A French Company is Suing Apple To Open the iPhone To Rival Browsing Engines (recode.net)

A French maker of open-source software said Friday it is suing Apple in an effort to get the company to make iOS more supportive of Web standards. Nexedi is suing Apple under French law in hopes it can force Apple to allow rival browsing engines onto the iPhone. From a report on Recode:Although Apple allows rival browser apps, such as Google's Chrome, on to the iPhone, the'y all have to use Apple's Web rendering engine. That means the ability to draw on the latest Web standards is is limited to whatever Apple decides to include. That means some newer technologies, like the WebM video standard and the WebRTC protocol for real-time communications, can't be made to work in an iOS browser even though they work in nearly all other browsers. "We hope [this lawsuit] will help Apple to sooner support the latest Web and HTML5 standards on its iOS platform -- the operating system used by all iPhones," Nexedi said in a blog post, which also explains the more granular details of how technology works and what needs to change, in their estimation.

Comments

Why should they?

[Anonymous Coward]

Just because you want another poorly coded standard as a way to track people, and allow exploit code to run?

No thanks.

Re:Why should they?

[Anonymous Coward]

Safari is holding the web back much like IE6 did when Microsoft refused to upgrade it.

Re:Why should they?

[Anonymous Coward]

The latest version of Safari (10) is 100% compliant with ES6.

Re:Why should they?

[Impy the Impiuos Imp]

Then don't buy Apple. Buy Android, like I did.

Dang, people. Freedom isn't hard to understand.

Security...

[Anonymous Coward]

Apple has said time and time again the issue is security-- making a sandbox isn't fucking easy. Despite whether that's good or bad, it's hard to do right. There's very little chance with the exception of Mozilla or Google proper making a secure (not massive security hole of a) browser for iOS.

Not gonna happen (for a few years at least). Not in France, not in the us, not anywhere.

Well I could see Apple doing this but on the proviso if you have a security hole that compromises the phone-- you owe them a billion dollars.

Re: Security...

[Anonymous Coward]

Unix has had sandboxing since forever with chroot.

BSD jails have existed for more than a decade.

These days, Linux has both lxc and systemd application level sandboxing (which is attained via cgroups, I believe).

This isn't the middle ages. How hard is it to sandbox a fucking browser, really?

Re: Security...

[molarmass192]

Ok, but chroot != sandbox, it's not really even sandbox-lite. A sandbox is complete process isolation, almost full virtualization, not just obfuscating the system root. I say almost because the process doesn't have to include it's own OS.

Re: Security...

[ls671]

Hmm, chroot needs to include its own OS or at least the parts you need to run said chrooted process unless compiled statically and still. This would make it more than sandbox lite according to your definition.

chroot is viewed as less secure as bsd jails because it wasn't designed for a security purpose in the first place.

I have a slackware pure 64 bits, no compat 32 what so ever. I chroot to a 32 bits full install and everything runs smoothly for legacy 32 bits apps.

Granted, only one kernel runs, 1 /sys /proc, etc., which is "less isolated" than a qemu vm but lets you run on bare metal for specific applications.

Anyway, even VMs can be victims of privilege escalation. BSD jail is less subject to it than chroot I hear. Good old unix chroot still has its usage nevertheless IMHO.

Re: Security...

[TheSync]

There are other risks as well, such as Android's default Web browser lets attackers spoof the URL shown in the address bar, allowing for more credible phishing attacks.

Re: Security...

[TheRaven64]

First, chroot isn't a sandbox. For desktop applications, it isn't even useful isolation because you have a big attack window via the IPC to the display server. That said, iOS uses the TrustedBSD MAC framework (also in FreeBSD - Apple funded the development of both), which allows very fine-grained resource control to processes. The entire sandboxing framework is based on this.

Second, the grandparent doesn't really mean sandboxing, he means compartmentalisation (which depends on some isolation primitive). Process-based isolation is fine when your threat model is different levels of trust for different processes. In a web browser, that isn't the case. Your tab browsing some random site needs to be strongly isolated from the other tab that contains your webmail login. Ensuring that this isolation is really present and not leaky is a very hard problem. Even that isn't really enough: if someone sends you an image as an email attachment and there's a vulnerability in your copy of libpng that allows arbitrary code execution, it doesn't really help you that the attacker can't compromise any other tabs: they already have the high-value target.

Beyond that, mobile Safari also has some quite neat tricks. It makes use of execute-only memory for the JavaScript engine. On startup, it reserves a range of memory for the JIT code emission and generates a special memcpy that copies data into an offset within that address range. It then deletes all copies that the process holds of the base address and marks the special memcpy as execute-only, so there is nowhere in readable memory that contains the address range where JavaScript code will run, making it almost impossible to exploit gadgets placed in JIT'd JavaScript code.

That said, no security is perfect and a monoculture is a good way of turning a vulnerability into a pandemic. If you have 4 different browsers with approximately equal market share, it's a lot harder to exploit all of them. This is why Verisign uses a mixture of FreeBSD and Linux with 3 different DNS server implementations on their root nameservers: If you want to take down their root zone, you need a to have a compromise for at least two DNS servers and for both operating systems.

Because previous legislation against Microsoft....

[Anonymous Coward]

Well they should... or who doesn't remember the "N" SKU for Windows that prevented the instant bundling of Internet Explorer? Microsoft had to develop a separate version of Windows XP, etc. and beyond to meet this standard that stripped out the "preferred" browser that came with Windows in Europe and other regions. This allowed those users to choose and install the browser(/rendering engine) of their preference instead of being defaulted into the browser packaged with their operating system. Why should Apple be given a golden ticket and allowed to skip over such similar legislation? This is not that much different.

Peace out.

Re:I'm confused.

[TechyImmigrant]

Are the Developers being forced to make web browsers? Are They being forced to make browsers for iPhones? Are They being forced by Apple?

You really didn't grasp the gist of the complaint did you?

It's javascript engines Apple doesn't allow.

[Henriok]

Apple are allowing other web rendering engines. They just aren't allowing engines running arbitrary code on their plaform. That includes Java, Flash, JavaScript and emulators. It's the "running arbitrary code" that's the problem, not rendering web pages or showing WebM movies. You are allowed to make such apps.

Re:It's javascript engines Apple doesn't allow.

[Guidii]

Apple’s App Store policies state: “Apps that browse the web must use the iOS WebKit framework and WebKit Javascript.” Source: http://www.howtogeek.com/18428...

Re:Because previous legislation against Microsoft.

[tlhIngan]

Well they should... or who doesn't remember the "N" SKU for Windows that prevented the instant bundling of Internet Explorer? Microsoft had to develop a separate version of Windows XP, etc. and beyond to meet this standard that stripped out the "preferred" browser that came with Windows in Europe and other regions. This allowed those users to choose and install the browser(/rendering engine) of their preference instead of being defaulted into the browser packaged with their operating system. Why should Apple be given a golden ticket and allowed to skip over such similar legislation? This is not that much different.

Easy. Microsoft was a monopoly that abused their OS monopoly to enter the browser market. The courts forced Microsoft to unbundle the browser because of this.

iOS? At 20%, hardly a monopoly. Apple can't leverage either WebKit on iOS nor iOS itself to distort any market.

Anyhow, browsing engines are hard - especially keeping them sandboxed. iOS and Safari run in a very low privilege state (lower than normal apps) so Safari can use a JIT javascript engine, while normal apps have teo use a slower interpreted engine to prevent sandbox exploits. Then there's battery life itself - given all the crap that can idle in the background chewing up CPU cycles, I wouldn't be surprised if WebKit on IOS has many tweaks to conserve battery life.

Re:Hmmm...

[brantondaveperson]

But the world is full of devices on which you can't just install whatever software you like. If a lawsuit like this succeeds, then what does that mean for all those devices? Will all manufacturers of computing devices have to provide SDKs for them? And remove whatever cryptographic restrictions have been placed on them? That would certainly make for a pretty interesting world.