Apple's WebKit techs declare privacy circumvention to be a security issue

Apple's WebKit team on Wednesday formalized the company's oft-repeated pro-privacy stance (provided you're not in China) by declaring that privacy-piercing browser code will be treated as a security abuse. In a privacy-focused manifesto titled WebKit Tracking Prevention Policy that ought to alarm online advertisers, the WebKit …

[JLV]

Safari?

If it’s a Webkit stance, seems to me it will also apply to Chrome on iOS.

Interesting gambit Apple has been taking of late, certainly with a hefty helping of self-interest and profit-seeking, to really push privacy as a brand/marketing strategy. Given the growing distrust of FB, Google & MS privacy handling it seems clever for a company that happens _not_ to rely on ads to try to screw those who do.

Their only big competitor in that space being Linux.

MS should take heed: telemetry can’t be _that_ valuable, revenue wise and it obviously didn’t avert 1809 issues.

[Anonymous Coward]

Re: Safari?

Does anyone actually run Chrome on iOS? If so, I can't imagine why unless they're Google employees.

[disco_stu]

Re: Safari?

I use Chrome on desktop pc and on iOS, though I am currently trying to wean myself off Chrome/Google usage., It's a shame Apple stopped releasing Safari for Windows as I would probably not be using Chrome if they did.

[jonathan keith]

Re: Safari?

The Windows version of Safari was almost as much of an abomination as the Windows version of iTunes was. Good riddance, frankly.

[Sgt_Oddball]

Re: Safari?

Swings and roundabouts...

I.E. 5.5 for OSX was an affront to humanity.

Truly one for the masochists only

[JLV]

Re: Safari?

YMMV but I really, really, dislike Safari*. Except for its no-clutter reader mode. So, while I mostly use Firefox now, I did use Chrome before.

I find the Safari iOS UI incredibly dumbed pared down, which annoys me just as much as Edge’s stupid no-menu crusade. Let me decide how I want to use a program, damnit!

* one of the things that got my goat was their past asinine refusal to support HTTP verbs like PUT, DELETE, back in Jobs’ days. Must have been a right pain to the REST crowd. Jobs could be brilliant, but not all the ways he thought the world should spin made sense, if you recall the “one mouse button is enough!” days. People tend to forget that about him and either idolize him or only make fun of his PR gaffes like “holding it wrong”.

[Anonymous Coward]

Re: Safari?

Like anyone who believes he's always right, sometimes he was wrong. But when he was right (hello, Flash Player...good riddance, Flash Player) he was often REALLY right.

I don't really care about the spartan UI for Safari on my phone. I just want to view sites, if I'm going to be mucking about filling in forms and stuff like that it doesn't matter what kind of UI it has, a phone based browser is going to suck donkey balls. That's where I visit my desktop PC, which runs Firefox (on Linux, so Safari wouldn't be an option even if I wanted it)

[JLV]

Re: Safari?

Nuking Flash from orbit was certainly a visionary move. +1.

[Anonymous Coward]

Minor Browser?

ROFL

Well done editors for using a new phrase to take a dig at Apple.

At least (and as you say,) they are not beholden to Advertisers (lawsuits incoming no doubt...)

I'd love to not have to use an Adblocker and NoScript etc just to make browsing a few dozen sites half bearable but many site owners/operators only have themselves to blame. It is their actions that are making it sometimes impossible to use sites because of all the adverts, popups and other crap that these sites are festooned with these days.

At least Apple are laying down some groundrules. My guess is that site designers will just laugh and carry on working out ever more devious way of pushing adverts to visitors.

there is one site (run out of the USA) that I visit frequently. It knows that I'm in the UK as one inline bit of clickbait tells me so. Ok, it shows the first part of the Postcode of my ISP's Point Of Presence onto the Internet. That's Ok, as I already have the product that they are advertising but recently, they have started showing so far unblockable small ads for bits of tat that is available in the USA and priced in USD. Hey lefthand, you do have a righthand you know.

I hate ALL adverts with a vengance. Any ads stuffed down my throat are added to my already lengthy 'Do Not Buy' list. I have some success but Virgin Media keep on sending shite to me even though I can't get their service. No matter what I do, they won't stop. Bah Humbug. A curse on all of them especially those at VM.

Yours Grumpy on Friday.

[Antonius_Prime]

Re: Minor Browser?

Grumpy, you should invest in a Raspberry Pi 3B+ at minimum and install PiHole for yourself.

(The Pi's British(-ish) made, so you'd be supporting your local economy.)

And it blocks a ton of ads at the DNS level. And can comfortably run wirelessly if you've a small house.

If you're not one for an additional wall wart, it can be run in a docker container, apparently.

They're great craic!

[Anonymous Coward]

Re: PiHole

Already done that but what about when I'm away from where my R-Pi is located eh?

Fartbook, 99% of Google, Twatter and the rest are blocked using the Pi.

[Anonymous Coward]

Re: PiHole

Adguard works well on LineageOS when away from home WiFi - provided you can get your head around regex usage, or just copy the expressions from PiHole.

[Anonymous Coward]

Re: PiHole

For those curious about PiHole and want to see what all the fuss is about without setting up an SD card or Raspberry Pi...

PiHole runs beautifully on Debian 9 (Stretch) so you can easily run a PiHole on a virtual machine.

The only thing I needed to do for this was to add the Debian stretch main repository link in /etc/apt/sources.list so all the dependencies could be met.

I also added TCP port 4712:4720 to iptables for both IPV4 and IPV6 to block telnet as I did not need remote access to the VM.

I saw: ├─{telnet-IPv4}

│ └─{telnet-IPv6}

after running the "pstree" command on my PiHole VM

(You can also just comment out line 1776 of the basic-install.sh so that those ports aren't opened up in the first place)

https://github.com/pi-hole/pi-hole/blob/master/automated%20install/basic-install.sh

[Anonymous Coward]

Re: PiHole

The above post should read ports: 4711:4720.

(I missed my edit window)

[Pascal Monett]

Re: Minor Browser?

Safari is at 15% market share.

So, yes, it is a minor browser.

And, since Apple has restricted it to not run under Windows, it's going to stay that way.

[Anonymous Coward]

Re: Minor Browser?

Considering it runs on a PC with not much more than 5% market share, and on a phone with market share in the low 10s, hitting 15% is pretty damn good!

If they went to the trouble of supporting Safari on Windows, they'd not only be fighting Chrome and Edge/IE, they'd be fighting other pro privacy browsers like Firefox and Brave. Not really worth their trouble to support Windows and go from 15% to maybe 18% if they were lucky.

[Richard Jones 1]

Re: Minor Browser?

I am unclear what if any benefit Apple could gain from spreading Safari onto other systems. It would not sell so no money there and no way to raise any user tax of any form either, so surely it would not be worth putting any unpaid work to spread their work.

[gnasher729]

Re: Minor Browser?

Safari may have 15% market share, but people who use Safari have often spent lots of money on their devices, and are capable / willing to pay lots of money on other stuff. Upset them and you upset 15% of the population that have more money in their pockets to spend than the other 85% on average.

[bombastic bob]

Re: Minor Browser?

If you ask ME, webkit just shot up in its value from MY perspective...

From the article:

"privacy-piercing browser code will be treated as a security abuse."

GOOD. I've been considering writing a WebKit browser (which can actually be as trivial as less than 20 lines of Python code, or as complex as you might want, involving touch gestures and everything else chrome does) anyway. Midori started out as "a nice idea" but they went the way of 2D FLATTY McFLATFACE FLATASS FLATSO in their more recent releases, and so it's off my list of acceptable browsers... (although they ARE using shadow effect in Midori, so not nearly as bad as Australis or some of the other Chromium-crap I've had to stomach).

/me wishes I could locate and SEVERELY punish those responsible for the 2D FLATSO "everywhere" cram-it-up-our-backsides-by-removing-all-other-options B.S.

Anyway, WebKit. I like it.

here's a sample python WebKit+GTK browser in python using the older style python code - using '.' for the indents since they are "disappeared" by the editor

import sys

import gtk

import webkit

import gobject

gobject.threads_init()

window = gtk.Window()

window.set_default_size(800, 480)

window.fullscreen()

window.connect("destroy", lambda a: gtk.main_quit())

browser = webkit.WebView()

if len(sys.argv) > 1 :

..browser.open(sys.argv[1])

else :

..browser.open("http://yourhome.page")

window.add(browser)

window.show_all()

gtk.main()

yeah. it's THAT simple. Or you can add menus and bookmarks and plugins and features and gestures and zoom and and and you get the idea.

[Jove]

Re: Minor Browser?

Squid does a fairly good job of blocking undesirable artefacts.

[Anonymous Coward]

Good

As far as Apple products are concerned, my level of interest is usually [nul], but top marks to them for bluntly stating something that all to often is talked under the carpet: breach of privacy is a breach of security.

[Anonymous Coward]

Oh for goodness sake

Security - ie viewing your personal data or hacking your system - is completely different to using cookies to track you.

Also I find it amazing that on a technical site so few people seem to know that the best way not to be tracked is to flush your cookie cache regularly if not every time you launch the browser. In firefox History -> Clear Recent History. It couldn't be any simpler. Yes, you can be tracked in other ways eg: ip address + browser and OS version, but its much less accurate as people move between places and devices.

[KittenHuffer]

Have been playing with a Pi-hole

A couple of years ago I was bought one of the Kano (Raspberry Pi) kits as a present. It got put together, played with, and then parked in a drawer. And I guess I expected it to stay there. A few months ago I ran across the Pi-hole, and remembering that I had a Pi gathering dust I decided it was time to bring it back to life.

It was fun setting it up and connecting it to my network ..... only to realise that my VPN wasn't going to play nicely with it. And the VPN was more important to me.

The other day I took the Pi when I was visiting a friend to show him the Ad blocking power. After it was set up I showed him the power of the Pi-hole ..... and we couldn't tell the difference between using the Pi-hole and not. It turns out that the Firefox add-ons that we're both already using (uBlock Origin, Privacy Badger, Ghostery, CanvasBlocker, NoScript & HTTPS Everywhere) are doing such a good job between them that the Pi-hole didn't really add anything to the mix.

I applaud Apple for the stand they're taking, but I think that those of us (technically capable and) concerned about Ads and tracking have probably already set ourselves up to pretty much avoid both. Though this may well help the masses.

[Anonymous Coward]

Re: Have been playing with a Pi-hole

Just, all the tracking that doesn't happen in a browser isn't blocked by browsers adds on....

[iron]

Re: Have been playing with a Pi-hole

And all the tracking that doesn't happen in my browser isn't just when I'm at home.

[big_D]

Re: Have been playing with a Pi-hole

Except that the blockers etc. only work in the browser, not for applications on the PC or apps on the phone.

I use Pi-Hole and NoScript.at home. I don't block ads per se, just the major tracking sites (and all of Facebook).

[Anonymous Coward]

Re: Have been playing with a Pi-hole

"Except that the blockers etc. only work in the browser, not for applications on the PC or apps on the phone" ...unless you use the full Adguard app, which isn't tied to a browser. I can't vouch for it being 100% efficient (as I'm sure nothing, bar unplugging from all networking, is) but it certainly cuts out a lot of clutter. Very noticeable (even on El Reg pages) if I suspend it. It occasionally stops something working as I'd like but easy to unblock that.

[Antonius_Prime]

Re: Have been playing with a Pi-hole

Pi-Hole can also run happily along side a PiVPN, in case your VPN is still super important.

As others have said, browser add-ons can block most browser stuff, but Pi Hole gets stuff at a network level.

Smart TV? IoT toys? Home assistants?

Bye-bye all their needless 2am call homes to deliver their espion--- I mean; telemetry...

[KittenHuffer]

Re: Have been playing with a Pi-hole

PiVPN allows the Pi to connect to a VPN, but what I need is a way to convince my the VPN on my PC to route DNS requests direct to a local IP address, and all other network traffic to the VPN. And I've been informed that this is not possible, or at least very difficult for PIA.

My main PC runs Ubuntu, Firefox, Thunderbird & Tixati. The only one of which is gonna have Ad problems is Firefox.

TV is dumb! No I(di)oT toys! Home assistants can ESAD as far as I'm concerned! Guess I'm too much of a (cynical pessimistic) greybeard to drink the millennial kool-aid for such junk tech.

I think I understand now. I'm not seeing the benefit of the Pi-hole cos I've minimised my exposure already.

[Anonymous Coward]

"in the wake of Safari's prior privacy enhancements"

Did anyone else read that as 'Satan', or is it just my drink addled brain not focussing my eyes properly... need more sleep...

[Anonymous Coward]

Well to be fair, Satan probably does have a better privacy policy than some. Chrome and Facebook come to mind as examples...

[A.P. Veening]

Besides that, Satan has an excellent reputation when it comes to keeping to the contract, unlike a lot of his contractees, who tried (and often succeeded) to break it.

[Rich 2]

Oh, for the days....

Oh for the days when tech companies did "tech" (you know, useful stuff that did things) rather than spending all their time spying on their customers

[Anonymous Coward]

So far so good!

I've been pleasantly surprised by Safari on IOS so far.

It is very rare that I see an advertisement on any website except maybe a static banner image.

I do have JavaScript and several other settings disabled of course.

[Anonymous Coward]

Re: So far so good!

What I really love about Safari on my iPhone (with the Firefox Focus ad blocker) is that if see a link to an article in the Facebook app I can open it in Safari and read it free of ads - and more importantly free of the crap that grabs your page and puts you on a spinning wheel where you win a prize or similar crap.

I can't believe anyone could read anything using Facebook's built in browser, you can't look at more than a few pages before being pulled away into some dead end page, and there are so many blinking ads you can't hardly find a place to touch the screen to scroll it without accidentally clicking one. I guess that must be what it is like to browse today's web without an ad blocker. I wouldn't know, I haven't done that since the first ad blocker plugins for Mozilla/Firefox like 15 years ago.

[Joe Gurman]

Perhaps....

....enhancements of this type re meant to sell more Apple hardware, or is that too simple-may need to mention?

[stiine]

The difference bweteen Apple and Mozilla

Apply don't want anyone else tracking you because that lowers the value of the information in their posession.

Mozilla don't want you to be able to track them and their harebraned changes they keep making to Firefox.

[doublelayer]

Re: The difference bweteen Apple and Mozilla

"Apply [sic] don't want anyone else tracking you because that lowers the value of the information in their posession."

Wrong. They don't want people tracking you because they think that will help them sell more devices to people who like privacy but don't know how to go about getting it themselves. They do collect some information, but their track record with collection is much better than with pretty much any other major tech company. They are doing it for a commercial reason, not out of the goodness of their hearts, but they are at least doing it honestly.

"Mozilla don't want you to be able to track them and their harebraned changes they keep making to Firefox."

Is this a joke? The tracking protection in Firefox blocks trackers from third parties from seeing user information. It doesn't block you from tracking Mozilla. Mozilla releases all their changes in source and documentation form to the public, and they've never seemed to care much whether people like the changes they made. I'm just confused now. What were you trying to say there?

[Grease Monkey]

Given how much Apple track their own customers this is frankly ridiculous. Basically the the stance seems to be "we will protect you from everybody but us" (Pause for maniacal laughter.)

[Anonymous Coward]

Pet peeve

Overall Safari on iOS is a great experience.

But, video/ad auto play drives me nuts!!!

Frequently video content is unrelated to the text, so my preference is to never auto play videos. Unfortunately Safari (or Firefox) has no way to stop them.

Videos take a while to load. You can’t pause the video while it’s loading (immediately). You also can’t (usually) ignore the video and scroll down. The video forcibly grabs the page to center on the video. It will continue to override user actions until the video loads, then you can stop it.

Apple can brag about what they’re doing for the user, but the reality is they collect billions each year from Google. That appears to be the same from Mozilla...

Microsoft’s iOS browser ironically DOES give you the ability to disable auto play.

[Tim99]

Re: Pet peeve

Have you tried the FireFox Focus Browser App? You can use its content Blocker in Safari, it can be a bit aggressive though, so you may need to use the "Reload Without Content Blockers" reload option - I also use Purify from the AppStore, and find it to be well worth the $1.99 it costs.

iOS 13 has new features including "Added support for aborting Fetch requests".

On the Mac, Safari Preferences has "Websites">"Autoplay" defaults of: Allow All-Autoplay/Stop Media with Sound/Never Autoplay - You can set these options individually for each website.

[Ian Joyner]

WebKit more widely used

To start with Safari it is the most used browser on Mac and iOS (and still seemingly the best).

But Chrome on iOS also uses WebKit, and Google used WebKit to actually get Chrome started. Thus it is hardly minor.

https://en.wikipedia.org/wiki/Google_Chrome

Many other things can use WebKit as well.

[amanfromMars 1]

Re Both Major and Minor Miner Browsers

Surely all browsers, and the information and intelligence they server to the masses and certain individuals, are mined ...... both deeply to extract and enrich and explosively to protect and destroy.