I think you’re confused on this topic, because Apple has to allow users to sideload full applications soon. This is a much bigger attack vector than PWAs, which are still sandboxed in the respective browser. PWAs need to find a browser exploit + an iOS exploit, whereas native apps only need an iOS exploit.
No, they don’t only need a browser exploit, because the browser itself is sandboxed too. Otherwise the danger exists for literally every webpage - no need to install a PWA to break out if you have a browser exploit! You understand that a PWA is just a website and nothing more, right?
You understand that a PWA is just a website and nothing more, right?
This is sort of reductive. Yes, and no. It’s more than just a link on your home screen. More than just a set of html pages saved locally. It downloads the entire javascript app, the manifest, the icons, all that stuff and packages it up. When you run one of these you’d have no indication that you’re in a website. There is no browser URL bar or any of that. Only the controls in the app. It’s not really “just a website and nothing more”. It’s a javascript program running on a phones javascript engine (which is currently webkit and locked down). An app in just about every sense of the word. https://app.starbucks.com is a great example. Even works offline once you save it.
I think you’re confused on this topic, because Apple has to allow users to sideload full applications soon. This is a much bigger attack vector than PWAs, which are still sandboxed in the respective browser. PWAs need to find a browser exploit + an iOS exploit, whereas native apps only need an iOS exploit.
PWAs only need a browser exploit. If alternative browsers are allowed apple no longer controls this mechanism.
It’s also easier to slip a PWA by a user, making it confusing for uniformed users who would be targeted.
No, they don’t only need a browser exploit, because the browser itself is sandboxed too. Otherwise the danger exists for literally every webpage - no need to install a PWA to break out if you have a browser exploit! You understand that a PWA is just a website and nothing more, right?
This is sort of reductive. Yes, and no. It’s more than just a link on your home screen. More than just a set of html pages saved locally. It downloads the entire javascript app, the manifest, the icons, all that stuff and packages it up. When you run one of these you’d have no indication that you’re in a website. There is no browser URL bar or any of that. Only the controls in the app. It’s not really “just a website and nothing more”. It’s a javascript program running on a phones javascript engine (which is currently webkit and locked down). An app in just about every sense of the word. https://app.starbucks.com is a great example. Even works offline once you save it.
You just described a website…