can still talk about “the open web” with a straight face in the age of the utter dominance of Chrome. It’s a Google-owned and Google-driven platform these days.

>Saying that they can be gated behind privacy controls doesn't take
>into account inevitable security bugs that allow those capabilities
>to be taken advantage of by drive-by malware

Unlike on platforms like iOS, which weren't originally intended to be secure, but had security features bolted on, this kind of bug is very rarely an issue on the web. What's much more common is that seemingly benign features turn out to be abusable by malicious actors.

>Besides that, I've never seen a web app that was even a half way
>decent substitute for a native application.

Meanwhile, a lot of people spend pretty much all of their time in a web browser. Pretty much all enterprise software now has web frontends, people's email clients are web apps, they use office in the web, they collaborate on web platforms, and so on.

I find it frankly disheartening that there are still people who think that this is a bad thing, and that we would be better off if every platform had its own set of native applications. Friends, the 90s sucked! It sucked to own a Mac and see great apps on Windows, Ataris, or Amigas, without any way to run them on your system. It sucked to write a document in ClarisWorks, and then be unable to send it to anyone else because nobody else had the exact same setup as you. These were not good times! These were very bad times!

It's amazing that today, as a developer, you can write one application, and target every platform in existence. It's amazing that as a customer, I can buy the device I actually want, without fear that the tools I need won't run on it. It's amazing that, as a harware manufcaturer, you can build a device, even come up with a new OS, and immediately have access to an infinite ecosystem of truly great apps.

There is absolutely no reason Apple couldn't implement these features in a secure, opt-in way. There is no reason Apple couldn't allow apps running third-party web rendering engines into their app store. The fact that they don't has one reason: they want to protect their ultra-profitable walled garden, and prevent web apps from becoming even more of a threat.

That is probably profitable for Apple, but it sucks for their customers, and we should stop defending them for doing it.

On the plus side, Safari's overall market share is now low enough that Apple's power to stop web apps from getting better is futile. All they really achieve is to make iOS users' experiences worse, and to push Mac users to Chrome and Firefox.

All features with marginal utility but real security risks. There is a reason why the web has such a tight straitjacket. Just see how websockets' seemingly unfettered ability to do whatever it wants on localhost has serious implications:

https://medium.com/@stestagg/stealing-secrets-from-developers-using-websockets-254f98d577a0

I'm 100% with Apple on this one, probably the only time I can say that in the last 5 years or so. If anything they haven't gone far enough. There are serious risks with the Service Worker API being used to spy on your web traffic, for instance.

The Web has gotten a lot more powerful, and some of it is quite cool.

But it’s also gotten… worse? I look at the old reddit site and the new one (luckily, both can still be used, for now), and while I can understand some of the changes, the new one is overall just… bad. It’s not a joy to use. It feels like someone tried to shoehorn an app into a browser. Which is exactly what they did. Only, 1) poorly, and 2) is that really what users wanted?

I also do understand the sentiment that Apple could have the nefarious/self-serving intention of doing this to drive more App Store revenue. Maybe. But I don’t think their argument is invalid.

If the concern is iOS lockdown, lobby for freer native development and support the antitrust investigations.

This.

Friends, the 90s sucked! It sucked to own a Mac and see great apps on Windows, Ataris, or Amigas, without any way to run them on your system. It sucked to write a document in ClarisWorks, and then be unable to send it to anyone else because nobody else had the exact same setup as you. These were not good times! These were very bad times!

That’s… half the story. The other half is that individual platforms had more personality, and more room to innovate, and actually competed with each other.

It did suck when you had a file and had to figure out how to open it with your incompatible app. But it was also great seeing all these different contenders try things out in their own way. Atari, Amiga, Be, others.

I am buying Apple and Supporting WebKit not because of privacy, but to stop the madness these so called Open Web advocated are making the web ten times worst. They are simply tech nerds that wants toys to play around with ZERO care about user experience.

>The other half is that individual platforms had
>more personality, and more room to innovate, and
>actually competed with each other

But they didn't. They all died in the mid-90s, and then we had a decade of stagnation, because we had exactly the kind of lock-in Apple wants to go back to. A monopoly was the inevitable outcome of this lock-in, because lock-in platforms are winner-take-all platforms. Once you have an advantage in apps, that advantage tends to only get larger.

All of these proprietary platforms died, Mac OS kind of barely scraped by, Windows ruled, and as a direct result of that, there was no progress. It was only when the web came around that this changed. Mac OS X didn't save Apple, the web saved Apple.

We now have the best of both worlds. We have a shared development platform, *and* we have individual platform innovation.

There are now more different platforms available than during the heydays of personal computing, and you have the actual freedom to choose these platforms, and use them, because they run the stuff you need them to run. You can get a Galaxy Tab 6, and an iPhone, and a Windows gaming PC, and a Linux server, and you can run the same apps on all of these platforms, with shared data, and with responsive user interfaces.

That's amazing.

Granted, it's not so great for Apple, but it's amazing for us.

It comes back to this: lock-in platforms are winner-take-all platforms, and Apple thinks it can be the mobile platform winner. That's why they see the web as competition. There is no reason why we should cheer them on, because none of what Apple is doing here is for our benefit.

Apple probably is not pushing those technologies to make you go native. There is one web feature that you can't do on iOS that is though, and that is web push notifications. At my school district we are looking at creating an app solely because we can't send notifications to iOS users.

(Yes, notifications can be intrusive, this would open up a lot of abuse, etc.)

I wonder if an alternative browser like Firefox could offer web notifications under iOS...

But they didn’t. They all died in the mid-90s, and then we had a decade of stagnation

Seems a bit much to re-litigate the 90s, but yes, there were various factors going on — both malicious (e.g. Microsoft, Intel) and incidental (users generally don’t seem to want more than two platforms).

But we’ve absolutely lost variety compared to the 90s, in my opinion.

All of these proprietary platforms died, Mac OS kind of barely scraped by, Windows ruled, and as a direct result of that, there was no progress.

And your answer to that is we should let Google instead of Microsoft define the future application platform? Because that’s what the end result is going to be. This isn’t an “open” platform where many people participate for the common good. It’s by and large a monoculture controlled by a single vendor.

We now have the best of both worlds. We have a shared development platform, and we have individual platform innovation.

There are now more different platforms available than during the heydays of personal computing, and you have the actual freedom to choose these platforms, and use them, because they run the stuff you need them to run. You can get a Galaxy Tab 6, and an iPhone, and a Windows gaming PC, and a Linux server, and you can run the same apps on all of these platforms, with shared data, and with responsive user interfaces.

I… really don’t agree that the status quo is better. It’s just different. Responsive user interfaces are nice, but not as great as user interfaces that are actually designed for different paradigms. You can scale a touch UI up or a mouse UI down, or you can make two good UIs. You can’t do both. (For the same reason, Catalyst is fundamentally less than ideal.)

Meanwhile, so much is still stuck in 1970s-80s’ levels of usability concepts, because no platform is picking up the slack to move forward.

>users generally don’t seem to want more than two platforms

No human being has a preference for there not being more than two platforms, except maybe CEOs of platform companies who directly benefit from monopolies.

People have a primary preference for running the apps they need, and a secondary preference for running these apps on a nice platform. A side effect of this is that, when your platforms are all proprietary, one clear winner will eventually emerge by necessity, since success begets more success.

>And your answer to that is we should let Google instead of
>Microsoft define the future application platform?

I'm not sure what gave you the impression that this was my answer, but no, that's not my answer. In fact, it is Apple that is giving that power to Google, by abandoning its own responsibilities. I would much prefer Apple to take a proper seat at this table and help design the future of the web. They're doing it to some degree, but they're undermining their own power and credibility with stunts like this.

>I… really don’t agree that the status quo is better.

So given the option of having today's ecosystem of platforms and apps, and going back to the days of the Atari and Amiga, you would have NO PREFERENCE for what we have today? That's fair enough, but I think that's very much a minority opinion.

I mean, you do still have the ability to use an Amiga today, or System 7, or BeOS, or TOS, but presumably, you're not. I also love Shadow of the Beast, but that's just nostalgia, in reality, it sucked, as did using a computer during that period of time in general :-)

>Responsive user interfaces are nice, but not as great
>as user interfaces that are actually designed for
>different paradigms

You can design responsive user interfaces that are *also* designed for different paradigms. But honestly, it's not even entirely clear to me that apps that don't bother to do that are really - as a general rule - worse than native apps were in the past, or are today. Native apps are plenty bad, too.

I would agree that the very best native apps are often better than the very best web apps (or at least have the potential to be), but that almost seems like an academic argument, because I'm not spending most of my time using the very best apps. And web apps make up for some of their shortcomings with advantages native apps can't offer as easily - very simple file sharing, concurrent editing, etc.

>Meanwhile, so much is still stuck in 1970s-80s’
>levels of usability concepts, because no platform
>is picking up the slack to move forward.

I do tend to agree with that, but I also think it's pretty clear that the velocity of progress has picked up after the demise of the Windows monopoly, and with the ascendance of the web as the primary application development platform.

> Unlike on platforms like iOS, which weren't originally intended to
> be secure, but had security features bolted on, this kind of bug is
> very rarely an issue on the web.

I fully agree with this! All the concern that exists over using web APIs to do fingerprinting/tracking seems to obscure the fact that in a lot of ways web apps are more secure, more private, and offer more user control than native apps.

Look at the clipboard snooping situation. Native apps can read your clipboard whenever they want, until recently without even telling you, and then squirrel that data away for their own purposes. Correct me if I'm wrong, but I don't think this is even possible on a web site. And this act seems to be much more invasive to my privacy than fingerprinting my browser (which, lest we forget, is also bad). It's directly spying on sensitive information.

Fully on Apple's side here. These creepy APIs don't represent the open web movement in any way, nor will they do anything other than make the web worse. Snuff them out, and choke out the ad and data-hoarding companies with them. I need a cigarette every time I see an ad rep hyperventilating about Apple's increasingly successful war on their business.

>These creepy APIs don't represent the open web
>movement in any way, nor will they do anything
>other than make the web worse

Just to be clear, what Apple is talking about here includes that they "removed support for custom fonts", and APIs they don't support include things like access to the magnetometer, or WebHID. It's just plainly not true that these things are creepy, or that they would "make the web worse." There is no reason why Apple can't provide access to something like the magnetometer in a secure, opt-in way, other than the fact that Apple wants you to go to the App Store to get a compass app.

Last year's Safari robbed us of the single best fingerprinting detection tool Mac users had: http://jsblocker.toggleable.com . There's nothing else that stops canvas fingerprinting cold. It also had many other features to lock down the kinds of abusive data collection websites could engage in. This website does a good job of demonstrating some of the state of the art in web surveillance: https://browserleaks.com/canvas

I think Apple does care about privacy. However I can't take them at their word so long as they have a locked down store with no side loading and are pushing services heavily as their growth vector. The mantra has long been that Apple cares about Apple first, Customers second, and Developers a distant third. Apple deliberately restricts tons of activities in the name of privacy, and those restrictions conveniently boost their stranglehold on developers and boost their services revenue. I am a web developer so I'm probably biased, but these things seem to benefit Apple more than they benefit the customer, and of course they don't care about the developer at all in this instance.

I agree with Michael and Lukas — it’s insane for Apple to think that at least some of these APIs won’t become popular. I’m already using a MIDI hardware controller that requires accessing a web page in Chrome to change its settings. Yes in a perfect world the developer would make an actual Mac app to do it, but when you’re talking about people who are more busy and passionate about designing hardware and embedded software than desktop or mobile apps, there’s not much you can do about it when writing a Web API that will literally run on any modern computer is so much simpler.

So now because Apple won’t support web MIDI, I have to run Chrome which eats CPU and battery instead of being able to use Safari which is my browser for everything else?

I’m not kept safe from anything — I’m forced to use a terrible web browser.

Macs used to be fun for several years but my god they have taken a turn for the worse with Apples nanny state BS in the past 3 years or so, the decline of their software quality (the bugs are out of control), and the UI regressions for seemingly artsy fartsy reasons.

I seriously question why I’m not just using Windows since most of my computer using experiences are either on the web or in apps that are full screen, and everything runs on Windows. If I’m going to deal with buggy software and bad UI, what’s the difference? I can’t even believe I’m considering it — I’ve been exclusively a Mac user for 30 years, but I don’t like where Apple is heading. It’s my computer, don’t tell me what I can and can’t do with it.

Lukas: "It was only when the web came around that this changed. Mac OS X didn't save Apple, the web saved Apple."

Holy anachronism Batman.

@Lukas

The 90s definitely did not suck. What does suck is all these half-baked "Web-applications" that need an insane amount of memory and CPU power to do the simplest of things badly.

The idea of cruddy "universally available apps" as provided by Javascript isn't even new. There were similar solutions available back in the 80s too. Look up Basicode. Look up Microsoft's p-code.

But even actual native software has regressed. I routinely spend 40 seconds waiting for my ~12K line C++ program to compile, when a ~12K line assembly program on the Atari ST would be instantaneously ready to run with TurboAss. You might say, C++ is harder to compile than assembly. True, but the Atari ST had a 1.4 MIPS 68000 and 512Kb, whereas now I have a 4 cores running at 100,000 MIPS approximately, and 16 Gb of RAM. Modern software aims for "good enough", not outstanding. C++ isn't 100,000x harder to compile than 68000. Torvalds bought himself a 2,356,230 MIPS Threadripper to spend less time waiting for the compiler.

"That's a minority opinion". Sure. Most people today think they are experts if they can figure out how to install an app by going to an App-store. So what? You want to dumb down the English language too? 500 words is enough for most tabloid readers, so let's get rid of the rest of them! It'll make for cheaper dictionaries! In the hands of experts computers should be incredibly more powerful than they are.

I'm bitter because given how much the hardware has improved, computers should be much much better than those of the 1990s. Hardware is hard. Software isn't as hard. But only some software like video compression, computer vision or speech recognition has improved. Most user facing software has not and is junk: it's no better than the old stuff and often more painful to use. Apple seems to think that changing styling is an "innovation". Javascript junkies are constantly reinventing the world with yet another wonderful GUI toolkit or library to use sockets... Like Alice in Wonderland, we're running faster and faster to stay in the same place. How very pointless.

How many of these features are actual open standards, developed in the open by stakeholders? And how many are features that Google wanted to add to Chrome and then released a public spec, making them “open” (with scare quotes)?

>Holy anachronism Batman.

Ajax first appeared in 1999.
OS X was released in 2001.
The first generally useful web apps started to appear around 2003.
Gmail launched in 2004.
Mac market share started to go up in 2005.

Where is the anachronism? It's pretty obvious what happened here. The web became the dominant application platform for more and more people, which allowed them to consider OS X as their primary platform, whereas previously, lock-in prevented them from leaving Windows.

>How many of these features are actual open standards

I think WebHID, for example, was very much driven by Google, whereas the magnetometer API had comparatively little input from Google.

But that's how these things work. If you abdicate your responsibilities and remove yourself from the process, as Apple is currently doing, your voice will be diminished. It's a bit odd to complain that Google is too involved in the process of defining the future of the web, when Apple is voluntarily removing itself from that process.

You can't take your toys and go home, yet think you still get a say in the rules of the game everybody else is playing.

And really, why can't Apple keep up? Why is there no Safari Pro with extra features that advanced users care about? Apple is the most wealthy company on the planet, surely they can make some Pro versions of Safari, Music, Mail? And leave the regular versions for the folks who don't need all the fancy stuff, who just need to browse the web, connect to Apple Music, and check their iCloud email -- the customers who don't know what web MIDI is, don't have huge music collections to organize, multiple email accounts + filtering to do, etc. Removing the existing "pro" features from some of these apps would make them easier to use for the large percentage of users who don't care about those features anyway. Make the Pro go beyond what we have now. Seems like a win-win to me.

Safari used to be one of the best web browsers, period. Now it's just the best one for battery life and... Apple Pay? Has there been any innovation lately with Safari? Other browsers are doing tab groups, tab login isolation, etc. Safari still seems like a browser built 10 years ago.

Yes in a perfect world the developer would make an actual Mac app to do it, but when you’re talking about people who are more busy and passionate about designing hardware and embedded software than desktop or mobile apps, there’s not much you can do about it when writing a Web API that will literally run on any modern computer is so much simpler.

Gruber just wrote about this conundrum. I don’t know if I agree with his radical take, and I don’t think it’ll ever quite happen that way, but imagine if the App Store does become more opinionated like that, and in turn, we also get ways to sideload.

So now because Apple won’t support web MIDI, I have to run Chrome which eats CPU and battery instead of being able to use Safari which is my browser for everything else?

I’m not kept safe from anything — I’m forced to use a terrible web browser.

OK, but maybe Safari is energy- and CPU-efficient in part because it doesn’t have such features? You’re simultaneously criticizing its feature set while also saying it’s overall your favorite browser.

(And yes, you basically have to use something Chromium-derived for now. Firefox only has partial support.)

I seriously question why I’m not just using Windows since most of my computer using experiences are either on the web or in apps that are full screen, and everything runs on Windows. If I’m going to deal with buggy software and bad UI, what’s the difference?

Yeah, I can see that.

I think the core issue is that Windows has gotten better at a pace the Mac hasn’t, either because Apple thinks the Mac doesn’t have as many low-hanging fruit, or because they were distracted by their other platforms (or because they were waiting for Apple Silicon, but I don’t quite buy that explanation).

It’s a simplistic unfair take, but from the outside, it sometimes feels to me like we’re seeing nerdy things like Windows Terminal and WSL, or notepad finally supporting Unix linebreaks, whereas on the Mac, we’re seeing… it being locked down further.

Lukas: “It was only when the web came around that this changed. Mac OS X didn’t save Apple, the web saved Apple.”

Holy anachronism Batman.

I don’t think that’s quite the write word — Lukas is right that the Web did grow at the time. And I’d agree that it helped Mac OS X.

But there were a lot of factors to helping Apple, and I think Mac OS X did play a huge role. Not just in itself, but also in the engineering culture the NeXT merger brought to Apple.

How many of these features are actual open standards, developed in the open by stakeholders? And how many are features that Google wanted to add to Chrome and then released a public spec, making them “open” (with scare quotes)?

Right. I get the sense that Google’s approach here is to implement a feature in Chrome, write the spec for it, publish that to W3C/WHAT-WG, and get to simultaneously claim that it’s “an open standard” (despite the spec being in Working Draft status, i.e. not yet a standard!) while also effectively controlling it, because:

Microsoft has largely peaced out of the process when they decided to abandon Trident, Tasman, EdgeHTML and Chakra
same for Opera’s Presto
Mozilla is still actively involved, but doesn’t have as many resources
Google has a big vested interest in driving the Web forward in their vision
Apple… well… Apple used to be a lot more invested in this in the Dashboard era. It’s hard to imagine now, but things like canvas and video were largely driven by them.

Which, yes, is in part on Apple. But in a way, Google (maliciously or by accident) has found a way to take the 2000s’ “open standards!” culture and subvert it for its own gain.

But that’s how these things work. If you abdicate your responsibilities and remove yourself from the process, as Apple is currently doing, your voice will be diminished.

Well, yes, in part. But there’s more BS to it:

HTML is now a “living standard”, which is a funny way of saying “who needs a standardization process when you can clone the Chromium git tree”. A living standard is no standard at all. Think about it: all the money in the world won’t let you implement it, because by the time you’re done, it’s already different.
we’ve essentially accepted that working drafts are good enough quality for a “standard”, making the standardization process moot.
there is such a massive amount of specs at this point that it’s completely unfeasible to compete. As individual contributors, obviously, but even with massive budgets. Consider that even Microsoft left.

I do think Apple should take on a more active role. But I don’t think “they should just agree with all the specs Google proposes” is that role, and that seems to be what a lot of web developers want. Objecting to certain specs is an active role.

Why is there no Safari Pro with extra features that advanced users care about? Apple is the most wealthy company on the planet, surely they can make some Pro versions of Safari, Music, Mail?

I’d much rather see a return of pro browsers from third parties, like OmniWeb (or Opera, though that was never my cup of tea). A lot of it can be done “just” by embedding WebKit, but Apple should open a few more things, such as access to iCloud bookmarks.

As I get more into the realm of "what can my PC help me do with *other* hardware?" I'm finding that Macs just aren't well supported anymore. Apple has been changing so much in every version of OS X in recent years, dropping 32 bit, deprecating APIs, breaking things with every new OS X release that old software just doesn't work and/or developers who used to write their apps for Windows and Mac just don't bother with the Mac anymore, or the "Mac" version is some bastardized Java, Electron, or CrossOver app. Devs can make a Windows app and it will work for YEARS with hardly any updates, where on the Mac they might have to rewrite it every 12 months because Apple just keeps breaking stuff. In a way, we're regressing to the bad old days.

Look at how much pro audio has been left behind on the Mac. So many VSTs don't work anymore, so much software for talking to external hardware via MIDI doesn't work anymore, etc. It's really nuts. Is anything really Mac first these days? Or Mac best? There was a time when OS X was blowing away anything on Windows and the Mac was seen as THE best platform to develop for because it had underlying UNIX geek cred if you needed to go there. Suddenly every college student had a Mac, Macs were everywhere, it was hot. I don't get that impression these days.

Apple should be bringing the future to us by convincing us that "their way" is better. So far they're trying to force it. In little ways I'm reminded of this every day such as when I need an extra USB port on my 2014 MBP and wonder why Apple decided to take up space with Thunderbolt 2 ports. I've never even seen a Thunderbolt 2 device in real life. What problem was these two ports supposed to solve? Hell if I know.

> I've never even seen a Thunderbolt 2 device in real life. What problem was these two ports supposed to solve? Hell if I know.

Apple's Thunderbolt Display acts as a docking station for Thunderbolt-supporting Macs. It's pretty great.

Apple has decided that marketing privacy makes money. I am not sure Apple really is doing its customers a service in implementing more privacy or simply using it to sell more products. Their message is more like sure we can offer you more privacy if it will convince you to buy into our ecosystem. Other than the US and some parts of Europe, the iPhone is not winning over the rest of the world. Most prefer Android purely based on it being far more flexible and customizing. I don't think web apps will ever materialize as being better than apps. Mostly because web browsers even if they support the same technologies are still going to have some unique quirks. Some are done on purpose, some are not.

Most prefer Android purely based on it being far more flexible and customizing.

“Most”? I doubt it.

Like, yes, those people obviously exist.

But surely most people buy Android because they haven’t thought about it, because they’ve been on Android before, or because it’s the only option in their preferred price range.