The Mazy Web She Whirls: starting Open Web Advocacy

There is an organisation called OWA. There is a muse called the Lady of Shalott. They’re both believers in opening the web. And both of them need your help. If you’ve ever wondered (while you’re looking angrily at caniuse) why you are half-sick of drop-shadow(), or why the web is cracked from side to side… your loyal knight and true is here.

If you'd like me to deliver this talk at your conference, get in touch.

Comments on this talk

by which we mean: shameless outright bragging

I’ve seen a fair few conference talks and let me tell you — this was one of the best

an absolute banger of a talk... Never thought one of my favorite poems would somehow crossover with web advocacy, but Stuart has masterfully woven (heh) them together

one of the best talks I've seen in a very long time... a brilliantly constructed 30 minutes. Set aside a lunchtime and give it a watch.

This set the standard for the whole conference

Their work has had an enormous impact… “The web is ours”, Stuart said and anyone who believes the same can join and help out at Open Web Advocacy, or do their own advocacy for an open web. Amen to that!

Lovely talk. Very inspiring and educational

your talk blew me away! ツ Loved it

thx to @sil for combining that intense #tennyson #theLadyofShalott with the #OpenWeb - really great :)

Get the talk

Originally given at State of the Browser 12, Saturday 14th September 2024.

Transcript and slides

In the summer of 1843 Alfred Lord Tennyson published his second book of poems. In it he told the story of a mysterious woman, the Lady of Shalott.

in 1989 and mid 1990, Tim Berners Lee wrote proposals for CERN that became the World Wide Web.

And in August 2021 two Australian brothers, Alex and James Moore, contacted me and Bruce Lawson about how we might talk to regulators about browsers.

(movie voice)
This is their story.
(end movie voice)

I don't know why all this stuff happens in August. I can't even get clients on the bleedin' PHONE in August half the time.

Anyway, hi. I'm Stuart Langridge. And I'm here to talk to you about Open Web Advocacy, both the organisation and the process, and about the Lady of Shalott.

On either side the river lie
Long fields of barley and of rye
That clothe the wold and meet the sky
And through the fields the road runs by
To many-towered Camelot
And up and down the people go
Gazing where the lilies blow
Round an island there below
The island of Shalott.

Willows whiten, aspens quiver
Little breezes dusk and shiver
Through the wave that runs for ever
By the island in the river
Flowing down to Camelot.
Four gray walls, and four gray towers,
Overlook a space of flowers,
And the silent isle imbowers
The Lady of Shalott.

So here, class, we see our first glimpse of the Lady. Beautiful, noble, the envy of all who look upon her, dream of being seen by her, and set apart from others: in her tower, looking down on the people as they look up aspirationally at her.

Remember her. We'll come back to her later.

So I got this message in August 2021 from Bruce Lawson. He said we needed a high-level important business meeting. He said we'd been contacted by two brothers, Alex and James Moore, two Aussies, about talking to the CMA about web browsers.

The CMA are the UK's competition regulator, and they were doing a "Mobile Ecosystems Market Study".

The CMA is a non-ministerial department who ensure that all industries in the UK are competitive – they used to be called the Monopolies Commission, for people who remember that.

They say: We help people, businesses and the UK economy by promoting competitive markets and tackling unfair behaviour. That is: they ensure that supermarkets compete fairly, that nobody creates cartels, that tech isn’t being used to monopolise users and force out new entrants into a market. And this was them looking into “competition in the supply of mobile browsers and browser engines.”, among other things.

They were looking at whether Apple and Google's effective duopoly over the supply of operating systems (iOS and Android), app stores (App Store and Play Store), and web browsers (Safari and Chrome), could result in consumers losing out.

What we wanted to do was make sure that web browsers were front and centre in this discussion.

Let's try a little exercise. This is State of the Browser, so I imagine you all know this one: how many of you know that all web browsers on iOS are actually just skins around Safari? Give me a show of hands. (Posts from Chris Coyier at CSS Tricks, Scott Gilbertson at the Register, Ron Amadeo at Ars Technica.)

You've got Chrome, Firefox, Vivaldi... but they're all Safari's rendering engine.

Slightly harder one: Android doesn't block other browsers, so Firefox on Android is actually Firefox, with Firefox's rendering engine, Gecko. Android supports adding web apps, PWAs, as proper apps, hooray; they show up in the app drawer and all that. The way this is done is with a process called WebAPK minting, where the browser sends the web app off to a server and the server sends back a signed Android app, an apk, for the phone to install. Now, Google has one of these for Android. Samsung has one but for Samsung phones only? How many of you know that only Chrome has access to WebAPK minting? Other browsers on Android do not.

Anyway, so this is what we wanted the CMA to care about. The aim here is to allow browsers to facilitate Web Apps being true substitutes and competitors to native apps.

I was... not confident about talking to a government regulator. I kinda expected that we'd walk in the door and get this.

“Hi, I’m Stuart Langridge, here with Open Web Advocacy?”

“Ah yes young feller me lad! I am Colonel Sir Bufton Tufton and welcome to the CMA. We are here to work out whether there is sufficient competition in ways to (look at piece of paper) SURF the INFORMATION SUPERHIGHWAY. I have a MO-DEM myself you know!”

“Um, ok… perhaps we could start by looking at access to hardware from web apps on mobile phones?”

“Ah yes mobile phones! Actually maybe you can help an old duffer with that! I wanted to set the wallpaper on my Nokia Communicator to be a picture of my favourite horse! But it’s inexplicably the Daily Telegraph! Can you fix it?”

But actually it was not like this at all!

They were smart, plugged in, knew what they were talking about. They asked good questions, were aware of what they didn't know and eager to learn. Turns out that our government can actually do ok! If they create an agency that is independent, anyway.

Happy with that.

And here we come back to our Lady of Shalott, sitting in her tall tower. What was she doing, Lord Tennyson?

There she weaves by night and day
A magic web with colours gay
And as the mazy web she whirls
She sees the surly village churls,
And the red cloaks of market girls
Pass onward from Shalott

She loves the web! Or at least she did, back then, when she started.

Steve Jobs: We have been trying to come up with a solution to expand the capabilities of iPhone by letting developers write great apps for it, and yet keep the iPhone reliable and secure. And we’ve come up with a very sweet solution. Let me tell you about it.

We've got an innovative new way to create applications for mobile devices. It's all based on the fact that iPhone has the full Safari inside. The full Safari engine is inside of iPhone and it gives us tremendous capability. You can write amazing Web 2.0 and Ajax apps that look exactly and behave exactly like apps on the iPhone. And these apps can integrate perfectly with iPhone services.

After you write them, you have instant distribution. You don't have to worry about distribution: just put them on your internet server. And they're really easy to update: just change the code on your own server, rather than having to go through this really complex update process. And they're secure, with the same kind of security you'd use for transactions with Amazon, or a bank. They run securely on the iPhone so they don't compromise its reliability or security. And guess what? there's no SDK that you need!

You've got everything you need, if you know how to write apps using the most modern web standards, to write amazing apps for the iPhone today.

But then a shiny pretty knight arrived. Jewels on his saddle, silver on his bugle, all covered in shiny, tempting gold. And the beautiful Lady, all up in her tower, got distracted by all the gold, and she stopped paying as much attention to the web that she once delighted in.

Let's talk about the patch gap. Everybody has bugs, it's a fact of life in software development and you can't stop it. (If any of you out there DO know how to write code with no bugs in, I will happily buy you a drink this evening to find out how.) So what's useful to look at is not how many bugs there are, but how long they take to fix.

This is data from Google's Project Zero, showing the amount of time between when a bug fix was committed to the public code repository for WebKit, Gecko, Blink, and when that bug fix became available in a browser that real people actually run. So you want this number to be low: towards the left- hand-side of the graph. You want the time between “bug fix goes into git” and “bug fix is in the browser” to be as low as possible, so there’s less chance for it to be exploited.

It's a bit complex though, so let's simplify it a bit: this is the graph for Chrome

and this is the graph for Safari

and to be honest the change here is pretty obvious. As you can see Safari's patch gap is pretty big. Because this is what happens when you de-prioritise your browser: you fall behind. But you don't have to deprioritise your browser. And these are old statistics: this patch gap graph ends in 2021, which is AGES ago. Internet years are like dog years; they go past way fast.

In 2021 we were all still into AIR FRYERS, can you imagine? It says in my script "OMG, I can't even" but I didn’t write that. I don't even know what it means. Anyway, what’s happened SINCE 2021?

This is a list of CVEs, security issues, in browsers over time. Again it's a bit complex, but it does have data right up to the present day. What this is showing is the number of security issues, for each browser, in each year. So being high up the graph is bad; that means you had more bugs. Being low is good.

If you look at this you can see that Firefox is pretty much somewhere in the middle, like this. That’s how a browser maker might be expected to do, there. So we’ll call that our baseline.

If your numbers are low, then you’re doing better than Firefox, so you’re doing OK. If you're doing worse than Firefox, having more security issues, then maybe there's something there to look at. So let’s take a trip to Planet Chrome.

oooh. Chrome just about managing to keep pace with a team with one one-thousandth of their budget there, but it's all gone a bit wrong recently.

Safari, though...Safari WAS pretty high some years ago, but in recent years they've got a LOT better. Now, you can take a lot of issues with these figures -- seriously, this is only one number, and boiling things down to one number is not very representative, so bring in a huge bin lorry full of salt before making decisions on only one metric. But I think it's fairly obvious that something's changed, especially with Safari's attention to detail. What prompted that? Well, it could be a lot of things, of course.

But I think it's reasonable to suggest one possible cause: As mentioned, in 2021, the CMA started their Mobile Ecosystems Market Study.

Right here. and they weren't the only ones. A whole bunch of tech regulators around the world finally got on board and started asking questions about browsers around that time, and browser diversity, and what limits on browsers are reasonable, and whether it's OK for an operating system maker to dictate which browser must be used. And... change started to happen at the same time as that, at the same time as regulators in the UK and the EU and around the world started asking questions; that's why we started talking to them, after all.

It's a similar story in other places; look at the Interop figures. Interop can be a bit contentious because what counts as an interoperable thing to be tested for is a complicated process, but the numbers don't lie: in 2021 Safari were behind

and in 2023 they aren't. (They are behind again in 2024 but 2024 ain't over yet, so it's not really fair to show those figures, so I won't.) But there certainly seems to have been a change in attention paid, at about the same time as investigations started happening. There must be some short, pithy way to sum that up. I can't think of one. But when I want short pithy summaries of tech stuff, I know who I turn to: Alex Russell!

This is the power of just the threat of competition.

Our little gang of folks started to grow. More people joined, and helped out, and became part of it.

We'd come together enough to give ourselves a name: Open Web Advocacy.

We talked to regulators all over the world about this stuff, in the UK, and the European Union, and Australia, and the US, and Japan. And we called upon the web developer community for help. And the regulators listened, and the community answered. And all this started to have an effect.

And let’s be clear here; this isn’t just about Apple banning other browsers. The regulators are investigating big tech companies as a whole, for all the things they’re doing wrong. And Google are a long, long way away from being an innocent party in this. Tracking people even in incognito mode, hidden extensions that work on Google sites, Google properties pushing Chrome. Regulators do not like this, and rightly so. Microsoft’s habit of wedging “hey why not run edge” into every bit of Windows is also known. I could do a whole separate talk on in-app-browsers and the shenanigans that go on there from Meta and Tiktok. Apple fans tend to push a line that they are the last lonely line of defence against Chrome taking over entirely. This isn’t true: it hasn’t even happened on macOS, where there’s free browser choice and a third of people still use Safari. But there is truth in it.

And given all this, the regulators... started regulating. No, says the European Union, it is not reasonable for you to require that there's only one web browser. The web is about diversity. That's how we stop one company taking it over, by stopping all companies from using their existing money and market share to push out competition. No, Google, you can’t steer people towards your own services. No, Meta, you can’t charge people if they won’t give you their personal data. And no, Apple, you can’t exclude all browsers from your phones except your own.

and the clues were all there in Tennyson! This is William Holman Hunt's picture of our Lady while she's being distracted by the shiny gold of the knight.

wonderful for details, Hunt. This is Hercules, capturing the golden apples of the Hesperides, his 11th labour. Hercules the hero, representative of humanity.

Here he is trying to SAVE THE APPLES, but there was a guardian serpent in the way. Hey, I didn't make this stuff up, it's right there in the painting. Can't argue with that. Because the guardian serpent tries to BITE BACK.

Yup. In February this year, Apple declared that there would no longer be home screen web apps on iOS. From now on, everything that used to be a web app was a bookmark; it would open in a Safari tab and not like an app; it would have no privileged access. This is a pretty long step away from the web. I mean, at first we assumed this was a bug, because they wouldn’t actually do this, would they?

She left the web
She left the loom
she made three paces through the room
she saw the waterlily bloom
she saw the helmet and the plume

This did NOT go down well. Most of you here will likely remember this furore. People were furious; pushback in every possible realm. Articles in every tech media outlet. Anger on all sides. You rouse the voice of the web, and you’ll hear it loud and clear.

Out flew the web and floated wide
The mirror crack’d from side to side
The curse is come upon me, cried
The Lady of Shalott.

At OWA we wanted to be sure that all this web developer feedback, how betrayed people felt, we wanted to be sure it wasn't ignored, that it couldn't be dismissed as "a few loud voices". So we put together an open letter, and invited people to sign it.

And people did sign it. Four thousand people. MEPs, 400 different companies, people from a hundred countries literally all across the world. Nobody wanted this, and everybody stood up to say so. I would have sworn that the only thing you could get 4000 web devs to do at once was get the syntax of clip-path wrong, but no. I bet a good chunk of people in this room signed the open letter, and here and now I shall say: thank you. You made your voice heard.

And it WAS heard. Because Apple, one of the world's richest companies, heard our voices and... they backed off!

They completely reversed the decision. The ban on PWAs... wasn't. "Developers and users who may have been impacted by the removal of Home Screen web apps in the beta release of iOS in the EU can expect the return of the existing functionality for Home Screen web apps with the availability of iOS 17.4 in early March."

You ask for miracles, Theo, I give you the OWA.

And it’s working.

The Verge says that the iPhone is now “more fun” in the EU.

Federico Viticci at MacStories says “I personally feel like the “DMA fork” of iOS is the version of iOS I’ve wanted for the past few years. It’s still iOS...a more flexible and fun version of iOS predicated upon the assumption that users deserve options to control more aspects of how their expensive pocket computers should work.”

Jason Snell at MacWorld says “Yet, when I consider everything being experimented with in the EU, I start to wonder if the envy is actually going to flow in the other direction.”

lots of people speak to the regulators. Some speak for their own company, some for their government, some for their product. But who speaks for the web? We do. I don't mean we, OWA, although we do, but we, us, here in this room, and in rooms like it.

The web is ours. "The web is woven curiously", as Tennyson tells us, in the poem. Someone needs to stand up for curiosities, to help the corporations and the money men and the governments understand why the web is great because it's ours, and that's where you can help. OWA doesn't need money, and we don't want medals: but what we do need is support. We always need more documents reading, more papers writing, more awareness, more staying on top of everything that's going on, more spotting of malicious compliance, and that is something you're all well qualified for. But this isn't a recruiting pitch; OWA isn't the only way here. You can do your own open web advocacy! Everyone in this room understands why the open web unlocks doors, why it can work for everyone, everywhere, why this thing we made together is the biggest and best collection of information and exhibitions and joy that the world has ever known. But not everybody is as enlightened as you.So we need to help people understand.

This is Johannes Ernst: The open web is amazing. So we keep saying in our little subculture, and outside that subculture we’re generally met with incomprehension . IMHO that's because we are not saying why the open web is amazing. I think it all boils down to: "on the open web, I can be much more creative, with minimum expense, than elsewhere, and so easily share my creations with the world."

So write about the web. Build things on the web, in the web, OF the web. Help people understand. That includes tech regulators. When they ask for input, and you give it, they really do listen.

So the Lady of Shalott stepped away from the web, turned her attention to the shiny gold of the knight, and the curse came upon her.

A longdrawn carol, mournful, holy,
She chanted loudly, chanted lowly,
Till her eyes were darken'd wholly,
And her smooth face sharpen'd slowly,
Turn'd to tower'd Camelot:
For ere she reach'd upon the tide
The first house by the water-side,
Singing in her song she died,
The Lady of Shalott.

But, you see, the curse doesn't have to be real. The Lady of Shalott stepped away from the web to her doom, but she didn't HAVE to. If she'd have had the foresight -- and the poem says! like some bold seer in a trance, seeing all his own mischance -- if she'd had the foresight to know what would happen, then maybe she wouldn't have done it.

If only someone had told her ahead of time, shown her. She could have embraced the web. Made it better; put all her undoubted skill into weaving the web, not hiding from it, trying to put it down. Well, here we are, ahead of time. Don't step away from the open web: embrace it. Come down from the tower and meet the people, instead of looking down on them.

If you'll excuse the sheer hubris, and if you listen you can hear Queen Victoria's own Poet Laureate turning in his grave, this is how I wish the poem had ended. Because it's not too late.

This need to win, her soul devours
Decided she to use her powers
Grow the web, to fill the towers,
Join the folks at Camelot
We birthed establishment defiance
So stop malicious rule compliance
We win when they have self reliance
The people of Shalott
Stop looking for more cash to trouser
And listen, if her pride allows her
To what she’d learn at State O’The Browser!
She’d love you folks a lot!