DMA Compliance: Alternative Browser Engines
The coming changes to iOS in the EU include:
[…]
New frameworks and APIs for alternative browser engines — enabling developers to use browser engines, other than WebKit, for browser apps and apps with in-app browsing experiences.
To use an alternative browser engine in your app, you’ll need to request the Web Browser Engine Entitlement (for browser apps that want to use alternative browser engines) or the Embedded Browser Engine Entitlement (for apps that provide in-app browsing experiences that want to use alternative browser engines).
Apple will provide authorized developers access to technologies within the system that enable critical functionality and help developers offer high-performance modern browser engines. These technologies include just-in-time compilation, multiprocess support, and more.
[…]
To help keep users safe online, Apple will only authorize developers to implement alternative browser engines after meeting specific criteria and who commit to a number of ongoing privacy and security requirements, including timely security updates to address emerging threats and vulnerabilities.
It sounds like this only applies to iPhone apps, they have to be EU-only, and they’re not allowed to be set as the default browser.
Since the beginning of the App Store, Apple has allowed lots of browsers but only one browser engine: WebKit. WebKit is the technology that underpins Safari, but it’s far from the only engine on the market. Google’s Chrome is based on an engine called Blink, which is also part of the overall Chromium project that is used by most other browsers on the market. Edge, Brave, Arc, Opera, and many others all use Chromium and Blink. Mozilla’s Firefox runs on its own engine, called Gecko.
On iOS, though, all those browsers have been forced to run on WebKit instead, which means many features and extensions simply don’t work anymore.
Previously:
- DMA Compliance: Default App Controls
- Apple’s Five App Stores
- Apple Considering Dropping WebKit Requirement
- EU Approves Digital Markets Act and Digital Services Act
- The Time to Fix Web Security Bugs
- The Danger of Sideloading Chromium
- The Hotel Cupertino Clause
Update (2024-01-26): BrowserEngineKit:
Create a browser that renders content using an alternative browser engine.
[…]
If you use an alternative browser engine in your app, you must design your secure browser infrastructure to separate different components into extensions that your browser manages. Design a limited inter-process communication (IPC) protocol that coordinates work across the extensions. Separating your alternative browser engine into distinct extensions limits the impact of security vulnerabilities in any one process.
Holy moly that’s a lot of APIs and granular architecture specifics. If you dig into the setup instructions, it has everything from splitting tasks across multiple XPC processes to mandating arm64e to a whole collection of new entitlements. You don’t just ‘build a web browser’. This almost feels like an AppleInternal Safari spec with a ‘your implementation goes here’. I love it
Update (2024-01-30): Juli Clover (Hacker News):
While support for alternative browser engines sounds like a win for browser companies, Mozilla spokesperson Damiano DeMonte told The Verge that Firefox is "extremely disappointed" with the way Apple is implementing the feature because it does not extend to the iPad.
Firefox uses the Gecko engine and could swap to that on the iPhone, but it would need to continue using WebKit on the iPad.
And outside the EU.
James Moore (via Hacker News):
This news is tempered by the fact that Apple’s proposed solution to comply with the DMA rules to allow browser competition has not been well received.
Others in the industry we have spoken to described Apple’s compliance plan as it relates to browsers as “unworkable”, “a massive problem for us” and “doing everything they can to make the DMA fail”.
[…]
Apple claims repeatedly, if you don’t like their app store, don’t use it. You can use the web and web apps to reach your customers.
They say this, while at the same time preventing this from happening by not providing the tools needed in their own browser and blocking other browsers from providing them.
Previously:
Update (2024-02-14): See also: Hacker News.
Previously:
Update (2024-05-17): Thomas Claburn (MacRumors):
The Register has learned from those involved in the browser trade that Apple has limited the development and testing of third-party browser engines to devices physically located in the EU. That requirement adds an additional barrier to anyone planning to develop and support a browser with an alternative engine in the EU.
It effectively geofences the development team. Browser-makers whose dev teams are located in the US will only be able to work on simulators. While some testing can be done in a simulator, there’s no substitute for testing on device – which means developers will have to work within Apple’s prescribed geographical boundary.
[…]
“The contract terms are bonkers and almost no vendor I’m aware of will agree to them,” lamented one industry veteran familiar with the making of browsers in response to an inquiry from The Register.
“Even folks that may have signed something to be able to prototype can’t ship under the constraints Apple’s trying to impose. They’re so broad and sweeping as to try to duck most of the DMA by contract … which is certainly bold.”
Update (2024-05-20): See also: Hacker News.
Update (2024-06-19): John Gruber:
Now that over four months have passed since Apple announced its initial DMA compliance plans, have any browser developer announced plans to bring their own rendering engines to iOS in the EU? As far as I know the answer is no. It’s entirely possible Apple went to all the trouble of creating BrowserEngineKit for compliance with the DMA, but no one is actually going to use it because no browser developer deems the EU market worth forking their browser for, solely for distribution outside the App Store.
2 Comments RSS · Twitter · Mastodon
How does a US-based developer test their web app with a Blink or Gecko-based browser on iOS? Now that Apple is locking down major OS capabilities by region, will developers be able to create test accounts for other regions?
Maybe there is an established pattern for this—I'm sure there is some limitprecedent for region-based capabilities in the platform—but I can't think of anything else like this.
I wonder if this will push Apple to include more default search engine choices in the Safari settings. I'm sure they would hate for people to switch to the Brave browser just for the default search engine it permits. It also means that Google will probably stay the out of the factory default for a while on Safari: Apple would not want people using Chrome just to have Google as the default search engine.
