Wednesday, November 4, 2026

Safari 27.3: Adaptive Dark Mode

When enabled by a user, Safari adapts light websites and presents them as dark.

[…]

At the core of Adaptive Dark Mode is the transformation of color. Sometimes colors are simply decorative, while other times they have semantic meaning. Adaptive Dark Mode determines when to invert colors so elements remain visible or when to leave colors unchanged.

While creating Adaptive Dark Mode, we developed a color matrix to invert the luminosity of colors while preserving hue. It’s used to make light backgrounds dark, and dark text light. When transforming text color, Adaptive Dark Mode aims for sufficient contrast as defined by the WCAG 4.5:1 contrast ratio. Light CSS gradients are also transformed to dark.

[…]

It takes the same care with images. Most are left unchanged, preserving their integrity. But many icons and logos can lose contrast when the background color behind them is inverted. So Adaptive Dark Mode inspects SVG images and transforms colors when needed. For bitmap images, it analyzes the pixel histograms and inverts simple black-and-white logos.

Federico Viticci:

If this sounds familiar, it’s because so many third-party Safari extensions for this very task already exist, including the very popular (and a MacStories favorite) Noir.

Previously:

Color CSS Dark Mode iOS iOS 27 Mac macOS 27 Golden Gate Safari Web WebKit

Comments

Safari 27.3: Vertical Tabs

Jason Snell (MacRumors):

In recent years, numerous browsers have experimented with re-orienting the traditional top-of-the-page tab bar into a vertical stack, and now Safari is joining the parade. (It makes sense, when you think about it, because most of our screens are much wider than they are tall, putting vertical space at a premium.

Vertical tabs aren’t a default, but they are now a new option. The tabs sit on the left sidebar as a strip of icons by default, but if you prefer you can resize the tab bar to also show tab titles. On the Mac, Apple has built a hover effect reminiscent of the macOS Dock that displays the name of the tab when you move the pointer over its icon, and if you pause and hover, it’ll display a floating window with a visual page preview.

John Gruber:

I got an advance demo of this last week and I’m really looking forward to trying it. I’ve gotten very used to horizontal tabs over the years, but a long time ago I was a devoted user of the Omni Group’s OmniWeb browser, of which one of my favorite features was its vertical tabs. That was so long ago, the tabs went in a drawer.

I liked this in OmniWeb and also in NetNewsWire 3, which had vertical thumbnail tabs on the right side of the window.

Ron Stewart:

Hopefully, allowing the vertical stack of tabs to be positioned on right side isn’t far off, too. Chrome, Firefox, Vivaldi all support it, and - as a right-handed user - it feels much more natural to me.

Brave also added vertical tabs a few years ago (Hacker News).

Adam Engst:

But now that I’ve become a complete convert to the wonders of vertical tabs, I’m seeing them everywhere. Or perhaps the industry has hit some sort of intersection between users clamoring for the option and browser makers gaining the gumption to brainstorm better interfaces. Whatever the reason, if you’re not using vertical tabs now, I’d encourage you to try them, either in your current browser or one of the newcomers mentioned below.

Francisco Tolmasky:

Every app should have both vertical and horizontal tabs. Neither one is better, they’re for different things. Vertical tabs display “everything” in the current context, while horizontal tabs show your “current focus”. IDEs get this right, just about everything else doesn’t, from browsers to Messages to Slack. Messages is a great example, it would be so much nicer on the Desktop app to have my “favorites” just as horizontal tabs instead of pinned bubble faces in my “every conversation ever” list.

Previously:

iOS iOS 27 Mac macOS 27 Golden Gate Safari Web Browser

Comments

Binance Heist

Rafael Nam:

The massive $6.3 billion cyber heist suffered by crypto exchange Binance last week may have taken place in only about twenty minutes — but the attacks were months in the making.

That’s according an initial assessment released by Binance on Tuesday about how it suffered the world’s biggest-ever cyber heist by hackers the FBI has identified as being a North Korean state-sponsored unit.

Molly White:

At least $5.5 billion of these were liquid assets. Tether announced they had frozen at least $1.567 billion of the stolen USDT, and Circle has frozen around $800 million of stolen USDC. World Liberty Financial froze the $27 million in USD1 stolen by the attacker, and the Arbitrum ethereum layer-2 network froze an additional $30.5 million that had moved to its network. The attacker is estimated to have made off with between $2.4 billion and $3.4 billion.

Binance founder Changpeng Zhao, who is legally not allowed to have any active role with the company [I98] yet still has remarkable amounts of inside knowledge into its inner workings, posted on Twitter less than an hour after the theft that “User funds are safe!”, adding early estimates of how much Tether and Circle had frozen.

[…]

Binance keeps an emergency insurance fund in case of exploits or other crypto disasters. Its most recent balance report puts it at around $1.3 billion. Unless more is recovered, Binance will either fail to make users whole or dip into its own balance sheet — potentially to the tune of 10 figures.

Jessica Lyons (Hacker News):

In September, another software engineer was contacted via a “legitimate job-hunting platform” by someone purporting to be a project director who arranged a series of job interviews for the Binance engineer with the fake company. During the first round - a live video interview with the engineer and a fake HR rep - the interviewer “shared a social media account with him, including personal photos and videos posted on the platform, in order to build trust,” according to the report. “This was more advanced and deceptive than previously seen social engineering approaches.”

The second interview with someone purporting to be the CEO of the phony company was conducted on a “popular social chat app,” and toward the end, the CEO instructed the engineer to download an “assignment” containing a malware-laced code repository. The code executed on his work computer during the setup process, which kicked off a series of unauthorized activities.

According to Binance, the malware replaced a legitimate development tool component with a malicious version, which executed commands and established communication with an attacker-controlled external server. The attackers also took steps to hide the malicious script and evade detection, and it worked. Binance’s endpoint security tools did not immediately detect the malware.

gandreani:

A lot of people are focusing on how irresponsible the engineer was about using the work computer. That’s obviously an issue but the bigger failure mode to me is the Engineer C’s container deployment token.

That’s a huge red-flag. In a company of this size, the deployments should be via CI only. CI isn’t just to increase the speed and reliability of deployments but also to provide a clean room to build the software! Even if it’s a token that was copied and pasted temporarily, the systems in place should not have to require this type of 1. copy 2. paste 3. remember-to-delete the token from my PC.

Bitcoin and Cryptocurrency Breach Federal Bureau of Investigation (FBI) Financial Hiring North Korea Security Web

Comments

mSecure Breach

Carly Page (Reddit):

Password manager mSecure has warned customers to change their passwords, reset two-factor authentication, and potentially remove their passkeys after detecting suspicious activity, but it has not explained what happened or whether anyone’s secrets were exposed.

[…]

For anyone with hundreds of passwords stored in mSecure, that’s potentially hours of work. And without knowing what happened, customers have no way of telling which credentials they actually need to replace.

The warning has understandably gone down poorly with customers, who have taken to mSecure’s support forum demanding answers.

Previously:

Breach Mac Mac App macOS 27 Golden Gate mSecure Passkeys Passwords

Comments

Tuesday, November 3, 2026

Apple’s Q4 2026 Results

Joe Rossignol:

John Ternus will participate in his first Apple earnings call as the company’s CEO today

Apple (transcript, Hacker News):

The Company posted quarterly revenue of $114.5 billion, up 12 percent year over year. Company gross margin was 47.9 percent, including a favorable impact of approximately 1 percentage point from tariff refunds.

[…]

“Our record September quarter capped off a strong fiscal 2026, with all-time record revenue of $479 billion and double-digit EPS growth,” said Kevan Parekh, Apple’s CFO.

Jason Snell (MacRumors):

iPhone revenue was up 17.5%, Mac revenue was up 23.7%, and Services revenue was up 9.8%. Wearables revenue was down 7.9% and iPad revenue was down 10.4%.

Jason Snell (MacRumors):

Apple CFO Kevan Parekh said it was the best iPhone year in every single Apple geographic segment.

Meanwhile, the Mac—a 42-year-old product!—had its best year ever. Interestingly enough, it wasn’t in total revenue (2021 still holds that record), but in total units.

[…]

Obviously, Apple sees iCloud+ growth as a new place to drive Services revenue.

[…]

This is the reality of Apple’s business right now: It has raised prices across the board, and it’s eating margin.

Newton Gitonga:

Apple is about to feel the squeeze from rising memory prices, with the cost of RAM climbing just as the company heads into its busiest shopping season. According to Reuters, Apple expects to pay more for memory in the December quarter, with the CEO, John Ternus, describing the current price increases as “unprecedented.”

[…]

But that cushion is getting thinner, and Apple expects memory purchases to become even more expensive into 2027.

Stephen Nellis (Hacker News):

Apple said it expects gross margin of 45% to 46% in the quarter ending in December, down from 47.9% in the fourth quarter. It forecast services revenue growth of 8% to 9%, below analysts’ expectations of 10.7%.

The Guardian (Hacker News):

While its rivals are facing investor uncertainty over huge investments in artificial intelligence, Bourne said Apple’s “tepid approach” to AI infrastructure spending had helped preserve its cashflow – while partnerships with companies such as Alphabet could help the iPhone maker strengthen its AI capabilities without taking on the same financial risks as its peers.

Hartley Charlton:

Apple’s research and development (R&D) spending increased by $11.22 billion in fiscal 2026, reaching $45.77 billion, according to the company’s financial statements.

[…]

Apple previously linked its growing development budget to AI. During its April earnings call, CFO Kevan Parekh said AI investment would come on top of spending already planned for Apple’s product roadmap.

Previously:

Apple Apple Quarterly Results Apple Services Artificial Intelligence Business iCloud+ iPad iPhone John Ternus Mac MacBook Neo

1 Comment

Microsoft Workforce Buyouts Amid Record Revenue

Satya Nadella:

Fiscal year 2026 was another record year for the company. Revenue was $331.8 billion, up 18 percent year-over-year. Microsoft Cloud revenue was $214.4 billion, up 27 percent year-over-year. Azure grew 41 percent year-over-year and surpassed $100 billion for the first time, while Microsoft 365 Copilot reached over 30 million paid seats. And operating income was $155.2 billion, up 21 percent year-over-year.

Microsoft:

Microsoft Corp. today announced the following results for the quarter ended September 30, 2026, as compared to the corresponding period of last fiscal year:

Revenue was $92.3 billion and increased 19%

Operating income was $45.9 billion and increased 21% (up 22% in constant currency)

Prosper Junior Bakiny:

Microsoft debuted a new reporting structure with two segments this quarter. The first, Agents and Infra, did most of the heavy lifting. Revenue from this unit was $76.8 billion, up 25% year over year. Microsoft Cloud revenue jumped 30% year over year to $63.9 billion, while Azure revenue grew 48% year over year to $33.2 billion.

Alex Halverson (Hacker News):

Microsoft only expects a fraction of the 60,000 employees who received buyout offers Monday to accept those packages and leave the company.

[…]

The buyouts, which cover roughly a quarter of the company’s workforce, come as it tries to control its labor costs while avoiding layoffs.

AbbeFaria:

Ex-MSFT here. I resigned in June, I was an L63. I spent 8 years at MSFT across two stints. My last 18 months at MSFT were deeply unproductive. Constant reorgs, the work not being aligned to my capabilities and unfortunately just the general feeling that I was under worked and had very little opportunity for career advancement.

[…]

In the end, I left off my own volition. In my last 6 months, I did very little work, if at all any. I thought why am I being paid so handsomely for such little and trivial work. I did try interviewing in a few different teams but didn’t make it (Azure Files and Hyperscale DB). If I had stayed, I would have been swiftly laid off or if I was lucky enough last long till this buyout.

Dare Obasanjo:

Earlier this year, Microsoft offered voluntary retirement to 8,750 employees. About 2,625 (30%) accepted.

It then laid off another 4,800 employees in July, followed by hundreds more in September.

Dare Obasanjo:

A high performer at Microsoft (200/200 means they got 200% of target bonus and stock compensation) was advised by their manager to take the voluntary retirement program.

Assuming the previous 30% acceptance rate, Microsoft needs 18,000 people to leave the company. There will be layoffs otherwise.

Previously:

Artificial Intelligence Business Layoffs Microsoft Working

Comments

Amazon Changing AI Strategy

Eugene Kim:

Amazon is overhauling its AI strategy, winding down many in-house models, reorganizing teams, and focusing engineers on a new strategy to compete at the frontier, according to people familiar with the matter.

The changes follow layoffs in Amazon’s Artificial General Intelligence, or AGI, organization last week and the shutdown of AGI Lab, a research group it created in 2024 after hiring most of the team behind AI startup Adept.

Joe Wilkins (Hacker News):

Instead, labor and computing power are being diverted toward a singular “frontier-model effort” led by Pieter Abbeel, director of the Berkeley Robot Learning Lab whose robotics company Covariant was hoovered up by Amazon in 2024. At the time Abbeel joined the tech giant, Covariant’s founders were working on AI models for robots, which lines up pretty well with Amazon’s push to automate everything it possibly can.

News of the shift in Amazon’s strategic focus comes a week after it closed one of its key AI offices in San Francisco, an 80-person site specializing in research on artificial general intelligence, the supposed next-level of AI development where the tech obtains human-level intelligence and reasoning skills.

Corey Quinn (Hacker News):

Conveniently, this week Amazon published a treatise by Terk Terkowitz, a VP/Distinguished Engineer/Final Boss of Their Independent Contributor Technical Career Track, on the role of the developer in the age of AI.

[…]

The memo says “If your work does not benefit from current AI tooling, that is a finding, not a failing.” Document it, bring it to your manager, work through the problem. I agree with every word of that! The question is whether anyone’s promo doc is gonna survive citing it.

Here’s what happens next. The memo concedes that input metrics are “deeply flawed,” but then in the next paragraph says to go ahead and use them anyway, carefully. It then warns that non-adopters are falling behind. Those are three different positions within three sentences and they’re not at all aligned with one another.

Previously:

Amazon Artificial Intelligence Business Layoffs Working

Comments

Lost Access to 1Password Mac Apps

Charles C Counselman III:

About 15 seconds after it was launched, it would quit because, it said, I had done nothing for 60 minutes. After this had happened several times, consistently, l went to 1Password’s Support website. I read all the info and advice there, but I found nothing relevant, so I e-mailed support@1password.com. I got a reply saying, yes, that happens when you migrate to a Mac with Apple Silicon. You must uninstall 1Password, then download and install the latest version.

[…]

The fresh version of 1Password exhibited the same bug.

[…]

I launched 1Password on [my old] Mac. It opened and declared that it could not do anything for me because my account had been closed. I had not closed my account, at least not deliberately.

[…]

After more than 72 hours, AgileBits has not replied to my bug report and request for help.

He is able to access the passwords via Safari, so I guess the message about his account being closed was in error. It’s still possible to use passkeys, as the browser extension can talk to the 1Password server without needing the app.

I still miss the 1PasswordAnywhere feature, which let me access all my passwords locally, without relying on an app.

Previously:

Update (2026-11-04): rckingsley and others in the 1Password forum are seeing a similar issue:

For me, the macOS 1Password app (not the extension in the browser) automatically locks after 10 seconds of being unlocked - even though under the password (to unlock 1Password) it says “1Password locked after 10 minutes of activity”.

I’m running macOS Golden Gate 27.2, and 1Password for Mac 8.12.42.

[…]

Fortunately, the 1Password extension in Safari stays open, so I can copy the password from there (for doing things with different macOS apps that require a password). However, I don’t have access to my Favorites, cannot create a backup .1PUX file quickly enough, and other tasks where the browser extension isn’t appropriate.

Charles C Counselman III:

More than four days – 96 hours – have elapsed since I reported this bug to AgileBits and requested help. I am still waiting for help.

[…]

MacDrew2000, thank you for suggesting that I try to access my 1Password account via the 1Password app in my iPhone. I tried, but all I got was an error message saying that my account had changed.

Doug Hogg:

1Password invited me to activate “A native macOS AutoFill Experience”.

1Password Customer Support Datacide Mac Mac App macOS 27 Golden Gate Passkeys Passwords

7 Comments

Monday, November 2, 2026

Golden Gate Does Not Actually Support CoreStorage

Wade Tregaskis:

macOS 15 Sequoia had a hard time with CoreStorage and HFS+ volumes, since it deprecated both technologies and callously crippled some important tools for working with them, but nonetheless it mostly still worked.

[…]

Not only does Golden Gate just not support CoreStorage or HFS+ volumes, out of the box you can’t do anything with them – can’t mount them, can’t convert them to APFS, can’t even erase them. It renders your expensive storage hardware completely useless.

Worse, macOS 27 puts up a misleading dialog, upon boot, saying that macOS 28 (the next version) won’t support these volumes. I have no idea what Apple’s doing or thinking. Maybe it’s all just an embarrassing misunderstanding – the file system team told the notifications team that CoreStorage & HFS support is gone, and typoed the version number as 28 rather than 27?

Apple also wrote an article this summer saying that CoreStorage volumes would be supported in macOS 27 and that unencrypted HFS+ would be supported in macOS 28.

Tregaskis says that macOS 27 does not support “CoreStorage or HFS+,” but in my testing plain HFS+ volumes do work.

Previously:

Sunsetting CoreStorage

Update (2026-11-04): See also: Hacker News.

Disk Utility File System HFS+ Mac macOS 27 Golden Gate Storage

6 Comments

Missing Logger Symbol on macOS 15

Jeongki Park:

The SDK marks Logger.isEnabled(type:) as available since macOS 11, but macOS 15.6.1’s libswiftos doesn’t have it.

[…]

For four days [my app] quit at launch on macOS 15, and I didn’t know.

[…]

OSLog has its own isEnabled(type:), which goes to the C function os_log_type_enabled, there since macOS 10.12. So I keep an OSLog handle, make the Logger from it, and ask the handle[…]

Previously:

Ending the Golden Era for Backward-Compatible Apps

Mac macOS 15 Sequoia os_log Programming Swift Programming Language

Comments

Anthropic S-1

Carly Page (SEC, Hacker News):

Anthropic has filed for an IPO that could rank among Wall Street’s biggest ever, revealing an $80.7 billion half-year loss, a startlingly complex governance structure, and warnings that its AI models could blackmail humans, resist shutdown, or create “existential risks” to society.

[…]

The Claude maker reported $16.3 billion in revenue for the first six months of 2026, up from $1.2 billion a year earlier. It also posted a whopping $80.7 billion net loss, although $72.4 billion of that was an accounting adjustment tied to the company’s soaring valuation, not money it actually spent.

Anthropic’s operating loss was considerably smaller at $693 million, down from $2.1 billion a year earlier. By its own adjusted accounting, the company made a $1.6 billion operating profit in the first half of 2026, for a margin of around 10 percent.

[…]

The seven co-founders will retain 50.1 percent of the voting power on shareholder matters, while a separate Long-Term Benefit Trust will get to appoint a majority of the board. In other words, Wall Street is being invited to bankroll Anthropic’s AI ambitions, but not necessarily to call the shots.

Brandon Vigliarolo:

Anthropic is going to need to do a lot to make its massive IPO more than just a flash in the pan[…] For one, the company has nearly a trillion dollars in compute commitments to pay for, which is going to mean it’ll be burning through more cash than a datacenter gas turbine turned up to 11. In addition to its massive spending for the foreseeable future, there’s also the fact that much of its computing power relies on customers who are also competitors.

Ashley Capoot (Hacker News):

Anthropic reported updated financials as part of an amended Form S-1 filing with the Securities and Exchange Commission on Monday, giving investors a more comprehensive look into the state of its business.

The artificial intelligence company said it generated $33.24 billion in revenue for the nine months ended Sept. 30, up roughly 1,200% from the same period last year. It reported a $104 billion net loss during the period, though most of that was due to the change in fair value of convertible notes and derivative liabilities. Anthropic had a loss of $25.1 billion over the same stretch in 2025.

[…]

During its third quarter, Anthropic generated roughly $17 billion in revenue, up about 1,127% from the same period last year. Revenue growth slowed on a quarter-to-quarter basis, however. Third-quarter revenue increased around 47%, a steep drop from 144% growth in Q2 and 132% in Q1.

The company reported a net loss of $23.29 billion during its third quarter.

Previously:

Anthropic Artificial Intelligence Business Claude

2 Comments

Ed Zitron’s AI Predictions

Tommy Craggs:

In his day job, Ed Zitron runs a boutique public relations firm called EZPR. This might surprise anyone who has come to know Zitron through his podcast or his social media or the newsletter in which he writes two-fisted stuff like “Sam Altman is full of shit” and “Mark Zuckerberg is a putrid ghoul.” Flacks, as a rule, tend not to talk like this. Flacks send prim, throat-clearing emails to media people who do, on rare occasions, talk like this.

[…]

We were talking about whether any of Zitron’s ranting about the AI industry had cost him business on the PR side of the ledger. He said no.

[…]

He has built an improbable little empire for himself out of tart commentary like this. His weekly podcast, Better Offline, about “the tech industry’s influence and manipulation of society,” has cracked Spotify’s top 20 among tech shows, and his newsletter, Ed Zitron’s Where’s Your Ed At, has grown north of 80,000 subscribers. The Ed Zitron media experience also includes a scrappy Bluesky account, a football podcast, some occasional baseball writing, a lot of to-and-froing with the users of r/BetterOffline, and a book due next year about, as he puts it, “why everything stopped working.” In other media, he has become a go-to source for AI naysaying. When Slate’s What’s Next: TBD podcast or WNYC’s On the Media needed someone to talk about the bursting of the AI bubble, they called on Zitron. It isn’t just the volume of output that has put him on the map; it is the aggrieved style that he brings to criticisms of media figures and industry titans alike.

Nick Heer:

Each of Zitron’s articles is an impenetrable wall of text often reaching into the tens of thousands of words. This volume of material feels substantial — it can be substantial — to the extent Zitron explicitly markets his newsletter on the basis of its word count. Weird. He explores basically two major themes: A.I.’s economic case, and its usefulness. Zitron is zealously opposed to the possibility of either in real terms; while he will occasionally gesture at people or businesses doing something with A.I., his default position is more-or-less that it has little use.

Dan Luu (Mastodon, Hacker News, Kyle Hughes):

I was curious how well the predictions of the most widely cited AI skeptic I’ve seen (Ed Zitron) have done, so I looked at how his predictions panned out. To disclose my own biases, I’ve never had a particularly strong pro or anti AI progress position. For example, in 2022, I did a comprehensive look at predictions Futurists made, including well-respected folks like Kurzweil and found them to be generally wrong on both the prediction results as well as the reasoning. On the flip side, in 2015, I wrote about how people were underestimating AI’s ability to displace humans in jobs and have repeatedly been on the record as saying that many people are underestimating AI’s ability to displace humans from jobs. My position on AI has been extremely boring and is basically, “if something is currently happening, the people who are saying that it’s impossible that it will ever happen are probably wrong”.

[…]

Zitron says Cursor is dying and expects that it will sell for a firesale price; a price as high as $10B is not plausible [It sold this year for $60 billion.]

[…]

In response to the question, “If you had to guess, what is the timeline we are looking at for the AI bubble to pop?”, Zitron answers, “No later than Q2 2026"

[…]

After this point, most further predictions that I saw were either non-falsifiable or resolve in the future. Note that I didn’t attempt to catalogue statements that are nonsensical or were simply factually incorrect statements at the time, such as his December 2024 claim that “Generative AI’s products have effectively been trapped in amber for over a year” or his January 2026 claim that “[models are] basically the same as they were a year ago. They have the same efficacy”. Zitron has not only made forward-looking statements that AI capabilities will not improve, he’s also consistently made backwards-looking statements that capabilities have not improved which, while obviously false at the time, seem to play well to his base (along with his other false statements). If you connect all his statements together, it’s implied that AI had the same capabilities in January 2026 as they did in December 2023 (and if you connect later statements, it’s actually implied that capabilities in August 2026 are the same as in December 2023, though to be fair to Zitron he frequently contradicts himself and has also admitted to limited improvement in mid 2026).

Nick Heer:

The beauty of Zitron’s voluminous output, for him, is that there is a vast difference between what he actually writes and what people remember. Financial experts and more reputable journalists have raised plenty of concerns about how much money is being spent on developing this infrastructure, and how highly these companies are valued. But the words Zitron writes are far more incendiary and conspiratorial than many seem to remember. It is frustrating to see his many media experiences filling the role of the A.I. skeptic when there are far more qualified, sober, and accurate options. We have enough boosters; this is an industry that is co-signed by the world’s most powerful economies. We deserve better A.I. criticism in popular media.

yousif_123123:

Things in general I think he’s right about:

Revenue if anthropic and openai is unlikely to grow to the high levels they need to pay for their commitments. Many of their heavy users (coding) will eventually offset a lot of usage to more efficient and cheaper open weight models. I know of people in a company I was at that spend thousands of dollars a month on tokens. I am sure that what they’re using it for can be substituted in large part by way cheaper models.

A lot of corporate AI usage is being pushed by management that doesn’t really understand the extent of its useful, and just wants to call themselves an AI-first company.

If this datacenter build-out proves to be beyond the actual demand, there might be a big economic crisis as to how much of the financial system is getting tied up with it (insurance money, private credit).

Whether openai and anthropic actually die, I’m not sure. But I don’t think they’ll be the next big tech companies. I think eventually they’ll be absorbed by others.

The whole thing I think, can be summarized as: LLMs will be commodity like. And it’s price will go down and eventually will run locally, it’s not at all clear that this will bring AGI and that it’s worth infinite amount (or trillions) of investment ahead of the actual demand or the AGI level do-it-all-for-you AI being reached.

Previously:

Anthropic Artificial Intelligence Business Cursor OpenAI Oracle The Media

4 Comments

Friday, October 30, 2026

Xcode 27.2

Apple (xip, downloads, Xcode Releases):

Xcode 27.2 includes Swift 6.4 and SDKs for iOS 27.2, iPadOS 27.2, tvOS 27.2, watchOS 27.2, macOS 27.2, and visionOS 27.2. Xcode 27.2 supports on-device debugging in iOS 17 and later, tvOS 17 and later, watchOS 10 and later, and visionOS. Xcode 27.2 requires a Mac running macOS Tahoe 26.6 or later.

[…]

When used via Sidecar or a MacBook with Touch, Device Hub now sends touches on the iPad screen to the remote device as touches. This allows you to use multi-finger gestures such as pinch and rotate to test your applications.

[…]

Projects that use APIs specific to iOS 27.1 show compile errors when building for Mac Catalyst (“undeclared identifier”, “not found”, “has no member”, “cannot find”, and similar errors).

[…]

macOS, watchOS, tvOS, and visionOS SDKs in Xcode 27.2 incorrectly report 27.1 as a valid deployment target. Builds and other functionality might have unexpected behavior if this deployment target is used.

Ron Elemans:

Every time I open a complex Storyboard in Xcode 26 or newer, the Inspector panel decides at a certain moment to resize to full window width. The only way to continue working is to hide the whole Inspector, resizing back doesn’t work.

Feedback Assistant shows “Recent Similar Reports: Less than 10” for at least a year. This is probably Apple language for “Deal with it, otherwise stop using dinosaur tech and switch to SwiftUI” (FB23611443).

Previously:

Catalyst (Marzipan) Device Hub Interface Builder Mac macOS 27 Golden Gate Programming Xcode

3 Comments

South Korea Fines Apple Over App Store

Marcus Mendes:

South Korea’s Korea Media and Communications Commission (KMCC) announced today a series of fines and corrective orders against Apple and Google over violations of the country’s Telecommunications Business Act.

Specifically for Apple, the KMCC imposed a fine of 20.81 billion won (approximately $15.5 million) and ordered the company to revise its App Store policies regarding payment methods and app review procedures, as well as prevent what it referred to as “discriminatory commission” practices from recurring.

[…]

In essence, the decision centers around three violations: forcing specific payment methods, unfairly delaying app reviews, and imposing discriminatory commissions.

Previously:

Antitrust App Store Apple Business iOS iOS 27 Legal South Korea

1 Comment

Taiwan: 26% App Store Fee

Apple:

Apple is making changes to the Taiwan storefront of the App Store, following discussions with the Taiwan Fair Trade Commission.

As of October 31, 2026, the commission rate for standard Apple In-App Purchase and paid app transactions will be 26% on the Taiwan storefront of the App Store on iOS and iPadOS.

Juli Clover (Marcus Mendes):

Apple normally charges a lower rate for Small Business Program members, but the announcement about the Taiwan commission changes doesn't include that information.

Previously:

Antitrust App Store Apple Business iOS iOS 27 Legal Mac Mac App Store macOS 27 Golden Gate Taiwan

Comments

Australia: App Marketplaces, External Payments, No Fees/Audit

Hartley Charlton (Hacker News):

Australia’s Federal Court today ordered Apple to allow competing app stores, direct app downloads, and alternative payment services for Australian users from March 1, 2027.

[…]

Apple must let users find, download, install, and update apps through competing marketplaces and websites without charging for access or obstructing their use. Developers must receive the necessary tools on substantially the same terms as for App Store distribution, and Apple cannot penalize them for using competing stores or payment services.

Developers will also be able to offer alternative payments and link to other ways to pay, including within App Store apps. Apple cannot require them to offer its own purchasing system alongside alternatives, report those transactions, or allow Apple to audit them.

Apps will be notarized, but Apple cannot collect fees on purchases not made through the App Store. This seems like the best antitrust result yet. This will take effect on March 1, 2027 unless blocked by Apple’s appeal or request for extension.

Marcus Mendes:

Today’s order follows a ruling last year that Apple violated Australian competition law by restricting alternative app distribution and payment methods, in a lawsuit brought by Epic Games similar to its long-running legal battle with Apple in the US.

[…]

Justice Beach described the latter two actions as “a paradigm example of Apple’s enforcement of its restrictive terms, in contravention of” section 46 of Australia’s Competition and Consumer Act 2010, which prohibits corporations with substantial market power from engaging in conduct that has “the purpose, or has or is likely to have the effect, of substantially lessening competition” in that market.

[…]

When it comes to Apple’s wins in the decision, the list is much slimmer. Judge Beach rejected Epic’s request to extend the court’s injunctions worldwide and allowed Apple to maintain security scanning and notarization requirements for apps distributed outside the App Store. And while Apple must permit competing app marketplaces on iOS, it is not required to distribute them through its own App Store.

[…]

Finally, the court ordered Apple to pay 85% of Epic’s legal costs incurred through the original trial[…]

Nick Heer:

It seems unsustainable to keep dripping out rule changes one country at a time, especially as many of them slightly differ in the details even when regulators’ overarching aims are similar. The reasons for the company’s stubbornness — namely: security and privacy — become much less believable as a growing number of regions require alternative distribution channels, essentially without issue.

Apple should just rip off the bandage and do Gatekeeper for iOS.

Hartley Charlton:

Fortnite will return to Australia’s App Store today, Epic Games told Reuters, after a federal court ordered Apple to allow eligible Epic apps back onto the store.

Previously:

Antitrust App Marketplaces App Store Apple Australia Business Epic Games External iOS Payments Fortnite iOS iOS 27 iOS App Lawsuit Legal Notarization Web Distribution of iOS Apps

7 Comments

Russia Wants User Data From Apple

Hartley Charlton (Hacker News):

Apple faces Russian data retention and disclosure requirements after being added to the country's state surveillance registry, Bloomberg reports.

[…]

Those obligations cover correspondence and messages containing audio or video. Companies must also keep information identifying users and recording the transmission of their communications within Russia for three years.

I guess this could include iMessage, iCloud mail, iCloud Photos, and perhaps iCloud backups. I have not seen whether they want an iCloud Advanced Data Protection backdoor.

William Gallagher:

That data must be stored on servers within Russia, and it must be turned over to the country’s security services as required.

Neither Apple nor Microsoft has yet commented publicly on the new requirements.

Previously:

Apple E-mail iCloud iCloud Advanced Data Protection iCloud Photo Library iMessage iOS iOS 27 Legal Microsoft Privacy Russia

2 Comments

iPhone Duo Crackgate

Juli Clover (forum):

Some iPhone Duos are already experiencing hinge issues that cause display cracks, based on photos shared on Reddit and the MacRumors forums. Almost all of the display faults are right along the hinge, and most result in a line of bright pixels across one side of the screen.

Juli Clover (iFixit, Hacker News):

iFixit commented on some of the display failures people have been seeing, suggesting they could be caused by pressure, a trapped particle, repeated bending, or a manufacturing defect. It may not be that the display has physically snapped, because a wiring problem can cause the same effect.

Where most of the faulty units are experiencing issues, the hinge has a different shape. The failure spot is also near where the accordion cable passes by and where several edges meet, which could be leading to a concentration of stress in that spot.

Terrence O’Brien:

Social media and the iPhone Duo subreddit are filled with reports of Apple’s foldable failing quickly and in spectacular fashion. Some users report having the phone for only a few hours before the hinge seems to catch on something, then audibly crack and break the screen. Tellingly, the cracks all seem to happen in the same place.

YouTuber CuriousHagi was able to reproduce the cracked screen during some durability testing of the iPhone Duo. Then he pulled it apart to try and find the culprit. What he found is that the Duo’s hinge is quite complex, consisting of a gear-like central hinge and two different types of linking hinges.

The piece that broke is one of the links in the middle of the phone that happens to be thinner than the links below or above it, and it snapped at a small notch where it would be weakest. He also found marks where the hinge met the support plate, indicating where it may have gotten caught.

Mark Gurman:

In these cases, customers reported hearing a crunching sound when unfolding the phone, followed by a large crack forming along the center crease. Some users also experienced a white patch or other display malfunction on the right side of the screen.

[…]

Apple acknowledged the issue in a statement, saying it was “aware of an issue impacting the inner display on a small number of iPhone Duo units.”

Juli Clover:

It is our understanding that some of the images of alleged cracking are AI-generated, which makes it harder to determine the actual scope of the problem.

Many of the iPhone Duos experiencing issues cracked in the same place on the lower half of the inner display. The crack is along the hinge, and users say there is a stuck feeling and sometimes a popping noise just before the damage appears.

Previously:

Update (2026-11-02): Joe Rossignol:

If a customer reports the issue, Apple advised technicians to inspect the iPhone Duo and repair or replace it in accordance with their standard procedures. While the instructions themselves are straightforward, the fact that Apple issued an internal memo suggests the issue is widespread enough to warrant official guidance.

[…]

Apple said there is no iPhone Duo recall, and the company has yet to launch a public-facing repair program on its website for this issue.

Display Hardware iPhone iPhone Duo

8 Comments

Thursday, October 29, 2026

eMudhra Intermediate CA Compromise

Dan Goodin:

Security personnel around the world are on high alert Tuesday following the discovery of eight TLS certificates with private keys so weak they could allow anyone to mint trusted browser and app credentials for any site on the Internet.

As of late morning Tuesday, browser makers and some major apps and programming languages had blocked all eight of the intermediate certificates.

[…]

“This will be a massive cleanup job, bigger than Heartbleed,” Filippo Valsorda, a cryptography engineer and a cryptography maintainer for the open source Go programming language, told Ars. “There will be a very, very long tail, IoT devices, Docker containers, forgotten Linux machines, unmaintained CLI tools that shipped their own copy of the roots (which is common in some ecosystems, like Python). Also, Linux distributions are still rolling out updates, some of them are not ready yet, and then system administrators will need to apply them to a lot of machines.”

[…]

The compromised eMudhra keys were defective at a level that’s challenging the imagination of many of the engineers studying the incident. A normal size for a NIST P-384 elliptic curve cryptography private key contains roughly 384 bits of entropy, a size allowing almost 2³⁸⁴, or a number with 116 digits, different possibilities. The private key sizes of the compromised keys ranged from 3 to 8 bits. Astonishingly, the private keys were 4, 56, 66, 115, 155, 156, 230, 237.

[…]

Ben Cartwright-Cox, director of BGP.tools, said: “My guess is that it’s example code that accidentally leaked to production, but hard to know. But it’s bonkers that no one noticed.”

Apple (Hacker News):

On 19 October 2026, Apple began blocking these 12 certificates on Apple devices. Updates to certificate configuration data are sent to devices automatically and as needed, so you don’t need to install a software update to get this change. Apple is making additional updates to this block, which will also be delivered automatically. On 23 October 2026, Apple also began blocking the emSign ECC Root CA - G3.

[…]

On Mac, some command-line tools included with macOS or the Xcode Command Line Tools (including curl, git, python3, ruby, perl, and openssl) check certificates against /etc/ssl/cert.pem. For certificates that chain to a root CA certificate in this file, these tools don’t check Apple’s block or whether the certificate has been revoked. This file will be updated in a future macOS update. If you use these tools and don’t want to wait for the update, you can remove root CA certificates from the file.

[…]

These steps affect every tool that uses /etc/ssl/cert.pem. Afterward, tools that use only this file might not be able to verify some websites whose certificates chain to these root CA certificates through intermediate CAs that weren’t affected.

emudhra.we-have-a-problem.com (Hacker News):

Apple has warned that until it ships its own fix, a macOS update may replace /etc/ssl/cert.pem. You may need to repeat these steps after each update.

See also: Filippo Valsorda, Howard Oakley, and TidBITS-Talk.

Previously:

Update (2026-11-02): Howard Oakley:

Apps written using standard Apple APIs, including many of mine, use the macOS trust store, which Apple updated between 19-23 October to block eMudhra’s compromised certificates. Those updates don’t appear in any common sources of information like System Settings, SilentKnight or even SystHist, though. If you want to confirm that your Mac or device has been updated, the best test is to view the checks Dennis Jackson generously provides, using Safari or another app that you know uses the macOS APIs.

[…]

Problems get worse once you look beyond macOS itself. Among the many apps that maintain their own trust stores, rather than using either of the above, are Google Chrome, Chromium-based browsers, Mozilla and Microsoft products, and some Electron apps. For those you’ll need to update that app to a version whose trust store has been updated to block the compromised certificates. But how can you tell whether that’s required for an app other than a browser? Others could also be affected if they use a language like Python, Java, Go, or possibly Rust or Ruby. Compiling a list of all Mac apps that might need their internal trust stores updated is a daunting task, and unlikely to happen.

If you were using the internet back in 2014, you may recall the chaos that resulted from Heartbleed, a severe vulnerability in OpenSSL 1.0.1, a precursor of TLS, leading to mass compromise of certificates and over a year of global insecurity. While eMudhra’s compromised certificates aren’t on the same scale, they demonstrate how little we learned from that.

curl Git iOS iOS 27 Mac macOS Tahoe 26 OpenSSL Perl Python Ruby Security SSL/TLS Xcode

4 Comments

Wednesday, October 28, 2026

Developing Mac Apps for Touch

Design for touch on Mac (via Jeff Nadeau):

Discover the key design considerations for updating your app for touch on macOS. We’ll explore the touch gestures now available on Mac, how system gestures work, how to size controls and touch targets while keeping your app great with a pointer and keyboard, and how to adapt hover interactions. Finally, we’ll dive into the expansion behaviors of native controls like steppers, dials, and sliders, and what that means for your app.

Bring Touch to your Mac app:

Discover how to add touch capabilities to your Mac app. Explore how to transition from classic mouse tracking APIs to modern gesture recognizers and touch-native controls. Find out how to optimize hit targets, implement multi-touch interactions, and manage system gestures to deliver an incredible touch experience. To get the most out of this session, watch Design for Touch on Mac.

Bring Live Activities to Mac:

Discover how to drive Live Activities from your Mac app. Explore how Live Activities appear in the menu bar and Dynamic Island. Learn how to define your data model, create compact and expanded views with SwiftUI, and drive interactive updates using App Intents.

Written documentation is “coming soon.”

Previously:

Update (2026-10-29): See also: Hacker News.

TN3216:

On a Mac with a touch display or a Sidecar-connected iPad, AppKit emulates mouse events from touch, so existing games can receive touch input with little or no code change. This guidance focuses on configurations common in games, such as an app with a single view backed by a CAMetalLayer. For more information about touch support in AppKit, including the view hierarchy and hit-testing mechanism, see Handling AppKit gestures.

Jeff Nadeau:

Another app development tidbit for the new MacBook Pro: the bottom screen corners on this Mac are rounded, and AppKit prefers to keep your window corners concentric with the display instead of clipping them.

For content inside the window, you can use APIs like NSView.LayoutRegion, UIView.LayoutRegion, GeometryProxy.containerCornerInsets, and containerCornerOffset to easily constrain your layout against the changing radius.

Steve Troughton-Smith:

In the developer videos today, I got the impression that full as-seen-on-MacBook-Pro touch support won’t be available in macOS until 27.3, and the APIs for it are in ‘the next SDK’. Indeed, a lot of the behaviors they showed today are not present when using 27.2 via Sidecar

Nick Lockwood:

I saw a post about the incredible engineering effort that went into retrofitting multitouch support into AppKit’s creaky old event handling, and while that was undoubtedly good work by talented engineers, it’s also a massive expansion of potential bug surfaces in one of the few remaining stable parts of the OS left over from the days when Apple’s quality control was still pretty decent

Steve Troughton-Smith:

macOS & iPadOS are on a collision course, no matter what the party line is. Both these platforms now have to solve the same problems for the same input devices, and they’re making the same choices for how to approach it pretty much every time.

[…]

I’m more convinced than ever that there is a future where you run AppKit apps on iPad. I don’t know how long it’s going to take for us to get there, but what I don’t think it will be is just putting macOS on iPad. There’s a successor to iPadOS and macOS both, with a completely shared userland, that’s waiting to be born.

Previously:

“No” Part 2

Cocoa Documentation Live Activities Mac macOS 27 Golden Gate Programming PROLED XDR Display

10 Comments

MacBook Pro (PROLED XDR Display)

Apple (technology overview, Hacker News, MacRumors, 9To5Mac, ArsTechnica, Slashdot):

Apple today introduced the all-new MacBook Pro with PROLED XDR Display, featuring breakthrough tandem OLED technology that delivers game-changing front-of-screen performance. Available in 14- and 16-inch models, MacBook Pro with PROLED XDR Display offers a visual experience unlike any other, transforming pro workflows with up to 2000 nits peak HDR and SDR brightness, an industry-leading 10,000,000:1 contrast ratio for exceptional detail, a 120Hz variable refresh rate, and a wider color gamut covering both P3 and Adobe RGB for brilliant colors. The new MacBook Pro also introduces intuitive Touch capabilities on the Mac for the first time, opening up a whole new dimension for pros to interact with their content, from manipulating 3D models to playing musical instruments onscreen. The Dynamic Island now comes to Mac, serving as the home for Spotlight, Live Activities, and Siri AI. And with up to 24 hours of battery life in thinner and much lighter 3- and 4-pound designs, MacBook Pro is more portable than ever, empowering pros to take their work wherever inspiration strikes. Featuring M5 Pro and M5 Max, Apple’s most powerful chips ever built for a pro laptop, along with up to 128GB of unified memory and now up to 16TB of blazing-fast storage, the new MacBook Pro delivers speed and capability for the most demanding workflows.

[…]

Crafted specifically for the Mac, every touch interaction feels incredibly responsive and refined. Everyday tasks are simple and intuitive, allowing users to scroll through a webpage with a natural swipe; pinch to zoom in on a photo; drag and drop slides from one presentation to another; and double-tap a window to fill the screen, or flick to tile it into place. And the touch sensor is built directly into the display panel — not layered on top of it — reducing latency so users feel like they’re touching the content itself.

Touch also introduces entirely new ways of working for pro users. Graphic designers can now use the entire display as their canvas, no longer constrained by the area of the trackpad when drawing; musicians can play software instruments right onscreen; and app developers can test how Touch performs in their iOS and iPadOS apps directly on the MacBook Pro display.

[…]

The 14-inch MacBook Pro now weighs half a pound less at 3 pounds, while the 16-inch MacBook Pro weighs just 4 pounds — 0.7 pounds lighter than before. Both models feature a slimmer design enabled by OLED’s more efficient display stack, with the 16-inch model nearly a millimeter thinner and the 14-inch model half a millimeter thinner.

Juli Clover:

Pricing on the MacBook Pro starts at $2,899 for the 14-inch model and $3,399 for the 16-inch model.

The base configurations have an M5 Pro with 24 GB of RAM and a 1 TB SSD.

This all sounds technically impressive, but these Macs don’t really interest me. I don’t need the better display; I rarely use the internal one, anyway. And I don’t want to touch my display; it seems less efficient, with horrible ergonomics, and I don’t want to get gunk on it.

I do like that the new MacBook Pros are a bit lighter, seemingly with no compromises.

The Dynamic Island does seem better than the Notch, but the problem with the Notch is mostly software, not hardware. There’s no indication that the software will be better, though at least the Dynamic Island is smaller.

What would I rather see in a new MacBook Pro? A smaller trackpad, a rounder front edge, more USB ports, Face ID, cellular.

John Gruber:

So I’m just wondering if tomorrow’s new touchscreen OLED MacBooks aren’t replacements for the current MacBook Pros, but instead are the start of a new MacBook family with another name. I don’t think they’d call them MacBook “Duos”, because they’re not two-in-one devices. MacBook “Ultras”, maybe — with the same specs as the MacBook Pros but more expensive displays? But “Ultra” seems like a wrong name for a MacBook because Apple’s M-series Ultra chips are (to date at least) desktop only. It’d be weird if the M5 Ultra is exclusive to the Mac Studio while the MacBook “Ultra” maxes out with the M5 Max. So maybe they just are the new MacBook Pros and this first OLED/touch generation uses the same chips as the ones from March?

“Ultra” never made sense, so I wondered whether Apple would add some other moniker like “Touch” or “Studio.” It turns out not, but “PROLED XDR Display” doesn’t exactly roll off the tongue, so something like “MacBook Touch” may end up being the defacto name, anyway.

Hartley Charlton:

The iconic glowing rear Apple logo is returning to the MacBook Pro with the latest model, Apple today announced.

John Voorhees:

The MacBook Pro does not, however, support the Apple Pencil.

John Ternus:

We’re glowing with excitement over the new MacBook Pro. You’ve gotta touch it to believe it.

Tim Cook:

We brought Touch to the Mac!

Steven Levy (MacRumors):

This turnaround is a big deal to Apple fans. Ternus shrugs off the drama. “The Mac is first and foremost an indirect input device, built around the trackpad and keyboard. But I think there’s times when it’s comfortable and handy to have touch.”

[…]

When I met with Apple executives Johny Srouji and Greg Joswiak this week to discuss the touchscreen MacBook Pro, you bet I invoked Schiller’s list of concerns. (Apple’s reps chose not to make Schiller, who now holds the title of “Apple Fellow,” available for an interview. In fact, they laughed when I asked.) It wasn’t only Schiller drawing a red line. In 2021, Ternus told journalist Joanna Stern, “The Mac is totally optimized for indirect input. We haven’t really felt a reason to change that.”

“Ten years is a very, very long time,” says Srouji, Apple’s chief hardware officer. “Many things have changed, whether it’s the display technology, the custom silicon, et cetera.” Eventually, he told me, the confluence of chips, display tech, and software architecture “met our bar.”

[…]

Joswiak, who holds Schiller’s old title of SVP of worldwide marketing, concedes that touch was overdue, at least for users with sophisticated needs. Its pro customers—engineers, scientists, software developers, and media creators—were impatient with Apple for its failure to let them interact directly with the screen. “Most pros own an iPad, and almost every pro owns an iPhone,” Joswiak says. “So this is something that they’re natural with. There’s a generation of young creators and young people using our MacBook Pros that expect to touch.”

Jason Snell:

Another question I had coming into this event was just how much effort Apple would make to adapt the macOS interface for touch. The answer is: A little, but not a lot. When you touch the screen, the interface makes subtle adaptations—more spacing in menus, more feedback when selecting and dragging items—but what it doesn’t do is flip into some new Touch Mode that looks and behaves totally unlike the Mac.

Federico Viticci:

Here is the same contextual menu on macOS activated via pointer (left) and touch

macOS automatically detects touch input and spaces out items a little bit more in the UI

TheRealAlex:

So I need to know what is the reason you need a Touchscreen on your […] Laptop?

What are you doing?

Paul Haddad:

The PROLED (🤮) display seems to have all the expected specs for a high end OLED. The sub pixel layout is unusual, at least I haven’t seen any others with this style. It’s an interesting choice since standard RGB is the next “big thing” with desktop OLEDs.

I wonder if Apple re-added sub-pixel rendering to the OS or just don’t bother since the PPI is high enough to maybe not matter.

MacBook Pro (M6, 2026)

Apple (MacRumors, Hacker News):

Apple today announced the new 14-inch MacBook Pro with M6, delivering even more performance, powerful on-device AI capabilities, and faster connectivity for college students, business users, creators, and more. M6 features an advanced 12-core CPU with the world’s fastest CPU core, so everything from productivity tasks to more demanding pro workflows feels incredibly fast and responsive.

[…]

The 14-inch MacBook Pro with M6 starts at $1,999 and $1,899 with education savings.

The base configuration has 16 GB of RAM and a 1 TB SSD.

John Gruber:

This tier of MacBook Pro has only ever been offered in the smaller 14-inch size. Prices seem unchanged from the post-June-price-hike M5 models[…]

Tim Hardwick:

According to Apple’s tech specs page, the option for 16GB of unified memory remains limited to 153GB/s. That’s identical to the M5 version, while only the new 24GB and 32GB configurations receive the faster 170GB/s memory bandwidth.

Hartley Charlton:

How much has changed, and is it worth upgrading or choosing the newer model?

Previously:

Apple Hardware Announcement Apple M6 Mac MacBook Pro macOS 27 Golden Gate

1 Comment

iMac 2026

Apple (MacRumors, Hacker News):

Apple today announced the new iMac featuring the superfast M6, delivering even more performance and powerful AI capabilities in its strikingly thin all-in-one design. […] Connectivity gets even better with Wi-Fi 7 and Bluetooth 6, along with available 2.5 Gigabit Ethernet and storage that is up to 2x faster, so apps and large projects launch in an instant. Completing the iMac experience is an expansive 24-inch 4.5K Retina display; an industry-leading camera, speakers, and mics; up to four Thunderbolt 4 ports; color-matched accessories; and the power of macOS 27. Available in a spectrum of seven colors — blue, green, pink, yellow, purple, orange, and silver — the new iMac is a tremendous upgrade for existing users and an incredible gateway into everything the Mac can do for new users.

[…]

iMac with M6 featuring a 10-core CPU and 10-core GPU starts at $1,499 and $1,449 with education savings. iMac with a 12-core CPU and 12-core GPU starts at $1,699 and $1,599 with education savings.

The base configuration has 16 GB of RAM and a 256 GB SSD, only 2 Thunderbolt ports, and no Touch ID or Ethernet, amongst other limitations. John Gruber has a price chart.

Previously:

Apple Hardware Announcement Apple M6 Apple N1 iMac Mac macOS 27 Golden Gate

8 Comments

macOS 27.2

Juli Clover (release notes, security, enterprise, developer, full installer, IPSW):

macOS Golden Gate 27.2 overhauls the brightness and volume sliders, plus it expands Siri AI to new languages including French, Japanese, Korean, Portuguese, and Spanish.

Mr. Macintosh (post):

Apple just broke the macOS security update record AGAIN, patching 263 CVEs in macOS Golden Gate 27.2! 🤯🔐

Jeff Johnson:

I decided to email Apple Product Security yesterday just to ask whether CVE-2026-112500 was my [e-mail privacy] issue. In the past I’ve had a number of email conversations with Apple Product Security, including a long-running thread initiated by them way back in 2024 about a WebKit security issue that I had reported, with last reply in July of this year. Sadly, as far as I can tell, I still haven’t been credit for that issue.

[…]

In other words, Apple Product Security no longer accepts reports via email, instead requiring security researchers to submit via a web form. But the web form wants you to “Report a vulnerability,” with no place for a simple question like mine, about a vulnerability already fixed. Also, the quoted paragraph implies that if you don’t use the web form, you might not get a CVE, which I suspect is what happened to me!

Gwynne Raskind:

PSA: If you use the removemacai tool and are having trouble updating to macOS 27.2, remove the RemoveMacAI profile in System Settings -> General -> Device Management. It appears to somehow block softwareupdate’s ability to download parts of the update.

Mario Guzmán:

macOS 27.2 beta brings back the solid divider line between sidebars and their details view.

Steve Troughton-Smith:

macOS 27.2 has reverted the [Mission Control] change: fullscreen apps are now once again titled by app name, not window title

David Deller:

Still broken on macOS 27.2. No response to my Feedback so far.

I’ve since added a workaround in Radiccio that simply removes the Liquid Glass effect (so the buttons can work again).

Hartley Charlton:

Upgrading to macOS 27 no longer removes an existing Rosetta installation[…]

Jeff Johnson:

I suspect what Apple really meant is that macOS 27 was not automatically reinstalling Rosetta, and now it does again in 27.2.

Previously:

Update (2026-11-02): Marc Edwards:

macOS 27.2 seems to have changed the design of the volume and brightness overlays. I like these better, but wish they were always top center, rather than being top right normally and top center for full screen.

E-mail Mac macOS 27 Golden Gate macOS Release Mission Control Rosetta Security

4 Comments

iOS 27.2 and iPadOS 27.2

Juli Clover (iOS/iPadOS release notes, security, iOS/iPadOS enterprise, developer):

The iOS 27.2 update expands Siri AI to new languages, including French, Japanese, Korean, Portuguese, and Spanish. It also adds profiles for the Apple TV app, a new icon and branding for Apple Music, and support for AI suggestions in the Messages app for taking quick actions in apps like Calendar and Reminders.

In the European Union, it introduces an alternative expanded prompt for App Tracking Transparency.

Ryan Christoffel:

iOS 27.2 adds a new setting for ‘Lock Controls’ inside the Home app’s HomePod accessory settings.

Previously:

App Tracking Transparency HomePod iOS iOS 27 iOS Release iPadOS iPadOS 27 iPadOS Release

Comments

macOS 26.7.2 and macOS 15.8.2

macOS 26.7.2 (security, no enterprise, no developer, full installer):

This update provides bug fixes and security updates for your Mac.

macOS 15.8.2 (security, no enterprise, no developer, full installer):

This update provides bug fixes and security updates for your Mac.

Previously:

macOS 26.7.1 and macOS 15.8.1

Mac macOS 15 Sequoia macOS Release macOS Tahoe 26

Comments

watchOS 27.2

Juli Clover (release notes, security, developer):

According to Apple’s release notes, watchOS 27.2 introduces new Siri AI features and extends Siri AI to new languages.

Previously:

watchOS 27

watchOS watchOS 27 watchOS Release

Comments

tvOS 27.2

Juli Clover (release notes, security, developer):

Today’s update adds support for four-speaker surround sound, a feature that works with the HomePod, HomePod mini 2, and the upcoming Apple TV 4K.

It allows the Apple TV 4K to be used with four HomePod mini 2 speakers, four second-generation HomePods, or two HomePods and two HomePod mini 2 speakers to get surround sound.

Previously:

Update (2026-11-03): Marcus Mendes:

Today, Apple released a new build of tvOS 27.2 (24K154), specifically for the fourth-generation Apple TV 4K, which is currently available for preorder ahead of its November 13 launch.

[…]

According to @itspdfu on X, the new build enables Siri AI on the fourth-generation Apple TV 4K, a feature that was previously restricted to internal builds.

tvOS tvOS 27 tvOS Release

Comments

audioOS 27.2

Juli Clover (release notes):

HomePod Software 27.2 brings a new Sound Glow option to the HomePod, HomePod mini, and upcoming HomePod mini 2. Sound Glow causes the top of a HomePod or HomePod mini to light up with color that pulses in sync with the music that’s playing. The feature draws colors from album artwork, and it works with songs, podcasts, and Apple’s ambient music feature.

The update also adds support for using HomePods as the default speaker for a Mac, plus it allows four HomePods or HomePod mini 2 speakers to be used as surround sound for the new Apple TV.

Previously:

audioOS audioOS 27 audioOS Release

Comments

visionOS 27.2

Juli Clover (release notes, security, no enterprise, developer):

Apple today released visionOS 27.2, the first big update for the visionOS 27 operating system that runs on the Apple Vision Pro.

[…]

The visionOS 27.2 update provides bug fixes and security updates, per Apple’s release notes.

Previously:

visionOS 27

visionOS visionOS 27 visionOS Release

1 Comment

Monday, October 26, 2026

iPad mini (8th Generation)

Apple (Hacker News):

Apple today unveiled the all-new iPad mini, featuring a stunning OLED display in an even thinner and lighter design, a huge leap in performance with A20 Pro, and water and dust resistance. The larger 8.5-inch OLED display, also available with a nano-texture option, delivers higher contrast and more than 2x higher peak brightness than the previous-generation iPad mini for a brilliant and immersive viewing experience.

[…]

The new iPad mini features an innovative Acoustic Display for an even better audio experience when gaming, watching videos, or editing content. Specially designed woofers are paired through the display to produce punchier bass and more volume. In addition, custom tweeters are now hidden between the glass and aluminum enclosure for clearer highs.

[…]

The 12MP Center Stage front camera is now on the landscape edge[…]

[…]

With iPadOS 27.2, iPad mini also supports extended display mode when connected to an external display, great for users multitasking with windowed apps.

John Voorhees:

The new iPad mini comes in Midnight and Starlight colors (fewer than before) and starts at $699, which is less than some rumors suggested, and can be configured up to $1,249 before accessories.

Before the recent price hikes it was $499. The MacBook Neo is also $699 (including keyboard).

John Gruber:

Still stuck with Touch ID — a bummer in general, and a shit sandwich given how expensive these have gotten. Unless Apple decides to make a mini-sized iPad Pro (which I definitely do not expect), there’s no way to buy a mini-sized iPad with Face ID.

[…]

This is the first iPad Mini with an XDR display. But: no ProMotion.

[…]

The new Mini is thinner (5.4mm vs. 6.3mm) and lighter (255g vs. 293g for Wi-Fi models). The display is slightly larger (8.5″ vs. 8.3″) while the footprint shrunk slightly, because the bezels have been reduced by 25 percent. The iPhone Duo weighs almost exactly the same (254g to be exact) but its inner display is only 7.6 inches diagonally.

Ryan Christoffel:

In fact, every configuration except the highest 512GB model includes a less powerful, binned A20 Pro chip.

According to Apple’s tech specs page, here’s the breakdown of the A20 Pro across different storage configurations.

Rui Carmo:

I very dearly want to go back to the Mini since the Pro is too large as a permanent companion device, but the inflated pricing is not helping. and neither is my feeling that Apple has likely nerfed the hardware in ways that matter to me.

Previously:

Update (2026-10-29): Dan Benjamin:

Why does Apple’s iPad mini product page show it as if it has no camera bump?

iPod at 25

Hartley Charlton:

Apple today marks 25 years since the introduction of the original iPod, one of the company’s most significant products and a major contributor to its expansion beyond the Mac.

Tony Fadell:

A small team. An unforgiving deadline. We had months to bring the hardware, software, and music experience together. Proud of what we built and that it means so much to people still today. A device that has been woven in many ways into our lives. People have filled their iPods with road trips, breakups, workouts, special occasions with family and friends.

Joe Rossignol (Hacker News):

Apple Music has a 404 page easter egg on the web: a functional iPod that appears when you load a page that does not exist, such as music.apple.com/macrumors.

Nick Heer:

This looks enough like my own iPod library circa twenty years ago that it threw me a little. I hope this is not appearing solely for the occasion of the iPod’s anniversary. It is a nice surprise.

Previously:

Anniversary Apple Music Easter Eggs iPod Web

1 Comment

Friday, October 23, 2026

WindowShade Redux

Another haxie reborn, from Rosyna Keller (Mastodon):

Instead of only cramming minimized windows into a crowded dock—or hiding them altogether—WindowShade Redux reduces your windows to their title bars or small live thumbnails at all times. It supports over twenty animation styles with the following power features:

Minimize the window to the Dock, as always
WindowShade the window into a tiny strip to quickly peek below or get it out of the way
Minimize-In-Place the window so it becomes a really small thumbnail that you can freely drag the thumbnail around your screen
Make any window float on top so it will never be obscured by other windows

$10 (with $7 intro price), and there are bundle discounts with FruitMenu and Xounds.

Modern macOS no longer allows one process to change the geometry of a window owned by another process (application), so I had to redesign and rewrite the core from scratch. Now, WindowShade Redux fakes everything hard. […] WindowShade Redux takes a snapshot of visible windows, composites them into an image, and displays it either as a fake WindowShade window or as a Minimize-In-Place (MIP) thumbnail to hide the Dock’s 500-millisecond genie animation.

[…]

Floating on top was an entirely different beast, as it requires constantly recording the target window and laying a new WindowShade Redux window on top of it. This fake window is then moved in tandem with the real window below it.

Previously:

Update (2026-10-26): Rosyna Keller:

WindowShade Redux 1.0.3 is now out.

It adds Prism Power and Sakura animations. It also adds a new window management feature that brings all windows forward in an app if you click on one of them (holding a modifier or not, it’s your choice), just like on Classic MacOS.

Previously:

Front and Center 1.0.1

Fun Hack Haxie Mac Mac App macOS 27 Golden Gate macOS Tahoe 26 WindowShade

14 Comments

Mastodon 5

Imani Joy:

We’re moving away from the embedded composer and adopting a pop-out composer with new controls for visibility and other post settings. Navigation is simplified and organised in a more intuitive way and create space for future new features.

[…]

In your feeds, the posts themselves have been rebuilt from the ground up, giving a fresh look to the places we all spend the most time. We’re also excited to roll out a few new colour themes, which took a truly monumental effort from our engineering team since the start of the year to tokenise our design system.

[…]

The new design includes many small affordances, such as hiding a user’s boosts directly from the post menu, following and unfollowing hashtags right from the post, and hiding your own posts and boosts in your home feed.

Via Jeff Johnson:

Incredibly, Mastodon’s own announcement shows the massive amount of wasted space in the new UI, and they’re fine with it!

Joe Fabisevich:

The Mastodon 5.0 design looks more Tumblr than Twitter, and I really dig it! Nice to see them take an approach to social media that is more differentiated than just “it’s tweeting but federated”.

To me it looks more like Twitter than before. Stars are now hearts. The layout is basically the same down to the empty right column where Twitter’s algorithmic features would be.

CM Harrington:

[The] toot button (the one that makes the toot window appear in the first place) is at the bottom of a list of everything else, including all your saved/followed hashtags.

It’s all such a mess. From what I can see (limited) they’re ‘just trying things’ that other sites have done — but without a reason or goal — so it’s all just a mash of disparate concepts.

The new composer slides up on top of the bottom post/message, so I can’t see what I’m replying to.

Matt Birchler:

There’s some interesting data here, but at a high level, you see a social network that gained over 2 million new active users in the 31 days after Musk closed on buying Twitter. A lot of those users bounced and we dropped to about 1.1 million active users by the following summer, when we saw a second spike as Twitter started to require logins to see anything and that rate limits were being applied. Since then, we’ve seen a slow but steady decline in number of people using Mastodon.

[…]

As a fan of Mastodon, these numbers are hard to look at. Not because I think a social network must have hundreds of millions of users to be valuable, but because it paints a picture where many people have tried Mastodon, but almost none of them stick around. Also, while infinite growth isn’t a requirement, constant decline isn’t what you want to see in a social network either.

Jeff Johnson:

To be honest, I’m not sure I want Mastodon to grow. I actually never wanted Twitter to grow. I originally joined Twitter in 2008 for a developer conference (C4 in Chicago) to network with other software developers. As far as I’m concerned, Twitter was ruined by the influx of celebrities and celebrity worshippers. Thankfully the celebrities have mostly ignored Mastodon. A crucial difference between the two social networks is that Twitter needed masses of people to join, because Twitter was a publicly-traded, for-profit corporation, financed by advertising. The goal of Twitter, like other such social networks—Facebook, Instagram, Threads, TikTok—was to maximize attention and thus eyeballs on ads.

[…]

This raises an important question: should you give your attention to social media? Is social media use healthy? […] In other words, Mastodon respects its users, doesn’t intend to waste their time. If Mastodon users decide to leave, I say good for them!

John Gruber:

Just after writing the preceding paragraph, I took a break to pick up some sandwiches for lunch. Get out of the house, enjoy at least a few minutes of a beautiful autumn afternoon, and stretch my legs. Waiting for the sandwiches to be prepared at the bagel joint, I took the Duo out of my pocket and checked NetNewsWire. First article up was a good one. Started reading. Screen’s too small. Do I want to open the Duo? Sandwiches aren’t going to take long. I clicked the side button to sleep the Duo and put it back into my jeans pocket (where it sank like the brick that it is). I spent the rest of the wait alone with my thoughts, pondering how to finish this review.

Apple isn’t going to start an ad campaign with a slogan like “So cumbersome you’ll keep it in your pocket”, but that’s part of my experience.

That’s kind of how I feel about Mastodon. It works OK, at least for the Mac/iOS community, without being very addictive. I wish the discovery and search were better, but that’s sort of antithetical to the federated model.

Rob Shearer:

Mastodon isn’t, and won’t ever be, a good platform for “asynchronous ephemeral notifications of any kind”. I’d also argue (more controversially) that it’s simply not good infrastructure for social networking of any kind. There are lots of interesting people using Mastodon, and I’m sure it will live on as a good-enough space for certain niche groups. But there is no question that it will never offer the fun of early Twitter, let alone the vibrancy of Twitter during its growth phase. I’ve long since dropped Mastodon from my home screen, and have switched to Bluesky for text-centric social media.

[…]

I’m not saying federation “won’t” work or “can’t” work. Merely that in 2025, nine years after deployment, federation does not work for the Mastodon use case. […] Crucially, the posts did not exist even if I visited the profile page of the account: even after weeks of daily posts, the profile page displayed by mastodon.social claimed the account had never posted, and the posts would only begin appearing after someone on mastodon.social began following the account.

[…]

When you “private mention” someone, only you and they can see the post. And they can reply with a “private mention” of their own. But if anyone in that “private” thread accidentally mentions any other Mastodon account by name, that is itself considered a “private mention”, and that person is invited into the thread. It is an absolutely insane UI design that makes it extremely easy to share private conversations with exactly the people you don’t want reading them.

[…]

The problem that did manifest is that all of this moderation is entirely opaque to users. If you explicitly follow a particular account, you may not see posts from that account because its instance doesn’t like its content, because your instance doesn’t like its content, or simply because one of the two instances doesn’t like the other.

Dave Winer:

The only way for the others to compete with Twitter is to start innovating. Get rid of the limits. The funny thing is Twitter, the dominant leader, is moving forward and getting rid of character limits, and introducing styles and links. They’re acting like the little guy while the others, Bluesky, Mastodon, Threads, aren’t doing anything to be more useful. That whole market is stuck in 2006 and the myth that 140 chars somehow was magic. It wasn’t. It killed the web as a writer’s platform.

[…]

Inbound and outbound RSS 2.0, is the way to go. And Markdown is the way you do text. This is what matters, you all are making something that’s really simple so unbearably complicated.

My first choice would be to see more people blogging on their own sites. But having longer and richer posts on Mastodon would be preferable to many of the alternatives. I still wish it supported RSS for my timeline and replies.

Previously:

Update (2026-10-26): Manton Reece:

If only there was a social network that actually prioritized blogging and had RSS feeds for the timeline, mentions, and everything else. I’m quite biased but there really isn’t anything else like it.

He’s talking about Micro.blog.

Design Mastodon Micro.blog RSS Web

12 Comments

Building Mac App Help Books

Amy Worrall:

The documentation is available on the website for the relevant app, and also in the app as a Help Book (openable from the Help menu). These days, Help Books on MacOS open in the Tips app[…]

Apple’s documentation for making these, such as Authoring Apple Help, is pretty old. If you look at the URL for that page, you’ll see it’s part of the Carbon documentation!

There are some third party tools to help. While planning this blog article I came across Helpbook Builder. I haven’t tried it, but if I were starting afresh I would probably check it out!

In this article I’ll share my process.

Previously:

Apple Help Mac macOS 27 Golden Gate Markdown

11 Comments

iOS 27.1

Joe Rossignol (no iOS/iPadOS release notes, no security, no iOS/iPadOS enterprise, no developer):

Apple this week released the full and final version of iOS 27.1, but it is only available for the foldable iPhone Duo that launched today.

iPhone Duo already ships with iOS 27.1 preinstalled, but users need to update to a newer build of iOS 27.1 while setting up the device[…]

Previously:

Update (2026-10-26): Christian Beer:

SwiftUI Table is broken on iPhone Duo! I discussed with an Apple engineer[…] he asked me to create a sample project. They have the sample code themselves in their OWN DOCUMENTATION!

Peter Steinberger:

I’ll wait a bit before thinking about a new phone.

Bug iOS iOS 27 iOS Release iPhone Duo SwiftUI

1 Comment

Apple Music’s New Look

Joe Rossignol:

In a YouTube video shared today, Apple said the new Apple Music visuals were “made by sound.” More specifically, Apple said it played a sound through a container of water, resulting in the liquid moving at the frequency of the notes. Apple Music brand elements were placed behind the vibrating water, resulting in a new liquid-inspired look.

Charlotte Gunn:

The approach draws on Apple’s wider design direction, particularly Liquid Glass, the translucent design language introduced across its software in 2025.
The redesign includes Apple Music’s typography. A new wordmark pairs the recognisable Apple symbol with a customised version of Apple’s own typeface, SF Pro. Bold, lowercase lettering gives the service a youthful energy, while a reworked musical note icon takes its shape from the forms captured during filming.

The project reportedly took months of experimentation with sound, materials and moving image.

Brian Webster:

“We spent a billion dollars to build a room where we splash in the water while smoking weed for a couple years, and came up with a plain black and white Apple Music icon. And oh yeah new font.”

Previously:

Liquid Glass 27 Icons

Update (2026-10-26): Louie Mantia:

Why does Apple know the visual identity for Apple Music looks like this across all social networks, but can’t bring themselves to use it for the actual app icon?

Apple Music Design Icon Composer Icons iOS iOS 27 Mac macOS 27 Golden Gate Music.app

9 Comments

Thursday, October 22, 2026

iPhone Duo Reviews

John Gruber (Mastodon, tweet, Bluesky):

The Duo name is perfect. It truly is like having two devices in one. The outer device is, by far, the worst iPhone Apple has ever made. It’s a miserable fat little thing. The inner device is a splendid, joyful, beautiful tablet, with a UI that out-iPads the iPad. For me, by far, it’s my favorite tablet experience ever. I prefer it to any iPad or Kindle-like reader I’ve ever used.

[…]

It does not go into or out of my jeans pocket smoothly. Sometimes, in my pocket, it rotates 90 degrees, which is uncomfortable. Folded up it never stops feeling heavy.

[…]

No, the problem with holding the Duo in your left hand alone is that the bottom left corner of its D-shaped frame digs into your palm. When you hold it in your right hand, it’s a nice round corner in the meat of your thumb’s base. In your left, it’s a crisp sharp corner, and it doesn’t feel good.

[…]

I’d love a display that looks and feels like this on my non-foldable iPhone 18 Pro. No glare, even in sunlight. It’s amazing.

[…]

Held horizontally, the iPhone Duo supports side-by-side multitasking with two apps. The user interface for this feature is brilliant. It puts every idea Apple has tried on iPadOS for multitasking to shame.

[…]

Every time you pick up the Duo to use it you face The Decision. Open it? Or be lazy and suffer with the outside display? Every time.

This is such a good review; you should just read the whole thing. Marques Brownlee has a great video review. Like Gruber, he really misses FaceID. They seem to disagree about the camera and screen aspect ratios. I also really liked Joanna Stern’s video review. She and Gruber both say it’s too hard to open the Duo with one hand.

MacRumors and MacStories have review roundups.

Austin Mann:

A week with the iPhone Duo at home, camping and in Iceland. A capable camera with new tricks, and a creative powerhouse for planning, editing and sharing.

Previously:

Update (2026-10-26): See also:

Update (2026-10-29): Federico Viticci (via John Gruber):

Don’t like that the iPhone Duo doesn’t auto-lock when you close it?

You can fix it with this simple Shortcuts automation.

Face ID iOS iOS 27 iOS Multitasking iPhone Duo Touch ID

21 Comments

iPhone Duo and Safari

Mike Piontek (Mastodon):

A year ago I wrote that Safari 26 and Liquid Glass have little respect for web sites and unfortunately this hasn’t changed.

[…]

It’s unclear to me why Apple is not opting to treat the iPhone Duo toolbar as a safe area. I have not come across anything discussing their reasons nor educating web developers on the best way to design for this device.

[…]

Apple has decided to examine my web page and pick out a color to use for their toolbar. The process they use to determine this color is complex and not documented.

Previously:

Update (2026-10-26): Jen Simmons (via Léo Natan):

Safari 27.1 does bring one change to users. Now, when someone holds iPhone Duo partially folded like a book while looking at a PDF on the web, Safari 27.1 automatically shows PDFs as two pages side by side. When they open the screen flat or close it fully, Safari switches back to one page.

For web developers, Safari 27.1 on iPhone Duo includes a preview of the Device Posture API and the Viewport Segments API, available behind feature flags.

Previously:

iOS 27.1

iOS iOS 27 iPhone Duo MobileSafari Web

3 Comments

WebKit Blocking Identity Resolution Infrastructure

Lara O’Reilly:

Apple’s latest privacy crackdown left the online ad industry scrambling for answers. Now, the tech giant has finally offered some.

John Wilander et al.:

A “post-cookie” tracking method emerged, called identity resolution. In this scheme, third parties (i.e., not the website owner) invisibly collect your email address when you log in or sign up for a newsletter. They send the email address to their servers, create an opaque tracking ID permanently linked to your email address, and send that tracking ID back to the webpage. The tracking ID is stored on the website and can from thereon be used for arbitrary purposes linked to your email address, such as building a profile of your browsing or targeting ads at you across websites. Logging out or unsubscribing from that newsletter does not remove the tracking ID or your email address stored with the third party.

[…]

Some companies serve as third-party infrastructure to facilitate identity resolution. They are present but invisible on many webpages where you enter your email address or use your email address for login purposes. They are not themselves login providers or newsletter services, they’re just there to track you.

In our iOS, iPadOS, macOS, and visionOS 27 releases, Safari and WebKit block network access to identity resolution infrastructure to prevent cross-site tracking. This stops them from sending your email address to their servers and all the downstream effects of that. The blocking is done on the domain level, meaning they can’t just change the structure of the network request to work around the protection.

Rowena Lam:

There is an unreleased update to WebKit that makes this list dynamic, meaning Apple can remotely add new vendor domains to the blocklist at any time without requiring users to download a new OS version.

The list is not public facing, domains added to the blocklist don’t appear to be notified of their addition and there does not appear to be any formal appeal process.

Previously:

Advertising iOS iOS 27 Mac macOS 27 Golden Gate Privacy Safari Web WebKit

1 Comment

Wednesday, October 21, 2026

PHP2Shell

Malwarebytes:

If you’ve encountered websites in maintenance mode today, it may be a security precaution. Reports of attacks targeting two critical PHP vulnerabilities have prompted warnings to install emergency updates and consider temporarily taking affected services offline until they can be patched.

[…]

Successful exploitation could let an attacker run malicious code on an affected server without logging in. That code would run with the permissions available to the PHP process, potentially allowing attackers to steal application data, alter website content, or establish a backdoor.

[…]

The PHP team scheduled its emergency security updates for October 21 at 10:00 am ET (14:00 UTC). It has now released fixes in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, and urges users to update immediately. Administrators should check with their hosting provider or operating system vendor for the appropriate updated packages.

Adam Engst:

Expect to see numerous websites go down or serve “Page not found” errors as they update PHP, the programming language that underpins 70% of websites. If you run a WordPress, Drupal, or Joomla site, this affects you directly.

Nick Heer:

Word on the street is that these exploits have leaked, and that remote code can likely be executed all the way back to PHP 5. If you have access to your website’s php.ini file, it might be worth turning off multipart uploads for now.

Vincent Schmalbach:

Two changes reduce the risk until the fixed versions are out. They were checked against PHP’s source code and the PHP manual, but they are not an official PHP mitigation. When someone suggested that turning off session upload progress might be enough, PHP core developer Gina Peter Banyard replied, “The only thing I can say is that the only mitigation is patching / upgrading PHP. I sadly know too much.” Use the stopgaps to lower the risk for a few hours, and update PHP as soon as the fixed builds exist.

Add to php.ini:

session.upload_progress.enabled = Off

Add to .htaccess:

<If "req('Content-Type') =~ /multipart/i">
    Require all denied
</If>

Update (2026-10-22): CJ Moses (Hacker News):

Amazon Threat Intelligence identified a PHP2Shell exploitation attempt dating to Oct. 17, 2026, in MadPot telemetry, four days before public disclosure of CVE-2026-109618 and CVE-2026-109619. The exploit attempt originated from an IP address associated with a commercial anonymization network. While the vulnerability was under embargo, the targeting of a honeypot from an anonymized IP address suggests the activity was conducted by a threat actor, though it remains unclear how the actor acquired exploit information prior to disclosure.

The PHP embargo window was set to be lifted on 2026-10-21 1400 UTC. On the day of the release, Amazon Threat Intelligence identified multiple proof of concept exploits for the vulnerability, with the earliest around 2026-10-21 0200 UTC. Subsequently, from 2026-10-21 0200 UTC to 2026-10-21 0800 UTC, Amazon Threat Intelligence identified additional exploitation attempts of PHP2Shell targeting MadPot from additional anonymized infrastructure. The actual payloads and choices in anonymization infrastructure varied, suggesting these were multiple actors. Technical analysis is ongoing, and it’s unclear if any of these attempts would have succeeded in real-world systems.

DreamHost:

Protections Are In Place - The official PHP security updates have been applied across the entirety of our network.

Ofcom Concedes Defeat in 4chan Case

Guido Fawkes:

Ofcom boss Dame Melanie Dawes has admitted today that tech firms have paid just two of the eleven fines handed out under the Online Safety Act since March last year. Giving evidence to the Culture, Media and Sport Committee, she conceded nine remain unpaid, four of the offending sites have simply geo-blocked the UK, and three are still up and running with nothing changed.

Via Preston Byrne (Hacker News):

American courts have, by now, provided their preliminary view on the likelihood of Ofcom’s enforcement powers being successful in U.S. courts – the obiter dicta in 4chan v. Ofcom, the opinion in the case we filed against Ofcom in the federal District Court for the District of Columbia a little over a year ago.

[…]

Ofcom can’t enforce the Online Safety Act in America. Ofcom knows it, Ofcom has known it for a long time, and now, Ofcom has, finally, admitted it.

[…]

The GRANITE Act, a foreign censorship shield now before both the House and Senate (H.R. 10174 / S. 5478), is one proposed legal response America could adopt. The HOMEFRONT Act, H.R. 10309, is another. Either of GRANITE or HOMEFRONT would strip sovereign immunity from foreign censors and let Americans targeted by their orders drag those agencies into federal court, where they could be held accountable for their actions.

Previously:

Lawsuit Legal United Kingdom Web

Comments

iOS Dev Course Going Out of Business

Sean Allen (via Rebecca Sloane):

iOS dev course sales plummeted due to AI. It costs a lot of money to host my courses online and with sales at basically $0, I’ve cancelled that hosting.

This closes down the site which unfortunately removes access to the courses.

[…]

I’ve put my recent course on sale at a large discount so you can get it before it’s gone and I’ve made old courses available for free if you want to grab those too.

The school will be online until November 24th so you have a few weeks to download these videos at seanallen.teachable.com.

Artificial Intelligence Bargain iOS iOS 16 iOS 17 iOS 18 Programming Sunset Video

10 Comments

Apple Broke an Essential Presentation Feature of iPads

Teddy Svoronos (Hacker News):

As of iPadOS 27, if you have multiple windows open while AirPlaying (whether or not Stage Manager is on), tapping on anything other than the presenting app will snap the external display into showing your whole iPad screen. This means that my students see all my notes on who I want to call on, or poll results that should be hidden from them. They also get distracted from what we’re learning by all these jarring windows popping up and disappearing. If you’re presenting at a big conference, it’s extremely embarrassing.

[…]

As for what the behavior should be, I’m not a developer, but here’s a proposal: if you’re using an app that is in presenter mode (e.g., PowerPoint playing a presentation, or a GoodNotes document open), it should always get precedence on the external display, until that presentation gets stopped, the document is closed, or the app is quit.

Previously:

iPadOS 27

AirPlay iPadOS iPadOS 27

2 Comments

Tuesday, October 20, 2026

Selection and Focus in Golden Gate

Howard Oakley:

Now move the pointer to the right edge of the list of folder contents, just far enough to the left to avoid moving the window divider, but not so far as to fully select items from within that folder. Click there and the item will be selected, but in grey, the same as would appear if it had been fully selected but its window was no longer in focus. At this stage, the original folder will still be fully highlighted, as if nothing had been selected inside it, but you can drag that grey unfocussed selection to include other items inside the folder.

On my Mac, if I click on a file icon in the second column, the first column retains focus. The second column only gets focus if I click on a filename (or even farther to the right).

Now using the up and down arrow keys doesn’t move within the items inside that folder, but back with the fully highlighted folder. With a few of the items inside that folder in grey, so they’re selected but not in focus, press the spacebar for a QuickLook preview, and you’ll see the greyed items, not the folder that’s still fully selected to the left.

[…]

In other situations, this becomes infuriating.

In my log browser LogUI, separation of selection from focus can leave you clicking wildly without being able to select log entries.

Previously:

Update (2026-10-21): Philip Savoulidis:

I too was wondering if there was something peculiar with my Mac. Focus seems so broken in Golden Gate that I was expecting macOS reviews to mention it. In this regard, I am glad to see focus problems mentioned here.

The behaviour seems inconsistent. For example, in Finder and Mail the sidebar does not gain focus on click, but it does in Contacts and NetNewsWire (a third-party app). The Passwords app seems like the worst offender: the password list itself does not gain focus on click (e.g. click the search field then click an item and focus remains in the search field).

I spent some time investigating this, and I think it comes down to a SwiftUI bug. List and Table in SwiftUI are affected. Both use NSTableView under the hood, but they never become first responder on click.

But I don’t think NSBrowser is built on SwiftUI, so there are probably multiple issues here.

Update (2026-10-26): Howard Oakley:

That evidence implies that the failure to change focus resulted from a bug in AppKit, which in those specific circumstances didn’t go through the correct state changes, omitting Began, Possible and Cancelled. The Finder still selected the item I had clicked, and passed that to QuickLook for its preview, but failed to change the focus, affecting future actions.

[…]

This bug isn’t consistent, though. While I experience it frequently in the Finder, and it affected a SwiftUI List view in LogUI, others have different experience, and many haven’t come across it in the Finder at all. I have several other apps that use List views in SwiftUI, but LogUI is the only app so affected.

[…]

Given the strong rumours that Apple is about to announce a touchscreen MacBook Pro, I wonder if there are been provisions made to support that in AppKit resulting in a new bug.

Bug Finder Mac macOS 27 Golden Gate Quick Look

8 Comments

Xcode Projects for the Command Line and Coding Agents

Artem Novichkov (via Fatbobman):

Xcode also ships two command-line tools for the new format:

xcprojformatter came with the format in beta 2. It’s a formatter for project files, like swift-format for code: it checks that a project.xcproj file is valid and rewrites it with sorted keys and consistent layout.

xcodeproj arrived in beta 3. It reads and edits projects from the terminal: targets, build phases, groups, build settings, xcconfig files, and Swift packages.

Neither is on your PATH, so run them with xcrun.

Previously:

Xcode’s New .xcproj Files Are JSON

Artificial Intelligence Mac macOS 27 Golden Gate Programming Xcode

Comments

Getting a File Path From a Swift URL

Seth Willits (2024, bug):

There’s a deprecation warning in Xcode for URL.path that reads:

WARNING: path will be deprecated in a future version of macOS: Use path(percentEncoded:) instead

The problem is something like this:
Bundle.main.url(forAuxiliaryExecutable: "tool")!.path
… which returns the expected file path (ex: /Applications/MyApp.app/Contents/tool)

would be quickly rewritten as suggested to:
Bundle.main.url(forAuxiliaryExecutable: "tool")!.path(percentEncoded: false)
… which simply returns tool, because the URL returned is relative to a base URL.

[…]

I’ve always found it not-completely-obvious to newcomers how to get a standard file path string from a file URL and this only makes it more confusing.

There are at least three issues here:

url.path returns an absolute path, but url.path(percentEncoded: false) returned a relative path as of his writing. I tested this on macOS 26, and now it returns an absolute path. The documentation now says, “This function will resolve against the base URL.” It seems the behavior of the method changed without it being documented when, so be careful if you’re deploying to a mix of OS versions.
percentEncoded has a default value of true, whereas path did not return an encoded string. In other words, url.path() and url.path are completely different. So this is another case where Apple updated the API but flipped the default—a good way to introduce bugs.
It’s not obvious how to get the full file system path out of a URL. With NSURL, url.path was natural and did the right thing. Now, the URL equivalent is deprecated.

The natural replacement, url.path(), is wrong. So is Xcode’s recommendation of url.(percentEncoded: false).

url.absoluteURL.path(percentEncoded: false) is correct but verbose.

url.absoluteURL.standardizedFileURL.path(percentEncoded: false) is possibly better but even more verbose.

FilePath(url)?.string uses a newer API but gives you an optional, even though for a file URL it should never fail.

This seems like such basic functionality, but there’s no API that’s the obvious right choice, concise, and ergonomic.

Previously:

Cocoa iOS iOS 27 Mac macOS 27 Golden Gate Programming Swift Programming Language URL

4 Comments

Monday, October 19, 2026

Carson Oliver and Apple’s Gaming Push

Giovanni Colantonio:

Seven years later, Apple Arcade hasn’t gone anywhere, and Apple itself hasn’t slowed its broader gaming efforts either. Between courting major publishers like Capcom to release their games on Mac to launching a proper gaming app, it’s clear that Apple still has its sights set on being a major player.

The latest example of that came this week as Apple launched an App Store event dubbed Indie Games Week. The week-long initiative saw Apple welcoming games like Vampire Crawlers to iOS and announcing an ambitious mobile version of No Man’s Sky. At the center of that push was Carson Oliver, the new head of App Store Worldwide following Phil Schiller’s sudden departure from the role this past August. The fact that one of his first acts in the role was spearheading an indie gaming showcase hints at where Oliver’s priorities might lie.

[…]

While Oliver sells the narrative with carefully worded precision, questions still linger around Apple’s wider gaming efforts. Continued investment in mixed reality gaming is uncertain given that Apple has reportedly cut down production of its Vision Pro headset due to underwhelming sales. And though Apple continues to court publishers and get games on iOS, we haven’t seen the full-throated support from major players like Capcom and Ubisoft in 2026 that was crucial to raising Apple’s gaming profile in 2023.

Previously:

App Store Apple Arcade Apple TV Game iOS iOS 27 Mac Mac App Store macOS 27 Golden Gate tvOS tvOS 27

13 Comments

NetNewsWire 7.2

Brent Simmons:

We’ve released NetNewsWire 7.2 for Mac with a new column view layout: choose View > Use Column Layout to switch.

I really missed this feature from the old NetNewsWire, so I was happy to see its return. Now that I’m using it, I have mixed feelings. I love the columns, how I can scan the titles without the feed names and dates getting in the way. But some titles aren’t very informative, so I miss how the iOS-style view shows a little preview of the article’s body. I wish I could see that, either appended after the title itself or in a second line below it.

We’ve also added a second long-requested feature: you can now hide unread counts or replace them with a •, so you don’t have to deal with the anxiety of an ever-increasing unread count and the feeling like you have to get caught up.

Here are the other changes.

Previously:

NetNewsWire 7.1

Update (2026-10-22): Nick Heer:

I am a huge fan. It feels like coming home.

Design Mac Mac App macOS 27 Golden Gate NetNewsWire RSS

2 Comments

DropDMG 3.7.2

DropDMG 3.7.2 is a maintenance update of my app for disk images and archives.

It still works back to macOS 10.13, but this will probably be the last such release. There’s no reason the code can’t continue to run there, but soon I will be switching to Xcode 27, which deploys back to macOS 12.
From some reason, this build was hard to submit to the Mac App Store. altool kept retrying, or something, right at the end of the upload. There’s usually a delay before a build shows up in App Store Connect, but this time I saw it there before altool had finished running.
I also ran into trouble submitting the app for review. It kept showing a spinner or reporting errors when I tried to save the build, and also when adding it for review.
The actual review was pretty quick by modern standards—three days including a weekend. It warned me ahead of time that review “can take up to 48 hours.”
When I was approving the build for release, it asked if I was “enjoying” App Store Connect and wanted me to rate the app.

Previously:

Disk Image DropDMG iTunes Connect Mac Mac App Mac App Store macOS 27 Golden Gate

Comments

Friday, October 16, 2026

Xcode 27.1

Apple (xip, downloads):

Xcode 27.1 includes Swift 6.4 and SDKs for iOS 27.1, iPadOS 27, tvOS 27, watchOS 27, macOS 27, and visionOS 27. Xcode 27.1 supports on-device debugging in iOS 17 and later, tvOS 17 and later, watchOS 10 and later, and visionOS. Xcode 27.1 requires a Mac running macOS Tahoe 26.6 or later.

Christian Beer:

You can’t run macOS UI tests on Xcode cloud as soon as your app uses „restricted entitlements“[…]

Previously:

Entitlements Mac macOS 27 Golden Gate Programming Testing Xcode Xcode Cloud

Comments

iMessage Downgrading

Glenn Fleishman:

The odds of this change in standards causing a security breach and your messages being exposed seem unlikely, at least right now. But after scrolling through conversations and seeing what’s going on, I feel Apple has omitted important signals for users when iMessage suddenly stops being used during a conversation.

[…]

The impact of that hit me while revising my book: when iMessage isn’t available, Apple tells you only inline. Despite all the information Messages displays about iMessage being encrypted, the inverse state is faint. This kind of negative knowledge, or information about something not happening, can often be as important as something that does happen. A warning about a fuel tank approaching empty is the kind of information every driver (or pilot) needs, for instance. If you think end-to-end encryption—or Apple-based encryption—is critical for you, then a pop-up message or other warning is what you would expect.

[…]

If you’d like to prevent Messages from downgrading security, you have options, although they may not be fully desirable. All of these are managed on an iPhone at Settings: Apps: Messages. You can’t control these message settings from an iPad or Mac.

This recently happened to my mother, and it was very confusing for her. For unknown reasons, while at home on Wi-Fi, she got signed out of iMessage. But it was not clear to her that this had happened or that she should try to sign back in. She was not aware that the Messages app supports multiple protocols or what the different bubble colors mean. All she noticed was that certain messages (e.g. ones sharing files) would no longer send and that she was not receiving some of the messages that people were sending to her. She saw the inline warning about encryption and interpreted it as that the sender was using a newer form of encryption that her phone didn’t support, so maybe she needed to upgrade.

I went over to take a look and quickly figured out that she was signed out of iMessage, but I couldn’t fix it. I kept getting errors that iMessage couldn’t be activated, even after rebooting the phone. Eventually, much later and again for unknown reasons, activation succeeded.

Update (2026-10-20): Boris Yurkevich:

My concern is that the Retry as Text Message toggle no longer exist. Just a couple of weeks ago my sister sent me an iMessage while I was flying. I was not reachable. Later she told me that messages turned from blue to green.

Design iMessage iOS iOS 27 Mac macOS 27 Golden Gate Messages.app Privacy Rich Communication Services (RCS)

6 Comments

Mark Stephens (Robert X. Cringely), RIP

Mary Alyce Stephens (Hacker News, Reddit, TidBITS Talk):

Mark Stephens, known to much of the world as Robert X. Cringely, passed away on October 3, 2026. He was 73.

Mark was a gifted writer, journalist, storyteller, husband, father, brother, and friend. To millions of readers and viewers, he was Robert X. Cringely, the witty and sometimes irreverent observer of the technology world. But to those of us fortunate enough to love him, he was simply Mark-and losing him leaves an emptiness that is difficult to put into words.

[…]

Writing as Robert X. Cringely, Mark became a distinctive voice in technology journalism. He had an unusual ability to understand not only technology but also the human beings behind it-the dreamers, inventors, entrepreneurs, eccentrics, and risk-takers who were changing the world. He could take a complicated subject and make it understandable, entertaining, funny, and deeply human.

Steven Sinofsky (via John Gruber):

Bob wrote “Accidental Empires” that chronicled SV and the tech industry of the PC era, 1970s-90s. It led to the highly regarded PBS series “Triumph of the Nerds” a definitive series of interviews of the era. Through that time he authored the “gossip” column” in InfoWorld on the latest goings on at OG PC companies. Everyone read it in print religiously.

Passkeys Attestation Trap

The Hack (Hacker News):

Like the Trojan Horse, passkeys are legitimately elegant on the surface, but there is something troubling inside.

What’s important to know is that unlike with any other kind of login credential, you do not have ultimate control over your passkeys. With passwords, you can choose where to write them down; with authenticator apps, you can decide for yourself which ones to use (they’re pretty interchangeable); and with physical security keys you can hand them to your colleague if you really trust them. But with passkeys come a hidden dial that lets the websites you use them on gradually remove your ability to do as you please with them.

[…]

This is the feature that means you no longer get to make the calls about your passkeys. Fortunately, attested passkeys are not yet required on most websites. But the FIDO Alliance standard makes attestation a part of the passkey ecosystem, whether you want it or not. And even if the website doesn’t require attestation now, simply by using passkeys you indicate to the website that your setup supports the FIDO Alliance’s passkey standard and that you as a user are capable of using passkeys. This means that once Twitter (formally X) is satisfied that the overwhelming majority of its users would be unaffected, they can flip the switch – perhaps not all at once, perhaps just for ten thousand users at a time so as not to cause a fuss – and start rejecting non-attested passkeys.

[…]

My expectation is that the industry will start off with very few constraints on your passkeys, and gradually add more and more, not all at the same time, but staggered on different sites, and then in a few years people will forget that they were ever offered a choice in which security measures they want to enable on their passkeys (if they even knew there were different kinds of passkeys at all).

[…]

Remote attestation can allow them to verify that your device is not capable of, say, sending and receiving encrypted messages, or running a competitor’s app, or using social media without verifying your ID.

Apple’s passkey implementation currently does not support attestation, but it sounds like this is only until they can work out how to do syncing:

Attestation was designed to attest to a specific device, exclusively at the point of creation, with a specific set of security properties. It doesn’t make sense for synced credentials for a number of reasons, including syncing to devices with different security properties, changes in security properties that happen after key creation, security properties of the sync fabric, sharing the passkey, or exporting to other passkey providers. We’re working hard with W3C and FIDO to solve these problems.

Ricky Mondello:

The post is predicated on the idea that a feature of WebAuthn called “attestation”, which is only used in high-assurance and usually corporate scenarios, and usually with physical hardware security keys, will be leveraged to hurt people, somehow.

The post posits that a website like X will bait and switch users: first, you get a passkey. Then, later, scary “attested” passkeys! This simply isn’t possible to do because attestation isn’t supported on the web for mass market, consumer authentication.

Attestation for passkeys (software-based, syncable credentials) is antithetical to their mass market goals, and would freeze out independent, non-corporate-backed credential managers. It’s an explicit non-goal of the designers of passkeys, who work together in a forum anyone can join.

And trust me, websites and apps like banks repeatedly asked for attestation at the beginning of the industry’s passkey journey. The platforms, browsers, and credential management apps have held firm that the goal of passkeys is reducing phishing and not some kind of trusted computing scheme. (And I will note: over my dead body!)

I believe this is not the goal of Mondello and some of the others working on this, but so far I’ve not been convinced that they will be able to control it. It sounds like Apple is working on it, and once the technology is out there, what’s to prevent key sites from forcing it on users? It seems like all this would take is the cooperation of a few big credential managers. This would be to their benefit in the sense that it would make their products required. Smaller credential managers who resisted would be frozen out.

varx:

The fact that websites and apps have been asking for attestation just reinforces the main point of the passkeys post! Sure, browsers aren’t supporting it yet, but that’s the sort of thing that can change, and the sort of thing that has changed in the past. See the footnote on Widevine and Firefox. (“Currently not supported” is also very subject to change.)

And we already have sites and apps allowlisting passkey vendors. That’s no theoretical, slippery slope fear -- it’s a real restriction on user freedoms that’s already happening right now.

I don’t think that a couple of bad points (e.g. the TOTP thing) invalidate the main point of the post, because the post wasn’t an argument from authority. The author makes some good points that stand on their own.

Ricky Mondello:

To be clear, the websites have stopped asking for attestation. Or at least, they’ve stopped asking me. Why? Because they know there’s no use in asking — that the OS vendors, browsers, and passkey managers are unified on this front. And now they’ve seen firsthand that passkeys without attestation are awesome and a big step forward.

iinuwa:

This is antithetical to users, as the types of authenticators that can pull this off are difficult to use (security keys). Companies with IT departments who can do account recovery for the user can handle this, an average user cannot. Synced passkeys are the answer to this for consumers and therefore attestation does not belong in the consumer space. Which is why password managers are in the spec groups pushing back against this every time it comes up.

Scott Helme (Hacker News):

If a consumer website decided tomorrow that it would only accept attested passkeys, it would lock out almost all of its own users, instantly. What website is going to do that?

[…]

If you’re worried about attestation creeping into consumer logins, then that’s worth pushing back on, loudly (if it ever happens). But it hasn’t happened, the biggest providers don’t support it, and avoiding passkeys today while you wait for it won’t protect you from anything, it just leaves you open to phishing.

It seems like rejecting passkeys is the only way the average user has to push back. The main thing protecting us is that sites don’t want to lock out their users who rely on passwords and 2FA. Once most people have adopted passkeys, if Apple and Google sell us out, I don’t think it matters much what the rest of the alliance thinks. Sites would be able to require attestation with the assurance that users could easily comply. Safari would probably opt everyone into attested passkeys, as it currently opts you into passkeys in general (unless you uncheck “Allow Automatic Passkey Upgrades”).

Previously:

iOS iOS 27 Mac macOS 27 Golden Gate Passkeys Security Two-Factor Authentication (2FA)

19 Comments

Attestation News

TheLastProject (Hacker News):

In the [EU age verification] README, the following is listed:

App and device verification based on Google Play Integrity API and Apple App Attestation

I would like to strongly urge to abandon this plan. Requiring a dependency on American tech giants for age verification further deepens the EU’s dependency on America and the USA’s control over the internet.

Bobby Borisov (Hacker News):

The European Union’s open-source age-verification project has drawn criticism after a maintainer confirmed that hardware-bound attestation is a mandatory architectural requirement, raising concerns about Linux, custom Android ROMs, and independently compiled applications.

[…]

The solution lets users prove they are over a certain age without revealing their name, exact birth date, or full identity document. To prevent credentials from being copied, cloned, or reused by modified clients, the project relies on keys stored in protected hardware like Android TEE, StrongBox, or Apple’s Secure Enclave.

However, critics claim that this approach endangers the system by making it dependent on a small number of approved devices, operating systems, and attestation providers.

Positiveblue (Hacker News):

Cloudflare’s new “signed agents” pitch sounds like safety but it’s a wolf in sheep’s clothing. They’ve built an allowlist for the open web and told builders to apply for permission. That’s not how the internet works. An application form is not a standard.

GrapheneOS:

Apple and Google are gradually expanding their use of hardware-based attestation. They’re convincing a growing number of services to adopt it. Google’s Play Integrity API and Apple’s App Attest API are very similar. Apple brought it to the web via Privacy Pass, which Google intends on doing too.

Google’s Play Integrity API requires hardware attestation for the strong integrity level and is gradually phasing in requiring it for the more commonly used device integrity level. Apple already has it as a requirement. Over the long term, this will increasingly lock out hardware and OS competition.

The purpose of these systems is disallowing people from using hardware and software not approved by Apple or Google. This is wrongly presented as being a security feature. Banks and government services are the main ones adopting it but Apple and Google are encouraging every service to use it.

German National EUDI Wallet Architecture Documentation (Hacker News):

When issuing the PID, the WB confirms to the PP (via OpenID4VCI Key Attestation) that the keys to which a PID is to be bound are controlled by an authentication means that meets certain security requirements with regard to resistance against attackers with a certain attack potential (see ISO/IEC 18045).

Simon B. Støvring:

It’s great that App Attest is coming to Mac with macOS 27. It means I can ship Canvases’ intelligence and sharing features with much more confidence, knowing I can protect the endpoints with App Attest.

Previously:

Android Children Cloudflare Digital Services Act (DSA) European Union GrapheneOS iOS iOS 27 Linux Mac macOS 27 Golden Gate Secure Enclave Security Web

3 Comments

Wednesday, October 14, 2026

Resetting Local Network Privacy

Howard Oakley:

Of all the privacy protections in macOS, those for local networking are among the most recent and the least understood.

[…]

All non-exempted apps and other processes start without any privilege. Those that try to make a local network connection result in the user being prompted to allow or deny their access. Your decision is then recorded in that app’s new entry in the Local Network section, and you can then set that to allow or deny its future access. For that to happen, the responsible app needs an additional item in its property list to explain to you why it requires that access, something that should appear in any prompt for access.

[…]

A process with a short life that immediately fails if it can’t complete a local network operation may not trigger a user prompt, and can continue to fail repeatedly as it can’t be granted the privilege. Apple recommends changing the code so that it doesn’t exit immediately after failure, to allow the prompt to be displayed and access granted.

Howard Oakley:

Another clue came in the statement in that note that “on macOS there’s no way to reset your program’s Local Network privilege to the undetermined state”. This contrasts with pretty well every other category of privacy protection, which are handled by the dreaded TCC, Transparency Consent and Control.

This has now changed in macOS 27.2.

TN3179:

During testing, you might want to reset your program’s Local Network privilege to the undetermined state. Your options for this vary by platform.

On iOS, the easiest option is to delete your app.

Alternatively, if you don’t want to delete your app for some reason, reset the entire privacy subsystem using Settings > General > Transfer or Reset > Reset > Reset Location & Privacy.

On macOS, the list in System Settings > Privacy & Security > Local Network has add (+) and remove (-) buttons. To reset your program’s Local Network privilege, select it in the list and click the remove button.

Previously:

Update (2026-10-23): See also: Howard Oakley.

iOS iOS 27 Mac macOS 27 Golden Gate Networking Privacy

4 Comments

Tuesday, October 13, 2026

Apple Home Collection

Apple (MacRumors, Six Colors):

Apple today announced Apple Home Collection, a new lineup of smart home accessories — including indoor and outdoor cameras, thermostats, temperature sensors, and a video doorbell and door lock — designed in collaboration with LG Electronics and Schneider Electric. These new accessories are simple to set up starting with one tap with iPhone, and everything is managed through the Apple Home app — no separate app or account required. Each accessory is encrypted end-to-end in Apple Home, so only users and the people they choose can access their home data.

[…]

LG’s Video Doorbell offers dual cameras that capture separate views of visitors and packages — allowing users to switch between the front and bottom camera views seamlessly — along with a built-in spotlight and a chime that plays through HomeView, HomePod, and HomePod mini. The front camera captures 2.5K resolution video, and the bottom camera captures full HD resolution.

LG’s Floodlight Cam delivers powerful perimeter monitoring with adaptive dual floodlights that activate automatically when motion is detected, and low-light color night vision that preserves clarity in darker conditions so users can see more of what’s happening outside.

[…]

LG’s Smart Deadbolt Lock brings a new level of convenience to home access. Using Ultra Wideband technology, the lock can tell how close a user is and when they’re approaching the door. As a user with a home key on a compatible iPhone or Apple Watch walks up, the door unlocks automatically, with no tapping required.

[…]

Two new Smart Thermostats are available — one from LG Electronics and one from Schneider Electric — so users can choose the product that best fits their home’s broader energy ecosystem.

John Gruber:

The thing that makes this partnership awkward for Apple is that these products — doorbells, cameras, deadbolt locks — are products that require the utmost of trust. What products could possibly require more trust than a camera with footage of what’s going on in or at your home, or a lock that controls who can get in? I think that’s why Apple wants to get into this market with products that they can put their stamp of approval on. But LG, of all companies, was just exposed in a scandal for shipping “smart” TVs that literally listen to the ambient audio in the room — even in standby! — and invade your privacy by tracking what content appears on screen.

Previously:

HomeView

Update (2026-10-26): Adam Engst:

The implication is that Apple guided the design and integration while letting its partners handle manufacturing and support. This gives Apple a way to ensure a curated smart home experience without entering the low-margin hardware business of cameras, locks, and thermostats directly. Whether these devices offer anything technically beyond what existing HomeKit accessories can do remains unclear; the main appeal seems to be Apple’s stamp of approval in a market full of inconsistent products. Apple also tends to stick with products for a long time, and the company may not have wanted to commit to maintaining these product lines indefinitely.

Apple Hardware Announcement Home.app HomeKit LG Privacy Siri

5 Comments

HomeView

Apple (video, Hacker News, MacRumors Six Colors, MacStories, Slashdot):

Apple today introduced Apple HomeView, designed to be central to the home and personal to everyone in it. With a stunning 7-inch Liquid Retina display, HomeView brings entertainment, connection, and smart home management together in one place, from playing music and making FaceTime calls to home monitoring and hands-free automations with voice control — all designed with privacy and security at the core. HomeView recognizes users by their faces, adapting so they can access their personal content in Messages, FaceTime, Calendar, Reminders, and Find My.

[…]

Designed to fit in any space, HomeView can be placed on a tabletop as the center of the home or wall-mounted to fit in spaces like the entryway or hallway.

I guess the best part is the price. $299 (not including wall mount) is less than the base iPad and the same as the Apple TV. But I just can’t imagine what I would use this thing for. It does not seem more appealing than an iPhone or HomePod for any tasks. I wouldn’t want to dedicate any kitchen space for it, and the cord is a problem. Why would I not just use an old iPad or iPhone, which are wireless and support apps and standalone video? Maybe it would be interesting if it could do something extra, like act as a Time Capsule.

John Gruber:

HomeView does not have FaceID. I asked about this and Apple reps said that first, your home is (reasonably!) presumed to be a safe space. But in order for users to be recognized — by voice or face — they must have a “registered [non-watch] personal device” that supports Apple Intelligence and Siri AI, that device must be present on the home’s Wi-Fi network, and it must have been recently unlocked.

Hartley Charlton:

Apple said it is “working constructively with the EU in an attempt to find a path forward,” but provided no timeline for EU availability.

Previously:

Update (2026-10-14): Julian Chokkattu:

It doesn’t have an App Store. Instead, Apple has a curated selection of apps, including FaceTime, Messages, and Safari. A handful of third-party media apps like Spotify are available, and developers can bring over existing CarPlay apps. If your iPhone already has one of these CarPlay apps installed, it can automatically appear on the HomeView after setup. (There are no video streaming apps like YouTube, Netflix, or Disney+, but if those companies choose to make their apps available on the CarPlay framework, they will show up on the HomeView; for now, you’ll have to consume videos by using the Safari browser.)

Via John Voorhees:

CarPlay makes some sense as a way to push apps to the HomeView, but unless the entitlement is opened wider, it also makes no sense at all.

I suspect this is just the mechanism for audio and video apps and not a more general developer channel for making apps.

Jason Snell (MacRumors):

Beyond that, though, it seems like HomeView is at least starting life as a very limited app platform. Apple does say that if you make a Siri AI query for your personal content, it will search everything on your iPhone or iPad—and that includes apps that aren’t on the HomeView. So you should be able to query your iPhone apps, but not actually run them.

Rui Carmo:

I do think I want one, but there are a few things to settle besides price and value. For starters, having more screens in the house doesn’t seem like a winning proposition (the HomePods we’ve got work OK for alarms, reminders, etc.), and the American fascination with the kitchen island (which, by the way, needs power sockets in the middle…) doesn’t translate to European flats.

Paul Solt:

Are you going to cut a hole in your island to feature HomeView?

Mr. Macintosh:

I really like the new Apple HomeView device!

The only thing I can’t get past, (as a previous iMac G4 owner) is the screen can’t rotate vertically.

Notice the slick Apple video edit:

If someone needs to rotate HomeView, the whole base needs to rotate along with the power cord.

Mr. Macintosh:

Wait… I just noticed something else from the HomeView video🤔

When she goes to grab the HomeView, you can see her right hand reach out to grab the lower right hand corner of the screen. But then the cut shows her grab the top of the base to rotate it?

Did they not like the cut where the entire base rotates? (This would would have shown the USB-C plug rotate along with the entire unit)

Basic Apple Guy:

iOS Icon History: iPod/Music

Bob Burrough:

Folks speculating HomeView is the tail end of Tim Cook’s product “leadership,” but 1) Ternus is the CEO and can torpedo it if he thinks it’s a stinker. 2) He’s also the guy who spearheaded iPad’s “what’s a computer?” campaign and the idea that an iPad was a viable replacement.

Quinn Nelson:

The biggest issue with Apple’s Home ecosystem is the absolutely garbage Home app. Still, in 2026, there is a tab dedicated fully to buying more smart home gadgets (aka, an ad) within the iOS Home app and it can’t be removed. Yet rooms are buried up top. Pitiful.

Scott:

This is the ONE THING (“One more thing”?) I’d been hoping to get from @Apple in this announcement: they were redoubling efforts on HomeKit/Home.app to make the ecosystem actually work better… annnnnd did not get that impression. At all.

IMHO, as an HomeKit user with dozens of devices in 2 Homes, there is SO MUCH low-hanging fruit that @Apple could be working on to improve the UX, it is pathetic.

Steve Troughton-Smith:

The original HomePod didn’t come to the EU either for 5 months, and even then it was only in two countries. The original HomePod never came to Ireland at all, before it was discontinued. But if you only listened to the pundits, this is somehow now the DMA’s fault.

Apple TV 4K 2026

Apple (video, Hacker News, MacRumors, Six Colors):

Apple today announced the next generation of Apple TV 4K, delivering its most immersive home theater experience yet. The new Apple TV 4K features Siri AI, an entirely new version of Siri powered by the next generation of Apple Intelligence, transforming how users search for, discover, and enjoy their favorite movies and TV shows through a full-screen Siri AI experience. With built-in far-field microphones, Apple TV 4K also lets users talk to Siri completely hands-free.

[…]

The A19 chip in the new Apple TV 4K delivers up to 50 percent faster CPU performance and up to 2x faster GPU performance than the previous generation, for greater responsiveness, faster navigation, and smoother animations. The A19 chip also includes a new, dedicated AV1 decoder, enabling more efficient, high-quality streaming while using less bandwidth.

The new Siri Remote keeps its familiar design while adding Find My support with Precision Finding and an option to play a sound on the remote — making it far easier to locate.

The price is now $299. Apple TV doesn’t get updated very often, so if you need one I guess now is the time to buy.

But I’ve really soured on this product. The software design is worse than when I bought it. I just want a basic interface like the iTunes column browser. Instead, we get all this extra stuff so that the text I care about is secondary, truncated, and obscured. It seems designed to hide the content I want to see, and which I am in the middle of watching, while constantly promoting what Apple wants me to watch. The search has always been bad and is still bad. The main thing it’s supposed to do is play video, and lately that’s been failing, too. It either won’t play at all or it’ll play for a while, and then after a commercial break it will switch to a different episode.

I’m considering just getting a $40 Fire TV Stick to see whether things are any better over there. Maybe the privacy is worse, but I have to weigh that against the product actually working. We watch TV to relax in the evening, and instead I keep getting agitated that either it didn’t work at all or we had to go through hassles like logging in again or rebooting. I would miss the screensaver, though.

Previously:

Update (2026-10-14): Joe Rossignol:

Here are 11 changes coming with the new Apple TV[…]

Scott:

Oh, yeah, one more thing: does the $300 Apple TV have a USB C port for UVC cams, for FaceTime/vidconf apps.

If not, why not? Really fucking stupid if it doesn’t, especially at that price. The chipset and OS HAVE the capability.

It does not.

Maynard Handley:

1. There is nothing compelling here for existing owners.

2. The price is so high compared to Roku or Fire that it’s hard to justify telling friends to upgrade for the better experience.

Apple should probably, at the very least, have kept the existing 64GB box at a lower price point, and bundled in a year of Apple TV+, to work with market.

[…]

It’s about “WTF is Apple thinking? Who is this targeted at?” We have three products released today all of which look like flailing.

[…]

I’ve been on team Apple (customer and employee) since 1990. This is the first time (even including the Wired Pray cover days) that I feel genuinely worried that Apple is fumbling the future.

Joe Rosensteel:

I don’t understand the direction the team working on the Apple TV has been given. I know people are excited by it, because they’ve been waiting to buy the best one, and cycle the old ones down to lesser TVs in their homes, but this update is going to be around next year and the year after so it’s worth thinking about it from that point of view. What will you get out of this when it isn’t just “new”? A microphone array? Chip bumps?

Asleep at the jog wheel.

Update (2026-10-16): Andrew Orr:

According to Apple’s footnotes, Precision Finding requires an iPhone Duo, iPhone Air, or iPhone 17 or later, excluding the iPhone 17e. Compatible iPhones must run the latest version of iOS, and availability varies by region.

The restriction is particularly notable because the iPhone 15 lineup and most iPhone 16 models already feature Apple’s second-generation Ultra Wideband chip. Those iPhones support expanded Precision Finding with the AirTag 2, but they can’t use the new Siri Remote’s Precision Finding feature.

John Gruber:

I’m sure the graphics and CPU improvements matter for gaming, but the only mention of gaming in Apple’s own Newsroom announcement is this sentence: “With Apple Fitness+, the living room becomes a workout studio, while Apple Arcade and the App Store’s library of games turn it into a home arcade.” I wish it were otherwise, but gaming is such an afterthought on Apple TV that it only garnered the second half of a sentence that started with Fitness+, a service that has only been in the news this year because Mark Gurman says Apple laid off part of the team.

[…]

The elephant in the room, though, is price.

Adam Engst:

You can pre-order a 128 GB fourth-generation Apple TV 4K with Wi-Fi and gigabit Ethernet for $299, and it ships on 13 November 2026. In comparison, the third-generation model started at $129 for 64 GB with Wi-Fi and $149 for 128 GB with added Ethernet. In June, Apple raised those prices to $199 and $249 (see “Apple Raises Prices for Many Products,” 26 June 2026). Apple eliminated the lower-capacity option, so now we have only the higher-end model at twice its initial price.

Jason Snell:

For the people who do care, who do want something better, the options are more limited. Amazon’s Fire TV Cube is $199. Roku’s “Ultra” is $149. The Google TV streamer, my favorite of all the non-Apple products on the market, is $150.

When you could get an Apple TV starting at $199, you could spot Apple playing its usual game—not the low-price leader, but in the ballpark. At $299, though, it becomes a lot harder for me to convince my relative who is complaining about how slow and terrible their streaming interface is to spring for the Apple one and solve their problems.

[…]

I’ve seen some commentators suggest this is a good thing because it “simplifies the product line.”

I don’t follow that argument at all. Having a cheaper product is good, because not only do some people not need Ethernet or large amounts of storage on a streamer box, but lower prices broaden the market!

Update (2026-10-19): John Gruber:

Inflation adjusted, a $69 Apple TV box today would cost a little under $99. Even if we only consider the $99 price in 2015 dollars, that’s about $137 in today’s dollars. Round that up to $150 and it would still be half the price of the only Apple TV hardware Apple now sells: this week’s new 4th-gen Apple TV 4K.

The new Siri Remote, with precision Find My support (and a speaker), is compatible with all prior generations of Apple TV 4K. So if you just want the new remote you can just buy the new remote. But it costs $59, which is almost as much as an entire Apple TV (with remote, of course) did in 2015.

Glenn Fleishman:

I wondered what the entry-level, initial price of each Apple TV box at introduction was, from the March 2007 original to the Apple TV 4K (4th generation) announced October 13, 2026, adjusted for inflation. So I charted it.

Steve Troughton-Smith:

I was ready to buy three new Apple TVs at the previous price point. At the new price point, I’ve bought zero 🤷‍♂️

John Siracusa says that pause/resume has been broken for him—in Apple’s own TV.app—and that he had to force-quit it several times.

Apple A19 Apple Hardware Announcement Apple TV Find My Siri TV.app tvOS tvOS 27

36 Comments

HomePod mini 2

Apple (video, MacRumors, MacStories, Six Colors):

Apple today announced HomePod mini 2, featuring Siri AI, gorgeous new colors, and enhanced audio experiences. Siri AI, coming to HomePod mini 2 in a future software update, is a profoundly more capable and conversational assistant with personal context understanding, broad world knowledge that powers tasks like richer music discovery, and the ability to tap into even more apps — bringing a whole new level of capability to HomePod mini.

[…]

With Sound Glow, the top of HomePod mini transforms into a visual canvas that glows and pulses in sync with the music, reacting in real time to bass and treble.

[…]

Sound Recognition gives HomePod mini users peace of mind by listening for a smoke or carbon monoxide alarm and, if one is detected, sending a notification immediately to the user’s iPhone, iPad, and Apple Watch.

The price has increased from $99 to $149. Our HomePod is placed high enough that the top isn’t visible, anyway. I assume it still can’t play all my purchased music.

Previously:

Update (2026-10-14): Scott:

Annnd… apparently the HomePod mini 2 cable IS still captive.

Mr. Macintosh:

The new HomePod mini 2 is “built with the environment in mind” yet still has a non-removable power cable.

Did you move furniture onto the cable, or did your cat eat through it?

Buy a new one.

Apple Hardware Announcement audioOS audioOS 27 HomeKit HomePod Siri

7 Comments