Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Isn't UIWebView a component written by Apple? Why not include Nitro in it? Why would it be a security issue on Chrome but not on Safari? Do people have access to the UIWebView source code? If not, this "security" reason is BS.


Third-party processes on iOS cannot mark data pages as executable, which is a great security feature but it prevents JIT compilers or any other technology that dynamically generates machine code. Apple's built-in apps have an exception to this security mechanism, presumably because Apple is more confident in their own security auditing of those apps. Perhaps with some sandboxing mechanism and/or code auditing process they could allow some third-party apps similar access in the future, but it's not clear whether they feel a need to.


> Third-party processes on iOS cannot mark data pages as executable

Doesn't the UIWebView do that for you? And isn't it written by Apple? Why couldn't Apple make it use Nitro? Not sure where the security risk would be.


The restriction on executable pages is enforced by the kernel at the process level. This particular mechanism won't allow for enforcing diffeerent policiees for UIWebView code running in the same process as app code. If UIWebView could run JavaScript code in a separate process like Chrome then it might be possible.


I thought Safari implemented multi-process a long time ago, not on mobile?




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: