Yeah, I think I disagree with the author. Unless someone can think of a reason it should be like this, I think it's Apples' fault. If there's a reason to allow no-confirmation telephone or facetime initiation, they should make it an option on WebView.

> I never said I agree with Apple, I think it's a extremely bad default.

You did say this, though, which is what GP is responding to:

> Who did the mistake?

> Well Apple did not. People didn't read the documentation at all.

If the default is this bad, having it in the documentation is not an excuse.

Especially since this is in the documentation for handling phone links, and the exploit explicitly affects apps that do not utilize/customize this functionality.

You can't say it's the developer's fault for not reading the documentation for a feature they never wanted to use in the first place.