Bruce Lawson's personal site

The Reading List is supported by Vivaldi browser, who give me a reasonable salary yet don’t beat me around the head when I read interesting stuff when I should be bolting the networking stack onto browser engines. We recently released a brand new Vivaldi for desktops and mobile with new UI, UX and sexy features – give it a spin, and see how we’re fighting for a better web.

• Link o’ the week! JavaScript dos and donts by Mu-An Chiou
• iOS age restriction blocks all browsers except Safari, breaks choice screen – whoever would have expected Apple to be cunningly trying to evade its legal obligations, again? I’m shocked. And stunned.
• New to the web platform in October by Rachel Andrew
• New CSS that can actually be used in 2024 – “The amount of CSS novelty in the last two to four years has been staggering. Multiple innovations have been released and are now supported in all modern browsers, and some of them fundamentally change how to make websites”. This short article is a useful overview for those who haven’t been following along with all the details.
• More options for styling <details> – really useful to be able to use grid or flex layouts, style the marker more easily and animate the opening/ closing of disclosure widgets.
• Ecosia and Qwant, two European search engines, join forces on an index to shrink reliance on Big Tech – “The pair is also open to other European firms joining in with their push for more tech stack sovereignty — at least as fellow customers for the search index, as they plan to license access via an API”
• An exploration of examples showing masonry as both a part of CSS Grid and as its own display type – a really good article by Ahmad Shadeed, that concludes “Making it part of CSS grid will at least guarantee that the layout will work, but without the masonry stuff… At the end of the day, masonry is a grid.”
• How a BBC navigation bar component broke depending on which external monitor it was on – amazing detective work!
• The social web – “There’s no doom scrolling in an RSS feed. That is the web I’m arguing for. A web that is intentional, where what you consume is curated by you and you alone, where connections with others happen because you made the conscious effort to connect.”
• European alternatives for digital products – :We help you find European alternatives for digital service and products, like cloud services and SaaS products.”
• Unofficial guide to the <button> element by Hey Don’t Pickering
• Find your font -“Test and preview fonts in real-time for all your design needs. Choose the perfect typeface with ease.”
• Your CSS reset should be layered by Mayank
• Add content to the margins of web pages when printed using CSS – splendid to see work resuming on printing from web (to paper, PDFs etc)
• Mind The (Remediation) Gap – “Please, please, please, do not rely on these frameworks until you understand the basics of HTML and CSS. Because at the end of the day, there’s only so much that accessibility consultants can do to help if developers lose sight of the “front-end” in “front-end development.”
• Australia/Lord_Howe is the weirdest timezone – “Timezones are weird. But only finitely so. Here’s the exact conceptual model you should have of them.”
• Igalia and WebKit: status update and plans (2024) – Your chums at @igalia@floss.social are the 2nd most prolific committers to WebKit (after Apple) including WebKit for Android and a new SVG engine!
• Apple facing near-£3bn UK lawsuit over cloud storage ‘monopoly’ – an amazing surprise
• Microsoft Edge is trying to forcefully get your Chrome tabs again – another amazing surprise: Microsoft are doing dodgy browserjacking again! It’s high time the EU stepped in and reversed its decision not to designate Edge as a regulated Core Platform Service, even though it meets the quantitative criteria to for designation.
• W3C@30: W3C and me – Léonie Watson. “In this talk, Léonie reflects on the past 30 years, especially her many encounters with the W3C. She concludes that the true accomplishment isn’t the standards and specifications, but the incredible people of the Web community she has had the privilege to work with.”
• You Can Now See the Code That Helped End Apartheid -Joh n Graham-Cumming, who happens to be Cloudflare’s CTO, cracked a 30-year-old encrypted file that had a role in rewriting South Africa’s history.
• Your air fryer might be spying on you, new report warns – and smart TVs are even hungrier for our data – “Which? found that the three fryers it tested all wanted to “record audio on the user’s phone, for no specified reason” … the companion Xiaomi app for its air fryer hooked it up to “trackers from Facebook, Pangle (the ad network of TikTok for Business), and Chinese tech giant Tencent (depending on the location of the user). That was alongside knowing its owner’s precise location.”
• Elevator control panels – “Designers of user interfaces: The elevator industry needs you! Behold the evidence”

In this podcast series, I interview people from across different communities and industries who, in their own way, are fighting for a better web. In this episode, my guest is Evan Prodromou, Research Director of the newly-launched Social Web Foundation. We discuss interconnected social networks and ActivityPub, the open standard that Evan co-authored which enables cross-platform connections, how this tech reshapes online interactions, and the Foundation’s work to support digital rights and diversity. We also go into key topics like privacy, content control, and the importance of diverse voices in social media.

As this is my blog, I’m assuming you are strong-stomached enough to tolerate seeing my face on YouTube – but if not, the audio and transcript is available on the Vivaldi blog, with links to all the podcasty places.

With all the excitement of the launch of Vivaldi 7 and speaking to 750 people in Utrecht, I somehow forgot to post the second episode of my For A Better Web podcast, in which I chatted with glamorous John Ozbay, founder of Cryptee, a privacy-preserving photo and notes Progressive Web App from Estonia, about Privacy, PWAs, Protecting People … and Pianos!

As you’re on my personal website, I’m assuming you’re not too timid to see my face, so here’s the YouTube video. But if my visage makes you vomity, the audio-only version plus transcript (of course!) is available on the Vivaldi blog – which has an RSS feed so you can subscribe to it with the built-in Vivaldi feed reader.

The Reading List is supported by Vivaldi browser, who give me a reasonable salary yet don’t beat me around the head when I read interesting stuff when I should be bolting the networking stack onto browser engines. We just released a brand new Vivaldi for desktops with new UI, UX and sexy features – give it a spin, and see how we’re fighting for a better web.

• Aria-activedescendant is not focus – by Sarah Higley
• Sustainable Futures: Funding the Web Ecosystem – this State of the Browser talk by Stephanie Stimac keeps running through my brain (with transcript)
• Privacy, PWAs, Protecting People … and Pianos – In this second episode of the For a Better Web podcast, Bruce chats with John Ozbay, founder of Cryptee, a privacy-preserving photo and notes Progressive Web App from Estonia
• Choosing a Masonry Syntax in CSS – What makes something a ‘grid’, and what’s at stake? asks Miriam Suzanne
• Zorin OS – a Linux desktop, based on Ubuntu, with a UI designed for Windows/ Mac users. I installed it on an old Dell machine running Windows 10 that cost me £85 from eBay, and my mum was up and running with Libre Office and Zoom in one hour.
• Where web components shine – and where they don’t. By Dave Rupert
• Reference Target for Cross-Root ARIA – Reference Target is a feature to enable using IDREF attributes such as for and aria-labelledby to refer to elements inside a component’s shadow DOM, while maintaining encapsulation of the internal details of the shadow DOM. The main goal of this feature is to enable ARIA to work across shadow root boundaries
• The Elephant in the Room in Google’s Antitrust Trials – “it’s time to face the elephant in the room, and require Google to spin off YouTube into an independent entity positioned to be a market counterweight. This would be a win-win-win-win: for advertisers, publishers, competitors, and consumers. And it would kick one leg out from under the stool that props up Google’s internet monopoly, which has done too much market damage in too many ways for way too long.”
• Chromium’s influence on Chromium alternatives – “I don’t think most people realize how Firefox and Safari depend on Google for more than “just” revenue from default search engine deals and prototyping new web platform features.”
• Apple will let everyone set new default phone and messaging apps with iOS 18.2 – not just geo-fenced to EU, which is relief to non-EU devs and testers. Let’s have all the EU improvements go global!
• It’s time for a fairer, more competitive app ecosystem – my old chums at open Web Advocacy have co-signed a letter to MEPs asking them to hold Apple, Microsoft, Google, Meta (Facebook) and Bytedance (TikTok) accountable under DMA
• Bad News: We’ve Lost Control of Our Social Media Feeds. Good News: Courts Are Noticing. – “Our legal system is starting to recognize this shift and hold tech giants responsible for the effects of their algorithms — a significant, and even possibly transformative, development that over the next few years could finally force social media platforms to be answerable for the societal consequences of their choices.” (Julia Angwin, seemingly free to read)
• The Global Surveillance Free-for-All in Mobile Ad Data – “Babel Street’s LocateX platform also allows customers to track individual mobile users by their Mobile Advertising ID or MAID, a unique, alphanumeric identifier built into all Android and Apple mobile devices … [This] allowed its investigator to find information about visitors to high-risk targets such as mosques, synagogues, courtrooms and abortion clinics… then tracked one likely juror’s phone to their home address over several days.”
• U.S. Finally Restricts Sale Of Location Data To Foreign Adversaries, But We’re Still Too Corrupt To Pass A Basic Internet-Era Privacy Law – “The U.S. needs comprehensive internet-era privacy laws that hold companies and executives accountable for lax security and privacy standards”
• Digital Divinity: Ancient traditions meet modern technology – fabulous article including Muslim 3D, a video game designed to fight Islamophobia; building robot elephants for Hindu temples; the world’s first 3D-printed temple .. and more! Boomshanka
• git-blame-someone-else – “This changes not only who authored the commit but the listed committer as well”

The Reading List is supported by Vivaldi browser, who give me a reasonable salary yet don’t beat me around the head when I read interesting stuff when I should be bolting the networking stack onto browser engines. Studies show that using Vivaldi can increase your gorgeousness by up to 78.6 IGUs (ISO Gorgeousness Units).

• OpenFreeMap lets you display custom maps on your website and apps for free. You can either self-host or use our public instance. Everything is open-source, including the full production setup
• Create a semantic breakout button to make an entire element clickable – by Andy Bell and his whippet
• mobile developer numbers have decreased again – Stack Overflow survey: “the number of mobile developers steadily decreasing YoY… companies are less and less interested in native mobile development, mainly because developing a responsive web page or a progressive web app is much easier and cheaper than a native app”
• Progress of Blink for iOS – slides from a lightning talk at BlinkOn by Gyuyoung Kim of Igalia
• Hackers Found Millions of Kias Could Be Tracked, Controlled With Just a Plate Number – “Kia updated its web portal after the hackers informed them of the security issue, which was similar to a past vulnerability with Lexus and Toyota vehicles”
• CSS min() All The Things – “a useful tool for responsive layouts that adapt to the viewport’s size”
• Interop 2025 must drop secret vetos – help persuade browser engine devs make next year’s Interop process more transparent by giving a thumbsup on the handful of bugs listed in the article
• Web Components Are Not the Future — They’re the Present – “The people actually shipping software are tired of framework churn. They’re tired of shit they wrote last month being outdated already. They want stability. They want to know that the stuff they build today will work tomorrow. As history has proven, no framework can promise that” by Cory LaViska
• Web components are okay – “As a framework author, if you want to freeze your thinking in 2011 and code as if nothing new was added to the web platform since then, you absolutely can! And you can still write a great framework! This is the beauty of the web” by Nolan (no relation) Lawson
• Web Components are not Framework Components — and That’s Okay – “The bottom line is, web components reduce the number of use cases where we need to reach for a framework, but complex large applications will likely still benefit from one” by Lea Verou
• Streaming Television Industry Conducting Vast Surveillance of Viewers, Targeting Them with Manipulative AI-driven Ad Tactics, Says New Report – “Leading streaming video programming networks, CTV device companies and “smart” TV manufacturers, allied with many of the country’s most powerful data brokers, are creating extensive digital dossiers on viewers based on a person’s identity information, viewing choices, purchasing patterns, and thousands of online and offline behaviors.”
• Google must crack open Android for third-party stores, rules Epic judge
• Overriding Gatekeeper Protections in MacOS 15 Sequoia Will Require Clicking Through Panels in System Settings – Blimey. Even Gruber thinks Apple’s gatekeeper nannying “for your comfort and security” has gone too far
• Android 15 could add built-in support for app archiving – Imagine if, instead of an elaborate “app archiving” subsystem to reclaim space taken up by seldom-used single-platform apps, you could just tap a homescreen icon which called a web page full-screen when you needed it. Imagine if that were possible across all Operating Systems, built with free, open standards instead of proprietary flim-flam.
• How North Korea Infiltrated the Crypto Industry – as if Crypto were not dirty enough already, it looks like the vile North Korean government might be making huge money from it.
• Mosaic Netscape 0.9 was released 30 years ago today (Oct 13 1994)
• Werner’s Nomenclature of Colours By P. Syme – A recreation of the original 1821 color guidebook that Charles Darwin consulted during his voyages

• An Abridged History of Safari Showstoppers – not the mere niggles, but the absolute cesspit explosions. By Roderick Gadellaa, who has seen things you people wouldn’t believe; IndexedDBs on fire off the shoulder of Orion. Scrolling bugs glitter in the dark near the Tannhäuser Gate.
• Paul Graham and the Cult of the Founder – “‘Founder Mode’ is such garbage” says this spot-on little essay
• New Values and Functions in CSS – gob-smacking things coming in CSS, detailed in this v nice article by Alvaro Montoro
• Ceefax and the birth of interactive TV – 50 years ago, a new BBC service was launched that gave 24/7 access to on-demand news, info, sports results from your TV and its remote control. It began for accessibilityy reasons: engineers were looking for a way to overlay subtitles for the Deaf.
• Richer Text Fields (Explainer) – Keith Cirkel’s proposal on making it easier to code common “rich” input patterns (think of input masking and the like) without contenteditable or hacks
• Announcing BCD Watch – Eric Meyer on a new service from your chums at Igalia that helps web devs keep up to date on changes to support for web features; you can subscribe to RSS to get weekly reports on BCD changes
• LinkedIn starts training GenAI on users’ personal data – without notification – If you use LinkTin (and why wouldn’t you? Who doesn’t like gormless crypto recruiters or a greeting on their work anniversary?) you can opt-out of being turned into AI fodder (non-EU folks. The EU has laws.)
• Halide rejected from the App Store because it doesn’t explain why the camera takes photos – “Halide may have been featured during the iPhone 16 keynote, but it seems that wasn’t enough to protect it from an over-zealous App Store reviewer”. lol gatekeepers
• Feedback needed: How should we define CSS masonry? – “The CSS Working Group has combined the two CSS masonry proposals into one draft specification. The group hopes that this will make it easier to compare the two, and make a final decision.”
• Google must share the ability to install Web Apps in Android by my old chums at OWA
• FTC Staff Report Finds Large Social Media and Video Streaming Companies Have Engaged in Vast Surveillance of Users with Lax Privacy Controls and Inadequate Safeguards for Kids and Teens – “Report recommends limiting data retention and sharing, restricting targeted advertising, and strengthening protections for teens”
• How I build a button component by Andy Bell and his whippet
• How Big Tech leverages its influence in statehouses – At least a dozen tech trade groups engage in state capitals. “There is no ‘tech industry …Technology is so widely suffused across the economy that everything is part of the tech industry.”
• Worst government use of ChatGPT: in a child protection report by Davif Gerard
• What the AT&T Breakup Teaches Us About a Big Tech Breakup
• The Department of Energy Wants You to Know Your Conservation Efforts Are Making a Difference – “By turning off your lights all day every day for a month, you conserved about 1 percent of the energy needed for AI to generate a picture of a duck wearing sunglasses.”

The Reading List is supported by Vivaldi browser, who give me a reasonable salary yet don’t beat me around the head when I read interesting stuff when I should be bolting the networking stack onto browser engines. Studies show that using Vivaldi can increase your gorgeousness by up to 78.6 IGUs (ISO Gorgeousness Units).

• Apple appears to mislead UK Regulator over deceptive default browser user interface – by pretending a dark pattern documented by several people never existed. Apple denied this, saying that the dark pattern was “never intended to discourage users from setting third-party browsers as the default”, and that anyone who says Apple is beastly is a big fat poo-poo, and so is their mum.
• What is React? – this brief unbiased video should be on syllabus of every coding bootcamp, University CS course and shown every night after the evening news.
• State of HTML 2024 survey – SPEKE YR BRANE!
• Should form labels be wrapped or separate? – should you wrap <input> in its associated <label>? Do you need for= pointing to the input’s id? James Edwards has the answers (you can if you want to but it can be harder to stlyle, and yes)
• CSS finally adds vertical centering in 2024 – align-content:center works in the non-grid/float layout, allowing vertical centering with 1 CSS property
• the audio element – Heydon Pickering’s unofficial guide
• Openly licensed streetview with Panoramax
• Ford seeks patent for tech that listens to driver conversations to serve ads – “Ford Motor Company is seeking a patent for technology that would allow it to tailor in-car advertising by listening to conversations among vehicle occupants, as well as by analyzing a car’s historical location and other data, according to a patent application published late last month”. Just the sort of thing that lovable Uncle Henry would have wanted.
• Apple vs EU Commission: the FSFE intervenes to safeguard Free Software – “The Free Software Foundation Europe is intervening in litigation brought by Apple against the European Commission before the Court of Justice of the European Union. Apple is seeking to avoid DMA obligations related to its App Store and the interoperability of its operating system. The FSFE aims to protect Free Software against monopolistic corporate control.”
• Ten reasons why Apple’s App Store terms are still not compliant with the DMA – from a legal rather than technical viewpoint
• Apple must pay Ireland €13bn in unpaid taxes, court rules – expect even more petulance against DMA from Fruitco
• Analysis of Meta, Apple, Google, Amazon, Bytedance and Microsofts’ implementation of their obligations under the Digital Markets Act non-compliance (PDF) by The European Consumers Organisation. Surprise! “We set out in this paper several ways in which we consider that these companies do not comply”
• On craft and the web by Chris Ferdinandi
• Ansi art Textmode graphics – Rauri Rochford on manipulating pixels in the pre-Cambrian
• Honest privacy policy

The Reading List is supported by Vivaldi browser, who give me a reasonable salary yet don’t beat me around the head when I read interesting stuff when I should be bolting the networking stack onto browser engines. Yesterday saw the release of Vivaldi 6.9 for desktop, which contains no fewer than THREE features I requested. That’s one per month on the payroll! Try it out.

• Chrome iOS Browser on Blink – “The Blink-based port of Chrome iOS is a large and laborious project. Igalia has made significant contributions… we believe that we are on the right track for eventually replacing WebKit by Blink on Chromium related products for iOS.”
• Coalition for App Fairness Statement on Legislation to Address Online Platform Monopolies in Korea – “Assemblyman Kim Nam-geun introduced legislation to put an end to the abusive behaviors of Apple and Google on mobile devices.”
• Upcoming customizable select dropdown demo that falls back to a traditional select menu. (Chrome Canary, Experimental web flag)
• Bypassing airport security via SQL injection – “Anyone with basic knowledge of SQL injection could login to this site and add anyone they wanted… allowing themselves to both skip security screening and then access the cockpits of commercial airliners.”
• Reckoning: Part 2 — Object Lesson “What hath we wrought? A case study, in which Alex Russell looks at BenefitsCal -the state of California’s recently developed portal for families that need food stamps. It’s a front-end catastrophe. “SPAs are ‘YOLO’ for web development.”
• What RSS Needs by Mark Nottingham
• Before Filing that Keyboard Bug… – Are you using a Mac or another Apple iDevice and think you found a keyboard bug? Try these settings tweaks first, says Adrian Roselli
• Misfire: We’re in a bad place when even the W3C TAG falls for Apple’s privacy schtick – “The TAG missed a critical opportunity to call for legislative fixes to the technically unfixable problems it failed to enumerate”, grumbles Big Al, legitimately.
• Apple trying to pressure WeChat into blocking a payment loophole; developer refusing – An odd fight to pick; “when Trump threatened to ban WeChat, analysts estimated it could cause global iPhone sales to fall by as much as 30%.”
• Using the term ‘artificial intelligence’ in product descriptions reduces purchase intentions – “When AI is mentioned, it tends to lower emotional trust, which in turn decreases purchase intentions,” he said. “We found emotional trust plays a critical role in how consumers perceive AI-powered products.”
• Indigenous creators are clashing with YouTube’s and Instagram’s sensitive content bans – “Deep in the heartlands of Brazil, Indigenous creators are having to censor themselves to avoid getting banned on social platforms”. Because on the world-wide web, everyone should conform to prudish Californian social mores, of course.

In this podcast series, I’ll interview people from across different communities and industries who, in their own way, are fighting for a better web. I’ve a list of candidates for future episodes, but I don’t know everyone on the Web so if you know of someone doing something interesting to make the web better, please leave a comment (or introduce me!)

In episode 1, I chat with Jon von Tetzchner, CEO of Vivaldi (disclosure: my boss), and Laurent Ach, CTO of Qwant, to talk about the unique missions and values of Vivaldi and Qwant—two European tech pioneers committed to privacy, innovation, and user empowerment.

It’s available at these places (more coming soon)

• Podcast Addict
• Anchor.fm RSS
• Spotify

I’m showing you the YouTube version, because this is my own blog and you’re my Special Chums who are unlikely to be too perturbed by it showing my face. Don’t forget to rent a werewolf (lycan subscribe)!

Today also sees the release of Vivaldi 6.9 for desktop, which contains no fewer than THREE features I requested. That’s one per month on the payroll!

We started Open Web Advocacy for one reason: to advocate to ensure that Web Apps could compete fairly with single-platform “native” apps on mobile, as they can on computers. We know that it’s a lot more work to develop, maintain and test two separate codebases, one for Android and one for iOS, which is onerous for smaller firms, charities and long tail businesses; web apps can run anywhere the web does, so you only need to maintain one codebase.

As an accessibility tester, I know that web tech is mature and exposes richer information to people with disabilities who use assistive technologies such as screen readers. For example, single-platform “native apps” can only say some text is a heading, or is not; the web can expose up to 6 levels of heading and sub-headings. Web apps run in browsers, and browsers fix accessibility bugs quickly. By contrast, React Native (a framework developed By Facebook that is write-once to produce “native” apps for each platform) has an outstanding bug I filed three years ago whereby people using an external keyboard on Android can’t focus in a text input field to enter information. Sucks to be disabled and reliant on some Facebook developers.

OWA’s first success was with the UK competition regulator, the Competition and Markets Authority (CMA) who wrote in their opening statements of the Market Investigation Reference into Browsers and Cloud Gaming

We all rely on browsers to use the internet on our phones, and the engines that make them work have a huge bearing on what we can see and do. Right now, choice in this space is severely limited and that has real impacts – preventing innovation and reducing competition from web apps. We need to give innovative tech firms, many of which are ambitious start-ups, a fair chance to compete.

The CMA has published its proposed remedies ^(PDF) (that is, fixes it could require of Apple and Google) in order to free up in the mobile app market in the UK. The fixes are good (thanks CMA!) but I’m worried they don’t go far enough, or aren’t specific enough, to avoid the kind of malicious compliance from Apple that we’ve been seeing in the EU as it attempts to wriggle around the Digital Markets Act. (The fixes aren’t only on Apple, but Apple has been the most egregious in stamping on competition and evading regulation).

Other browser engines are not enough

Obviously, allowing competing browser engines, like Firefox’s Gecko and Chromium (in Vivaldi, Chrome, Edge, Opera et al) is welcome, and vital. But that is not the goal; the goal is making web apps competitive with “native” apps, and the CMA does not go far enough because it only plans to mandate that Apple “grant equivalent access to APIs used by WebKit and Safari to browsers using alternative browser engines”.

The problem here is that Apple has long denied Safari access to some system features that “native” apps on iOS can access. For years, for example, native apps could send push notifications but Safari couldn’t. That recently changed (although the web push implementation is still reportedly pretty buggy). But still on iOS, Apple refuses to allow the web to access Bluetooth, USB etc, even though “native” apps can access these device capabilities.

Apple says that this is for security, but I note that Apple themselves told the CMA^PDF that

WebKit’s sandbox profile on iOS is orders of magnitude more stringent than the sandbox for native iOS apps

So Apple’s web browser, according to Apple, is more secure than Apple’s own iOS native sandbox. Yet Apple has a worse track record than Firefox or Google in shipping patches for browser vulnerabilities. The CMA wrote^(PDF)

it is not clear from the evidence available to date that WebKit has better security outcomes compared to other browser engines

If Apple itself does not believe that native iOS apps are more secure than browser sandboxes, why do they keep some device features away from Safari? It’s fair to think that Apple wants to force businesses to make native iOS apps instead of Web Apps, so that distribution and monetization is therefore controlled by Apple.

Missing remedy

To ensure that Apple cannot artificially hamstring all third party browsers, the CMA should mandate that all APIs and device integrations available to native iOS Apps, Apple’s own apps and services must be available to third party browsers.

Apple must implement install prompts

Apple likes to tell regulators that web apps are an alternative to native iOS apps in its App Store. In a submission to the Australian regulator ^PDF, Apple wrote

Web browsers are used not only as a distribution portal, but also as platforms themselves, hosting “progressive web applications” (PWAs) that eliminate the need to download a developer’s app through the App Store (or other means) at all. PWAs are increasingly available for and through mobile-based browsers and devices, including on iOS. PWAs are apps that are built using common web technology like HTML 5, but have the look, feel and functionality of a native app.

Let’s test the accuracy of Apple’s statement. Here’s an example of a PWA, Stuart Langridge’s Farmbound game, rendered by Chrome on Android:

Chrome has seen that Farmbound is an installable Progressive Web App and generated the install banner you can see ‘floating’ over the game (and which I’ve highlighted with a red box). Tapping it adds the game’s icon to your Android homescreen. Stuart didn’t need to do anything other than code the game correctly, and add a line in his HTML pointing to a manifest file:

<link rel="manifest" href="manifest.json">

(You can see Farmbound’s manifest; this is the Web! You can view source!)

The excellent image compression squoosh.app adds its own install button rather than rely on Chrome’s heuristics, using the beforeinstallprompt event that fires when the browser has detected that a website can be installed as a Progressive Web App. As MDN states,

The typical use for this event is when a web app wants to provide its own in-app UI inviting the user to install the app, rather than the generic one provided by the browser. This enables the app to provide more context about the app, explaining to the user why they might want to install it.

Safari on iOS does not prompt a user to install a Progressive Web App; neither does it support beforeinstallprompt. On iOS, the user must perform the following intuitive ritual:

1. Press the share button. Yes, you choose “share” to install; makes sense, right?
2. Scroll down below the share menu’s fold to discover the ‘add to homescreen’ option, assuming you somehow know that this exists
3. Click ‘add to homescreen’
4. Decide to accept the app’s name, or replace it
5. Click ‘add’

Apple does offer an analogous one-tap installation mechanism for apps, but (you’ll be amazed to learn) it only works for native iOS apps that are in the Apple App Store. A web site owner can add a single line of HTML, much like the one linking to a PWA manifest, but this one pointing to the app in the App Store associated with the website:

<meta name="apple-itunes-app" content="app-id=myAppStoreID, app-argument=myURL">

Apple writes that its proprietary Smart App Banners allow site owners to “create a banner to promote your app on the App Store from a website”. Here’s an example from yuka.io, with the Safari-generated banner highlighted by me in a red box:

Apple says

If the app is already installed on a user’s device, the Smart App Banner intelligently changes its action, and tapping the banner simply opens the app. If the user doesn’t have your app on their device, tapping the banner takes them to the app’s entry in the App Store … Smart App Banners automatically determine whether the user’s device supports your app. If it doesn’t, or if your app is unavailable in the user’s location, the banner doesn’t appear.

How different from the clunky precess to install a PWA on iOS! So much for Apple’s claim to the Australian regulator that PWAs “have the look, feel and functionality of a native app”.

It’s hard to see why Apple make it so hard to install a PWA yet so easy to install a native app. And when I say “hard to see”, I mean because it’s in a tiny grey font against a white background, so I’ve emphasised it with a red rectangle:

Apple makes it easy to install a native iOS App from a webpage; a native app in the Apple App Store, from which Apple taxes 30% of in-app purchases. It earns nothing from PWAs because they are distributed from the owners’ sites, not an intermediary gatekeeper’s App Store.

The missing remedy

Apple cannot be allowed to continue self-preferencing native Apps over Web Apps. I don’t think Smart App Banners should be removed, but comparable functionality should be added for PWAs. Although 5.32 of CMA WP7 says

Apple would be required to eliminate its use of private APIs for WebKit and Safari without degrading currently available functionality made available for WebKit and Safari

I would like to remove any doubt and see CMA explicitly require Apple to implement install prompts for PWAs in Safari/iOS. It doesn’t have to be implemented in them the same way as Chrome, just with the same outcome.

Web Apps must open in the browser that installed them

The current suggested remedies allow for third-party browser engines on iOS, and those will be able to download PWAs. However, none of the remedies explicitly requires that those PWAs will subsequently run in the engine that downloaded them.

Apple is a master of malicious compliance, and would probably argue that it could fulfil CMA’s remedies by allowing browsers to use their own engine and providing them access to the share menu to install Apple’s WebKit implementation of Web Apps. This is actually the current state of affairs in the EU; Apple tried to completely kill PWAs (which it calls ‘Homescreen Apps’) in Safari, so that it wouldn’t have to allow them in other engines. They backed down after a campaign by EU web developers, but (so far, at least) all PWAs on iOS will continue to be hamstrung by running in Webkit. Apple said

we will continue to offer the existing Home Screen web apps capability in the EU. This support means Home Screen web apps continue to be built directly on WebKit and its security architecture, and align with the security and privacy model for native apps on iOS.

The CMA is aware of this problem. In their interim report in connection with our market study into mobile ecosystems, they wrote

By requiring all browsers on iOS to use the WebKit browser engine, Apple is able to exert control over the maximum functionality of all browsers on iOS and, as a consequence, hold up the development and use of web apps. This limits the competitive constraint that web apps pose on native apps, which in turn protects and benefits Apple’s App Store revenues.

This would also be very user-hostile. The browser that installs a PWA would almost certainly be the user’s default browser, and (on a personal device rather than, say, a locked-down corporate laptop) people choose their default browser for a reason.

I use Vivaldi browser, and prefer to browse with some accessibility settings that I can tweak as necessary if my Multiple Sclerosis is playing silly buggers:

You might use something else, with different settings. That’s your choice. But whatever your choice is, I believe it should be respected if you open up a PWA, and I believe that the CMA should make this explicit. Wouldn’t it be weird if your default browser settings worked fine while you played Farmbound on its website, but didn’t work if you opened the Farmbound PWA because, unknown to you, it was running in WebKit?

The missing remedy

The CMA should require that PWAs downloaded in one browser are subsequently run in that browser, running its own engine, with its user settings.

Otherwise, we could find ourselves in a situation where Microsoft could ship Edge on iOS, powered by Chromium; Edge could be my default in-app browser, but they couldn’t implement web Bluetooth in Edge (because Safari doesn’t have Bluetooth access so Edge doesn’t have to have it either) and they couldn’t add an Edge app to Home Screen (because Apple might/would mandate that add to Home Screen would add it as Safari).

And I don’t think that is what the CMA want, at all.

What you can do to help

You can write to CMA, explaining why these suggested ‘missing remedies’ would be useful for the PWA you make, or for your UK customers. I don’t want to give a template, because a deluge of “+1” mails isn’t helpful; what is helpful is for CMA to understand how their remedies should be tightened or augmented. But you might try something like:

Darling CMA [they are human! Make them feel loved!]. My organisation makes YrkshrPudz.io, an app aimed at UK customers to help them make crispier Yorkshire puddings. Our Android PWA is really well-received but we have to spend 20 developer hours a week making a native iOS app because Safari can’t access bluetooth, which we need to control the temperature of our YrkshrPudz™ bluetooth Yorkshire Pudding Oven (the “Krispinator XL™”). Allowing iOS browser engines to access the same device functions as native apps would save us £900,000 per year in developer time. Lots of love, Hang loose and stay gravy! etc

You need only comment on stuff which is relevant to you; you do not need a comprehensive position paper on the whole thing. If any part of your email is confidential, just tell them. Email the MIR team at browsersandcloud@cma.gov.uk, referencing Working Paper 7 (perhaps as the subject field) before end of Thursday 29 August, please!

We saw the power of 5,308 real, independent developers in getting Apple’s attempt to kill PWAs reversed in the EU. Your voice can make a difference; use it!

Further reading

• UK’s Browser and Cloud Investigation may fail to allow Web App competition by Open Web Advocacy
• The CMA wants your comments on web apps by Stuart Langridge