Hacker News new | past | comments | ask | show | jobs | submit login
Safari is now probably the influential wild card browser for user privacy (utcc.utoronto.ca)
161 points by goranmoomin on March 20, 2021 | hide | past | favorite | 322 comments



> (Conversely, if Safari refuses to implement some alleged 'feature', it becomes much less useful even if Chrome does implement it.)

The fact that Apple refuses to implement basic features in mobile Safari that Firefox and Chrome have had for years now, and the fact that they refuse to allow other browser engines on iOS is the reason why we can't have nice things like progressive web apps.

I recently worked on a health app related to the COVID pandemic. The most common use case would be served really well by a PWA, and as such, there's no reason users would need to install an app on their phones to access the web app's full set of features.

Despite the web app working perfectly on Android and across Windows, Linux and macOS without native integration, we now must dedicate time and resources to develop an additional iOS app just so iOS users, which over half of Americans are, aren't left out.

This is an expensive endeavor time-wise and money-wise, during a pandemic where time is of the essence and resources are stretched thin. It shouldn't be this way, but it is.


I don’t want websites to be able to send notifications to my phone. Sites abuses this and are always asking on my computer and it’s too easy to accidentally say accept.


The default setting for notifications in Chrome is "Sites can ask to send notifications", but you can set that to false in "Preferences > Privacy and security > Site settings > Notifications" and you'll never see the browser popup again.

This is a feature that Chrome has had for about 6 years. The fact you haven't discovered it shows Chrome's UX could be better, but the fact you haven't searched for it might alsp show that the popups aren't quite such a problem for you after all.


You don't seem to understand what "I don’t want websites to be able to send notifications to my phone." means.


You'd rather install the website as a native app so that it has even more device access and then allow it to send notifications to your phone?

Is that really a cleaner, less intrusive UX for you then it would be to have an easily ignorable button next to a website's address bar that would allow you to turn notifications on or off for each website with maybe three or four clicks at max?


> You'd rather install the website as a native app so that it has even more device access and then allow it to send notifications to your phone?

I can always chose not to install an app.

> Is that really a cleaner, less intrusive UX for...

Imho it's a security question. I don't care if it's clean or less intrusive, the browser should be a sandbox.


> I can always chose not to install an app.

Sure, but I can also choose not to use a website or service. If a set of features is only available in a specific medium (whether that's a website or an app) your choice is the same -- you either use it in that medium or you don't.

> the browser should be a sandbox.

This is an interesting point, because I do get where you're coming from, but I almost draw the opposite conclusion from the same data. The browser is a sandbox, so I want to put things in it. I refuse to install a native app to check my bank balance or post on social media, I don't trust those companies with that level of access to my phone.

The browser is a better sandbox than my native device, and notifications don't really break the browser sandbox in any significant way. So if (as heavyset_go suggests) notifications are the difference between having an app built in the sandbox or out of it, then I want notifications, because I want the app to be built in the sandbox.

If having notifications could make it feasible to use Twitter without installing an app, then great, we should do that. Or if notifications are enough that I don't need to have an email app or Matrix client installed... it's a pretty substantial win for security if I can get rid of those apps on my phone and use them as mobile progressive websites instead. Having email notifications on my phone is mandatory for me, I can't drop that feature. But is that alone a good reason to install a completely separate application that's requesting filesystem access or contact access?


If you block a website sending you Chrome notifications it blocks notifications for all your Chrome installations, including your phone.

If you turn notifications off for Chrome everywhere you won't see Chrome web notifications anywhere.

If you're talking about some other way websites can send notifications to your phone then I don't think that has anything to do with Chrome. And I can't think of what mechanism you're talking about.


My point is that the person said "I don't want websites to be able to send notifications to my phone", and then you responded by explaining how one can prevent such notifications via configuration.

That is true, but not really relevant to what he said. He didn't say "I wish there was a way to configure my browser to not send notifications to my phone".

You then followed up with a snarky line telling them the thing that bothers them doesn't actually bother them, and that wasn't great either.


If I said "I don't want bears to be able to maul me in my sleep," and someone said "here's an option you can check which prevents that from ever happening," please explain to me how that failed to solve my problem.


OP didn't say "I want to prevent chrome from sending notifications". If he did, then sure, having an option toggle would solve his problem. But that's not what he said.

He said he doesn't want chrome to be able to push notifications to his phone. Having an option to disable that feature means it is has to be possible in the first place.

Maybe I am being overly pedantic, but to me the distinction matters.


Then it should be said "I don't want Chrome pushing notifications on anyone's phone, ever".

If you want it for yourself, you can make it happen. If you change a setting that disables ALL notifications for Chrome in your Android phone, your condition is satisfied. Chrome is not able to send notifications, unless the developers find a workaround :)

I want selected websites to be pushing notifications to me through Firefox. For example ebay-kleinanzeigen. Why should I install an app for that purpose?


I hope I'm not coming off as contentious, and I know I'm sort of beating a dead horse here, but I really feel like this distinction matters, so bear with me:

>Chrome is not able to send notifications, unless the developers find a workaround :)

Yes, it is able to send notifications. It won't (or shouldn't, at least) but it is still capable of sending notifications.

If I put my manual transmission car in first gear, it's never going to shift to second, but it still able shift to second.

Lets say I told you your showerhead has the capability to live stream your showers on youtube, but that feature has been toggled off. I'm sure you would understand if some people didn't want that to be possible in the first place, whether or not you agree with them.

> Why should I install an app for that purpose?

I'm not saying you should! I'm not arguing the merits of the original opinion, I'm simply saying there is a difference between whether an application can do something, and whether it will do something.


If you turn off notifications for Chrome, it can't send notifications. If you rip off your transmission, your car can't switch to first gear.


That's not the same thing..........


The point is that you don't represent everybody, yet the browser gives you a choice instead of forcing you to do something.


The point is that few want this and Chrome make a default behavior that inconveniences lots of users.

Chrome should default not to prompt. Safari estimates that no one wants this, and I suspect they’re right.


Chrome should default not to prompt.

It absolutely should. Making the default "never prompt" would lead to websites prompting users to modify their preferences and change security settings. We do not want to normalize that behaviour. It would be a security nightmare. The defaults might be a little annoying for users (who can switch it to never prompt if they want to) but keeping average users who do want email or chat notifications safe online should take priority.


I don’t think average users want email or chat notifications.

And I don’t think web sites would prompt this as they don’t on Safari and that works out ok.

I think Chrome defaults stuff that Google thinks makes advertisers more money and Google more money. Safari defaults stuff that Apple thinks users want.


Yeah, it's an old "feature" that makes me immediately close the site and never come back. The culprit is usually a random newspaper.


> I don’t want websites to be able to send notifications to my phone.

You might not, but our users requested desktop and mobile notifications. The notifications let sick patients know when their prescriptions are ready, facilitate care-provider check ups, etc.


PWA cab be 'installed' to the device, similarly to 'Add to home screen' option.

It would be reasonable to allow notifications only to installed PWA, and not just any website you visit.


It seems like the that’s the obvious solution at first but if you think about it, this will make every site ever to greet you with “add to home screen” popup. Just like aggressively trying to make you install their app from the appstore. The number will increase since there won’t be a barrier of entry.

Then there would be people who are trying to make you "install" their PWA at any cost, then sell their install base and the buyers will simply rename the app/website to anything they want.

It can actually be another golden age for the web while making users hate their phones.


Right now, if you go to any website on mobile, you get a big popup telling you to install a native app.

What would be different?

Getting asked to enable a browser feature is not more annoying than getting asked to exit the app and install a brand new native app with worse sandboxing and privacy. It's at most the same level of annoying.


There's some barrier of entry(buy an account and create documents describing your app) to have a mobile app, with PWA it will be removed and you will have every single website trying to make you "install" their web app, just like every single website is trying to take your e-mail address or make you create an account.

The app experience is almost always better because you always have more screen real estate, higher performance, better persistence and the developer has more opportunities to monetise you which eases the need to shove all the adds technologically possible into your face before you leave and never come back.

Visiting a new website in 2021 has the following installation process:

0) click a link

1) download the website. Websites are bloated these days, things jump around until you download and execute a few MB of JS, CSS, HTML and so on.

2) accept/deny tracking(usually designed to trick you into accepting)

3) accept/deny subscribing to newsletters(usually the skip button is obscured)

4) try to figure out what is this all about, trying to distinguish site element from ads

5) if you still want to continue you probably will need to create an account for anything that's beyond an article. Many times, you will need to create an account even for an article

6) after all that jazz you can actually try out the app/website or consume the article

7) if you like what you see, you need to bookmark/add to home screen

An app experiance is something like this:

0) click a link

1) see screenshots and explanation of what this app is all about, accompanied with reviews and ratings

3) if you like what you se, tap install, make a fingerprint scan or a face scan to download and open the app

4) try out the app. if you like it, it will be on your homescreen to use again. if you don't like it, you can delete it from the same place.

For both cases, any use hardware or system API you will get about the same popup asking you to give access to location/microphone/camera/bluetooth. For the mobile app the experience of managing it will be easier since it will have standardised settings in the device settings and you know the permissions are revoked when you delete the app.

For web apps you don't have an uninstall process. You need to dive into browser settings to remove history, cookies etc.


What barrier of entry? We've already had notifications on the web for 6 years, and the experience isn't what you describe. It's far more common for me to run into a website asking me to install a native app than it is for me to see websites asking to display notifications. Nobody wants to be forced to install a native app to order a pizza or check their bank balance. It's better if we can do those things on a website without installing an entire application.

> The app experience is almost always better

Strong disagree. Even on iOS native apps are more invasive and have fewer privacy controls than a website does. That's why all of these websites want you to install apps. Facebook isn't asking you to install their app because it'll be a better experience for you, they're asking you to install their app because then they can request contact permissions.

> 0) [...] 1) [...] 2) [...] etc...

This is just nonsense. You're arguing that configuring a browser to default-deny permission prompts is a worse experience than getting badgered to install a completely separate application every single time you visit Reddit.

And to your point on advertising, this is a good reason to have an app environment that supports competent adblocking. Neither Safari nor iOS provides APIs to do that for websites or for native apps.

This all kind of boils down to, you have an environment with less sandboxing, less privacy, less granular permissions, and a longer install process (visit a site, switch apps, download and install a new app, switch apps again, then uninstall and clean up when you're done); but it's OK because the process of building an app is so cumbersome that a lot of businesses won't bother? This may not be the persuasive argument you think it is.

I mean, you can tell me all you want that notification prompts are worse than the current system of websites constantly asking to exit the website and install a new thing that gives them native file access to my phone, but... I browse the mobile web. I know what the mobile web is like from day-to-day experience, notification prompts are not the reason that the mobile Reddit website is annoying to use.


It's interesting that the sites that you'd expect to use notifications tend to not be the ones actually offering them. Webmail? Reddit? HN? Obvious notification cases. Legitimate ecommerce? I could see prompting for "let us send order update notifications after purchase." Don't see it there though.

Instead, I see a lot of "enable notifications to prove you're not a robot" scam fake-CAPTCHAs and a lot of newspaper/TV/media sites asking for it. Just because I want to read one article doesn't mean I'm naturally after an update every time you post anything else.


This is what I've wanted safari/iOS to do.

They'd get to claim privacy/user safety (no drive by permissions grab)

But, this eats into their walled garden money pit, so yeah it's not going to happen..


Have those users download some simple app if this is so important to them. Or let them enter their phone number to get more reliable text notifications. Just because you have a good use doesn’t outweigh the all the bad abuse.


> Just because you have a good use doesn’t outweigh the all the bad abuse.

Personally, this is how I feel about downloading apps to my phone for every individual service and product. I see no need to download a separate app for each individual service I'm interested in, as the potential for abuse is higher than getting the occasional notification from my browser app and visiting their website.

However, it sounds to me like the focus should be on minimizing the potential for any avenue of information delivery to be abused, not to remove or decline to add features for fear that they will be. From the user side, I'm not interested in being told by a developer, "download my app if it's so important to you." I'd probably never discover how useful a service can be if I would have to download another app to try it. From the developer side, I'm not interested in telling potential users, "you actually don't want that feature."


99% of apps you download aren’t spam unlike the 99% of web notification requests that are spanmy


I don't find that very convincing at all. 99% of apps I've ever used add no value beyond what a web interface could do, and most of those send me spammy notifications trying to draw me back into the app. App notification spam is a much greater problem for me and everyone I know than web notification spam, and apps pose a greater privacy and security threat.


I agree, because I've become picky about what I install. I tend to use only open source apps, especially from F-Droid.

However I routinely deny notification requests in Firefox so this is not a problem. I also routinely deny the permission to use canvas image data. Firefox warns it can be used to fingerprint browsers https://support.mozilla.org/en-US/kb/firefox-protection-agai...

Sadly Apple does its best to make more money. If they allow other browser engines they'd end up selling less apps. IMHO they'll care about privacy only until it positively correlates with making money. If it will ever cost them more than it gains, they'll find a way to weaken privacy without losing face.

An example, Apple ruthlessly enforcing in app payments for small companies but bowing to Netflix, Amazon and the like. They know they would sell less phones if those apps won't run on iOS.

And that's expected. Why would a company care about you and me in this age? No more than what you and me would care about ants.


Then 99% of the websites you visit are spammers, that's a different problem.

Removing this feature from all users though is not a good solution either. Chrome allows you to block notifications from all sites so you don't have to dismiss requests anymore which seems like it would suit your needs and at the same time allow others to use this feature.


In my experience the usage of notifications in native apps is hardly less spammy than web notifications.


Instagram, Facebook, Twitter are the biggest offenders here. Its worse cause for these apps if you allow them the send notifications permissions you are automatically opting-in for everything and you need to use their UI to granularly remove the ones you don't want.


>Have those users download some simple app

The whole discussion is about it being unnecessary resource use to develop said "simple app" due to Apple's restrictions on mobile Safari..


And not everyone has the resources to build a "simple app" just for iOS.


This is, unfortunately, the route we're going, and was addressed in the OP:

> Despite the web app working perfectly on Android and across Windows, Linux and macOS without native integration, we now must dedicate time and resources to develop an additional iOS app just so iOS users, which over half of Americans are, aren't left out.

> This is an expensive endeavor time-wise and money-wise, during a pandemic where time is of the essence and resources are stretched thin. It shouldn't be this way, but it is.

The end result is that, right now, some sick patients are punished for their wrong choice of phone or tablet because the native app doesn't exist yet, while others don't have a problem.


How is this abused when you have to opt in to get the notifications? If you opt out once the site cannot request it again.


Can you send them an SMS? One would think that notifying someone with a phone is a solved problem that doesn't require deep phone-browser integration.


You can always disable all notifications from browser for your use case.

Personally on Android I have enabled notifications from a total of 2 sites and I find the experience quite good. I actually think its better than having to install an app for something that you rarely use just for that one time you will need to receive a notification from it.


>> I don’t want

Who are you? And why does only your absolute opinion matter, when others are asking for a choice?


I’m the same as the the users of Firefox who deny 99% of notifications https://blog.mozilla.org/futurereleases/2019/11/04/restricti...

We are the the 99%


99% of notification requests being blocked is not the same as 99% of users blocking notifications. If every user visits 100 sites and accepts notifications from one of them, then 100% of users actually want notifications despite 99% of requests being denied.

I'm not defending stupid notification popups from some website you'll only ever visit once. Those are annoying. I'm saying you can't tell what users want unless you specifically measure exactly that. Maybe you're right and 99% of users don't want notifications, but that's not what your cited numbers show. You're drawing a conclusion from the data that isn't there.


I would imagine that 99% of people wouldn’t be happy with a service that is 99% spam.


Again though you're making assumptions that the data can't back up. If a site asks to send me notifications and I say no that doesn't make the notifications spam. That just means I don't want to see them for some reason.

And besides, for something to be spam you need to actually see it. In the case of notifications if you deny the permission on a site you don't see the notifications. That's the perfect spam filter. Imagine a world where people could only send you email if you explicitly said you accepted it from them. Or if robocallers could only call you if you agreed first. Spam would be over. There would be no spam. That sounds fantastic.


Email _is_ 99% spam. That doesn't mean that email isn't useful, though.


Somehow, by the time it reaches any of my multiple inboxes it’s not 99% spam


TL;DR: I'd like to see web notifications improved rather than abandoned because I think they are part of a suite of features that could provide important competition for native apps on mobile devices.

> Somehow, by the time it reaches any of my multiple inboxes it’s not 99% spam

Right. Email providers didn't fix spam by throwing away the ability to send unsolicited messages, they fixed it by looking at the behavior of bad actors and blocking it, and evolving the UX of email services to adapt ("Report Spam" buttons and the like). My comment above was intended to suggest that rather than demanding the industry throw out the feature that would allow a website to send notifications at all, they can instead invest in making the experience more streamlined for the user (fewer notifications, less intrusive request flow). They could even use some of the same techniques used in fighting spam, like allowing users to report sites that are abusive in how they ask for permission.

The subtext here is that I think progressive web apps have the potential to foster a more open online culture than can be achieved through app stores alone, and they also give the user more control over the experience, since they leverage the browser, which is a "user agent" in a way that that apps rarely (if ever) achieve. Adopting a stance that solidifies the current inadequacies of web apps pushes more users and developers to "app store apps", which tilt the balance of power towards app store owners and away from users and developers. I think that trend has already caused problems (Spotify, Fortnite, Librem Tunnel[0], etc.), and I don't see any reason the problems will lessen in the future.

[0]: https://puri.sm/posts/why-librem-tunnel-is-leaving-ios/


For me on Android Firefox website push notifications don't even work. I thought this was by design. Am I doing something wrong? There's a couple of sites where I really do want this.


The more I see posts like this that complain about other browsers lacking features and essentially encouraging the "Google-isation" of browsers, the more convinced I am of the power of Google's gigantic monopoly-enhancing propaganda-machine.

Firefox unfortunately has no choice but to be dragged along by Google.


I'm a mobile and desktop Firefox user, and Firefox has supported the features that are missing from iOS Safari like the Web Notifications API since 2013, and the Web Push API since January 2016.


Why should a web browser be able to send notifications? Why are we overloading web browsers to do more and more things? I get that transferring data over the internet is king, but surely we can devise better user interfaces than bloated browsers, etc?


>Why should a web browser be able to send notifications?

Why not? Web browsers are not just for reading text based articles. Most use a calendar, email, perhaps some kind of chat app through their browser. Aren't these and other similar use cases good reasons for notifications to exist?


Web browsers are essentially an inner platform now. Instead of taking the time to develop native apps, or even to write using cross-platform frameworks, developers prefer to trade performance/security/privacy for developer time. It's really just an acceleration of a trend that has been going on for decades (Wirth's Law) but Web 2.0 is hip and cool. You're not writing some lumbering dog of a Java application (write once run anywhere!), you're agile and using React and web sockets, you're one of the cool kids (writing a lumbering dog of a Javascript application).

https://en.wikipedia.org/wiki/Inner-platform_effect

All in all, building out applications using cross-platform frameworks seems to be a far better solution for end users, and not significantly worse in terms of developer velocity, but I think there are other reasons they are not adopted, primarily that the web makes it far easier to invade privacy and deploy dark patterns, while that behavior typically is checked by the app store approval process for "native" or cross-platform applications.


> the web makes it far easier to invade privacy and deploy dark patterns, while that behavior typically is checked by the app store

Disagree. One reason sites want me to use their app is because I can’t block trackers. I wont use native apps if there is a web alternative BECAUSE i value privacy.


What trackers? Apps are sandboxed, so they shouldn't be able to track you.


Why not? Why must an app be written natively?


Because it offers superior experience.


Apps don't (or shouldn't) need to be native to offer a good user experience.


Yes they need and should be native, if you don't want to reinvent OS integration yourself.


But often writing them natively does do this.


iOS dev since 2014 here. So many of my app ideas would have been completed 2-5x quicker if mobile Safari supported push notifications. It is unreasonable gatekeeping.


It is very reasonable gatekeeping. People would be inundated with notifications on their phones.


No: you would--at worst--be asked more often than you would like to approve notifications for random websites, all of which you would click no on; this feature doesn't just magically cause notifications... hell: it already even exists on desktop Safari and I just click "no".


Yeah, having to click no all the time on desktop Safari is terrible.

Also websites have realized that I am going to click No in the browser, so now they popup first asking if I want to allow push notifications in JavaScript so when I click no, they can ask me again later, vs if they popped up the browser and got a "No" there they could never ask me again.


I wish developers could get it through their skulls. I don’t want your notifications. Your app is not important enough that I’m willing to be interrupted by you. The lack of notifications is a desired feature. Please stop using notifications. It is almost always a pathetic attempt to try to “drive engagement” to your app. If I want to run your app I will run it. You don’t have to nudge me into it. The world would be a better place if all platforms got rid of them. Please stop adding to the problem.


"I don't want notifications" is just a setting in a modern browser. And voila, it's as if notifications did not exist as a feature. I don't understand why you need the feature to not exist; do you feel tempted to leave them enabled if they can be enabled?

I don't like notifications. I never get any notifications requests, unless I'm in a private window trying because some site wouldn't work with adblockers etc. Life can be so simple.


> I don’t want your notifications. Your app is not important enough that I’m willing to be interrupted by you. The lack of notifications is a desired feature. Please stop using notifications.

I don't want your phone calls. Your conversation is not important enough that I'm willing to be interrupted by you. The lack of phone calls is a desired feature. Please stop using phone calls. If I want to talk to you I will write you a letter. You don't have to nudge me into it.


As someone who gets marketing calls every fine day, I agree with your every word. And with gp too.

The problem with not implementing notifications is that when they are useful (instant dispatch software), they are not implemented. But honestly I’d just spin up a telegram or email bot, if clients were not brainwashed with tekhnology. Messages and email are notifications. It is also a matter of minutes, opposed to creating a stupid service worker client-server-like runtime and trying to get things right without any test mode (long story short, implementing and debugging webpush requires publishing every change to a certified https host). There is even an entire company that sells you a properly configured webpush as a service. That’s just stupid.


Odd argument. SMS is a hellscape to DIY (especially financially), email even more so with DKIM. If by SMS/email you mean "Twilio" or "Mailchimp," well, that's no different than using a third party push service.


The mistake was the presentation UI for notifications. Instead of making it an active question for users to dismiss, it should been presented as a subtle toggle somewhere in the UI chrome-- sort of like the star icon to add to favourites.

This would have made it possible to offer notifications without being in-your-face about it, which would have made them more amenable for sites that were concerned about brand image and user feedback. The paradigm might not have become unavoidably tainted, and we'd just name-and-shame the bad actors.

It also makes it clear that the notification consent shouldn't be a one-way street-- you should be able to discontinue notifications through the same UI and in an obvious manner, rather than treating it as a consent you can easily offer, but not easily retract.


I agree about clicking no all the time. This isn't an intractable problem, though; people just assume the ask-on-visit interaction pattern is the only way to implement this kind of functionality.

If I were on the Mobile Safari team, I'd propose bundling notifications into the bookmark workflow. If a user chooses to bookmark a site, prompt them at that moment (as an option in the modal) to subscribe to notifications if the site offers it. Because the user is expressing an interest in returning to the site, it's now appropriate to ask them to enable notifications, versus their first visit.

(For sites accessed through a synced iCloud bookmark, however, I would show a notifications prompt for the first visit on that device.)


Perhaps desktop Safari should work the way you described. Whenever I get a new Mac, one of the first things I do is stop allowing any website to ask to notify me.


Did I accidentally disable this or something? I’ve never seen it.

Everyone acts like

1. For some reason it has to be some sort of pop up, it could easily be a small icon in your bar

2. Apple couldn’t/wouldn’t design this so that it was unobtrusive

3. If the way they did design it was still too annoying, they wouldn’t make it less so, or make it easy to turn off

Why do so many on HN argue from “if it existed it would obviously be in form X that already exists and therefore be bad and therefore I never want it and will oppose it vehemently” it’s a total lack of capability of even the most incremental innovative thinking.


>> it’s a total lack of capability of even the most incremental innovative thinking

Honestly, HN is a cargo cult of native only, anti web app sentiment. It’s frustrating.


Or...

Your opinion isn’t held by other people, some of whom disagree with your opinion and are expressing that.


> Your opinion isn’t held by other people, some of whom disagree with your opinion and are expressing that.

The other opinion seems "notifications cannot be disabled, therefore notifications are bad".

If you don't want to see notification requests, you never will. Granted: you need to be able to change settings, in a very restricted environment or with a custom clone of some browser you might not be able to.

For most users, that's not a problem. I'm one of them. I don't see notification requests on my desktop or phone. Neither do I see requests for geo-location, even though the browser is fundamentally capable of providing my geo-location to websites through an API; I've disabled it.


I didn’t express an opinion either way. But it’s clear to me that there are some amongst us that believe that a difference of opinion must mean everyone who disagrees must therefore be in a cargo cult. That is what I am taking issue with. It’s also against the guidelines here.


I'm still struggling to find out the non-cult reason for "the feature must be banned from the browser, just being able to disable it for all time with a single click is not enough".


It'll be the same reason as the "cult" of "what I want should be the norm and anyone who disagrees, for whatever reason, must be in a cult"


I think the misunderstanding is that the HN sentiment is very tangential to how real average users experience websites. Here everyone uses Adblock and NoScript, whereas most users have neither installed. So HN is more like a cult, whereas the real world is much larger and not like a cult?


HN has many cargo cults not reflected by broader tech. It certainly has a crowd.


> 1. For some reason it has to be some sort of pop up, it could easily be a small icon in your bar

It is a popup right now... it is in your face and requires immediate action.

An example:

https://imgur.com/a/GfqUuAZ

Using:

https://www.bennish.net/web-notifications.html

> 2. Apple couldn’t/wouldn’t design this so that it was unobtrusive

It is obtrusive in that it is a full-window popover and you can't go to any other tabs until you have completed the action.

> 3. If the way they did design it was still too annoying, they wouldn’t make it less so, or make it easy to turn off

You can currently disable it browser wide in Preferences -> Websites => "Allow websites to ask permission to send notifications".

However, that doesn't stop various websites from displaying their own JavaScript based popups and requests before even attempting to use the Web Push Notifications API to see if the user wants to grant access using the native API's.

This way they can nag the user over and over to enable notifications whereas if you deny it once in the browser you need to take a bunch of manual steps to remove the website and grant them access.


Safari does not use the Web Push or Notification API, Apple has a bespoke Safari Push Notifications[1] API on macOS, so this poor implementation is completely on Apple.

On Firefox, it just puts a little message window icon in your address bar if you didn't trigger the Notifications API permission via a control on the website. When you do trigger the permissions through user interaction, and unobstructive widget shows up[2] that can be promptly hidden without ever actually interacting with it, unlike in your Safari example.

[1] https://developer.apple.com/notifications/safari-push-notifi...

[2] https://support.mozilla.org/en-US/kb/push-notifications-fire...


Wow, now I understand the sentiment... but that's a reason to stop using Safari, not against notifications.


I’ve been slowly using safari more and more and this made me realize why I enjoy surfing the web in it more: no constant stream of sites asking for location/notifications/whatever


And I don’t wanna click no all the time. Nobody does.


ChromeOS has won, Safari is the only one left standing on the way that actually matters.

Firefox as much as I love it, and has been my main browser linage since the Netscape days, doesn't stand a chance.

Specially when everyone is now packaging Chrome as Electron, while praising it for GNU/Linux desktop apps.


I’ve never heard praise for electron, though that could be the crowd I associate with. Electron apps are the worst of both worlds; it’s so bad that I’m willing to open a web browser if electron is the other option.


Just check the comments here, where many of us happen to bash it, while others praise it for bringing apps to GNU/Linux.

99% of Electron stuff could be done as pure Web application, and if native support is required, running as daemon.


I don't think it's a contest really. I'm happy using Firefox knowing it's got a small marketshare. The same way I vote for a small political party knowing they'll never win any election.

With Firefox I don't see any issues related to the marketshare. All add-ons I want are available and all websites work just fine except one or two that just block it outright just out of spite (Apple Business Manager - business.apple.com being one)


Sure, but what do you think it will happen the day Google no longer supports its development?

As far as I know Mozilla doesn't have that many sources to keep it running, and the latest round of layouffs was kind of a signal of what is yet to come.


Your speculation doesn't hold water. They have been increasing their hiring recently, and their layoffs were largely in areas where community members could power development and in experimental areas. MDN still exists and has good info. Note anyone can contribute straight on GitHub. Servo got picked up by the Linux Foundation after much of Servo already got integrated into Firefox. The Rust Foundation recently started and multiple big names have picked up large Rust contributors. So Mozilla made a smart move laying off those people. People on HN don't want to admit it.


We are talking about browsers with serious market share here, Rust and Servo are irrelevant to the future of the Web.

Let Google close the money stream and lets see what happens.

I hope to be wrong.


Well then we'll see what happens... For now it's great. Nothing is forever, even Internet explorer came to an end after its (totally undeserved) monopoly.

I would pay a lot though to keep it going. Like 100 a year or so (for me that's a lot :) )


If your progressive web app stops working because the browser is missing a feature, by definition you have not built a progressive app. It’s supposed to work everywhere, with progressive enhancements if platform features are available.


The parent comment didn’t say their PWA stops working on Safari, only that it doesn’t have a full set of features on it. For some applications, features like push notifications are essential.


They said Safari is

> the reason why we can't have nice things like progressive web apps

I.e. implying that progressive web apps are only possible if a specific set of features are supported everywhere. It’s like saying that accessibility is only possible if no users have disabilities.


I think OP is implying that if Safari is the only one lacking a feature that is part of the W3C standard[1], Safari is at fault.

[1] https://www.w3.org/TR/push-api/


I feel like I’m repeating myself, but the whole concept of “progressive” web apps is to be resilient to these variations in which features are implemented.


> but the whole concept of “progressive” web apps is to be resilient to these variations

Your confusion comes from your personal definition of "Progressive Web App"

For sure the confusion starts from their name, but in short «A progressive web application (PWA) is a type of application software delivered through the web, built using common web technologies including HTML, CSS and JavaScript. It is intended to work on any platform that uses a standards-compliant browser, including both desktop and mobile devices.»

Emphasis on any platform that uses a standards-compliant browser, in this case Safari is not standard compliant.

A Progressive Web App (or PWA in short) is not the same thing of "progressive enhancement" or "graceful degradation" for regular Web Application.

Those are just some of the features, but it doesn't stops there.

Some of the fundamental charateritics of a PWA include being

- App-like — Feels like an app to the user with app-style interactions and navigation

- Re-engageable — Ability to use push notifications to maintain engagement with the user

As you can see being able to notify the user is a key feature of a PWA.

Which is not possible if some vendor refuses to implement the standard features that narrow the gap between Web and Native, like Apple is deliberately doing with Safari.

It's not too hard to make them work without those features, that's not the point, the point is it's impossible to have the same feature set on every platform because one vendor in particular doesn't want you to, they want you to develop native applications which is vastly more costly and it feels like wasting effort and money on something that should have worked with almost the same capabilities on all the major platforms with little or no modifications. It's true everywhere, except on Apple mobile devices, where you can't even chose the web rendering engine.


Not sure what you’re quoting in italics there. But it’s certainly not my “personal definition of the term”, it’s the origin of the term [1]. The idea was to take progressive enhancement so far that a regular website can progressively become something app-like. Over time, people seem to have forgotten why we call them progressive, and think it just means they’re entitled to use every idea that someone in W3C’s Department of Feature Creep put their stamp of approval on.

1: https://infrequently.org/2015/06/progressive-apps-escaping-t...


I think this is more about the missing possibility to list it in the store


And collect a revenue percentage (not just from the app itself but any in-app purchases). Apple has been really strict on this and PWAs would avoid this entirely if they were possible.


Progressive web apps is not a feature. It is one of the worst bugs a browser can have.

It is almost Electron level bad.


What is Safari on iOS missing specifically?


For this specific use case, it's missing the Web Push API[1], which can be used to implement push notifications, and the Web Notification API[2], which can also be used for the same thing.

[1] https://developer.mozilla.org/en-US/docs/Web/API/Push_API

[2] https://developer.mozilla.org/en-US/docs/Web/API/Notificatio...


Maybe your app is a rare exception, but apart from chat apps, any use of notifications I’ve seen are undesirable and abused to spam users. Even those that do have a legit use-case still abuse it by pushing non-desirable (from user perspective) messages.

I think apart from Gitter I’ve never wanted a notification, as a user.


This app helps sick patients navigate the healthcare system. Notifications were requested by users so that they don't need to continuously go back to the web app to see if there are any updates.


How about sending notifications over email?


See this post[1]. We already do text and email notifications. Not all phones and tablets get texts, and email notifications are unreliable. Many users wanted desktop and mobile notifications, hence why we implemented them on top of texts and emails.

[1] https://news.ycombinator.com/item?id=26520303


I use apps like this to manage my health care. Email would be a significantly worse experience than notifications.


This speaks to your inexperience in making applications for the average user - they barely use email.


> This speaks to your inexperience in making applications for the average user - they barely use email.

Do you find that most users do authentication via phone number instead of email?


The speaks to your inexperience making applications - using anecdotes and assumptions about "the average user" to determine what to do is nowhere near as useful as asking your actual users. Real data is better than guesswork.


I have built global apps, and found that users struggle to even accept email address confirmations. The reality is that email is dying.


> users struggle to even accept email address confirmations

This experience is geographically or demographically unique.


That's true for the users you've seen. My users all open emails with no problem.

Now do you see why "the average user" isn't useful to determine how to build something? Even if most people suck at using email, in my app it works well.


So you would agree that some users can prefer notifications over email/sms, or is that line of reasoning only self-serving?


I absolutely agree that different groups of users want different things. An "average user" isn't useful in determining that.


Which is exactly why you can continue emailing your users, while others like me would like an option to use notifications and other PWA features.


> This speaks to your inexperience

Please be kind and not sneer as the guidelines suggest.

https://news.ycombinator.com/newsguidelines.html

You could easily reword you comment to.

> In my experience the average user barely uses email.

Unless you know parent commenter personally I don't think you're competent enough to judge their experience in an online discussion.


I agree. Most websites use push notifications for the wrong reasons. This has given them a bad reputation. But when properly used they are certainly powerful and useful.

I use them for some local forums to notify me of replies. Don't want to fill up my inbox for this.


Great. Take their phone number and text them. Amazon charges what, $0.00645 per SMS?


You want to send potentially sensitive health updates over SMS? Or just a link, that then opens the web-app anyways? Definitely sounds like bad UX.


CVS has no problem sending text notifications. You can send informative alerts without any sensitive info.

Push notifications are subject to the same HIPPA rules as sms. You can’t included sensitive info.


Push notifications go through apple/google servers. The advantage of PWA notifications is that they can be local - https://developer.mozilla.org/en-US/docs/Web/Progressive_web....


You don’t get it, 100s of billion of these notifications have been shown already to users on desktop with a less than 1% accept rate. These are spam .


What a weird argument. We're not talking about suspicious blogospam sites asking for notification access here. By the same token, most email sent is spam. Should we stop using email?

Spammy notification requests should be mitigated with better browser guards for requesting them. The fact that there is spam does not somehow invalidate that there are legitimate use cases people want them for.


If 99% of something is used by spam and not opened it makes a strong argument to remove said feature.


Here in California, I got updates about my covid19 test results, and my covid19 appointment information, over SMS or a link over SMS.

This includes what vaccine I received, the lot number of its production, plus information from v-safe[1] and reminders to check in telling the government how I feel on days after the vaccine.

1. https://vsafe.cdc.gov/en/


What a terrible ux


Why? Text messages are great because they pop up on my Mac too.


This - email and text notifications go everywhere for me. Web ones don’t follow what device I’m using


I don't like browser notifications, especially on mobile. Maybe it's me but there's no explicit place agreed upon between me and the browser where the browser says "if the site sends a notification, here is where it will be".

Mobile is already bad enough where if you swipe a notification away, well I hope you remembered the icon and the bit of context that was on that notification. Browser notifications just make this worse.

And then there's the whole "will I get a notification if the browser app is closed? What if I get a notification in the middle of the night, will I receive it in the morning? Will it continue to receive notifications if I restart my phone?" kind of questions. Maybe it all just works but I am very untrusting of the whole feature.


Technically, webpush-enabled site starts a service on your phone (read on js service workers) that then asks a browser to accept notifications from some origin and sends permission credentials to that origin. Then it decides for every incoming notification if it is worth popping up (e.g. if a site is a chat and it is already on the screen, there is no need to spam with popups), or if it’s worth a new tab on tap/click, etc. It is a hassle to configure, but then it usually just works. I suspect that your browser has to be running anyway, because a service worker is just a restricted browser env. Push providers may have delayed delivery, at least there is a ttl field in a notification at server-side. Didn’t test that much and only used that in one project, but remote alpha users already reported missing notifications. I have no clue how to debug that, because it simply doesn’t happen (phone config seems okay).


There's nothing stopping Safari having a less annoying implementation of notifications. They have full control of the experience.


Similarly, I’ve rarely needed web notifications and on the handful of occasions I have they’re of a nature that’s better tied to a desktop/laptop than a phone or tablet.


lichess notifies when it is your turn, quite useful. There are many legitimate uses of this feature especially business environments.


I'm willing to go as far as to say it's The one feature that's singlehandedly holding back PWAs entirely. Most apps that you use every day needs notifications for one reason another, mainly communication apps, and if you could do them with a web app it'd be a game changer. But Apple is holding us all back and has been for years.


If it is a progressive web app, then it should abide by progressive enhancement https://en.wikipedia.org/wiki/Progressive_enhancement .

So no, lack of push notifications are not holding back PWAs. They are holding back web developers which choose to aggressively require new features, then get upset when they only work in the browser they tested with (invariably Chrome).


Pretty much none of the apps, native or web I use regularly, need notifications in order to do what I want them to do. It is usually the makers of said apps that really really want notifications as a strategy to increase engagement.

I’m not against web notifications per se, but I’m not buying that most web applications are held back because notifications are actually crucial to them functioning.


I don't understand why Apple is holding anyone back. Just build an app that doesn't work on iOS. There's lots of apps exclusive to iOS and Mac - why not exclusive Android?

If the app really is a game changer, if it's that compelling, Apple will absolutely change its tune.


Because any app that is social in nature (where interactions between users is required really) that can only reach 50% of users does not have 50% of the potential value, it's closer to 0.

As an example, my girlfriend's a nurse, and they have a really bad paging system. Basically, the doctor calls the hospital reception who calls one person who is on call, who calls the second person on call. Of course, this breaks up regularly: the wrong person is called, or they call their boss because they don't know who is on call, and so on.

I thought I would do a PWA to help them out and learn some new things, but it's pretty much impossible on iOS. Now, if 50% of her team cannot use the app, it has no value. You would have to know who has the app or not and call the other ones. It's easier to just keep on calling directly.


> Because any app that is social in nature (where interactions between users is required really) that can only reach 50% of users does not have 50% of the potential value, it's closer to 0.

This wasn’t true 10 years ago when Instagram launched, and was iPhone only for a considerable time.

Clubhouse seems to think it’s not true today either, also iPhone only.


> 10 years ago when Instagram launched, and was iPhone only for a considerable time

iPhone users are, on average, higher earners than the median American [1]. Being iOS only means you get the vast majority of high-income Americans.

[1] https://www.statista.com/statistics/195006/percentage-of-us-...


The issue is not very clear to me, but usually people create a group chat for that and simply turn notifications off when not “on call”. Whatsapp, telegram, signal, discord, mailing list, whatever fits more. For automation chat/email bots may be used. Chances are it’s already solved, if you take wider than “PWA or nothing”.


Isn’t the entire point of progressive web apps that they’re tolerant of different features being available or not? That’s ‘progressive enhancement’. Your app is supposed to work if the functionality isn’t there, or equally if it’s there but denied access. You can have it show updates when the user checks the app if that’s what they want.

Complaining a browser doesn’t support a progressive feature is a contradiction in terms!


It works, but users don't get the notifications they sign up for and expect without using a native app on iOS.


Apart from chat, what are use-cases where users actually want notifications, as opposed to being coerced or tricked into accepting them?


The app helps sick patients navigate the healthcare system. Users get notifications like "Your prescriptions are ready for pickup" or "Your prescriptions are scheduled for delivery at 5PM", and it's a user requested feature.


As an iOS user I generally don’t want notifications from apps


Right... isn’t that the whole point of progressive web apps? Users get as many features as their browser supports or they permit? That’s the point.

If your app doesn’t work like that then it’s not progressive... so you can’t complain it doesn’t support your progressive app because it’s not progressive.


Try explaining to users that the feature they want and expect doesn't work for them because their particular browser doesn't support it, despite it working on every other browser and platform.

The only solution I see is telling users to "use the app", which doesn't exist yet.


You tell them it doesn't work on iPhone because of Apple policy such and such and to go complain to Apple if they want the feature. If enough people do it then maybe things change. If developers continue caving and not letting users know there will be no pressure on Apple.


I agree on principle, but I'm not telling sick people that.


"can be", not "must be"...

Remember that we had real time webchat without JavaScript two decades ago, and a lot of other things that would probably turn into some sort of Chrome-only site if invented today.


If you have a solution to giving iOS users the notifications they want via a web app, PWA or not, I'm all ears. We already implement text and email notifications.


Polling, long-polling, websockets? I feel like I'm missing some context here.


Isn't the issue getting notifications out through the OS notification system?

Unless I'm misunderstanding something about the problem, I don't do iOS dev or any webdev complicated enough to require OS notifications.


The Push API allows for efficient push notifications without polling, I believe, but don't quote me on it. The problem is displaying notifications like you would a message notification on iOS.


> The problem is displaying notifications like you would a message notification on iOS.

As an iPhone user, this being difficult for developers is a highly desirable feature!


It would be opt-in like on every other platform, isn't that enough? As heavyset_go said, it's a huge pain when a user wants a notification and can't enable one.


In addition to the issues other people are bringing up, there are a ton of decentralized video use cases crippled by the lack of Media Source Extensions on iPhone (they finally I think decided to deign to include it on iPad, just not iPhone).


Web Push Notifications, ShardeWorker, BroadcastChannel. Native Add to Homescreen, Good Developer tools to debug things on a non Apple computer, Background Sync, Notification Badging API, App Shortcuts

These are only the ones that I remember right now, but I know there is more


web push notifications, notification badging, shared worker, etc are user hostile features. They burn battery life, the former two exist almost solely to spam users (Mozilla did a study and it turns out no one wants notifications from random websites).

Safari has had add to home screen for the best part of a decade. Giving web pages the ability to spam users to add it is an anti feature.


> Safari has had add to home screen for the best part of a decade

On Chrome you can trigger a add to home screen prompt from your own UI, making it a two touch experience. On iOS IIRC it only works on Safari and not in Chrome, but I could be wrong.

> no one wants notifications from random websites

I am not talking about random websites, but rather web applications that you interact with on regular basis, if Apple cared about the user experience they could have just moved the notification prompt behind a user interaction.

> shared worker ... They burn battery life

If you are building more demanding websites shared workers are a great way to share state and computing resources across and thus saving battery life. Spawing a Worker per tab is more demanding.


How about Web Push Notifications that only works in sort of a PWA mode once it is added to Home Screen?


Progressive Web Apps


But what exactly?

Wikipedia says it does support it https://en.m.wikipedia.org/wiki/Progressive_web_application:

And I know I’ve written Progressive apps for iOS myself - manifests etc.

So I know it’s not as simple as you’re saying. What do you really mean?


Safari absolutely does not support PWAs in a meaningful way when compared with other platforms. Service Worker support is fine, but one of its main features is its use in combination with the Push API, which is not supported in Safari. This omitted feature alone alone makes web apps on iOS far less valuable than native apps. There are other omissions as well, but this one in the most glaring.


I’d say being able to target 50% of your market with a single codebase/binary isn’t a bad investment.


> and the fact that they refuse to allow other browser engines on iOS is the reason why we can't have nice things like progressive web apps.

Is that against the App Store guidelines? Or is that a programming limitation? I am aware all the iOS browsers are just a wrapper around WKWebView but am curious why another engine can't be implemented.


This is another example of Apple anti competitive and anti consumer behaviour and regulators should start to look into it. Unfortunately Apple managed to amass so much wealth through various tricks and loopholes, they are now in position to buy any regulation they want and probably that's why they are allowed to continue with these practices.


I wouldn't care about what Safari is doing if iOS would allow you to install browsers that are not based on webkit. The fact that Apple only allows webkit browser makes it so much worse and means that no one can compete on iOS against Apple


Yeah it's strange because PWAs were Apple's original plan for iOS apps :)They didn't yet exist under the PWA name but this was definitely what they were aiming at.

But Safari will never be a serious option for me. I want the same browser on all my systems and I use a lot more than Mac and iOS. So Firefox it is.


I still remember the early days of iOS and webOS via Palm and HP, and now LG. We had HTML/CSS/JS powered mobile apps available on the Palm Pre in 2009, and it was pretty great.


Some "features" are harmful to the users and only exist for the convenience of Google and other data mining and spying companies.


Half of Americans use an iPhone? Is that true?



The answer is to make the nice things and force Apple to implement them lest its user feel left behind.


I agree with the sentiment, but the real result of that would have sick people punished for the wrong choice of phone.


You choose crap you lose, always been like that. Refusing nice things to those choosing (more) open platform so as not to punish them makes no sense.


Or you just send them a text?


We already do texts and emails[1]. Users wanted desktop and mobile notifications, as well.

[1] https://news.ycombinator.com/item?id=26520303


I don't get that, why not just not support safari if they intentionally make it difficult?


Because Safari has like 50+ percent of the mobile market share in the west


On the west side of the Atlantic.


About 30% in Europe, but in the "western" part, like Norway, above 60%


Because we don't think it's fair that sick people can't access the care they need because they have the wrong phone or tablet.


I love Safari as a browser, but I hate the fact that it neuters the web and makes it feel much less powerful. Web Bluetooth and webUSB are ignored by Safari and unsupported. Notification support is lacking last I checked. No PWA functionality to speak of and webNFC won’t be added. Extensions are lacking largely due to being basically native apps that bring with them all the cost and overhead of being such.

As a browser Safari is beautiful (loving the look of it on Big Sur), efficient, lightweight and has a lot of little creature comforts that other browsers can’t or won’t implement because they are Mac specific (keychain, Touch/FaceID, native share sheet, 2fa code reads direct from Messages, etc). But it’s also hard to see a future in a browser that is still stuck in a Web 2.0 philosophy.

The author’s point is good though: Safari is becoming the final bastion of hope against a purely Chromium landscape just by virtue of being an Apple product with an immediately large market share. I hope Apple will use this position of power wisely and help drive browser behavior rather than just being comfortable to exist in their own little world. Wishful thinking, I’m afraid. For Apple Safari seems to be little more than a talking point when advertising MacOS/iOS. It’s just another feature.

For what it’s worth I’ve been really enjoying Vivaldi of late (I have no affiliation with the project, just including for context on my day to day browser).


On one hand you have people complaining Chrome kills their batteries and on the other you want to have a browser that does push notifications, Bluetooth and usb. I want my browser to be fast and light. These complaints seem to come more from companies wanting to save money and developers too lazy to develop native apps. I don’t want to load a 200Mb progressive web app that goes through 20 layers of abstraction to show a list of news items just because developers are lazy and companies want to make more money. This is not for the users, at least let’s be honest about that.


> I don’t want to load a 200Mb progressive web app

And I don't want to download your 200Mb native app that I will only use once. Besides that, the average webpage size is 2Mb which IMO is still too big, where as the average iOS app size is 34.3Mb.


> because developers are lazy and companies want to make more money

I think that Apple don't implement these features because they want to make more money and have developers make apps for their platform for free (and actually collect a fee from the developers that are improving the Apple ecosystem).


Nailed it - basically everyone here saying safari should do these things is app devs vs a ton of people going nope no thank you I don’t want that


Web Bluetooth and Web USB, along with other useless things like Web Battery that Google loves don't make the web more powerful. It only serves to make the web more bloated and user hostile. And making new browsers that much harder to implement while taking the time of existing competitors.

As a user I have never needed or wanted web bluetooth or web usb, and I have never seen a person in real life that uses these either. For all I know, it's just mythical users mentioned in HN comments that want those.


I have a Ledger Nano X I use for storing an ADA wallet on. It interfaces over webUSB with most ADA wallet managers. I also have a Pax Era Pro vape pen that can only interface over web Bluetooth because Apple banned their native app. These two uses alone require I always have at least one Chromium browser installed. Niche, yes, but I also know I’m not alone here in finding uses for these APIs.


I want them. I’ve wanted to build out hardware interactive controls, and use them in a web app. Building a web app is an easy and universal platform.


The Web is gone, ChromeOS it is.


>to exist in their own little world.

Today, the iPhone has 66% market share in the United States, 75% of U.S. App Store revenues, and over 80% of time spent on the mobile internet.


Apple sell phones globally, so really you should be using global statistics to determine what Safari needs to implement.


Are we going to include stats from Africa and India where the target market are not within the current pricing bracket of entry level iPhone?

And even if you do, it is still 25%+, hardly a minority.


> Web Bluetooth and webUSB are ignored by Safari and unsupported.

Web Bluetooth: A Chrome only feature. Not a standard or standards track. Firefox and Safari both said that they will not implement due to the security issues.

Web USB: A Chrome only feature. Not a standard or standards track. Firefox and Safari both said they will not implement due to the security issues.


Web Bluetooth and webUSB

Hard to tell without looking if these things are real or a parody!


I’m pretty sure they exist only for Chromebooks. Nobody else supports them, nobody else ever will.


Seriously, these top level complaints make me very happy Safari isn’t doing this stuff.


Thanks, you just said what I was going to comment on.

One additional thing: over use of devices is also a problem. Apple tracks use for you and I find the weekly reports useful. Apple does not need us to be addicted to social media and marginally useful stuff on the web, their business model doesn’t require it.

I don’t want many apps on my devices and I don’t want every web site to effectively be an app on my device. If I do spend time on a digital device, I either want to be doing something useful, or working on a book project that hopefully some people might find useful. It takes some care to not waste time, and since I am approaching my 70th birthday, I have stronger feelings about not wasting time than I had when I was younger.


In this sense, it’s actually a good thing Chrome and others aren’t allowed on Apple. As someone whose fought against the App Store lockdown, I think I’ve come around a bit. The web is in a weird way a better place for apple locking down the browser choice.


But Chrome/etc are totally “allowed” on both macOS and iOS...? Not sure what you mean here.


they are not allowed to use their engine on iOS, they are just a customized skin over safari/webkit (and I honestly think that’s the right way, as google has no interest in saving iPhone battery).


The problem with browser engines is that they require just-in-time compilation to be fast, and Apple wants all code in an app to be signed and available to inspection. JIT compilation requires a way to add new, unsigned code to the process.

That’s a rabbit hole of DLC, plug-ins and vulnerabilities they don’t want to go into.


If that's true then why do they have safari? What's the difference in this regard between safari and other browsers?


They control that the Safari JIT doesn’t enable DLC or plugins because the web view control it runs in can’t be used to implement this.

With regards to vulnerabilities, they are mitigated as much as possible by making sure the JIT runs in separate, unprivileged processes. And anyway it is easier to secure one Javascript engine that is included in OS updates than it is to keep a multitude of engines up to date which came with apps most people don’t even think of as a browser.


The only thing I really miss on Safari is a good adblocker. Everything else is fine, I don't use my mobile browser the way I do on desktop.



I use Wipr and I can’t remember the last time I saw an ad.


You might want to give the combination of 1Blocker (https://1blocker.com/) and NextDNS (https://nextdns.io/) a try. Personally using both on all my Apple devices and they work great IMO.


Will definitely give 1blocker a try. I hadn't thought of going with the route of tampering with DNS but that's a good idea, same basic idea as pihole.


Was a 1blocker user, but I recall there was some discrepancy between iOS and macOS that broke it.

Moved to AdGuard, seems good for now.

Also, try Hush on iOS, I don’t know the magic behind it but it seems to be much more potent at killing nagging questions.


I think they fixed those issue with the latest version. I just checked and I'm running 3.14.1 on iOS and 3.13 on Mac and they're both getting updates regularly.

Hush looks excellent. Thanks for the tip.


> Web Bluetooth and webUSB are ignored by Safari and unsupported. Notification support is lacking last I checked. No PWA functionality to speak of and webNFC won’t be added.

Very good, none of those webCVE features deserve to be potentially accessible from malicious scripts on the web.


This is why, despite it being monopolistic, I hope Apple can continue their requirement on using Safari's rendering engine on iOS. It's the sole remaining defense against a far worse monopoly. Neither the Mozilla nor Edge teams have the backbone to resist Google's web platform initiatives.


"Not following sensible standards to protect your own App Store monopoly and being a pain in the ass to work with due to rendering differences that all other browsers get right(even Firefox)" is not a good base to build a defense against a monopoly on.


Being asshole for the sake of keeping a far worse asshole from being in total power is.


Saying they don't get rendering "right" implies they aren't following standards. Is Firefox not standards compliant?


iOS only allows webkit based browsers, thus every browser on iOS pretty much just a skinned Safari


> due to rendering differences that all other browsers get right(even Firefox)

Singling Firefox out by saying "even Firefox" makes me think you don't expect Firefox to "get it right." I am wondering why that is.


People choose to install chrome it doesn't come with Windows Machines or Macs yet is a very popular CHOICE of browser. IOS we have no choice and forced to to use Safari.


People chose to install Chrome because Google displayed prominent ads on their search engine and optimized their web apps to Chrome. Basically nagging people until they installed it.


Nags you about installing it on any Google site essentially. Not just Google.com


I don’t know about you, but I installed Chrome because it’s apparently what developers optimize for and occasionally I’m forced to use it because of bugs.


I chose not to install Chrome and use Firefox, to ensure the web is not optimized for one company’s desire.

Chrome is sprinting ahead with new feature at a high pace, however, we should make sure the web only uses features that are widely available in all major browsers.


Even better: people choose to buy a thousand dollar phone to use Safari, i'd say that makes Safari better.


People can also choose to buy other phone.


you mean safari - a minority browser on a minority platform - is a monopoly?

There's a browser that has almost absolute domination of the market, chooses what features become standards simply by shipping them, is aggressively anti-competitive, and yet you're complaining about safari?


>you mean safari - a minority browser on a minority platform - is a monopoly?

With All due respect, this is a very Apple view.

Today, the iPhone has 66% market share in the United States, 75% of U.S. App Store revenues, and over 80% of time spent on the mobile internet. We can debate whether that fit anyone's definition of monopoly. But it is definitely not on a minority platform, nor a minority browser.

Safari's current features set doesn't have much problem as a Web Page browser. And wouldn't be a concern if it wasn't for App Store's policy. But when Apple is the majority or dominant platform in a market these can no longer be looked at as an individual case. And will very likely be used as a weapon in AntiTrust issue.

To be quite frankly honestly I dislike PWA and Chrome and I wish Safari stay the way it is and only Apps Store changes its policy. But right now Apple seems to be willing to fight that at all cost. And there are no middle ground to balance things out.


Apple platform is anything but minority.


I agree. And it's sort of perverse, isn't it? At least they’ll have extensions soon (or they do, already?) so it’ll become more usable. I would gladly use Safari on desktop, too. The graphics are excellent, which is one of the reasons I’m excited about https://github.com/tauri-apps/tauri


As a developer, I hate it. Not only because feature lacking. But also because it's so buggy in terms of literally every aspect. It don't really actually properly implemented all spec from web 2.0 properly. Bugs comes out from everywhere for no reason. Supports it is just like rewrite the whole page again with no really payoff.


> Edge teams

What happened with Edge? I've been out of the loop with MS stuff for years, and last I heard you had to select a browser in the EU or something, but was this also made mandatory worldwide?

I'd imagine still being bundled with Windows means their usage is not insignificant...


Edge is now a Chromium fork, and is headed by an ex-Googler who cheerfully me-toos every Google web agenda. It's sole purpose is to be a Chrome browser that connects to Microsoft accounts and hence can integrate with Microsoft's enterprise tools.

Despite enterprise teams already finding Chrome's six week release cycle tedious, Microsoft immediately followed Chrome to announcing their four week cycle in the last week, and Edge also failed to protect ad blocking by rejecting the Manifest V3 changes for browser extensions designed to cripple ad blockers.

Basically, at any opportunity Microsoft has had to differentiate itself, it has decided to just do what Google does.


The Edge team - first engineering alone, now both eng. and product - has been led for 3 years by Rajesh Sundaram, a Microsoft lifer who has never worked for Google. [1]

And Chromium-based Edge has tracking prevention through filter lists, while Chrome does not. [2]

Microsoft is no one's privacy hero these days, I will concede that. But some of these specific claims are just wrong.

[1] https://www.linkedin.com/in/rajeshsu

[2] https://support.microsoft.com/en-us/microsoft-edge/learn-abo...


Your [1] is apparently not public or "does not exist". It's possible I was confused by Microsoft's horrible titling scheme, as I would assume a guy who goes by "Principal Program Manager, Microsoft Edge", Eric Lawrence, is well-placed in the org, especially since he's quoted in every major article around every new Edge news: https://www.theverge.com/2019/5/6/18527550/microsoft-chromiu...

It is true Microsoft ported some of it's tracking prevention features over to Chromium Edge, but it certainly isn't a step above or beyond Firefox or Safari, and it's frustrating Microsoft continues to follow Google in places reasonable companies should not go.


Hmm maybe I can see Rajesh's LinkedIn when I log in because I'm some number of degrees away from him. Or maybe just logging in is enough. Anyway, you can search the web for him if you want to see that he has indeed been at Microsoft a long time (nearly 25 years now).

As for Eric Lawrence, if Eric gets quoted a lot that's probably because he wrote the first versions of Fiddler, the debugging localhost proxy that many Windows developers use, so tech journalists that specialize in Microsoft have heard of him through their developer acquaintances. Plus his Microsoft email address is easy to guess: [his Twitter username]@microsoft.com

Eric left Microsoft after over 10 years, went through 2 companies including Google, then came back within about 6 years. I consider him closer to Microsoft in outlook than Google, though one could plausibly disagree given how rude he was about his old team's products IE and Edge while he was away.

As for "Principal Program Manager," that being misleading about scope is news to me, and if it is, that's on the journalists to clarify, because this kind of title is commonplace and implies very little. At any tech company "Program/Product Manager" is not necessarily a people leader. "Principal" doesn't change this. "Principal" at Microsoft and other tech companies is just a rank like "Senior," albeit a hard-to-earn and usually well-deserved one. If I say I am a "Principal Product Manager, HotTechCo BlahBlah," I don't think anyone in the industry will assume I run the entirety of that product.


Program managers control products more than than people managers usually. And principal is high enough to run a product.

Several pages say Sundaram's title is Technical Fellow and VP of Engineering. I assume you know what you're talking about. But you can't blame people for thinking it's an engineering role only.


One day ycombinator will be full of people that talk after informing themselves, but that day is not today.

The Chromium Edge doesn’t support 3rd party cookies already and thus isn’t really subject to targeted ads like Safari or Firefox.

Now please continue with your reasoning.


I’m not an expert on this, but aren’t there other ways to track users (like fingerprinting based on extensions)?


Yes but it doesn’t really matter. If you’re using edge chromium , you’re probably using it on the platform it runs best on anyway, that already would probably do it all anyway.


I feel like someone just gave you a laundry list of problems, and you lifted a sock off the pile and acted like you had finished the lot...


Edge is now just a rebranded Chromium, and Microsoft's approach with Windows 10 suggests they are betting big on advertising and the "attention economy" thus very unlikely to push towards privacy protection.


They are also adopting the "user herding" trend --- taking away choices and control, bludgeoning the userbase into docile and obedient consumers that they can monetise or do whatever else they want to.

Take a look at the settings for IE, which actually improved with each new version, and you can clearly see which side MS used to be on. Then compare it with the useless dumbed-down "modern" UI of even pre-Chromium Edge.


I think the parent is referring to the fact that MS abandoned their browser engine and Edge is now running on Chromium as of Jan 2020.


Edge is now a Chromium fork


Ah, thank you. I must've missed this rather large change...


> Conversely, if Safari refuses to implement some alleged 'feature', it becomes much less useful even if Chrome does implement it.

How is Safari not implementing standards seen as a good thing?

While I do acknowledge that there might be privacy concerns when it comes to Chrome, I do appreciate that Google is trying to push the Web forward, while Apple is trying to hold the Web back.

Safari truly is the worst browser, I fucking hate it. Apple is doing the bare minimum and pretends to "protect user privacy" when all they do is to prevent the web to compete with their app store. Apple pretends to care about the user experience when they are the only ones not implementing standards that would benefit the user.

Ohh and you are on Windows and wan't to debug something on Safari? Forget it.


I do appreciate that Google is trying to push the Web forward, while Apple is trying to hold the Web back.

"push the Web forward" is Googlespeak for "gaining control". It gets to decide what the "standards" are and churns them to discourage any competitors while at the same time operating a massive "developers developers developers" style propaganda campaign to gather supporters and help increase its monopoly.

I don't use Apple products and disagree a lot with what it does, but this is really a "enemy of an enemy is a friend" situation.

Related article: https://news.ycombinator.com/item?id=9961613


> How is Safari not implementing standards seen as a good thing?

One, “feature” isn’t the same as a standard. And two, standards aren’t standard. They’re adopted through a dubious process and then ignored by the most powerful companies.


> And two, standards aren’t standard. They’re adopted through a dubious process and then ignored by the most powerful companies.

Apple is really the only one these days ignoring these standards. Even if it a "dubious process", if there is consensus among the majority browser vendors I would call it standard.


> if there is consensus among the majority browser vendors I would call it standard

“Consensus among the majority browser vendors” effectively means what Google does.


     Ohh and you are on Windows and wan't to debug something on Safari? Forget it. 
Yeah, this utterly baffles me. You'd think Apple, out of sheer self-interest, would offer some sort of "Safari for Developers" that runs on Windows/Linux. Even if it's some kind of klunky suboptimally-performant thing. Just make it really obvious in terms of it's branding and theming that it's devs-only.


My hypothesis is that Apple is probably getting enough money from companies having to buy their devs Macbooks that they don't feel like releasing Safari on Windows/Linux (much less Xcode).


I think it's because at some point they start to rely on features solely available in OSX and at the same time repeating somehow what Microsoft did in dominant years of IE on Windows but without all that predatory tactics. The times obviously change; today companies give their users ecosystems of software and services successfully trapping them within these; Safari is the browser for Apple ecosystem, just like Edge tries to be for Microsoft one.

Safari on Windows was left alone in time Chrome was in the process of being bundled with various software installers as an additional option - which is the way how this browser become popular. I doubt it will be ever pushed forward with development, simply because Microsoft and Windows it's not Apple's subject of interest. Sure, they do offer iCloud services for Windows but it's a rather basic stuff that allows to use different platform from time to time, not on everyday basis (as in, you aren't buying just to remove OSX and install Windows).

Of course, would be great to have more options but we're living in almost homogeneous web browser world - it's all about Chromium/Blink, even Microsoft abandon their engine and took Chromium. There's of course Firefox but honestly, I don't think it's gonna last long - not will all these decisions that has been made and how Mozilla treated its (power)users. We're all dependent on Chromium, its devteam and what Google decides is "best" for the whole world and the Internet. Which I believe, is certainly a bad thing.


    I think it's because at some point they start to rely on features solely available in OSX
This is the only answer that really makes sense to me. I think it tightly couples with MacOS stuff like sandboxing, whatever codec stuff they're doing, and whatever perf stuff they're doing to make Safari "feel" so fast on the Mac. I think they feel that replicating all of that in Win32 would just be impossible/unsustainable. Still, I wish they'd just make it some kind of "developer edition" thing. It could be a bit janky, even... as long as it was clearly labeled "for developers" or whatever I don't really see it giving the company a black eye.

    We're all dependent on Chromium, its devteam and what Google 
    decides is "best" for the whole world and the Internet. Which 
    I believe, is certainly a bad thing. 
I agree wholeheartedly, and Apple seems to agree! That's what's so f'ing baffling to me.

Clearly they feel that Safari is an extremely important project; the only thing standing between Google utterly 100% owning the web in every sense that matters. A thing that would clearly be bad for Apple.

Accordingly, Safari on Mac gets a ton of investment from Apple. And clearly Apple feels Safari is so important that it's the only browser engine allowed on iOS.

But, I can tell you from experience, a hell of a lot of B2B stuff and stuff cranked out by small shops is just never tested on Safari. And one reason is that a lot of small shops just don't have a Mac sitting around. And experience tells us that this is the death of a browser. Nobody wants to stick with browser XYZ once some percentage of their stuff stops working. They don't want to run multiple different browsers. It's a pain. They eventually follow the path of least resistance and just use the browser where 100% of their stuff works.


Apple sells about 20 million Macs a year according to this: https://www.statista.com/statistics/263444/sales-of-apple-ma...

What percentage of that is possibly due to folks buying Macs just to run Safari? Pure speculation on my part but I don't believe it can be more than a percentage of a percentage.

Was there a sudden increase when the Windows version of Safari was discontinued in 2010? It's hard to say exactly, because there are an awful lot of factors involves in sales numbers, but I don't see any evidence to suggest that's the case.

Also: think about your average dev or dev shop that buys a Mac just to make sure their stuff works on Safari. Are they buying a shiny new high-margin Mac? Oh heck no. They're buying the cheapest possible new Mac or, more likely, they're getting some cheapo preowned Mac. Or perhaps even more likely, they're using a service like Browserstack.

They wouldn't shoot their entire web strategy in the foot just to sell some negligible additional amount of Macs per year.


I wanted to test a web app and was naive enough to buy an old iPhone 6, thinking I could test and debug my app. To my disappointment you can't update Safari through the app store and developer tools are pretty much non existent...


To be fair, that’s a very old phone and IOS12 is still getting updates in 2021. I’m not sure that the issue is, safari is updated along with IOS.


I should have probably looked into that before buying the phone.

The issue that I have with safari being locked to a specific iOS version is that people on older model such as the iPhone 6 are being stuck with an outdated browser, even though the phone is still useable.

To be fair, Apple handles updating iOS a lot better than Android, but Chrome is not tied to the OS versions, this means I can update Chrome through the Play Store which means: 1) faster update cycle and 2) old android phones can still run the latest Chrome.


Safari is not getting updates in 2021.


Microsoft for instance offers free VM images for browser testing.


Epiphany uses WebKit...


I've been using Safari for a couple of months on an M1. Purely from a privacy perspective. I don't think I suddenly "have" privacy because I'm using Safari, but I do at least feel that Apple are in my corner.

Because I give them money.


This announcement from last October is a huge deal.

"Meet Face ID and Touch ID for the Web" https://webkit.org/blog/11312/meet-face-id-and-touch-id-for-...


Well, Safari and Chrome being the two giants in the room mean they also keep each other in check.

Safari may support Face ID and Touch ID, but I doubt it would be in anybody else's best interest to also support it.

Not that it matters anyway, since on iOS they all use Safari...


If you read the parent post, the support is implemented on top of WebAuthn standard, so as far as developers are concerned, they don’t have to do anything Safari-specific to support it - their code will work fine with YubiKey or other Authenticators as well. Which is the point of web standards after all.

https://webauthn.io/


It would be great if anything closed source was barred from using the word "privacy" in marketing.


It would be great if people just understood that they can't trust closed-source binaries.


To be fair, they can’t trust open-source either. Particularly when so much is happening server-side and on the cloud. Our trust model is fundamentally broken.


Folks in these comments seem to be missing the point re: Safari lacking features, specifically features which would allow for 1) greater access to the hardware, and 2) PWAs.

Apple isn’t just lagging behind. They very intentionally do not want web APIs to become a viable app development platform on their hardware ecosystem.

Other hardware vendors are rapidly catching up to Apple in terms of hardware quality, so the main remaining differentiator for Apple becomes quality of software experiences. This is, of course, precisely the arena in which Apple currently dominates, owing to their investment in making their app dev stack the best in the world. More than anything else, they do NOT want to lose that advantage.

So, a non-proprietary app dev platform which matches or exceeds the quality of their own? Yikes. If they allow Safari to become a gateway to such a platform, it would truly be an incomparable existential threat to their app development and distribution model.

I personally think it’s inevitable, but... you can better believe Apple will fight it as hard as they can, for as long as they can. My money’s on their next CEO slipping up and allowing a full glorious Web implementation to be built. There goes any advantage to developing software experiences for the proprietary Apple platform, and that’ll be the true beginning of the end for the modern successful Apple.


What about Edge? I found Firefox unusable on my phone - prone to crashing and a bit slow. Meanwhile, Edge for Android includes some of the privacy and Adblocking features of FF but still uses the Chromium renderer so it doesn't sacrifice performance. I'm very happy with it.

On desktop I'm all FF, of course.


If you're on Android, give Bromite a try. It's a Chromium fork with privacy and adblocking features and good performance.

Firefox Klar/Focus also isn't bad, if you don't mind losing some of the functionality of the full version.


Full version of Firefox on Android hasn't crashed on me in months. I know what you are referring to. I would recommend giving it a try again. New version is also very fast.


> (Conversely, if Safari refuses to implement some alleged 'feature', it becomes much less useful even if Chrome does implement it.)

Ah yes... such as push notifications. Firebase would be so much more useful if Safari supported push notifications...


What do you mean by "useful"? I've been using Safari exclusively for years now and the lack of push notifications hasn't been a problem. It's actually good because it shields me from all kinds of shitty websites demanding notification permissions while having no good reason to send any.


Why are we optimizing the case of users browsing bad websites? Why not cater to good websites instead?

Isn't a notification receiver of the most important uses of a phone?


> Why are we optimizing the case of users browsing bad websites? Why not cater to good websites instead?

I would say it's not so much optimizing for good websites vs bad websites, as optimizing for real-world websites.

Real-world websites are overwhelmingly shitty, push dark patterns, invade users' privacy, abuse any APIs they are given access to, etc. Limiting the amount of things they can do is an enhancement to the user experience, even if it's worse for you as a dev.

It's a lot like having to have laws. Why do we have to have laws, isn't that "optimizing for bad people" instead of maximizing the freedom of good people?


Don't real world native apps do the same thing? Abuse APIs, push dark patterns, track users? There has to be a better way to prevent abuse other than "don't let this particular type of app use push notifications".


But surely we can devise a way to minimise abuse and still let people who wants the features have them? This defeatist attitude is pretty sad, we have to be careful when designing new features, but we shouldn't let bad users just make it worse for everyone and give up.

For instance, you could forbid websites from requesting the notification permission, but the user could manually go and allow it. It would probably cut 99% of the spam while allowing people that really want notifications to have them. As for the 1% left, we're not talking life and death scenario here, at that point the good outweighs the bad I would say.


The number of terrible websites a far higher than the number of good ones. The former category includes many different news websites, streaming sites, etc


web pages aren't something users want notifications from.

Mozilla literally studied this and essentially 100% of "let us spam you" requests were denied.


Because essentially 100% of web pages that request push notification access are garbage tabloids that nobody cares about. No push notifications on mobile Safari means that there is no incentive to build mobile web apps that function similar to their native counterparts. Obviously people are accepting push notifications somewhere or else they wouldn't be such a popular design decision.


People could also build cool websites if your computer gave all sites kernel access into your computer. Doesn’t make it a good idea


> web pages aren't something users want notifications from.

I agree users don't want notifications from web pages, but the web is much more then just web pages and I would argue that on web applications users are much more likely to allow push notifications if they get a clear benefit.


Every other platform supports these notifications and yet somehow 99% of the sites that do it are using it for spam.


Every non-web platform has an initial gate of "install application X".

The web does not have that gate. The web has "I went to the apps website to see if it did what I wanted. it did/didn't, and then asks to send me update notifications"


As as been said by many other users in these threads you can disable it globally if you know you never want it.

This is the thing I don't understand about some Apple advocates these days. Even the idea of having a choice is unacceptable.


From their profile:

> Co-Founder of NodeBB Inc., modern forum software for the modern web.

So I assume they want notifications for forum software.


Indeed! Although in our implementation it's entirely opt-in (we don't request the permission access unless the user asks us to).

It's just entirely broken on iOS, but them's the breaks.


> Ah yes... such as push notifications. Firebase would be so much more useful if Safari supported push notifications...

All part of Apple's plans to enforce their one and only apps store for use on the iOS platform. Wouldn't want those pesky webapps being able to sidestep Apple's walled garden.


Apple are pretty much the only humanist big tech company. They’re a bulwark against all sorts of absolute nonsense that would reduce the technological landscape to more of a dismal-looking, utilitarian panopticon than it already is.


The only thing Safari has to do is be good enough people can use it as a web browser but bad enough it can't replace apps. It doesn't need to ensure user data gets collected and sold or push ads or any other business model - it just needs to protect the 10s of billions of passive income from the app store.

As a result it's free to make whatever choices make sense for the user as long as they aren't related to that. I wouldn't call it "humanist" because of that just a different revenue model.

The same is true for the rest of Apple, it didn't get to a 2,000,000,000,000 market cap because it's humanist it got there with unique ways and focus on how to make money. Probably less bad than how Google does it though I don't consider that the bar for doing good.


No thanks, I'll stick with firefox


Safari is today's IE. I've had to write so much extra code because Safari has to be special/broken.


Too bad this is only available on a operating system that spies on its users.

(Sorry Apple fans, it does and while their marketing tries to hide it as much as possible, their privacy policies don't lie : https://www.apple.com/legal/privacy/en-ww/)

It's funny how quickly one can get downvoted for criticizing Apple's misleading marketing. Apple is a data hoarding company like every others, and no “not being worse than their competitors” isn't good enough.


That’s a very long, thoughtful, and detailed document. Linking to it without any context at all isn’t super helpful.

What exactly are you referring to when you claim Apple ‘spies on its [sic] users’?

Every bit of data Apple has about me is a) made explicitly clear, b) used for a specific purpose or feature, and c) isn’t sold to or used in any adtech bs. That all sounds good to me…


> c) isn’t sold to or used in any adtech bs

What makes you think so? Because the privacy policies you agreed on allows them to (in the the Apple’s Sharing of Personal Data section):

>Partners. At times, Apple may partner with third parties to provide services or other offerings.

Yes, that's it (there is an “Example” section following, but this is non-binding). Any kind of partner, for any kind of “other offering”. Partnering with any ad tech for selling ads complies with this clause.

Also, as I'm not a native speaker, what's wrong with “spies on its[sic] users“? (Note that the original sentence was “operating system that spies on its users” not “Apple spies on its users”)


The difference, of course, is that if I message someone about an iPhone in messages.app, I'm not inundated with "targeted" ads for phones everywhere I go. Or, if I'm talking to someone about a recipe, my devices don't suddenly start displaying recipes (looking at you, Echo). Anonymized analytics, the type that Apple are informing you about in that document, are fine. Searching the App Store for a productivity app and being shown a single ad for a productivity app at the top of the search results is fine. What you are doing is trying to convince the world that the Emperor is naked, when in fact they merely have their top shirt button undone.


Displaying real-time targeted ads (1) isn't Apple Business for sure. Selling you health data to health insurance companies (2) fits their strategy much more, and by accepting their privacy policy, you allowed them to do it. I don't consider (2) less harmful than (1).


Got any evidence, tangible or otherwise, of (2)?


In French[1] (2014) linking to a Bloomberg link behind a paywall[2].

There's no evidence that they have done anything like this yet, but they at least considered it and their privacy policies allows it as soon as they decide it's worth it. And you wouldn't necessarily know it.

Just because a company's marketing says they respect your privacy doesn't mean they do, especially when their privacy policy says they can.

[1]: https://www.numerama.com/magazine/30323-apple-approche-les-m...

[2]: https://www.bloomberg.com/news/articles/2014-08-21/wear-this...


So your first source (from 2014) is based on Withings working with AXA and is also speculation based on your second source, who's reporting it must be pointed out is of an extremely dubious nature (cf. https://www.bloomberg.com/news/features/2018-10-04/the-big-h...) which has been debunked and vehemently refuted by all parties, including the very sources Bloomberg cite in the article.

Sorry, no. Did Apple consider it? Possibly, in fact it almost a certainty. More importantly, did the act on it? No. Nothing wrong with exploring options.

Let's not engage in slippery-slope hypotheses.

> Just because a company's marketing says they respect your privacy doesn't mean they do, especially when their privacy policy says they can.

You still haven't shown us where it says they can. I'll take your word for it...


> You still haven't shown us where it says they can. I'll take your word for it...

Yes I did a few comments above, but no problem I'll repeat it :

> (in the the Apple’s Sharing of Personal Data section):

> Apple may share personal data with […] Partners. At times, Apple may partner with third parties to provide services or other offerings.


Apple may share personal data with service providers who act on our behalf, our partners, or others at your direction. Further, Apple does not share personal data with third parties for their own marketing purposes.

Service Providers. Apple may engage third parties to act as our service providers and perform certain tasks on our behalf, such as delivering products to customers. Apple service providers are obligated to handle personal data consistent with this Privacy Policy and according to our instructions. They cannot use the personal data we share for their own purposes and must delete or return the personal data once they've fulfilled our request.

Partners. At times, Apple may partner with third parties to provide services or other offerings. For example, Apple financial offerings like Apple Card and Apple Cash are offered by Apple and our partners. Apple requires its partners to protect your personal data.

Others. Apple may share personal data with others at your direction or with your consent, such as when we share information with your carrier to activate your account. We may also disclose information about you if we determine that for purposes of national security, law enforcement, or other issues of public importance, disclosure is necessary or appropriate. We may also disclose information about you where there is a lawful basis for doing so, if we determine that disclosure is reasonably necessary to enforce our terms and conditions or to protect our operations or users, or in the event of a reorganization, merger, or sale.

I think you are clutching at straws, based on shoddy information. The above seems unambiguous to me.


You're right, it is pretty unambiguous: they can share with any partner they like, for any reason other than marketing with the only condition being that the partner “protects personal data”.

That's it. No other limits or restrictions.

So yes, partnering with a insurance company is allowed by their privacy policies.

If you want to have faith that Apple will never do evil things with your data and that their is nothing to worry about, that's up to you. I have plenty of friends who thinks the same about Facebook or Google you know…


[flagged]


I did not move goal posts, the conversation did.

If you want to go back to Apple's OS spying the users, it's another section of the privacy policy:

> Usage Data. Data about your activity on and use of our offerings, such as app launches within our services, including browsing history; search history; product interaction; crash data, performance and other diagnostic data; and other usage data

From “Personal Data Apple Collects from You”

That being said, since you've moved from just a bit narrow-minded to openly rude, I'm not interesting in pursuing further.


Provide the rest for context!

You have been disingenuous from the outset, clearly arguing in bad faith to unsuccessfully prove your own bias. The facts are that Apple are indeed one of the more trustworthy companies with personal data, and arguably one of the few that get it. So what if it’s ‘marketing’ that drives them to do right by their users data, at least they are doing right.

All you have illustrated is a potential to misuse personal data. Google and Facebook (brought up by you) actually do privacy invasive things, largely without plainly written privacy policies, or worse still, without consent.


Tangential: why did you put [sic] after its? "its" is correct there.


Yes. The way I remember this is that 'his' and 'her' don't have apostophes so neither does 'its' when used as a possessive.


It's still better than the competition IMO.

The intent of the spying should also be considered. Apple does not have a significant targeted advertising business which reduces/removes the incentive to hoover up as much personal data as they can.

Would I prefer something that doesn't spy at all? Absolutely, but this means rolling your own computing environment using Linux and giving up a lot of features that are considered a given in macOS, and yet there's only 24 hours in a day and I no longer have time for that.


Seems like bullshit. The linked document doesn’t support the claim.


That's a very long document, which bits are questionable?




Consider applying for YC's Spring batch! Applications are open till Feb 11.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: