August 9th, 2024

Apple: Using alternative browser engines in the European Union

Apple's iOS 17.4 enables EU apps to use alternative browser engines, requiring developers to meet strict security and privacy standards to enhance user choice and competition among browsers.

Read original articleLink Icon
Apple: Using alternative browser engines in the European Union

Apple has introduced new capabilities in iOS 17.4 and later that allow apps in the European Union to utilize alternative browser engines beyond WebKit. This change is aimed at enhancing user choice and competition among browser applications. Developers must apply for either the Web Browser Engine Entitlement or the Embedded Browser Engine Entitlement, depending on whether they are creating a dedicated browser app or providing in-app browsing features. To qualify, apps must meet specific functional, security, and privacy requirements, including passing industry-standard test suites and committing to secure development practices. Apple emphasizes the importance of user safety, requiring developers to implement timely security updates and maintain a vulnerability disclosure policy. The Embedded Browser Engine Entitlement allows apps to embed alternative engines for in-app browsing, provided they adhere to similar requirements. Developers must also ensure that their apps do not share sensitive user data without consent and must block third-party cookies by default. Overall, these measures aim to foster a secure and competitive environment for browser applications within the EU.

- Apple allows alternative browser engines in iOS apps for EU users.

- Developers must apply for specific entitlements to use these engines.

- Strict security and privacy requirements are mandated for compliance.

- Timely security updates and vulnerability management are essential.

- The initiative aims to enhance user choice and competition in browser applications.

Link Icon 20 comments
By @BoppreH - 2 months
> Program security requirements

>> You must do the following:

>>> Use memory-safe programming languages, or features that improve memory safety within other languages, within the alternative web browser engine at a minimum for all code that processes web content;

AFAIK all major engines are written primarily in C++. This "features that improve memory safety" is worryingly vague, and we already know Apple goes out of it's way to make these rulings less useful.

I wouldn't be surprised if they rejected both Firefox and Chrome on these grounds.

By @_shantaram - 2 months
It's mind-boggling they are doing all these gymnastics instead of just allowing alternative app stores and browsers everywhere.
By @thrdbndndn - 2 months
> Requirements

>> To qualify for the entitlement, your app must:

>>> Be distributed solely on iOS and/or iPadOS in the European Union;

I assume this means you have to release a separate App like "Firefox EU" to be able to use Gecko, right? Practically speaking, would any major players actually do it? It just sounds unlikely to me but I may miss something.

By @_shantaram - 2 months
It's mind-boggling they are doing all this gymnastics instead of just allowing other browsers and app stores everywhere.
By @rf15 - 2 months
> To qualify for the entitlement, your app must:

> Be distributed solely on iOS and/or iPadOS in the European Union

These jokers. This is the usual malicious compliance.

By @unglaublich - 2 months
> Meet the above test suite requirement if Just in Time (JIT) compilation is unavailable (e.g., if Lockdown Mode is enabled by the user)

Interesting, I wasn't aware that Lockdown Mode disabled JIT. Does it do that system-wide, or only for third party apps?

By @acheong08 - 2 months
> Program privacy requirements You must do the following: Block cross-site cookies (i.e., third-party cookies) by default

I wonder if chrome will implement their sandbox on IOS first because of this

By @nnx - 2 months
I'm all for Apple opening up to other browser engines on iOS but at the same time I'm worrying that this is gonna end up in furthering Chrome as "the web" over time.

Especially considering iOS is far from having majority marketshare in EU compared to Android... this feels like forcing a minor player (iOS in EU) to help a major player (Chrome).

By @ryanbigg - 2 months
This is weasel wording but with actions. I’d expect better from Apple
By @apexalpha - 2 months
The arrogance of thinking you can take on an entire continent.

Besides that I wonder what happens if I travel outside of the EU. Will they just remotely disable everything I could do while in the EU?

By @difosfor - 2 months
OK, then Apple should also be transparent and show how they meet all of these requirements no? Actually this should probably be judged by an independent organization. Great idea Apple!

Kind of ironic that they are also requiring WPT compliance while they are the worst scoring major browser there.

By @fabian2k - 2 months
The main question is whether they will allow Firefox, Chrome and Edge to use their own engine or not. The guidelines leave enough room to deny any potential browser engine if they want to, so it depends entirely on how Apple will decide on actual cases.
By @ilrwbwrkhv - 2 months
I just want to use firefox with ublock origin on the iPhone.
By @lostfocus - 2 months
It's honestly weird to me how much work they put into their hissy fits. It's not like their bottom line or their stock price would notice it when they would just open up their OS a bit more.
By @willhackett - 2 months
Why only in the EU?
By @fwef64 - 2 months
Can anyone explain why is Apple so opposed to having different browser engineson iOS? Is it really just about security? I don't understand what is Apple to gain by not allowing 3rd party engines everywhere in the world.
By @sharpshadow - 2 months
I wonder if WebKit would pass these requirements.
By @unglaublich - 2 months
So, will Electron apps be an option now, for better or worse?
By @hexage1814 - 2 months
>Apple will only authorize developers to implement alternative browser engines after meeting specific criteria and who commit to a number of ongoing privacy and security requirements

Smells like malicious compliance.

By @sunshinerag - 2 months
Why don't apple just dump EU instead of adhering all its bureaucratic regulations?