Episode Transcript
Available transcripts are automatically generated. Complete accuracy is not guaranteed.
Speaker 1 (00:00):
Welcome to Upwardly Mobile API and App Security, the podcast
that keeps mobile developers and security pros ahead of the curve.
I'm Sky and I'm George.
Speaker 2 (00:08):
We're here to unpack the latest in mobile security threats
and the tech landscape.
Speaker 1 (00:12):
And a big thanks to our sponsor, Approve, mobile security
leaders in mobile app attestation and API security solutions. Check
them out for securing your apps.
Speaker 2 (00:21):
Absolutely. Approve helps tackle the kind of complex security challenges
that often arise from the sort of platform dynamics we're
actually discussing today.
Speaker 1 (00:28):
That's right. Today we're looking into something huge, the global
regulatory pushback against Apple's restrictions on browser engines on iOS.
It might sound technical, but it has massive implications for
app functionality, competition, innovation, and yes, even security. Mm hmm.
Speaker 2 (00:45):
We've been digging into some key documents, recent reports from
open wed Advocacy, the UK's Competition and Market Authority, and
significantly brand new guidelines from Japan's Mobile Software Competition Act.
Speaker 1 (00:57):
Our goal is to unpack why this browser engine issue
has become such a global flashpoint and what it means
for you, whether you're developing apps, managing security, or just
using a smartphone and.
Speaker 2 (01:09):
We should start with the latest news, which is pretty
significant coming out of Japan.
Speaker 1 (01:13):
Right just recently August six, twenty twenty five, Japan passed
a new law, the Bill on the Promotion of Competition
for Specified Software used in Smartphones, quite a.
Speaker 2 (01:24):
Mouthful, usually just called the Smartphone Act now, and it
takes direct aim at Apple's ecosystem control how so well, fundamentally,
it prohibits Apple's ban on third party browser engines on
iOS full stop.
Speaker 1 (01:38):
Okay, that's clear, but we know the devil's often.
Speaker 2 (01:40):
The details with these things exactly, and that's where the
new Mobile Software Competition Act or MSCA guidelines come in.
They clarify what prohibiting really means. It's not just about
outright bans. They state that preventing or even just hindering
adoption includes measures that make using an alternative engine impractical
or commercially unviable.
Speaker 1 (02:00):
So no loopholes where you technically allow something but make
it impossible to actually use effectively.
Speaker 2 (02:05):
Precisely, it's about genuine functional access, not just ticking a
box on paper. This tries to prevent those situations where
the platform owner puts up so many hurdles that competition
just dies.
Speaker 1 (02:17):
That makes sense. What about the technical side, like APIs
for developers, that's crucial.
Speaker 2 (02:21):
The MSCA guidelines hit that hard too. They mandate fair
access to osapis. The language is specific. Third parties must
have functionally equivalent performance.
Speaker 1 (02:32):
Functionally equivalent means.
Speaker 2 (02:34):
Meaning Apple can't offer, say, a slower, less capable set
of APIs to competing browsers. They need access to the
same core performance and system features that Safari gets. It's
about leveling the playing field.
Speaker 1 (02:46):
Okay, that's a big step towards real competition. Anything else significant.
Speaker 2 (02:51):
In those guidelines, Yes, choice screens. The guidelines specify that
browser choice screens must appear promptly after the first activation.
Speaker 1 (02:58):
Of the phone, so right when you set up a
new iPhone.
Speaker 2 (03:00):
Exactly during that initial setup flow, not buried in setting
somewhere you might never look. It's about giving users real
awareness and choice from the get go.
Speaker 1 (03:09):
Japan seems to be taking a very thorough approach here.
When does this all kick in?
Speaker 2 (03:13):
The act is expected to come into force by December
twenty twenty five, so quite soon.
Speaker 1 (03:18):
And the significance of Japan joining this it's huge.
Speaker 2 (03:21):
You now have the EU, the UK and Japan three
massive economies all mandating that Apple allow alternative browser engines.
This really ramps up the pressure. Twenty twenty six could
genuinely be the year we see real change in browser
competition on iOS, which.
Speaker 1 (03:36):
Leads us nicely to the EU because they really set
the stage for this, did they with the Digital Markets
Act the DMA?
Speaker 2 (03:41):
They absolutely did. Apple was designated a gatekeeper under the
DMA and the compliance deadline was back on March seventh,
twenty twenty four. The DMA is really landmark stuff for
trying to ensure fairness on major digital platforms.
Speaker 1 (03:55):
And its specifically addressed browser engines.
Speaker 2 (03:57):
Oh yes, Article five seven explicitly prohibits gate keepers like
Apple from forcing users to use their browser engine. The
reasoning behind it mentioned in recital forty three, is clear
stop gatekeepers dictating the functionality and standards for competing browsers
and the web apps they run.
Speaker 1 (04:13):
But Apple's response hasn't exactly been welcoming, has it. I
remember their legal VP Kyle Ander making some comments right.
Speaker 2 (04:21):
He basically claimed Apple had created a way for others
to bring their engines, but that companies like Google and Mozilla, well,
for whatever reason, they have chosen not to.
Speaker 1 (04:30):
Do so shifting the blame essentially.
Speaker 2 (04:32):
Pretty much, while also heavily emphasizing that iOS is all
about being the most secure computing platform, implying perhaps that
allowing other engines is inherently risky, which is where.
Speaker 1 (04:43):
Groups like Openweb Advocacy OWA come in. What's their take?
Speaker 2 (04:47):
Their take is pretty blunt. They argue Apple knows exactly
what the problems are and is deliberately refusing to fix them.
The evidence it's been over fifteen months since the DMA
took effect and not a single major browser vendor has
mana to launch a competing engine on iOS in the EU.
Speaker 1 (05:03):
So it's not for lack of trying. OWA points to
specific barriers.
Speaker 2 (05:07):
Yes, concrete barriers that they say make it commercially and
technically non viable, and for developers listening, understanding these is key.
Speaker 1 (05:14):
Okay, let's break them down. What's the first big one?
Speaker 2 (05:16):
The user base issue. Apple's current setup forces browser vendors
to create a completely new app for their own engine.
They can't just update their existing iOS app.
Speaker 1 (05:25):
Wait, so if you use Chrome on iOS now and
Google wanted to bring its Blink engine, they'd have to
release a separate Chrome app.
Speaker 2 (05:32):
Essentially, Yes, they'd have to tell all their existing EU users, Hey,
ditch the app you're using and download this brand new
Onewa quotes alber Ribera Martinez saying, this destroys the business
case because you abandon your entire user base. It's a
commercial non starter.
Speaker 1 (05:49):
Wow, Okay, that alone sounds like a huge hurdle.
Speaker 2 (05:51):
What else testing for web developers. If you're building a
web app, you need to test how it works on
different browsers. But Apple doesn't provide a way for developers
outside the EU to easily test their sites and web
apps using these potential third party engines on iOS, So.
Speaker 1 (06:06):
It creates a fragmented testing nightmare, especially for global companies exactly.
Speaker 2 (06:11):
And then there's a user security concern. Owa raised Apple
hasn't clarified if browser updates, including security patches will stop
working if an EU user travels outside the EU for
more than thirty days.
Speaker 1 (06:23):
Seriously, that sounds actively harmful.
Speaker 2 (06:26):
Owa argues it actively lowers user's security, which is quite
the claim against a company that emphasizes security so much.
Leaving users potentially vulnerable just because they travel.
Speaker 1 (06:37):
It really undermines the security argument for restricting engines in
the first place. Are there legal hurdles too.
Speaker 2 (06:43):
Yes. Owa describes the contractual terms Apple imposes as harsh,
one sided, and incompatible with the DMA's requirement. Now, Apple
has made a couple of small concessions like what They
now allow an app to support both webcit and another engine,
and they allow to test their own engines outside the EU,
something owas as they initially blocked. But these are seen
(07:05):
as minor tweaks, the.
Speaker 1 (07:06):
Incremental changes that don't address the core viability issues.
Speaker 2 (07:09):
That's Owa's argument, and they point back to the DMA itself.
Articles eight and thirteen require compliance measures to be effective
in achieving the law's goals. They also prohibit actions that
undermine effective compliance.
Speaker 1 (07:21):
So if the measures make it financially unviable in practice,
as Owa claims, then Apple isn't truly complying even if
they've technically allowed something.
Speaker 2 (07:29):
That's the crux of the argument. The lack of any
actual competing engines launching seems to support that view.
Speaker 1 (07:36):
And what about web apps in all this, they're increasingly
important alternatives to native apps.
Speaker 2 (07:41):
That's another major point of friction. Owa says Apple has
given zero indication it plans to let third party browser
engines install and manage web apps like Safari.
Speaker 1 (07:51):
Can, which is odd because didn't Apple itself say web
apps are potentially more secure due to tighter sandboxing.
Speaker 2 (07:57):
They did. They described web apps unboxing as orders of
magnitude more stringent than native apps. Yet instead of sharing
that capability, their initial reaction to the DMA was to
remove the ability to install web apps entirely in the EU.
Speaker 1 (08:12):
They backed down on that after backlash.
Speaker 2 (08:14):
Right, yes, but it showed how determined they seemed to
be to keep control over the app ecosystem, even potentially
hindering a more secure alternative like web apps if it
competes with the app store model.
Speaker 1 (08:25):
Okay, so strong pushback in the EU and now Japan?
What about the UK?
Speaker 2 (08:29):
Similar story brewing there. On July twenty third, twenty twenty five,
the UK's Competition and Markets Authority, the CMA provisionally designated
Apple and Google with strategic market statuses SMS under their
new Digital Markets Law the DMCC, and that gives.
Speaker 1 (08:45):
A CMA more power to intervene correct.
Speaker 2 (08:48):
And in their decision, the CMA specifically called out Apple's
requirement for all iOS browsers to use webcit They stated
very clearly this position will not change unless Apple lifts
its total.
Speaker 1 (08:59):
Prohibition, so they see it as a fundamental block. Do
they comment on webaps too?
Speaker 2 (09:03):
They did. They found that web apps currently are not
a viable substitute to the native apps, precisely because of
Apple's restrictions on their functionality and how easily users can
find them.
Speaker 1 (09:13):
Which for developers listening means web apps can't really exert
competitive pressure on native apps, keeping app store dominance and
fees entrenched.
Speaker 2 (09:20):
That's the implication. The CMA is clearly advocating for strong enforcement,
arguing that weak rules just protect monopolies and harm innovation,
consumers and startups. They even framed it, quoting Luther Low
as aligning with American ideals of fair competition.
Speaker 1 (09:34):
It's framed not as anti Apple but pro competition exactly.
Speaker 2 (09:37):
It's about the market structure, which.
Speaker 1 (09:39):
Brings us to the big question why is Apple resisting
so hard despite pressure from the EU, UK and now Japan.
It must be more than just technical preference.
Speaker 2 (09:49):
Oh, it's absolutely about the money. Billions and billions of
dollars are at stake here.
Speaker 1 (09:54):
Let's tuck numbers. Safari itself.
Speaker 2 (09:56):
Safari is incredibly lucrative. Maybe Apple's highest margin product. They
reportedly get around twenty billion dollars a year just from
Google paying to be the default search engine.
Speaker 1 (10:07):
Twenty billion just for the search default YEP.
Speaker 2 (10:09):
That's estimated to be something like fourteen to sixteen percent
of apps entire annual operating profit from one deal.
Speaker 1 (10:16):
Wow. So if Safari loses market share to other browsers.
Speaker 2 (10:19):
Every percentage point matters. Estimates suggests that for each one
percent browser market share Safari loses, Apple could lose two
hundred million dollars in revenue per year.
Speaker 1 (10:28):
That puts the resistance into perspective. And it's not just
search revenue right, The app store is tied into this massively.
Speaker 2 (10:33):
App store revenue is enormous and growing. Think twenty seven
point four billion dollars in commissions from ninety one point
three billion dollars in sales in twenty twenty four. Now,
consider web apps on desktop, they have something like a
seventy percent share. Okay, if web apps became truly viable
on mobile powered by capable third party browser engines, and
(10:55):
captured even a fraction of that, say a modest twenty
percent shift towards webs on iOS.
Speaker 1 (11:01):
That would mean users bypassing in the App Store.
Speaker 2 (11:03):
From anything exactly, and that twenty percent shift alone could
represent a five point five billion dollar annual loss in
revenue for Apple. So there's a huge incentive to keep
web apps limited and browser engines restricted.
Speaker 1 (11:14):
Beyond direct revenue, there's this strategic lock in factor too,
keeping users tied to the Apple ecosystem.
Speaker 2 (11:19):
Absolutely. The US Department of Justice antitrust case against Apple
makes this point explicitly that Apple's actions reduce interoperability and
increase lock in, making.
Speaker 1 (11:27):
It harder for users to switch phones or use services
across different platforms.
Speaker 2 (11:31):
Right, and they even cited internal Apple emails like one
from Craik Fettere about not bringing I message to Android,
acknowledging it would maintain serious lock in. It's a conscious strategy.
Speaker 1 (11:41):
And finally, Apple's known for its, let's say, robust legal strategy.
Speaker 2 (11:46):
That's putting it mildly. They have a market cap and
the trillions, a legal budget over a billion dollars a year.
Their former general counsel Bruce Sewell was quoted saying the
approach is to steer the ship as close as you
can to that line of non compliance.
Speaker 1 (12:01):
Meaning they're unlikely to make changes that hurt their bottom
line unless forced by very strong, unambiguous regulation.
Speaker 2 (12:09):
That seems to be the historical pattern. Voluntary concessions on
core revenue streams are rare.
Speaker 1 (12:14):
So looking at this globally, it's really important to stress
this isn't just say the EU picking on a US company,
not at all.
Speaker 2 (12:21):
Apple is unique here. It stands alone in enforcing a
ban on competing browser engines. And who's trying to bring
competing engines? Google, Mozilla, Microsoft, all major American tech companies.
Speaker 1 (12:32):
So the fight is about market dynamics, not.
Speaker 2 (12:34):
Nationality precisely, and the momentum is building globally. You have
the EU, UK, now Japan with legislation, the USDOJ case
is ongoing, Australia is looking into it.
Speaker 1 (12:43):
It feels like international pressure is really mounting.
Speaker 2 (12:46):
It is, and if the EU in particular succeeds in
getting effective compliance, not just token gestures, it will set
a massive global precedent. It could reshape digital platform regulation worldwide.
Speaker 1 (12:58):
So wrapping this up, we see this clear conflict Apple's
powerful financial and strategic reasons to maintain its walled garden
versus a growing international regulatory push for openness, competition, and
user choice.
Speaker 2 (13:11):
And for you listening, this isn't just abstract tech policy.
This battleover browser engines directly affects how apps function on
your phone, the potential for more powerful and secure web apps,
your choices as a consumer, and the opportunities you have
as a developer. It impacts the security landscape by influencing
how apps are delivered and updated.
Speaker 1 (13:29):
So here's a final thought to leave you with. As
regulators push for these changes, think about how the outcome
success or failure, might ripple outwards. How could it reshape
the fundamental power balance between giant platforms like Apple, the
developers building apps and services, and us the users. What
could it mean for everything from app cost to data
privacy and the future direction of mobile innovation itself.
Speaker 2 (13:50):
It's a pivotal moment with long term consequences.
Speaker 1 (13:53):
Definitely something to keep watching. That's all we have time
for on this episode of Upgradly Mobile. Remember to check
out our sponsor Approve Mobile Security.
Speaker 2 (14:01):
This discussion was based on human research and analysis with
AI assistance in structuring and refining our points. Join us
next time for more insights into the world of mobile
app and API security.