{"id":3509,"date":"2024-02-28T11:30:53","date_gmt":"2024-02-28T10:30:53","guid":{"rendered":"https:\/\/blog.tomayac.com\/2024\/02\/28\/so-what-exactly-did-apple-break-in-the-eu\/"},"modified":"2024-02-28T11:30:53","modified_gmt":"2024-02-28T10:30:53","slug":"so-what-exactly-did-apple-break-in-the-eu-2","status":"publish","type":"post","link":"https:\/\/tomayac.com\/wordpress\/2024\/02\/28\/so-what-exactly-did-apple-break-in-the-eu-2\/","title":{"rendered":"So, what exactly did Apple break in the EU?"},"content":{"rendered":"\n\t\t\t

Disclaimer, just in case\u2026 \ud83d\udd17<\/a><\/h2>\n

I work for Google on the Chrome Developer Relations team. But for this post, I\nwant to make it super duper clear that I'm speaking not<\/em> on behalf of my\nemployer and that all views and opinions expressed in this blog post are purely\nmy own<\/em>: Thomas Steiner's, the guy commonly known for his avatar with a green\nhat, but today in my pajamas having my second morning coffee. Oh, thanks for\nasking, the two cats are Lluna (yes, with double 'l', it means moon in Catalan)\nNorris, looking at the camera, and Skinny Norris, looking out of the window.<\/p>\n

\"Thomas<\/p>\n

How I noticed \ud83d\udd17<\/a><\/h2>\n

With this out of the way, it's time to dive in and answer the question of what\nexactly did Apple break in the EU? I'm physically located in the European Union\nand my iPhone has a German SIM card. On January 30, 2024, I sent the following\ntoot<\/a> with attached screenshot\n(cropped here):<\/p>\n

\n

Hope this is a bug in the beta, but opening previously installed Home Screen\nWeb apps on iOS 17.4 (21E5184i) results in a prompt:<\/p>\n

Open "Example app" in Safari. "Example app" will open in your default browser\nfrom now on.<\/p>\n

Newly installed apps always open in the browser. There doesn't appear to be a\nstandalone mode anymore.<\/p>\n

Reported as FB13567834.<\/p>\n<\/blockquote>\n

\"Prompt<\/p>\n

The toot that all the news outlets cited was the\none from Mysk<\/a> from February\n1, 2024, that said:<\/p>\n

\n

\ud83c\udfac Finally, iOS treats all browsers equally when it comes to PWAs. Previously,\nonly Safari was able to install and run PWA apps. With iOS 17.4 beta in the\nEU, no browser can install PWA apps, even Safari. It seems PWAs have been\ndisabled entirely.<\/p>\n

Oh yes, when you set a third-party browser as the default browser and then you\ndelete it, iOS sets Safari as the default browser. Watch this:<\/p>\n

#iOS #Apple #DMA #EU #maliciouscompliance<\/p>\n

youtu.be\/AST12aDGf0Q<\/a><\/p>\n<\/blockquote>\n

Then, on February 2, 2024, Tixie<\/a> opened a\nWebKit bug<\/a> titled "Bug\n268643 - [iOS 17.4 Beta (21E5184k)] REGRESSION: PWA added to Home Screen are\nforced to open in Safari."<\/em><\/p>\n

\ud83c\udd95 Update:<\/strong> The message in the release candidate of iOS 17.4 (21E217) is now:\n"Open 'Example app' in 'Default browser'? In your region, web apps now open in\nyour default browser".<\/em><\/p>\n

What does Apple say? \ud83d\udd17<\/a><\/h2>\n

By now, you have probably heard that\nusers in the EU don't have access to Home Screen web apps<\/a>\nanymore. Here is Apple's statement in its full glorious detail:<\/p>\n

\n

To comply with the Digital Markets Act, Apple has done an enormous amount of\nengineering work to add new functionality and capabilities for developers and\nusers in the European Union \u2014 including more than 600 new APIs and a wide\nrange of developer tools.<\/p>\n

The iOS system has traditionally provided support for Home Screen web apps by\nbuilding directly on WebKit and its security architecture. That integration\nmeans Home Screen web apps are managed to align with the security and privacy\nmodel for native apps on iOS, including isolation of storage and enforcement\nof system prompts to access privacy impacting capabilities on a per-site\nbasis.<\/p>\n

Without this type of isolation and enforcement, malicious web apps could read\ndata from other web apps and recapture their permissions to gain access to a\nuser's camera, microphone or location without a user's consent. Browsers also\ncould install web apps on the system without a user's awareness and consent.\nAddressing the complex security and privacy concerns associated with web apps\nusing alternative browser engines would require building an entirely new\nintegration architecture that does not currently exist in iOS and was not\npractical to undertake given the other demands of the DMA and the very low\nuser adoption of Home Screen web apps. And so, to comply with the DMA's\nrequirements, we had to remove the Home Screen web apps feature in the EU.<\/p>\n

EU users will be able to continue accessing websites directly from their Home\nScreen through a bookmark with minimal impact to their functionality. We\nexpect this change to affect a small number of users. Still, we regret any\nimpact this change \u2014 that was made as part of the work to comply with the DMA\n\u2014 may have on developers of Home Screen web apps and our users.<\/p>\n<\/blockquote>\n

These changes are iOS only! \ud83d\udd17<\/a><\/h2>\n

The first important thing to note here is that this statement exclusively\napplies to iOS, but not iPadOS and not macOS. This works because Apple managed\nto convince the EU Commission that iPadOS and macOS are distinct core platform\nservices. The\nrelevant section of the DMA<\/a>\nsays:<\/p>\n

\n

Moreover, the Commission considers, in line with Apple's view, that iOS,\niPadOS, macOS, watchOS, and tvOS constitute distinct CPSs [core platform >\nservices] within the meaning of Article 2, point (2), sub (f), of Regulation\n(EU) 2022\/1925.<\/p>\n<\/blockquote>\n

This means on iPadOS and macOS, everything will stay the same. You can still add\nWeb apps to the Home Screen on iPadOS or the Dock on macOS, and they will open\nin standalone mode as they always did.<\/p>\n

\ud83d\udca1 Note:<\/strong> This article exclusively talks about Home Screen Web Apps, not\nbookmarks. According to\nApple's documentation<\/a>,\n"Web developers have the option to create a\nmanifest file<\/a> (with its\ndisplay<\/code><\/a>\nmember set to standalone<\/code> or fullscreen<\/code>) and serve it along with their\nwebsite. If they do, that site becomes a Home Screen web app. Then, when you tap\non its icon, the web app opens like any other app on iOS or iPadOS instead of\nopening in a browser. You can see its app preview in the\nApp Switcher<\/a>, separate from Safari\nor any other browser."<\/em><\/p>\n

What happens on iOS? \ud83d\udd17<\/a><\/h2>\n

Looking now at iOS. If\u2026<\/p>\n

    \n
  1. you have an iPhone that runs (betas of) iOS 17.4 or later, and iff (if and\nonly if)\u2026<\/li>\n
  2. you are detected as being in the European Union (EU), you can still add apps\nto the Home Screen, but they will open in a regular new browser tab in your\ndefault browser<\/a>.<\/li>\n<\/ol>\n

    How exactly Apple detects if you're in the EU isn't clear yet. It seems not to\nbe based on the SIM operator, as some users claim they are affected even on\nSIM-less iPhones. Possibly IP geolocation as it doesn't require location access?\nOr maybe GPS for improved accuracy based on a system-level access grant? What\nabout travelers in the EU from non-EU countries? I hope we will find out\neventually. People\nstarted noticing<\/a>\nan IDENTIFIABLE_REGION<\/code> string in iOS 17.4 beta 1 (21E5184i) as early as\nJanuary 25, 2024, but it was removed in the next beta.<\/p>\n

    \ud83d\udca1 Note:<\/strong> Since iOS 16.4, apart from Safari, alternative browsers, too, have\nthe ability to add apps to the Home Screen. Based on\nApple's instructions<\/a>,\n"if your app has the\ncom.apple.developer.web-browser<\/code><\/a>\nentitlement, the iOS share sheet can offer Add to Home Screen for an http<\/code> or\nhttps<\/code> webpage, creating a convenient link to a web app or bookmark. To allow\nsomeone to add the current webpage to the Home Screen, include the WKWebView<\/code>\ninstance in the activityItems<\/code> array when you call\ninit(activityItems:applicationActivities:)<\/code><\/a>\nto create the UIActivityViewController<\/code>."<\/em><\/p>\n

    There are different scenarios listed in the following.<\/p>\n

    You previously added an app to the Home Screen with Safari \ud83d\udd17<\/a><\/h3>\n

    In this case, the app will open in a regular new browser tab in your current\ndefault browser. It doesn't matter if Safari was your default browser when you\nadded the app to the Home Screen, it will still open in your current default\nbrowser.<\/p>\n

    You previously added an app to the Home Screen with an alternative browser that has the com.apple.developer.web-browser<\/code> entitlement \ud83d\udd17<\/a><\/h3>\n

    In this case, the app will open in a regular new browser tab in your current\ndefault browser. It doesn't matter if the alternative browser was your default\nbrowser when you added the app to the Home Screen, it will still open in your\ncurrent default browser.<\/p>\n

    You newly add an app to the Home Screen with Safari \ud83d\udd17<\/a><\/h3>\n

    In this case, the app will open in a regular new browser tab in your current\ndefault browser. It doesn't matter if Safari was your default browser when you\nadded the app to the Home Screen, it will still open in your current default\nbrowser.<\/p>\n

    You newly add an app to the Home Screen with an alternative browser that has the com.apple.developer.web-browser<\/code> entitlement \ud83d\udd17<\/a><\/h3>\n

    In this case, the app will open in a regular new browser tab in your current\ndefault browser. It doesn't matter if the alternative browser was your default\nbrowser when you added the app to the Home Screen, it will still open in your\ncurrent default browser.<\/p>\n

    What breaks? \ud83d\udd17<\/a><\/h2>\n

    As you see, all the cases mentioned above lead to the same result, a new tab in\nyour current default browser. While simple to understand, there are a number of\nthings that now break.<\/p>\n

    Push API \ud83d\udd17<\/a><\/h3>\n

    The Push API<\/a> was\ndescribed in the article\nWeb Push for Web Apps on iOS and iPadOS<\/a>\npublished on February 16, 2023. It's important to note the caveat: "A web app\nthat has been added to the Home Screen can request permission to receive push\nnotifications as long as that request is in response to direct user interaction\n\u2014 such as tapping on a 'subscribe' button provided by the web app."<\/em> Since Home\nScreen web apps are no longer available in the EU, the Push API is effectively\nbroken for EU users.<\/p>\n

    Badging API \ud83d\udd17<\/a><\/h3>\n

    The Badging API<\/a>\nwas described in the article\nBadging for Home Screen Web Apps<\/a>\npublished on April 25, 2023. The important caveat here is: "The user must grant\nthe app permission to display notifications before the badge will appear."<\/em>\nSince the Push API is no longer exposed, the Badging API breaks as collateral\ndamage.<\/p>\n

    Standalone mode \ud83d\udd17<\/a><\/h3>\n

    Running in standalone mode allows Web apps to look and feel like native apps\nwithout any browser UI. This was particularly useful for game streaming services\nlike NVIDIA GeForce Now<\/a> or\nXBox Cloud Gaming<\/a>, but also just any other\napp that wants to make best use of the limited screen real estate. Even manually\nentering fullscreen mode isn't possible anymore, as Safari 17.4\n"[f]ixed multiple issues by disabling support for the Fullscreen API on iOS."<\/em><\/a><\/p>\n

    Stored data \ud83d\udd17<\/a><\/h3>\n

    Home Screen Web apps ran in a different isolated context than regular in-tab Web\napps. This means that if you were logged in to a Web app from the Home Screen,\nyou need to log in again in the browser tab, and all previously stored data is\ngone. This includes any data stored in:<\/p>\n