Friday, November 6, 2026

Safari’s Autofill Feature May Be Distorting Time

Thomas Claburn:

The autofill feature of Apple’s Safari browser appears to be suffering from a date handling error that occasionally leads it to supply an incorrect credit card expiration date when filling out forms.

The supposed issue has been a sore spot for Apple customers dating back at least to 2017, when the author of an Apple Community forum post complained about changes to the month field in the Autofill credit card expiration date when moving between time zones.

[…]

Wherever the bug may reside, Safari’s unreliable handling of credit card dates has kept a complaint-filled Reddit thread going for four years. And the reported month-shifting has been noted in other threads, too.

Previously:

Goodbye, Salon

Salon (via John Gruber, Hacker News):

The business realities of independent digital journalism have changed profoundly over the years. After careful consideration, we have reached the difficult decision that our publishing model is no longer sustainable. We know this news will be deeply disappointing to many of you, and we share that sadness.

Thirty-one years is a remarkable run, but what matters most is what happened during those years: the journalism, the ideas, the voices, the conversations and the community that grew around them. Salon helped demonstrate what digital journalism could be and could become.

Previously:

Castro Sold Yet Again

Dustin Bluck:

I’ve decided to sell the app to Maple Media. Maple Media is a mobile media and technology company that owns and runs category-leading entertainment, productivity and podcasting apps, including Player FM.

Previously:

Thursday, November 5, 2026

Unable to Export Mac Passwords

I create periodic CSV password backups on the Macs that I manage. After the recent 1Password story, I was feeling good that at least I shouldn’t have to worry about the Passwords app not launching. But it turns out that, today, Apple’s app didn’t work, either.

After telling it to export everything (except the passkeys, which are not exportable), it asked for the user’s password twice but then failed to save the file or report an error. This happened several times. I saw some vague CloudKit errors in Console, but it wasn’t clear they were related to the export. And shouldn’t it be able to export the locally stored data without going to the cloud?

Then I noticed that the passwords in the app were stale—the last modification was more than a month ago. Had it stopped syncing with iCloud Keychain? I could find no indication of that in Passwords or in System Settings, though it’s not as if there’s an easily accessible sync status indicator or log.

I tried the all-purpose remedy: signing out of iCloud. This made things worse because when I signed back in it wouldn’t accept any device passwords, even though I’m sure that I entered three different ones correctly. It kept saying:

Verification Failed
There was an error verifying the passcode of your iPhone.

Now I was stuck with the dreaded “Some iCloud Data Isn’t Syncing” error in System Settings, with no access to any end-to-end encrypted data. (I’d been almost ready to enable to iCloud Advanced Data Protection, but now I wonder whether that’s a bad idea because it increases the likelihood of a bug or server problem locking me out of my own data.) Exporting from Passwords still failed without reporting an error. And, because I had to sign out of iCloud in order to sign out of iCloud Keychain, I now had 80K photos that needed to be redownloaded.

I thought maybe there was a temporary server glitch. Of course, the iCloud status page showed nothing. I waited a few hours and tried again, but it still didn’t accept my device passwords.

What finally worked was reinstalling macOS. That allowed me to fully sign into iCloud, passwords started syncing again, and exporting suddenly worked.

Previously:

Switch to Safari

Chance Miller (Hacker News):

Apple is kicking off a new campaign today to promote Safari’s benefits over Chrome. With a new “Switch to Safari” page on its website and a pair of new YouTube videos, Apple wants everyone to know Safari is “a more powerful and private browser than Chrome.”

Apple (Hacker News):

Safari offers up to 5 hours more video streaming on your Mac compared with Chrome.

[…]

Faster page loads on frequently visited sites when browsing on Mac.

Lex Friedman:

Apple then uses some iffy animations to promote its claims that “Safari cuts the clutter while Chrome piles it on”. (I don’t think this one’s fair. Chrome doesn’t add extra crap to websites, in my experience.)

I’m fine with Apple’s claim that “Safari shields you while Chrome reveals you,” though internal rhyme is never my favorite.

Then the next one says “Safari blazes; Chrome cruises.” I don’t think those are opposites, and the rabbit with a snail shell is a weird image to me. And even Apple’s explainer text — “Safari is up to 35% faster than Chrome when loading frequently visited sites on Mac” — feels heavily caveated.

There are so many things about this page that seem weird to me.

I still use Safari because I prefer its interface. But I wish I could find something better so I could switch away from Safari:

Anonymous:

I’d be more supportive of this if Apple would actually port Safari to Windows again, or even make new ports to Android and Linux! As is, however, it sort of feels kinda desperate. Chrome is mentioned so many times on that page, which doesn’t look bad until one compares it to their other currently-running campaigns like Mac does that. (Switch to Mac) where Windows is only mentioned a couple times (PC gets twice that amount), or even Switch to iPhone where Android is only mentioned once!

Previously:

Quarantined Safari .webloc Files

Jeff Johnson (Reddit):

Opening a webloc file, for example by double-clicking in Finder, now triggers a Gatekeeper alert in the latest versions of macOS Golden Gate and Tahoe, 27.2 and 26.7.2 respectively, though oddly not in macOS Sequoia 15.8.2.

[…]

I could not find anything relevant in the macOS 27.2 security release notes, but the document is extremely long and each entry terse, in typical Apple fashion.

I’ve seen this occasionally, over the years, with Web archives and downloaded PDF files, but now it seems to happen with every bookmark file. I’m not sure what the point of it is. These are not even downloaded files; they’re created by the user dragging a link, so presumably it’s not a surprise what the file contains. And if it is a surprise, the alert doesn’t help because it doesn’t show you a preview of the URL that would be opened. A malicious URL would probably hide anything suspicious behind a redirect, anyway.

So how is this actionable? What is the story where Apple thinks a user will accidentally end up with a bad .webloc file and be dissuaded from opening it by this alert? It just seems like pointless friction.

All that opening the file does is open the URL in Safari, which is the same thing that would have happened had you clicked the link in the browser window. What’s next—warnings for those clicks, too? They could market it as a reason to Switch to Safari.

Previously:

Wednesday, November 4, 2026

Safari 27.3: Adaptive Dark Mode

Simon Fraser et al. (Hacker News):

When enabled by a user, Safari adapts light websites and presents them as dark.

[…]

At the core of Adaptive Dark Mode is the transformation of color. Sometimes colors are simply decorative, while other times they have semantic meaning. Adaptive Dark Mode determines when to invert colors so elements remain visible or when to leave colors unchanged.

While creating Adaptive Dark Mode, we developed a color matrix to invert the luminosity of colors while preserving hue. It’s used to make light backgrounds dark, and dark text light. When transforming text color, Adaptive Dark Mode aims for sufficient contrast as defined by the WCAG 4.5:1 contrast ratio. Light CSS gradients are also transformed to dark.

[…]

It takes the same care with images. Most are left unchanged, preserving their integrity. But many icons and logos can lose contrast when the background color behind them is inverted. So Adaptive Dark Mode inspects SVG images and transforms colors when needed. For bitmap images, it analyzes the pixel histograms and inverts simple black-and-white logos.

See also: NSTextView.usesAdaptiveColorMappingForDarkAppearance (WWDC 2019).

Federico Viticci:

If this sounds familiar, it’s because so many third-party Safari extensions for this very task already exist, including the very popular (and a MacStories favorite) Noir.

Previously:

Safari 27.3: Vertical Tabs

Jason Snell (MacRumors):

In recent years, numerous browsers have experimented with re-orienting the traditional top-of-the-page tab bar into a vertical stack, and now Safari is joining the parade. (It makes sense, when you think about it, because most of our screens are much wider than they are tall, putting vertical space at a premium.

Vertical tabs aren’t a default, but they are now a new option. The tabs sit on the left sidebar as a strip of icons by default, but if you prefer you can resize the tab bar to also show tab titles. On the Mac, Apple has built a hover effect reminiscent of the macOS Dock that displays the name of the tab when you move the pointer over its icon, and if you pause and hover, it’ll display a floating window with a visual page preview.

John Gruber:

I got an advance demo of this last week and I’m really looking forward to trying it. I’ve gotten very used to horizontal tabs over the years, but a long time ago I was a devoted user of the Omni Group’s OmniWeb browser, of which one of my favorite features was its vertical tabs. That was so long ago, the tabs went in a drawer.

I liked this in OmniWeb and also in NetNewsWire 3, which had vertical thumbnail tabs on the right side of the window.

Ron Stewart:

Hopefully, allowing the vertical stack of tabs to be positioned on right side isn’t far off, too. Chrome, Firefox, Vivaldi all support it, and - as a right-handed user - it feels much more natural to me.

Brave also added vertical tabs a few years ago (Hacker News).

Adam Engst:

But now that I’ve become a complete convert to the wonders of vertical tabs, I’m seeing them everywhere. Or perhaps the industry has hit some sort of intersection between users clamoring for the option and browser makers gaining the gumption to brainstorm better interfaces. Whatever the reason, if you’re not using vertical tabs now, I’d encourage you to try them, either in your current browser or one of the newcomers mentioned below.

Francisco Tolmasky:

Every app should have both vertical and horizontal tabs. Neither one is better, they’re for different things. Vertical tabs display “everything” in the current context, while horizontal tabs show your “current focus”. IDEs get this right, just about everything else doesn’t, from browsers to Messages to Slack. Messages is a great example, it would be so much nicer on the Desktop app to have my “favorites” just as horizontal tabs instead of pinned bubble faces in my “every conversation ever” list.

Previously:

Binance Heist

Rafael Nam:

The massive $6.3 billion cyber heist suffered by crypto exchange Binance last week may have taken place in only about twenty minutes — but the attacks were months in the making.

That’s according an initial assessment released by Binance on Tuesday about how it suffered the world’s biggest-ever cyber heist by hackers the FBI has identified as being a North Korean state-sponsored unit.

Molly White:

At least $5.5 billion of these were liquid assets. Tether announced they had frozen at least $1.567 billion of the stolen USDT, and Circle has frozen around $800 million of stolen USDC. World Liberty Financial froze the $27 million in USD1 stolen by the attacker, and the Arbitrum ethereum layer-2 network froze an additional $30.5 million that had moved to its network. The attacker is estimated to have made off with between $2.4 billion and $3.4 billion.

Binance founder Changpeng Zhao, who is legally not allowed to have any active role with the company [I98] yet still has remarkable amounts of inside knowledge into its inner workings, posted on Twitter less than an hour after the theft that “User funds are safe!”, adding early estimates of how much Tether and Circle had frozen.

[…]

Binance keeps an emergency insurance fund in case of exploits or other crypto disasters. Its most recent balance report puts it at around $1.3 billion. Unless more is recovered, Binance will either fail to make users whole or dip into its own balance sheet — potentially to the tune of 10 figures.

Jessica Lyons (Hacker News):

In September, another software engineer was contacted via a “legitimate job-hunting platform” by someone purporting to be a project director who arranged a series of job interviews for the Binance engineer with the fake company. During the first round - a live video interview with the engineer and a fake HR rep - the interviewer “shared a social media account with him, including personal photos and videos posted on the platform, in order to build trust,” according to the report. “This was more advanced and deceptive than previously seen social engineering approaches.”

The second interview with someone purporting to be the CEO of the phony company was conducted on a “popular social chat app,” and toward the end, the CEO instructed the engineer to download an “assignment” containing a malware-laced code repository. The code executed on his work computer during the setup process, which kicked off a series of unauthorized activities.

According to Binance, the malware replaced a legitimate development tool component with a malicious version, which executed commands and established communication with an attacker-controlled external server. The attackers also took steps to hide the malicious script and evade detection, and it worked. Binance’s endpoint security tools did not immediately detect the malware.

gandreani:

A lot of people are focusing on how irresponsible the engineer was about using the work computer. That’s obviously an issue but the bigger failure mode to me is the Engineer C’s container deployment token.

That’s a huge red-flag. In a company of this size, the deployments should be via CI only. CI isn’t just to increase the speed and reliability of deployments but also to provide a clean room to build the software! Even if it’s a token that was copied and pasted temporarily, the systems in place should not have to require this type of 1. copy 2. paste 3. remember-to-delete the token from my PC.

mSecure Breach

Carly Page (Reddit):

Password manager mSecure has warned customers to change their passwords, reset two-factor authentication, and potentially remove their passkeys after detecting suspicious activity, but it has not explained what happened or whether anyone’s secrets were exposed.

[…]

For anyone with hundreds of passwords stored in mSecure, that’s potentially hours of work. And without knowing what happened, customers have no way of telling which credentials they actually need to replace.

The warning has understandably gone down poorly with customers, who have taken to mSecure’s support forum demanding answers.

Previously:

Tuesday, November 3, 2026

Apple’s Q4 2026 Results

Joe Rossignol:

John Ternus will participate in his first Apple earnings call as the company’s CEO today

Apple (transcript, Hacker News):

The Company posted quarterly revenue of $114.5 billion, up 12 percent year over year. Company gross margin was 47.9 percent, including a favorable impact of approximately 1 percentage point from tariff refunds.

[…]

“Our record September quarter capped off a strong fiscal 2026, with all-time record revenue of $479 billion and double-digit EPS growth,” said Kevan Parekh, Apple’s CFO.

Jason Snell (MacRumors):

iPhone revenue was up 17.5%, Mac revenue was up 23.7%, and Services revenue was up 9.8%. Wearables revenue was down 7.9% and iPad revenue was down 10.4%.

Jason Snell (MacRumors):

Apple CFO Kevan Parekh said it was the best iPhone year in every single Apple geographic segment.

Meanwhile, the Mac—a 42-year-old product!—had its best year ever. Interestingly enough, it wasn’t in total revenue (2021 still holds that record), but in total units.

[…]

Obviously, Apple sees iCloud+ growth as a new place to drive Services revenue.

[…]

This is the reality of Apple’s business right now: It has raised prices across the board, and it’s eating margin.

Newton Gitonga:

Apple is about to feel the squeeze from rising memory prices, with the cost of RAM climbing just as the company heads into its busiest shopping season. According to Reuters, Apple expects to pay more for memory in the December quarter, with the CEO, John Ternus, describing the current price increases as “unprecedented.”

[…]

But that cushion is getting thinner, and Apple expects memory purchases to become even more expensive into 2027.

Stephen Nellis (Hacker News):

Apple said it expects gross margin of 45% to 46% in the quarter ending in December, down from 47.9% in the fourth quarter. It forecast services revenue growth of 8% to 9%, below analysts’ expectations of 10.7%.

The Guardian (Hacker News):

While its rivals are facing investor uncertainty over huge investments in artificial intelligence, Bourne said Apple’s “tepid approach” to AI infrastructure spending had helped preserve its cashflow – while partnerships with companies such as Alphabet could help the iPhone maker strengthen its AI capabilities without taking on the same financial risks as its peers.

Hartley Charlton:

Apple’s research and development (R&D) spending increased by $11.22 billion in fiscal 2026, reaching $45.77 billion, according to the company’s financial statements.

[…]

Apple previously linked its growing development budget to AI. During its April earnings call, CFO Kevan Parekh said AI investment would come on top of spending already planned for Apple’s product roadmap.

Previously:

Update (2026-11-05): Jason Snell:

Now that Apple’s fiscal 2026 has concluded, it’s time for a second set of colorful financial charts, ones that take the longer view and show the changes in Apple’s business over an entire year.

Jeff Johnson:

Adjusted for inflation, peak iPad was actually way back in 2013.

Microsoft Workforce Buyouts Amid Record Revenue

Satya Nadella:

Fiscal year 2026 was another record year for the company. Revenue was $331.8 billion, up 18 percent year-over-year. Microsoft Cloud revenue was $214.4 billion, up 27 percent year-over-year. Azure grew 41 percent year-over-year and surpassed $100 billion for the first time, while Microsoft 365 Copilot reached over 30 million paid seats. And operating income was $155.2 billion, up 21 percent year-over-year.

Microsoft:

Microsoft Corp. today announced the following results for the quarter ended September 30, 2026, as compared to the corresponding period of last fiscal year:

  • Revenue was $92.3 billion and increased 19%
  • Operating income was $45.9 billion and increased 21% (up 22% in constant currency)

Prosper Junior Bakiny:

Microsoft debuted a new reporting structure with two segments this quarter. The first, Agents and Infra, did most of the heavy lifting. Revenue from this unit was $76.8 billion, up 25% year over year. Microsoft Cloud revenue jumped 30% year over year to $63.9 billion, while Azure revenue grew 48% year over year to $33.2 billion.

Alex Halverson (Hacker News):

Microsoft only expects a fraction of the 60,000 employees who received buyout offers Monday to accept those packages and leave the company.

[…]

The buyouts, which cover roughly a quarter of the company’s workforce, come as it tries to control its labor costs while avoiding layoffs.

AbbeFaria:

Ex-MSFT here. I resigned in June, I was an L63. I spent 8 years at MSFT across two stints. My last 18 months at MSFT were deeply unproductive. Constant reorgs, the work not being aligned to my capabilities and unfortunately just the general feeling that I was under worked and had very little opportunity for career advancement.

[…]

In the end, I left off my own volition. In my last 6 months, I did very little work, if at all any. I thought why am I being paid so handsomely for such little and trivial work. I did try interviewing in a few different teams but didn’t make it (Azure Files and Hyperscale DB). If I had stayed, I would have been swiftly laid off or if I was lucky enough last long till this buyout.

Dare Obasanjo:

Earlier this year, Microsoft offered voluntary retirement to 8,750 employees. About 2,625 (30%) accepted.

It then laid off another 4,800 employees in July, followed by hundreds more in September.

Dare Obasanjo:

A high performer at Microsoft (200/200 means they got 200% of target bonus and stock compensation) was advised by their manager to take the voluntary retirement program.

Assuming the previous 30% acceptance rate, Microsoft needs 18,000 people to leave the company. There will be layoffs otherwise.

Previously:

Amazon Changing AI Strategy

Eugene Kim:

Amazon is overhauling its AI strategy, winding down many in-house models, reorganizing teams, and focusing engineers on a new strategy to compete at the frontier, according to people familiar with the matter.

The changes follow layoffs in Amazon’s Artificial General Intelligence, or AGI, organization last week and the shutdown of AGI Lab, a research group it created in 2024 after hiring most of the team behind AI startup Adept.

Joe Wilkins (Hacker News):

Instead, labor and computing power are being diverted toward a singular “frontier-model effort” led by Pieter Abbeel, director of the Berkeley Robot Learning Lab whose robotics company Covariant was hoovered up by Amazon in 2024. At the time Abbeel joined the tech giant, Covariant’s founders were working on AI models for robots, which lines up pretty well with Amazon’s push to automate everything it possibly can.

News of the shift in Amazon’s strategic focus comes a week after it closed one of its key AI offices in San Francisco, an 80-person site specializing in research on artificial general intelligence, the supposed next-level of AI development where the tech obtains human-level intelligence and reasoning skills.

Corey Quinn (Hacker News):

Conveniently, this week Amazon published a treatise by Terk Terkowitz, a VP/Distinguished Engineer/Final Boss of Their Independent Contributor Technical Career Track, on the role of the developer in the age of AI.

[…]

The memo says “If your work does not benefit from current AI tooling, that is a finding, not a failing.” Document it, bring it to your manager, work through the problem. I agree with every word of that! The question is whether anyone’s promo doc is gonna survive citing it.

Here’s what happens next. The memo concedes that input metrics are “deeply flawed,” but then in the next paragraph says to go ahead and use them anyway, carefully. It then warns that non-adopters are falling behind. Those are three different positions within three sentences and they’re not at all aligned with one another.

Previously:

Lost Access to 1Password Mac Apps

Charles C Counselman III:

About 15 seconds after it was launched, it would quit because, it said, I had done nothing for 60 minutes. After this had happened several times, consistently, l went to 1Password’s Support website. I read all the info and advice there, but I found nothing relevant, so I e-mailed support@1password.com. I got a reply saying, yes, that happens when you migrate to a Mac with Apple Silicon. You must uninstall 1Password, then download and install the latest version.

[…]

The fresh version of 1Password exhibited the same bug.

[…]

I launched 1Password on [my old] Mac. It opened and declared that it could not do anything for me because my account had been closed. I had not closed my account, at least not deliberately.

[…]

After more than 72 hours, AgileBits has not replied to my bug report and request for help.

He is able to access the passwords via Safari, so I guess the message about his account being closed was in error. It’s still possible to use passkeys, as the browser extension can talk to the 1Password server without needing the app.

I still miss the 1PasswordAnywhere feature, which let me access all my passwords locally, without relying on an app.

Previously:

Update (2026-11-04): rckingsley and others in the 1Password forum are seeing a similar issue:

For me, the macOS 1Password app (not the extension in the browser) automatically locks after 10 seconds of being unlocked - even though under the password (to unlock 1Password) it says “1Password locked after 10 minutes of activity”.

I’m running macOS Golden Gate 27.2, and 1Password for Mac 8.12.42.

[…]

Fortunately, the 1Password extension in Safari stays open, so I can copy the password from there (for doing things with different macOS apps that require a password). However, I don’t have access to my Favorites, cannot create a backup .1PUX file quickly enough, and other tasks where the browser extension isn’t appropriate.

Charles C Counselman III:

More than four days – 96 hours – have elapsed since I reported this bug to AgileBits and requested help. I am still waiting for help.

[…]

MacDrew2000, thank you for suggesting that I try to access my 1Password account via the 1Password app in my iPhone. I tried, but all I got was an error message saying that my account had changed.

Doug Hogg:

1Password invited me to activate “A native macOS AutoFill Experience”.

Monday, November 2, 2026

Golden Gate Does Not Actually Support CoreStorage

Wade Tregaskis:

macOS 15 Sequoia had a hard time with CoreStorage and HFS+ volumes, since it deprecated both technologies and callously crippled some important tools for working with them, but nonetheless it mostly still worked.

[…]

Not only does Golden Gate just not support CoreStorage or HFS+ volumes, out of the box you can’t do anything with them – can’t mount them, can’t convert them to APFS, can’t even erase them. It renders your expensive storage hardware completely useless.

Worse, macOS 27 puts up a misleading dialog, upon boot, saying that macOS 28 (the next version) won’t support these volumes. I have no idea what Apple’s doing or thinking. Maybe it’s all just an embarrassing misunderstanding – the file system team told the notifications team that CoreStorage & HFS support is gone, and typoed the version number as 28 rather than 27?

Apple also wrote an article this summer saying that CoreStorage volumes would be supported in macOS 27 and that unencrypted HFS+ would be supported in macOS 28.

Tregaskis says that macOS 27 does not support “CoreStorage or HFS+,” but in my testing plain HFS+ volumes do work.

Previously:

Update (2026-11-04): See also: Hacker News.

Missing Logger Symbol on macOS 15

Jeongki Park:

The SDK marks Logger.isEnabled(type:) as available since macOS 11, but macOS 15.6.1’s libswiftos doesn’t have it.

[…]

For four days [my app] quit at launch on macOS 15, and I didn’t know.

[…]

OSLog has its own isEnabled(type:), which goes to the C function os_log_type_enabled, there since macOS 10.12. So I keep an OSLog handle, make the Logger from it, and ask the handle[…]

Previously:

Anthropic S-1

Carly Page (SEC, Hacker News):

Anthropic has filed for an IPO that could rank among Wall Street’s biggest ever, revealing an $80.7 billion half-year loss, a startlingly complex governance structure, and warnings that its AI models could blackmail humans, resist shutdown, or create “existential risks” to society.

[…]

The Claude maker reported $16.3 billion in revenue for the first six months of 2026, up from $1.2 billion a year earlier. It also posted a whopping $80.7 billion net loss, although $72.4 billion of that was an accounting adjustment tied to the company’s soaring valuation, not money it actually spent.

Anthropic’s operating loss was considerably smaller at $693 million, down from $2.1 billion a year earlier. By its own adjusted accounting, the company made a $1.6 billion operating profit in the first half of 2026, for a margin of around 10 percent.

[…]

The seven co-founders will retain 50.1 percent of the voting power on shareholder matters, while a separate Long-Term Benefit Trust will get to appoint a majority of the board. In other words, Wall Street is being invited to bankroll Anthropic’s AI ambitions, but not necessarily to call the shots.

Brandon Vigliarolo:

Anthropic is going to need to do a lot to make its massive IPO more than just a flash in the pan[…] For one, the company has nearly a trillion dollars in compute commitments to pay for, which is going to mean it’ll be burning through more cash than a datacenter gas turbine turned up to 11. In addition to its massive spending for the foreseeable future, there’s also the fact that much of its computing power relies on customers who are also competitors.

Ashley Capoot (Hacker News):

Anthropic reported updated financials as part of an amended Form S-1 filing with the Securities and Exchange Commission on Monday, giving investors a more comprehensive look into the state of its business.

The artificial intelligence company said it generated $33.24 billion in revenue for the nine months ended Sept. 30, up roughly 1,200% from the same period last year. It reported a $104 billion net loss during the period, though most of that was due to the change in fair value of convertible notes and derivative liabilities. Anthropic had a loss of $25.1 billion over the same stretch in 2025.

[…]

During its third quarter, Anthropic generated roughly $17 billion in revenue, up about 1,127% from the same period last year. Revenue growth slowed on a quarter-to-quarter basis, however. Third-quarter revenue increased around 47%, a steep drop from 144% growth in Q2 and 132% in Q1.

The company reported a net loss of $23.29 billion during its third quarter.

Previously:

Ed Zitron’s AI Predictions

Tommy Craggs:

In his day job, Ed Zitron runs a boutique public relations firm called EZPR. This might surprise anyone who has come to know Zitron through his podcast or his social media or the newsletter in which he writes two-fisted stuff like “Sam Altman is full of shit” and “Mark Zuckerberg is a putrid ghoul.” Flacks, as a rule, tend not to talk like this. Flacks send prim, throat-clearing emails to media people who do, on rare occasions, talk like this.

[…]

We were talking about whether any of Zitron’s ranting about the AI industry had cost him business on the PR side of the ledger. He said no.

[…]

He has built an improbable little empire for himself out of tart commentary like this. His weekly podcast, Better Offline, about “the tech industry’s influence and manipulation of society,” has cracked Spotify’s top 20 among tech shows, and his newsletter, Ed Zitron’s Where’s Your Ed At, has grown north of 80,000 subscribers. The Ed Zitron media experience also includes a scrappy Bluesky account, a football podcast, some occasional baseball writing, a lot of to-and-froing with the users of r/BetterOffline, and a book due next year about, as he puts it, “why everything stopped working.” In other media, he has become a go-to source for AI naysaying. When Slate’s What’s Next: TBD podcast or WNYC’s On the Media needed someone to talk about the bursting of the AI bubble, they called on Zitron. It isn’t just the volume of output that has put him on the map; it is the aggrieved style that he brings to criticisms of media figures and industry titans alike.

Nick Heer:

Each of Zitron’s articles is an impenetrable wall of text often reaching into the tens of thousands of words. This volume of material feels substantial — it can be substantial — to the extent Zitron explicitly markets his newsletter on the basis of its word count. Weird. He explores basically two major themes: A.I.’s economic case, and its usefulness. Zitron is zealously opposed to the possibility of either in real terms; while he will occasionally gesture at people or businesses doing something with A.I., his default position is more-or-less that it has little use.

Dan Luu (Mastodon, Hacker News, Kyle Hughes):

I was curious how well the predictions of the most widely cited AI skeptic I’ve seen (Ed Zitron) have done, so I looked at how his predictions panned out. To disclose my own biases, I’ve never had a particularly strong pro or anti AI progress position. For example, in 2022, I did a comprehensive look at predictions Futurists made, including well-respected folks like Kurzweil and found them to be generally wrong on both the prediction results as well as the reasoning. On the flip side, in 2015, I wrote about how people were underestimating AI’s ability to displace humans in jobs and have repeatedly been on the record as saying that many people are underestimating AI’s ability to displace humans from jobs. My position on AI has been extremely boring and is basically, “if something is currently happening, the people who are saying that it’s impossible that it will ever happen are probably wrong”.

[…]

Zitron says Cursor is dying and expects that it will sell for a firesale price; a price as high as $10B is not plausible [It sold this year for $60 billion.]

[…]

In response to the question, “If you had to guess, what is the timeline we are looking at for the AI bubble to pop?”, Zitron answers, “No later than Q2 2026"

[…]

After this point, most further predictions that I saw were either non-falsifiable or resolve in the future. Note that I didn’t attempt to catalogue statements that are nonsensical or were simply factually incorrect statements at the time, such as his December 2024 claim that “Generative AI’s products have effectively been trapped in amber for over a year” or his January 2026 claim that “[models are] basically the same as they were a year ago. They have the same efficacy”. Zitron has not only made forward-looking statements that AI capabilities will not improve, he’s also consistently made backwards-looking statements that capabilities have not improved which, while obviously false at the time, seem to play well to his base (along with his other false statements). If you connect all his statements together, it’s implied that AI had the same capabilities in January 2026 as they did in December 2023 (and if you connect later statements, it’s actually implied that capabilities in August 2026 are the same as in December 2023, though to be fair to Zitron he frequently contradicts himself and has also admitted to limited improvement in mid 2026).

Nick Heer:

The beauty of Zitron’s voluminous output, for him, is that there is a vast difference between what he actually writes and what people remember. Financial experts and more reputable journalists have raised plenty of concerns about how much money is being spent on developing this infrastructure, and how highly these companies are valued. But the words Zitron writes are far more incendiary and conspiratorial than many seem to remember. It is frustrating to see his many media experiences filling the role of the A.I. skeptic when there are far more qualified, sober, and accurate options. We have enough boosters; this is an industry that is co-signed by the world’s most powerful economies. We deserve better A.I. criticism in popular media.

yousif_123123:

Things in general I think he’s right about:

  1. Revenue if anthropic and openai is unlikely to grow to the high levels they need to pay for their commitments. Many of their heavy users (coding) will eventually offset a lot of usage to more efficient and cheaper open weight models. I know of people in a company I was at that spend thousands of dollars a month on tokens. I am sure that what they’re using it for can be substituted in large part by way cheaper models.

  2. A lot of corporate AI usage is being pushed by management that doesn’t really understand the extent of its useful, and just wants to call themselves an AI-first company.

  3. If this datacenter build-out proves to be beyond the actual demand, there might be a big economic crisis as to how much of the financial system is getting tied up with it (insurance money, private credit).

Whether openai and anthropic actually die, I’m not sure. But I don’t think they’ll be the next big tech companies. I think eventually they’ll be absorbed by others.

The whole thing I think, can be summarized as: LLMs will be commodity like. And it’s price will go down and eventually will run locally, it’s not at all clear that this will bring AGI and that it’s worth infinite amount (or trillions) of investment ahead of the actual demand or the AGI level do-it-all-for-you AI being reached.

Previously:

Friday, October 30, 2026

Xcode 27.2

Apple (xip, downloads, Xcode Releases):

Xcode 27.2 includes Swift 6.4 and SDKs for iOS 27.2, iPadOS 27.2, tvOS 27.2, watchOS 27.2, macOS 27.2, and visionOS 27.2. Xcode 27.2 supports on-device debugging in iOS 17 and later, tvOS 17 and later, watchOS 10 and later, and visionOS. Xcode 27.2 requires a Mac running macOS Tahoe 26.6 or later.

[…]

When used via Sidecar or a MacBook with Touch, Device Hub now sends touches on the iPad screen to the remote device as touches. This allows you to use multi-finger gestures such as pinch and rotate to test your applications.

[…]

Projects that use APIs specific to iOS 27.1 show compile errors when building for Mac Catalyst (“undeclared identifier”, “not found”, “has no member”, “cannot find”, and similar errors).

[…]

macOS, watchOS, tvOS, and visionOS SDKs in Xcode 27.2 incorrectly report 27.1 as a valid deployment target. Builds and other functionality might have unexpected behavior if this deployment target is used.

Ron Elemans:

Every time I open a complex Storyboard in Xcode 26 or newer, the Inspector panel decides at a certain moment to resize to full window width. The only way to continue working is to hide the whole Inspector, resizing back doesn’t work.

Feedback Assistant shows “Recent Similar Reports: Less than 10” for at least a year. This is probably Apple language for “Deal with it, otherwise stop using dinosaur tech and switch to SwiftUI” (FB23611443).

Previously:

South Korea Fines Apple Over App Store

Marcus Mendes:

South Korea’s Korea Media and Communications Commission (KMCC) announced today a series of fines and corrective orders against Apple and Google over violations of the country’s Telecommunications Business Act.

Specifically for Apple, the KMCC imposed a fine of 20.81 billion won (approximately $15.5 million) and ordered the company to revise its App Store policies regarding payment methods and app review procedures, as well as prevent what it referred to as “discriminatory commission” practices from recurring.

[…]

In essence, the decision centers around three violations: forcing specific payment methods, unfairly delaying app reviews, and imposing discriminatory commissions.

Previously:

Taiwan: 26% App Store Fee

Apple:

Apple is making changes to the Taiwan storefront of the App Store, following discussions with the Taiwan Fair Trade Commission.

As of October 31, 2026, the commission rate for standard Apple In-App Purchase and paid app transactions will be 26% on the Taiwan storefront of the App Store on iOS and iPadOS.

Juli Clover (Marcus Mendes):

Apple normally charges a lower rate for Small Business Program members, but the announcement about the Taiwan commission changes doesn't include that information.

Previously:

Australia: App Marketplaces, External Payments, No Fees/Audit

Hartley Charlton (Hacker News):

Australia’s Federal Court today ordered Apple to allow competing app stores, direct app downloads, and alternative payment services for Australian users from March 1, 2027.

[…]

Apple must let users find, download, install, and update apps through competing marketplaces and websites without charging for access or obstructing their use. Developers must receive the necessary tools on substantially the same terms as for App Store distribution, and Apple cannot penalize them for using competing stores or payment services.

Developers will also be able to offer alternative payments and link to other ways to pay, including within App Store apps. Apple cannot require them to offer its own purchasing system alongside alternatives, report those transactions, or allow Apple to audit them.

Apps will be notarized, but Apple cannot collect fees on purchases not made through the App Store. This seems like the best antitrust result yet. This will take effect on March 1, 2027 unless blocked by Apple’s appeal or request for extension.

Marcus Mendes:

Today’s order follows a ruling last year that Apple violated Australian competition law by restricting alternative app distribution and payment methods, in a lawsuit brought by Epic Games similar to its long-running legal battle with Apple in the US.

[…]

Justice Beach described the latter two actions as “a paradigm example of Apple’s enforcement of its restrictive terms, in contravention of” section 46 of Australia’s Competition and Consumer Act 2010, which prohibits corporations with substantial market power from engaging in conduct that has “the purpose, or has or is likely to have the effect, of substantially lessening competition” in that market.

[…]

When it comes to Apple’s wins in the decision, the list is much slimmer. Judge Beach rejected Epic’s request to extend the court’s injunctions worldwide and allowed Apple to maintain security scanning and notarization requirements for apps distributed outside the App Store. And while Apple must permit competing app marketplaces on iOS, it is not required to distribute them through its own App Store.

[…]

Finally, the court ordered Apple to pay 85% of Epic’s legal costs incurred through the original trial[…]

Nick Heer:

It seems unsustainable to keep dripping out rule changes one country at a time, especially as many of them slightly differ in the details even when regulators’ overarching aims are similar. The reasons for the company’s stubbornness — namely: security and privacy — become much less believable as a growing number of regions require alternative distribution channels, essentially without issue.

Apple should just rip off the bandage and do Gatekeeper for iOS.

Hartley Charlton:

Fortnite will return to Australia’s App Store today, Epic Games told Reuters, after a federal court ordered Apple to allow eligible Epic apps back onto the store.

Previously:

Russia Wants User Data From Apple

Hartley Charlton (Hacker News):

Apple faces Russian data retention and disclosure requirements after being added to the country's state surveillance registry, Bloomberg reports.

[…]

Those obligations cover correspondence and messages containing audio or video. Companies must also keep information identifying users and recording the transmission of their communications within Russia for three years.

I guess this could include iMessage, iCloud mail, iCloud Photos, and perhaps iCloud backups. I have not seen whether they want an iCloud Advanced Data Protection backdoor.

William Gallagher:

That data must be stored on servers within Russia, and it must be turned over to the country’s security services as required.

Neither Apple nor Microsoft has yet commented publicly on the new requirements.

Previously:

iPhone Duo Crackgate

Juli Clover (forum):

Some iPhone Duos are already experiencing hinge issues that cause display cracks, based on photos shared on Reddit and the MacRumors forums. Almost all of the display faults are right along the hinge, and most result in a line of bright pixels across one side of the screen.

Juli Clover (iFixit, Hacker News):

iFixit commented on some of the display failures people have been seeing, suggesting they could be caused by pressure, a trapped particle, repeated bending, or a manufacturing defect. It may not be that the display has physically snapped, because a wiring problem can cause the same effect.

Where most of the faulty units are experiencing issues, the hinge has a different shape. The failure spot is also near where the accordion cable passes by and where several edges meet, which could be leading to a concentration of stress in that spot.

Terrence O’Brien:

Social media and the iPhone Duo subreddit are filled with reports of Apple’s foldable failing quickly and in spectacular fashion. Some users report having the phone for only a few hours before the hinge seems to catch on something, then audibly crack and break the screen. Tellingly, the cracks all seem to happen in the same place.

YouTuber CuriousHagi was able to reproduce the cracked screen during some durability testing of the iPhone Duo. Then he pulled it apart to try and find the culprit. What he found is that the Duo’s hinge is quite complex, consisting of a gear-like central hinge and two different types of linking hinges.

The piece that broke is one of the links in the middle of the phone that happens to be thinner than the links below or above it, and it snapped at a small notch where it would be weakest. He also found marks where the hinge met the support plate, indicating where it may have gotten caught.

Mark Gurman:

In these cases, customers reported hearing a crunching sound when unfolding the phone, followed by a large crack forming along the center crease. Some users also experienced a white patch or other display malfunction on the right side of the screen.

[…]

Apple acknowledged the issue in a statement, saying it was “aware of an issue impacting the inner display on a small number of iPhone Duo units.”

Juli Clover:

It is our understanding that some of the images of alleged cracking are AI-generated, which makes it harder to determine the actual scope of the problem.

Many of the iPhone Duos experiencing issues cracked in the same place on the lower half of the inner display. The crack is along the hinge, and users say there is a stuck feeling and sometimes a popping noise just before the damage appears.

Previously:

Update (2026-11-02): Joe Rossignol:

If a customer reports the issue, Apple advised technicians to inspect the iPhone Duo and repair or replace it in accordance with their standard procedures. While the instructions themselves are straightforward, the fact that Apple issued an internal memo suggests the issue is widespread enough to warrant official guidance.

[…]

Apple said there is no iPhone Duo recall, and the company has yet to launch a public-facing repair program on its website for this issue.

Thursday, October 29, 2026

eMudhra Intermediate CA Compromise

Dan Goodin:

Security personnel around the world are on high alert Tuesday following the discovery of eight TLS certificates with private keys so weak they could allow anyone to mint trusted browser and app credentials for any site on the Internet.

As of late morning Tuesday, browser makers and some major apps and programming languages had blocked all eight of the intermediate certificates.

[…]

“This will be a massive cleanup job, bigger than Heartbleed,” Filippo Valsorda, a cryptography engineer and a cryptography maintainer for the open source Go programming language, told Ars. “There will be a very, very long tail, IoT devices, Docker containers, forgotten Linux machines, unmaintained CLI tools that shipped their own copy of the roots (which is common in some ecosystems, like Python). Also, Linux distributions are still rolling out updates, some of them are not ready yet, and then system administrators will need to apply them to a lot of machines.”

[…]

The compromised eMudhra keys were defective at a level that’s challenging the imagination of many of the engineers studying the incident. A normal size for a NIST P-384 elliptic curve cryptography private key contains roughly 384 bits of entropy, a size allowing almost 2384, or a number with 116 digits, different possibilities. The private key sizes of the compromised keys ranged from 3 to 8 bits. Astonishingly, the private keys were 4, 56, 66, 115, 155, 156, 230, 237.

[…]

Ben Cartwright-Cox, director of BGP.tools, said: “My guess is that it’s example code that accidentally leaked to production, but hard to know. But it’s bonkers that no one noticed.”

Apple (Hacker News):

On 19 October 2026, Apple began blocking these 12 certificates on Apple devices. Updates to certificate configuration data are sent to devices automatically and as needed, so you don’t need to install a software update to get this change. Apple is making additional updates to this block, which will also be delivered automatically. On 23 October 2026, Apple also began blocking the emSign ECC Root CA - G3.

[…]

On Mac, some command-line tools included with macOS or the Xcode Command Line Tools (including curl, git, python3, ruby, perl, and openssl) check certificates against /etc/ssl/cert.pem. For certificates that chain to a root CA certificate in this file, these tools don’t check Apple’s block or whether the certificate has been revoked. This file will be updated in a future macOS update. If you use these tools and don’t want to wait for the update, you can remove root CA certificates from the file.

[…]

These steps affect every tool that uses /etc/ssl/cert.pem. Afterward, tools that use only this file might not be able to verify some websites whose certificates chain to these root CA certificates through intermediate CAs that weren’t affected.

emudhra.we-have-a-problem.com (Hacker News):

Apple has warned that until it ships its own fix, a macOS update may replace /etc/ssl/cert.pem. You may need to repeat these steps after each update.

See also: Filippo Valsorda, Howard Oakley, and TidBITS-Talk.

Previously:

Update (2026-11-02): Howard Oakley:

Apps written using standard Apple APIs, including many of mine, use the macOS trust store, which Apple updated between 19-23 October to block eMudhra’s compromised certificates. Those updates don’t appear in any common sources of information like System Settings, SilentKnight or even SystHist, though. If you want to confirm that your Mac or device has been updated, the best test is to view the checks Dennis Jackson generously provides, using Safari or another app that you know uses the macOS APIs.

[…]

Problems get worse once you look beyond macOS itself. Among the many apps that maintain their own trust stores, rather than using either of the above, are Google Chrome, Chromium-based browsers, Mozilla and Microsoft products, and some Electron apps. For those you’ll need to update that app to a version whose trust store has been updated to block the compromised certificates. But how can you tell whether that’s required for an app other than a browser? Others could also be affected if they use a language like Python, Java, Go, or possibly Rust or Ruby. Compiling a list of all Mac apps that might need their internal trust stores updated is a daunting task, and unlikely to happen.

If you were using the internet back in 2014, you may recall the chaos that resulted from Heartbleed, a severe vulnerability in OpenSSL 1.0.1, a precursor of TLS, leading to mass compromise of certificates and over a year of global insecurity. While eMudhra’s compromised certificates aren’t on the same scale, they demonstrate how little we learned from that.

Wednesday, October 28, 2026

Developing Mac Apps for Touch

Design for touch on Mac (via Jeff Nadeau):

Discover the key design considerations for updating your app for touch on macOS. We’ll explore the touch gestures now available on Mac, how system gestures work, how to size controls and touch targets while keeping your app great with a pointer and keyboard, and how to adapt hover interactions. Finally, we’ll dive into the expansion behaviors of native controls like steppers, dials, and sliders, and what that means for your app.

Bring Touch to your Mac app:

Discover how to add touch capabilities to your Mac app. Explore how to transition from classic mouse tracking APIs to modern gesture recognizers and touch-native controls. Find out how to optimize hit targets, implement multi-touch interactions, and manage system gestures to deliver an incredible touch experience. To get the most out of this session, watch Design for Touch on Mac.

Bring Live Activities to Mac:

Discover how to drive Live Activities from your Mac app. Explore how Live Activities appear in the menu bar and Dynamic Island. Learn how to define your data model, create compact and expanded views with SwiftUI, and drive interactive updates using App Intents.

Written documentation is “coming soon.”

Previously:

Update (2026-10-29): See also: Hacker News.

TN3216:

On a Mac with a touch display or a Sidecar-connected iPad, AppKit emulates mouse events from touch, so existing games can receive touch input with little or no code change. This guidance focuses on configurations common in games, such as an app with a single view backed by a CAMetalLayer. For more information about touch support in AppKit, including the view hierarchy and hit-testing mechanism, see Handling AppKit gestures.

Jeff Nadeau:

Another app development tidbit for the new MacBook Pro: the bottom screen corners on this Mac are rounded, and AppKit prefers to keep your window corners concentric with the display instead of clipping them.

For content inside the window, you can use APIs like NSView.LayoutRegion, UIView.LayoutRegion, GeometryProxy.containerCornerInsets, and containerCornerOffset to easily constrain your layout against the changing radius.

Steve Troughton-Smith:

In the developer videos today, I got the impression that full as-seen-on-MacBook-Pro touch support won’t be available in macOS until 27.3, and the APIs for it are in ‘the next SDK’. Indeed, a lot of the behaviors they showed today are not present when using 27.2 via Sidecar

Nick Lockwood:

I saw a post about the incredible engineering effort that went into retrofitting multitouch support into AppKit’s creaky old event handling, and while that was undoubtedly good work by talented engineers, it’s also a massive expansion of potential bug surfaces in one of the few remaining stable parts of the OS left over from the days when Apple’s quality control was still pretty decent

Steve Troughton-Smith:

macOS & iPadOS are on a collision course, no matter what the party line is. Both these platforms now have to solve the same problems for the same input devices, and they’re making the same choices for how to approach it pretty much every time.

[…]

I’m more convinced than ever that there is a future where you run AppKit apps on iPad. I don’t know how long it’s going to take for us to get there, but what I don’t think it will be is just putting macOS on iPad. There’s a successor to iPadOS and macOS both, with a completely shared userland, that’s waiting to be born.

Previously:

MacBook Pro (PROLED XDR Display)

Apple (technology overview, Hacker News, MacRumors, 9To5Mac, ArsTechnica, Slashdot):

Apple today introduced the all-new MacBook Pro with PROLED XDR Display, featuring breakthrough tandem OLED technology that delivers game-changing front-of-screen performance. Available in 14- and 16-inch models, MacBook Pro with PROLED XDR Display offers a visual experience unlike any other, transforming pro workflows with up to 2000 nits peak HDR and SDR brightness, an industry-leading 10,000,000:1 contrast ratio for exceptional detail, a 120Hz variable refresh rate, and a wider color gamut covering both P3 and Adobe RGB for brilliant colors. The new MacBook Pro also introduces intuitive Touch capabilities on the Mac for the first time, opening up a whole new dimension for pros to interact with their content, from manipulating 3D models to playing musical instruments onscreen. The Dynamic Island now comes to Mac, serving as the home for Spotlight, Live Activities, and Siri AI. And with up to 24 hours of battery life in thinner and much lighter 3- and 4-pound designs, MacBook Pro is more portable than ever, empowering pros to take their work wherever inspiration strikes. Featuring M5 Pro and M5 Max, Apple’s most powerful chips ever built for a pro laptop, along with up to 128GB of unified memory and now up to 16TB of blazing-fast storage, the new MacBook Pro delivers speed and capability for the most demanding workflows.

[…]

Crafted specifically for the Mac, every touch interaction feels incredibly responsive and refined. Everyday tasks are simple and intuitive, allowing users to scroll through a webpage with a natural swipe; pinch to zoom in on a photo; drag and drop slides from one presentation to another; and double-tap a window to fill the screen, or flick to tile it into place. And the touch sensor is built directly into the display panel — not layered on top of it — reducing latency so users feel like they’re touching the content itself.

Touch also introduces entirely new ways of working for pro users. Graphic designers can now use the entire display as their canvas, no longer constrained by the area of the trackpad when drawing; musicians can play software instruments right onscreen; and app developers can test how Touch performs in their iOS and iPadOS apps directly on the MacBook Pro display.

[…]

The 14-inch MacBook Pro now weighs half a pound less at 3 pounds, while the 16-inch MacBook Pro weighs just 4 pounds — 0.7 pounds lighter than before. Both models feature a slimmer design enabled by OLED’s more efficient display stack, with the 16-inch model nearly a millimeter thinner and the 14-inch model half a millimeter thinner.

Juli Clover:

Pricing on the MacBook Pro starts at $2,899 for the 14-inch model and $3,399 for the 16-inch model.

The base configurations have an M5 Pro with 24 GB of RAM and a 1 TB SSD.

This all sounds technically impressive, but these Macs don’t really interest me. I don’t need the better display; I rarely use the internal one, anyway. And I don’t want to touch my display; it seems less efficient, with horrible ergonomics, and I don’t want to get gunk on it.

I do like that the new MacBook Pros are a bit lighter, seemingly with no compromises.

The Dynamic Island does seem better than the Notch, but the problem with the Notch is mostly software, not hardware. There’s no indication that the software will be better, though at least the Dynamic Island is smaller.

What would I rather see in a new MacBook Pro? A smaller trackpad, a rounder front edge, more USB ports, Face ID, cellular.

John Gruber:

So I’m just wondering if tomorrow’s new touchscreen OLED MacBooks aren’t replacements for the current MacBook Pros, but instead are the start of a new MacBook family with another name. I don’t think they’d call them MacBook “Duos”, because they’re not two-in-one devices. MacBook “Ultras”, maybe — with the same specs as the MacBook Pros but more expensive displays? But “Ultra” seems like a wrong name for a MacBook because Apple’s M-series Ultra chips are (to date at least) desktop only. It’d be weird if the M5 Ultra is exclusive to the Mac Studio while the MacBook “Ultra” maxes out with the M5 Max. So maybe they just are the new MacBook Pros and this first OLED/touch generation uses the same chips as the ones from March?

“Ultra” never made sense, so I wondered whether Apple would add some other moniker like “Touch” or “Studio.” It turns out not, but “PROLED XDR Display” doesn’t exactly roll off the tongue, so something like “MacBook Touch” may end up being the defacto name, anyway.

Hartley Charlton:

The iconic glowing rear Apple logo is returning to the MacBook Pro with the latest model, Apple today announced.

John Voorhees:

The MacBook Pro does not, however, support the Apple Pencil.

John Ternus:

We’re glowing with excitement over the new MacBook Pro. You’ve gotta touch it to believe it.

Tim Cook:

We brought Touch to the Mac!

Steven Levy (MacRumors):

This turnaround is a big deal to Apple fans. Ternus shrugs off the drama. “The Mac is first and foremost an indirect input device, built around the trackpad and keyboard. But I think there’s times when it’s comfortable and handy to have touch.”

[…]

When I met with Apple executives Johny Srouji and Greg Joswiak this week to discuss the touchscreen MacBook Pro, you bet I invoked Schiller’s list of concerns. (Apple’s reps chose not to make Schiller, who now holds the title of “Apple Fellow,” available for an interview. In fact, they laughed when I asked.) It wasn’t only Schiller drawing a red line. In 2021, Ternus told journalist Joanna Stern, “The Mac is totally optimized for indirect input. We haven’t really felt a reason to change that.”

“Ten years is a very, very long time,” says Srouji, Apple’s chief hardware officer. “Many things have changed, whether it’s the display technology, the custom silicon, et cetera.” Eventually, he told me, the confluence of chips, display tech, and software architecture “met our bar.”

[…]

Joswiak, who holds Schiller’s old title of SVP of worldwide marketing, concedes that touch was overdue, at least for users with sophisticated needs. Its pro customers—engineers, scientists, software developers, and media creators—were impatient with Apple for its failure to let them interact directly with the screen. “Most pros own an iPad, and almost every pro owns an iPhone,” Joswiak says. “So this is something that they’re natural with. There’s a generation of young creators and young people using our MacBook Pros that expect to touch.”

Jason Snell:

Another question I had coming into this event was just how much effort Apple would make to adapt the macOS interface for touch. The answer is: A little, but not a lot. When you touch the screen, the interface makes subtle adaptations—more spacing in menus, more feedback when selecting and dragging items—but what it doesn’t do is flip into some new Touch Mode that looks and behaves totally unlike the Mac.

Federico Viticci:

Here is the same contextual menu on macOS activated via pointer (left) and touch

macOS automatically detects touch input and spaces out items a little bit more in the UI

TheRealAlex:

So I need to know what is the reason you need a Touchscreen on your […] Laptop?

What are you doing?

Paul Haddad:

The PROLED (🤮) display seems to have all the expected specs for a high end OLED. The sub pixel layout is unusual, at least I haven’t seen any others with this style. It’s an interesting choice since standard RGB is the next “big thing” with desktop OLEDs.

I wonder if Apple re-added sub-pixel rendering to the OS or just don’t bother since the PPI is high enough to maybe not matter.

See also: Mac Power Users Talk.

Previously:

Update (2026-10-29): Jason Anthony Guy:

The overall MacBook Pro design hasn’t radically changed. “Thinner” translates into a few (always welcome) millimeters shaved off each dimension, while “much lighter” is a more noticeable weight reduction: 0.4 pound for the 14-inch and 0.7 pound for the 16-inch (nearly 15% less than the 16-inch M6 MacBook Pro).

He has a chart.

M.G. Siegler:

I know Apple is very proud of their XDR technology, as they highlight it in the branding of their displays wherever they can. But I just can’t imagine anyone outside of Cupertino actually cares. It has always sounded like a brand Dell came up with, not Apple. And ‘Display’ is just silly. It suggests that no one knows what ‘XDR’ is!

[…]

Yes, it has a touchscreen, but it’s just a feature, not the main event – hence, the naming. If you call it the MacBook Pro Touch or the like, it signals the capability as the marquee feature. Apple is playing it up as a nice-to-have addition, made possible by their new screen technology, not vice versa.

Nick Heer:

And just look at the quote above: Apple does not even mention touch features — sorry, “Touch capabilities”, with a capital T — until the third sentence. If anything, this is a MacBook Pro with a nicer display that happens to support touch.

[…]

For that $400, you get an ostensibly nicer screen that supports touch input and has a Dynamic Island instead of a notch, and a lighter and thinner chassis.

[…]

What you do not get, though, is a true hybrid of an iPad and a Mac. The display does not fold back to create a tablet, for example, and it does not support Apple Pencil input. Yet. Apple also has not managed to reinforce the human arm or fix the ergonomic issues it has repeatedly identified when it was not selling a Mac with a touch screen.

Tom Warren:

Apple hasn’t tried to reinvent the wheel here like Windows 8, or create a Yoga-style folding laptop. It’s added the touchscreen support that pro users have been demanding for years. That seems fine because touchscreens didn’t exactly revolutionize laptops in quite the way people maybe expected a decade ago.

I rarely use touchscreens on a clamshell laptop, reaching out occasionally to swipe away notifications and pinching to zoom into photos and maps. I use touch a lot more on a device like the Surface Pro, whose form factor is very different from the MacBook Pro’s.

Rui Carmo:

Given that I have been using touchscreen laptops for decades and (like I quipped to Miguel de Icaza the other day) pretty much only use the touch screen for hitting “Cancel” on dialog boxes when I’m standing near the laptop (because the ergonomics of raising your arms off the keyboard have always been questionable), I’m not terribly excited by the fact that Apple has finally caught up hardware-wise.

John Gruber:

After a long fun day of hands-on exploration, briefings, and a slew of demos, not just most, but all of my concerns about touchscreen support adversely affecting the Mac UI have been allayed. I love it.

Adam Engst:

I’m more skeptical about the touch interface, not because I think it’s a bad idea, but because it will be tiring to use for any amount of time, so people won’t use it as much as they might. Plus, because rich touch interfaces will require developer support, it’s not obvious to me that it will catch on. Touch may end up like the poorly supported and unloved Touch Bar, though it’s easier to ignore if you don’t want to use it, and there’s no downside to having it available.

Federico Viticci:

Steve Jobs was right about many things, but I’ve long disagreed with his take on the “terrible” ergonomics of touchscreen laptops. Sure, you don’t want to be forced to interact with a laptop display that sits perpendicular to the keyboard at all times. But for the occasional interaction that benefits from direct manipulation of content – whether that’s zooming on a picture or rotating a 3D object or game character with your fingers – it’s nice to have a secondary input method that does not rely on a UX abstraction such as a trackpad.

[…]

The lack of touch on the Mac feels like a self-inflicted problem that has no reason to exist anymore, and which John Ternus is rightfully rectifying for the modern age.

George Black:

It’s not about doing new things. It’s about reducing friction, rounding off a few sharp corners in your workflow.

I still don’t get it. I just don’t see any benefit to touching the screen—especially in order to zoom a picture. Ergonomics aside, touch seems slower (you have no acceleration or multiplier) and less precise to me. But I’m glad they’re happy.

John Voorhees:

Perspective means knowing when to give up past dogma and embrace today and what’s to come.

The problem I have with this sentiment, which I’ve heard a lot, is that I’m not really seeing a reason to change one’s mind. You could argue that Jobs was mistaken about the ergonomics or utility, but I don’t think that’s the case. Or you could argue that conditions have changed such that once solid arguments are now moot. But people like Joswiak aren’t really doing that either—they just state that young people “expect” touch screens. Apple has always prided itself on doing what it thinks is good even when that’s not what what people expect.

If touch is better, Apple should be extolling its advantages and encouraging everyone to use it. If it’s not better, but merely more familiar to some users, we should be helping them learn what mice and keyboards can do.

Jeff Johnson:

The saddest part about the “people expect touch screens” defense is that people are missing out on the power and productivity of keyboards. Instead of catering to familiarity and ignorance, the lowest common denominator, we ought to be teaching people how to take advantage of keyboards. Remember when computers were supposed to be bicycles for our mind? Now the tech oligopolies want people permanently on training wheels.

Jeff Johnson:

Ironically, people like me who were introduced to computers before the smartphone era are ridiculed as “resistant to change,” yet I’ve managed to learn how to use iPhones and iPads (the latter without a keyboard), so why can’t people who were introduced to computers during the smartphone era learn how to use Macs?

It’s a shame to introduce new users to Mac by telling them to use it in the same way they used their old familiar devices, which are strictly limited by both hardware and software. A Mac is a terrible thing to waste!

Dave Mark:

Is the touchscreen the future for all Macs? Is it a niche product like the Duo?

If the former, will we see a day when your Mac becomes obsolete because it does NOT have a touchscreen, where apps stop working because they depend on touch?

Lounge vibes 05:

Absolutely not on day one, but everything points to the touchscreen spreading to the entire MacBook and iMac line within the next three years.

I think it’s being underestimated how many consumers already think or expect the Mac to have touchscreen support. There’s only anecdotal data, but I can just find hundreds and hundreds of people talking about how everyone automatically assumes their Mac screen is touch capable.

I can imagine that touchscreen support coming to especially the lower end models is going to be absolutely huge in education and for younger purchasers, it might even create another rush like the initial launch of the M1, including new purchasers who are coming from iPads and other touchscreen Apple devices getting into the Mac for the first time.

See also: Accidental Tech Podcast.

Update (2026-11-05): Joe Rossignol:

Nicolas Lellouche of the French website Numerama shared 15 details about the new MacBook Pro models in an article and a social media post. Some of this information has already surfaced, but he provided a useful summary[…]

John Gruber:

I find it useful to organize all of the configuration options into tables on a single page, and I figured it might be useful to share this now, before I finish writing my full thoughts on the redesigned hardware and displays for the PROLED XDR models.

Jeff Johnson:

Would the touch screen increase productivity for MacBook Pro owners who don’t currently have a touch screen, or is the new device just for people who are hopelessly stuck in their old iDevice habits?

[…]

The screen is not detachable. Nor does it bend all the way back to lie flat. So what are the new use cases? All I hear is “people expect touch” without any idea whatsoever of how touch would IMPROVE a MacBook Pro.

Jason Snell:

And once you spend enough time touching pieces of glass, it becomes second nature—to the point where I have absolutely reached up to tap or scroll on my laptop screen only to have to remind myself that it’s a Mac and it doesn’t work that way.

I’ve also used my iPad Pro with an attached keyboard and trackpad enough to recognize that, even when I’m driving that device like it’s a laptop, sometimes I will find it easier to just reach out and touch. It’s natural, it works, and it’s nothing to be afraid of.

Chip Warden:

As an amateur electronic musician, I can promise you I (nor any other electronic musicians I know) would never play a software instrument by touching a MBP screen.

On an iPad, sure.

Jeff Johnson:

Here’s the thing about the Steve Jobs “ergonomically terrible” quote: at the same time, Jobs also said, “we’ve done tons of user testing on this.” I’ve yet to hear that from current Apple executives.

Jesper:

Touch has the feel of a feature that is implemented well, and reasonably and thoroughly integrated (revisited hinge included), but also a nice-to-have feature for limited scenarios. If there had been no other touch laptops out there for the past 15 years that people had gotten used to, and it wasn’t one more feature to either lose to in a PC head-to-head, or use to pad the functionality delta for this particular product, I’m not sure they would have even done it - clearly they were in no hurry otherwise.

[…]

It says something that the absolute strongest argument in favor of touch (aside from “so that people who think every display ought to be a touch display are not confused or disappointed”) is “so iOS development, iPhone mirroring or iOS-on-Mac apps will work much better”.

Matt Birchler:

When I think about the Mac, I don’t see a single reason there couldn’t be a future device that looks a lot like an iPad. Think about all the use cases people have for iPads in professional environments. They use them because they’re small and ergonomically easy to use, but they’re limited to the software allowed to run on iPadOS. I’m not saying all those iPad use cases would go away, but I promise there are people who would be liberated by the idea of getting a little Mac in a screen they can fully customize and control, turning it into exactly the device they want.

[…]

I want my fellow tech community members to think bigger, to think more audaciously. Don’t think like someone committed to the idea that macOS shall never have touch – we don't live in that world anymore. Instead, think the way we’d hope Apple themselves would think: now that we have this whole new way to use a Mac, what can we do now?

Benjamin Mayo:

Unless Apple starts making new Mac hardware designs that bring the display forward, such that the ergonomics invite users to touch the screen more frequently, they don’t need to do anything more on the software side. Users who have grown up on iPads and iPhones want to tap and swipe their Mac screen sometimes, and this lets them do just that. I expect Apple will bring touchscreens to the MacBook Air and MacBook Neo in due course. In 2026, touch is a commodity, in all senses.

Guilherme Rambo (tweet):

The glowing Apple logo on the new MacBook Pro models is controllable by software. It has a 25kHz PWM frequency and per-device calibration. CoreBrightness implements automatic brightness and controls the relationship between display and logo brightness. One interesting tidbit: the brightness of the logo is adjusted differently depending on the enclosure color.

Joe Rossignol:

The first reviews of the new 14-inch and 16-inch MacBook Pro models with PROLED XDR displays have been published ahead of the laptops launching on Friday.

Tuesday, October 27, 2026

MacBook Pro (M6, 2026)

Apple (MacRumors, Hacker News):

Apple today announced the new 14-inch MacBook Pro with M6, delivering even more performance, powerful on-device AI capabilities, and faster connectivity for college students, business users, creators, and more. M6 features an advanced 12-core CPU with the world’s fastest CPU core, so everything from productivity tasks to more demanding pro workflows feels incredibly fast and responsive.

[…]

The 14-inch MacBook Pro with M6 starts at $1,999 and $1,899 with education savings.

The base configuration has 16 GB of RAM and a 1 TB SSD.

John Gruber:

This tier of MacBook Pro has only ever been offered in the smaller 14-inch size. Prices seem unchanged from the post-June-price-hike M5 models[…]

Tim Hardwick:

According to Apple’s tech specs page, the option for 16GB of unified memory remains limited to 153GB/s. That’s identical to the M5 version, while only the new 24GB and 32GB configurations receive the faster 170GB/s memory bandwidth.

Hartley Charlton:

How much has changed, and is it worth upgrading or choosing the newer model?

Previously:

iMac 2026

Apple (MacRumors, Hacker News):

Apple today announced the new iMac featuring the superfast M6, delivering even more performance and powerful AI capabilities in its strikingly thin all-in-one design. […] Connectivity gets even better with Wi-Fi 7 and Bluetooth 6, along with available 2.5 Gigabit Ethernet and storage that is up to 2x faster, so apps and large projects launch in an instant. Completing the iMac experience is an expansive 24-inch 4.5K Retina display; an industry-leading camera, speakers, and mics; up to four Thunderbolt 4 ports; color-matched accessories; and the power of macOS 27. Available in a spectrum of seven colors — blue, green, pink, yellow, purple, orange, and silver — the new iMac is a tremendous upgrade for existing users and an incredible gateway into everything the Mac can do for new users.

[…]

iMac with M6 featuring a 10-core CPU and 10-core GPU starts at $1,499 and $1,449 with education savings. iMac with a 12-core CPU and 12-core GPU starts at $1,699 and $1,599 with education savings.

The base configuration has 16 GB of RAM and a 256 GB SSD, only 2 Thunderbolt ports, and no Touch ID or Ethernet, amongst other limitations. John Gruber has a price chart.

Previously:

macOS 27.2

Juli Clover (release notes, security, enterprise, developer, full installer, IPSW):

macOS Golden Gate 27.2 overhauls the brightness and volume sliders, plus it expands Siri AI to new languages including French, Japanese, Korean, Portuguese, and Spanish.

Mr. Macintosh (post):

Apple just broke the macOS security update record AGAIN, patching 263 CVEs in macOS Golden Gate 27.2! 🤯🔐

Jeff Johnson:

I decided to email Apple Product Security yesterday just to ask whether CVE-2026-112500 was my [e-mail privacy] issue. In the past I’ve had a number of email conversations with Apple Product Security, including a long-running thread initiated by them way back in 2024 about a WebKit security issue that I had reported, with last reply in July of this year. Sadly, as far as I can tell, I still haven’t been credit for that issue.

[…]

In other words, Apple Product Security no longer accepts reports via email, instead requiring security researchers to submit via a web form. But the web form wants you to “Report a vulnerability,” with no place for a simple question like mine, about a vulnerability already fixed. Also, the quoted paragraph implies that if you don’t use the web form, you might not get a CVE, which I suspect is what happened to me!

Gwynne Raskind:

PSA: If you use the removemacai tool and are having trouble updating to macOS 27.2, remove the RemoveMacAI profile in System Settings -> General -> Device Management. It appears to somehow block softwareupdate’s ability to download parts of the update.

Mario Guzmán:

macOS 27.2 beta brings back the solid divider line between sidebars and their details view.

Steve Troughton-Smith:

macOS 27.2 has reverted the [Mission Control] change: fullscreen apps are now once again titled by app name, not window title

David Deller:

Still broken on macOS 27.2. No response to my Feedback so far.

I’ve since added a workaround in Radiccio that simply removes the Liquid Glass effect (so the buttons can work again).

Hartley Charlton:

Upgrading to macOS 27 no longer removes an existing Rosetta installation[…]

Jeff Johnson:

I suspect what Apple really meant is that macOS 27 was not automatically reinstalling Rosetta, and now it does again in 27.2.

Previously:

Update (2026-11-02): Marc Edwards:

macOS 27.2 seems to have changed the design of the volume and brightness overlays. I like these better, but wish they were always top center, rather than being top right normally and top center for full screen.

iOS 27.2 and iPadOS 27.2

Juli Clover (iOS/iPadOS release notes, security, iOS/iPadOS enterprise, developer):

The iOS 27.2 update expands Siri AI to new languages, including French, Japanese, Korean, Portuguese, and Spanish. It also adds profiles for the Apple TV app, a new icon and branding for Apple Music, and support for AI suggestions in the Messages app for taking quick actions in apps like Calendar and Reminders.

In the European Union, it introduces an alternative expanded prompt for App Tracking Transparency.

Ryan Christoffel:

iOS 27.2 adds a new setting for ‘Lock Controls’ inside the Home app’s HomePod accessory settings.

Previously:

macOS 26.7.2 and macOS 15.8.2

macOS 26.7.2 (security, no enterprise, no developer, full installer):

This update provides bug fixes and security updates for your Mac.

macOS 15.8.2 (security, no enterprise, no developer, full installer):

This update provides bug fixes and security updates for your Mac.

Previously:

Update (2026-11-05): gongty (Hacker News):

After updating a MacBook Pro (M1 Pro) from macOS 15.8 to the 15.8.2 release candidate (24H219), every OpenGL context that is attached to a window has no default framebuffer. NSOpenGLView and -[NSOpenGLContext setView:] are both affected, so anything drawn that way shows a blank window. I filed FB25133383 with a minimal sample, kernel log and call trace.

This seems to have been fixed in the release version, but it’s interesting that the bug made it to RC 2.

watchOS 27.2

Juli Clover (release notes, security, developer):

According to Apple’s release notes, watchOS 27.2 introduces new Siri AI features and extends Siri AI to new languages.

Previously:

tvOS 27.2

Juli Clover (release notes, security, developer):

Today’s update adds support for four-speaker surround sound, a feature that works with the HomePod, HomePod mini 2, and the upcoming Apple TV 4K.

It allows the Apple TV 4K to be used with four HomePod mini 2 speakers, four second-generation HomePods, or two HomePods and two HomePod mini 2 speakers to get surround sound.

Previously:

Update (2026-11-03): Marcus Mendes:

Today, Apple released a new build of tvOS 27.2 (24K154), specifically for the fourth-generation Apple TV 4K, which is currently available for preorder ahead of its November 13 launch.

[…]

According to @itspdfu on X, the new build enables Siri AI on the fourth-generation Apple TV 4K, a feature that was previously restricted to internal builds.

audioOS 27.2

Juli Clover (release notes):

HomePod Software 27.2 brings a new Sound Glow option to the HomePod, HomePod mini, and upcoming HomePod mini 2. Sound Glow causes the top of a HomePod or HomePod mini to light up with color that pulses in sync with the music that’s playing. The feature draws colors from album artwork, and it works with songs, podcasts, and Apple’s ambient music feature.

The update also adds support for using HomePods as the default speaker for a Mac, plus it allows four HomePods or HomePod mini 2 speakers to be used as surround sound for the new Apple TV.

Previously:

visionOS 27.2

Juli Clover (release notes, security, no enterprise, developer):

Apple today released visionOS 27.2, the first big update for the visionOS 27 operating system that runs on the Apple Vision Pro.

[…]

The visionOS 27.2 update provides bug fixes and security updates, per Apple’s release notes.

Previously:

Monday, October 26, 2026

iPad mini (8th Generation)

Apple (Hacker News):

Apple today unveiled the all-new iPad mini, featuring a stunning OLED display in an even thinner and lighter design, a huge leap in performance with A20 Pro, and water and dust resistance. The larger 8.5-inch OLED display, also available with a nano-texture option, delivers higher contrast and more than 2x higher peak brightness than the previous-generation iPad mini for a brilliant and immersive viewing experience.

[…]

The new iPad mini features an innovative Acoustic Display for an even better audio experience when gaming, watching videos, or editing content. Specially designed woofers are paired through the display to produce punchier bass and more volume. In addition, custom tweeters are now hidden between the glass and aluminum enclosure for clearer highs.

[…]

The 12MP Center Stage front camera is now on the landscape edge[…]

[…]

With iPadOS 27.2, iPad mini also supports extended display mode when connected to an external display, great for users multitasking with windowed apps.

John Voorhees:

The new iPad mini comes in Midnight and Starlight colors (fewer than before) and starts at $699, which is less than some rumors suggested, and can be configured up to $1,249 before accessories.

Before the recent price hikes it was $499. The MacBook Neo is also $699 (including keyboard).

John Gruber:

Still stuck with Touch ID — a bummer in general, and a shit sandwich given how expensive these have gotten. Unless Apple decides to make a mini-sized iPad Pro (which I definitely do not expect), there’s no way to buy a mini-sized iPad with Face ID.

[…]

This is the first iPad Mini with an XDR display. But: no ProMotion.

[…]

The new Mini is thinner (5.4mm vs. 6.3mm) and lighter (255g vs. 293g for Wi-Fi models). The display is slightly larger (8.5″ vs. 8.3″) while the footprint shrunk slightly, because the bezels have been reduced by 25 percent. The iPhone Duo weighs almost exactly the same (254g to be exact) but its inner display is only 7.6 inches diagonally.

Ryan Christoffel:

In fact, every configuration except the highest 512GB model includes a less powerful, binned A20 Pro chip.

According to Apple’s tech specs page, here’s the breakdown of the A20 Pro across different storage configurations.

Rui Carmo:

I very dearly want to go back to the Mini since the Pro is too large as a permanent companion device, but the inflated pricing is not helping. and neither is my feeling that Apple has likely nerfed the hardware in ways that matter to me.

Previously:

Update (2026-10-29): Dan Benjamin:

Why does Apple’s iPad mini product page show it as if it has no camera bump?

See also: Mac Power Users Talk.

Update (2026-11-03): Joe Rossignol:

In an interview with YouTuber and podcaster Christopher Lawley, Apple’s vice president of hardware design David Pakula commented on the new iPad mini lacking 120Hz support, noting that its OLED display still has significantly faster pixel response times compared to the previous model with an LCD, resulting in reduced motion blur.

Jason Snell:

“OLED is unquestionably a better display experience than LCD in so many ways,” Pakula said. “You’ve got the incredible contrast ratio… We’ve got much higher peak brightness, going up to 1,200 nits. What I also really love about this display is that it goes all the way down to 1 nit.” That’s great for pilots in the cockpit at night, but also for people who want to read in bed and not disturb their partner.

That decision made, “from an integration standpoint, it opened up all sorts of really cool doors for us,” Pakula said. “We were able to make the product thinner because there’s fewer layers in the display stack and the OLED panel itself is thinner. We were able to make the screen go from 8.3 inches to 8.5 inches in the same footprint because of the narrower borders of OLED… Once we flipped the switch and said, we’re going to do this thing on OLED, it opened up a tremendous number of opportunities and everything got better because of it.”

[…]

He continued: “And if you kind of look across the industry, there’s nothing like the Mini, right? Anything that typically has been in that size form factor, it’s been very low-end, very just consumer oriented—watch some movies, throw it in the back of the car with your kids.

Jason Snell:

This iPad mini is the first iPad ever to receive a rating against dust and water ingress: IP67. This doesn’t mean you can swim with the iPad mini, but it does mean that if your kid drops it in the bathtub or you’re using it on a utility pole in the middle of a dust storm, you should probably be okay.

[…]

That means, yes, that the new iPad mini is more powerful than a MacBook Neo—and may remain so even when the MacBook Neo gets an update next year.

[…]

These prices are extremely high if you consider the iPad mini a unitasker. […] This iPad mini is a full-featured product at a full-featured price. If you’re only going to use it to do one or two things, there may be better options. But the thing about iPads is that they are flexible and malleable, and you can use software and accessories to make them be what you want them to be.

Update (2026-11-04): John Voorhees:

To test this, I had Codex build me a benchmark that takes 10 minutes of AppStories and converts it to text using Voz on the iPad mini. Across three sessions for a total of nine runs, Voz transcribed a 10-minute AppStories clip in about one second on average (excluding model preparation), and every run produced an identical transcript. That’s comparable to the 0.98-second iPhone 18 Pro result in Desert Ant’s SDK documentation. The different audio and possibly different software versions make this an approximate comparison, but the results show how quickly the iPad mini can handle local transcription with a model optimized for Apple’s Neural Engine.

The mini’s local AI capabilities extend beyond software optimized for the Neural Engine. To explore those, I ran Qwen 3.5 4B (4-bit) locally using a benchmark built into Russet, a local AI and developer tool. The 512GB iPad mini averaged a pace of 40 tokens per second across four sessions on both tests that output 128 or 256 tokens with a time to first token of 0.32 seconds for the 128 output token tests and 0.36 for the 256 output token tests.

iPod at 25

Hartley Charlton:

Apple today marks 25 years since the introduction of the original iPod, one of the company’s most significant products and a major contributor to its expansion beyond the Mac.

Tony Fadell:

A small team. An unforgiving deadline. We had months to bring the hardware, software, and music experience together. Proud of what we built and that it means so much to people still today. A device that has been woven in many ways into our lives. People have filled their iPods with road trips, breakups, workouts, special occasions with family and friends.

Joe Rossignol (Hacker News):

Apple Music has a 404 page easter egg on the web: a functional iPod that appears when you load a page that does not exist, such as music.apple.com/macrumors.

Nick Heer:

This looks enough like my own iPod library circa twenty years ago that it threw me a little. I hope this is not appearing solely for the occasion of the iPod’s anniversary. It is a nice surprise.

Previously:

Friday, October 23, 2026

WindowShade Redux

Another haxie reborn, from Rosyna Keller (Mastodon):

Instead of only cramming minimized windows into a crowded dock—or hiding them altogether—WindowShade Redux reduces your windows to their title bars or small live thumbnails at all times. It supports over twenty animation styles with the following power features:

  • Minimize the window to the Dock, as always

  • WindowShade the window into a tiny strip to quickly peek below or get it out of the way

  • Minimize-In-Place the window so it becomes a really small thumbnail that you can freely drag the thumbnail around your screen

  • Make any window float on top so it will never be obscured by other windows

$10 (with $7 intro price), and there are bundle discounts with FruitMenu and Xounds.

Modern macOS no longer allows one process to change the geometry of a window owned by another process (application), so I had to redesign and rewrite the core from scratch. Now, WindowShade Redux fakes everything hard. […] WindowShade Redux takes a snapshot of visible windows, composites them into an image, and displays it either as a fake WindowShade window or as a Minimize-In-Place (MIP) thumbnail to hide the Dock’s 500-millisecond genie animation.

[…]

Floating on top was an entirely different beast, as it requires constantly recording the target window and laying a new WindowShade Redux window on top of it. This fake window is then moved in tandem with the real window below it.

Previously:

Update (2026-10-26): Rosyna Keller:

WindowShade Redux 1.0.3 is now out.

It adds Prism Power and Sakura animations. It also adds a new window management feature that brings all windows forward in an app if you click on one of them (holding a modifier or not, it’s your choice), just like on Classic MacOS.

Previously:

Mastodon 5

Imani Joy:

We’re moving away from the embedded composer and adopting a pop-out composer with new controls for visibility and other post settings. Navigation is simplified and organised in a more intuitive way and create space for future new features.

[…]

In your feeds, the posts themselves have been rebuilt from the ground up, giving a fresh look to the places we all spend the most time. We’re also excited to roll out a few new colour themes, which took a truly monumental effort from our engineering team since the start of the year to tokenise our design system.

[…]

The new design includes many small affordances, such as hiding a user’s boosts directly from the post menu, following and unfollowing hashtags right from the post, and hiding your own posts and boosts in your home feed.

Via Jeff Johnson:

Incredibly, Mastodon’s own announcement shows the massive amount of wasted space in the new UI, and they’re fine with it!

Joe Fabisevich:

The Mastodon 5.0 design looks more Tumblr than Twitter, and I really dig it! Nice to see them take an approach to social media that is more differentiated than just “it’s tweeting but federated”.

To me it looks more like Twitter than before. Stars are now hearts. The layout is basically the same down to the empty right column where Twitter’s algorithmic features would be.

CM Harrington:

[The] toot button (the one that makes the toot window appear in the first place) is at the bottom of a list of everything else, including all your saved/followed hashtags.

It’s all such a mess. From what I can see (limited) they’re ‘just trying things’ that other sites have done — but without a reason or goal — so it’s all just a mash of disparate concepts.

The new composer slides up on top of the bottom post/message, so I can’t see what I’m replying to.

Matt Birchler:

There’s some interesting data here, but at a high level, you see a social network that gained over 2 million new active users in the 31 days after Musk closed on buying Twitter. A lot of those users bounced and we dropped to about 1.1 million active users by the following summer, when we saw a second spike as Twitter started to require logins to see anything and that rate limits were being applied. Since then, we’ve seen a slow but steady decline in number of people using Mastodon.

[…]

As a fan of Mastodon, these numbers are hard to look at. Not because I think a social network must have hundreds of millions of users to be valuable, but because it paints a picture where many people have tried Mastodon, but almost none of them stick around. Also, while infinite growth isn’t a requirement, constant decline isn’t what you want to see in a social network either.

Jeff Johnson:

To be honest, I’m not sure I want Mastodon to grow. I actually never wanted Twitter to grow. I originally joined Twitter in 2008 for a developer conference (C4 in Chicago) to network with other software developers. As far as I’m concerned, Twitter was ruined by the influx of celebrities and celebrity worshippers. Thankfully the celebrities have mostly ignored Mastodon. A crucial difference between the two social networks is that Twitter needed masses of people to join, because Twitter was a publicly-traded, for-profit corporation, financed by advertising. The goal of Twitter, like other such social networks—Facebook, Instagram, Threads, TikTok—was to maximize attention and thus eyeballs on ads.

[…]

This raises an important question: should you give your attention to social media? Is social media use healthy? […] In other words, Mastodon respects its users, doesn’t intend to waste their time. If Mastodon users decide to leave, I say good for them!

John Gruber:

Just after writing the preceding paragraph, I took a break to pick up some sandwiches for lunch. Get out of the house, enjoy at least a few minutes of a beautiful autumn afternoon, and stretch my legs. Waiting for the sandwiches to be prepared at the bagel joint, I took the Duo out of my pocket and checked NetNewsWire. First article up was a good one. Started reading. Screen’s too small. Do I want to open the Duo? Sandwiches aren’t going to take long. I clicked the side button to sleep the Duo and put it back into my jeans pocket (where it sank like the brick that it is). I spent the rest of the wait alone with my thoughts, pondering how to finish this review.

Apple isn’t going to start an ad campaign with a slogan like “So cumbersome you’ll keep it in your pocket”, but that’s part of my experience.

That’s kind of how I feel about Mastodon. It works OK, at least for the Mac/iOS community, without being very addictive. I wish the discovery and search were better, but that’s sort of antithetical to the federated model.

Rob Shearer:

Mastodon isn’t, and won’t ever be, a good platform for “asynchronous ephemeral notifications of any kind”. I’d also argue (more controversially) that it’s simply not good infrastructure for social networking of any kind. There are lots of interesting people using Mastodon, and I’m sure it will live on as a good-enough space for certain niche groups. But there is no question that it will never offer the fun of early Twitter, let alone the vibrancy of Twitter during its growth phase. I’ve long since dropped Mastodon from my home screen, and have switched to Bluesky for text-centric social media.

[…]

I’m not saying federation “won’t” work or “can’t” work. Merely that in 2025, nine years after deployment, federation does not work for the Mastodon use case. […] Crucially, the posts did not exist even if I visited the profile page of the account: even after weeks of daily posts, the profile page displayed by mastodon.social claimed the account had never posted, and the posts would only begin appearing after someone on mastodon.social began following the account.

[…]

When you “private mention” someone, only you and they can see the post. And they can reply with a “private mention” of their own. But if anyone in that “private” thread accidentally mentions any other Mastodon account by name, that is itself considered a “private mention”, and that person is invited into the thread. It is an absolutely insane UI design that makes it extremely easy to share private conversations with exactly the people you don’t want reading them.

[…]

The problem that did manifest is that all of this moderation is entirely opaque to users. If you explicitly follow a particular account, you may not see posts from that account because its instance doesn’t like its content, because your instance doesn’t like its content, or simply because one of the two instances doesn’t like the other.

Dave Winer:

The only way for the others to compete with Twitter is to start innovating. Get rid of the limits. The funny thing is Twitter, the dominant leader, is moving forward and getting rid of character limits, and introducing styles and links. They’re acting like the little guy while the others, Bluesky, Mastodon, Threads, aren’t doing anything to be more useful. That whole market is stuck in 2006 and the myth that 140 chars somehow was magic. It wasn’t. It killed the web as a writer’s platform.

[…]

Inbound and outbound RSS 2.0, is the way to go. And Markdown is the way you do text. This is what matters, you all are making something that’s really simple so unbearably complicated.

My first choice would be to see more people blogging on their own sites. But having longer and richer posts on Mastodon would be preferable to many of the alternatives. I still wish it supported RSS for my timeline and replies.

Previously:

Update (2026-10-26): Manton Reece:

If only there was a social network that actually prioritized blogging and had RSS feeds for the timeline, mentions, and everything else. I’m quite biased but there really isn’t anything else like it.

He’s talking about Micro.blog.

Building Mac App Help Books

Amy Worrall:

The documentation is available on the website for the relevant app, and also in the app as a Help Book (openable from the Help menu). These days, Help Books on MacOS open in the Tips app[…]

Apple’s documentation for making these, such as Authoring Apple Help, is pretty old. If you look at the URL for that page, you’ll see it’s part of the Carbon documentation!

There are some third party tools to help. While planning this blog article I came across Helpbook Builder. I haven’t tried it, but if I were starting afresh I would probably check it out!

In this article I’ll share my process.

Previously:

iOS 27.1

Joe Rossignol (no iOS/iPadOS release notes, no security, no iOS/iPadOS enterprise, no developer):

Apple this week released the full and final version of iOS 27.1, but it is only available for the foldable iPhone Duo that launched today.

iPhone Duo already ships with iOS 27.1 preinstalled, but users need to update to a newer build of iOS 27.1 while setting up the device[…]

Previously:

Update (2026-10-26): Christian Beer:

SwiftUI Table is broken on iPhone Duo! I discussed with an Apple engineer[…] he asked me to create a sample project. They have the sample code themselves in their OWN DOCUMENTATION!

Peter Steinberger:

I’ll wait a bit before thinking about a new phone.

Apple Music’s New Look

Joe Rossignol:

In a YouTube video shared today, Apple said the new Apple Music visuals were “made by sound.” More specifically, Apple said it played a sound through a container of water, resulting in the liquid moving at the frequency of the notes. Apple Music brand elements were placed behind the vibrating water, resulting in a new liquid-inspired look.

Charlotte Gunn:

The approach draws on Apple’s wider design direction, particularly Liquid Glass, the translucent design language introduced across its software in 2025.

The redesign includes Apple Music’s typography. A new wordmark pairs the recognisable Apple symbol with a customised version of Apple’s own typeface, SF Pro. Bold, lowercase lettering gives the service a youthful energy, while a reworked musical note icon takes its shape from the forms captured during filming.

The project reportedly took months of experimentation with sound, materials and moving image.

Brian Webster:

“We spent a billion dollars to build a room where we splash in the water while smoking weed for a couple years, and came up with a plain black and white Apple Music icon. And oh yeah new font.”

Previously:

Update (2026-10-26): Louie Mantia:

Why does Apple know the visual identity for Apple Music looks like this across all social networks, but can’t bring themselves to use it for the actual app icon?

Thursday, October 22, 2026

iPhone Duo Reviews

John Gruber (Mastodon, tweet, Bluesky):

The Duo name is perfect. It truly is like having two devices in one. The outer device is, by far, the worst iPhone Apple has ever made. It’s a miserable fat little thing. The inner device is a splendid, joyful, beautiful tablet, with a UI that out-iPads the iPad. For me, by far, it’s my favorite tablet experience ever. I prefer it to any iPad or Kindle-like reader I’ve ever used.

[…]

It does not go into or out of my jeans pocket smoothly. Sometimes, in my pocket, it rotates 90 degrees, which is uncomfortable. Folded up it never stops feeling heavy.

[…]

No, the problem with holding the Duo in your left hand alone is that the bottom left corner of its D-shaped frame digs into your palm. When you hold it in your right hand, it’s a nice round corner in the meat of your thumb’s base. In your left, it’s a crisp sharp corner, and it doesn’t feel good.

[…]

I’d love a display that looks and feels like this on my non-foldable iPhone 18 Pro. No glare, even in sunlight. It’s amazing.

[…]

Held horizontally, the iPhone Duo supports side-by-side multitasking with two apps. The user interface for this feature is brilliant. It puts every idea Apple has tried on iPadOS for multitasking to shame.

[…]

Every time you pick up the Duo to use it you face The Decision. Open it? Or be lazy and suffer with the outside display? Every time.

This is such a good review; you should just read the whole thing. Marques Brownlee has a great video review. Like Gruber, he really misses FaceID. They seem to disagree about the camera and screen aspect ratios. I also really liked Joanna Stern’s video review. She and Gruber both say it’s too hard to open the Duo with one hand.

MacRumors and MacStories have review roundups.

Austin Mann:

A week with the iPhone Duo at home, camping and in Iceland. A capable camera with new tricks, and a creative powerhouse for planning, editing and sharing.

Previously:

Update (2026-10-26): See also:

Update (2026-10-29): Federico Viticci (via John Gruber):

Don’t like that the iPhone Duo doesn’t auto-lock when you close it?

You can fix it with this simple Shortcuts automation.

Update (2026-11-05): M.G. Siegler:

I’m not quite ready to say it’s the best iPhone Apple has ever made, but I’m close. Certainly closer to that than the reviewers seem to be towards putting it on the other end of that spectrum! Three simple things hold me back. First, I don’t like knowing that I don’t have the best possible camera system. Second, it’s heavy and feels fairly bulky when folded. Third, a lot of software, namely third-party software, is still playing catch-up here.

[…]

Sure, I wish the Duo were thinner when folded. But again, I actually quite like holding it, heft and all. And I’m definitely faster at typing on it than I am on a “regular” iPhone. I sort of suspected this would be the case in a move to a more BlackBerry-like aspect ratio, but it’s sort of wild just how much faster I am typing on that outer screen. I don’t know if it’s just the perfect shape for my particular thumbs, but it’s hands down one of my favorite surprise upgrades here.

iPhone Duo and Safari

Mike Piontek (Mastodon):

A year ago I wrote that Safari 26 and Liquid Glass have little respect for web sites and unfortunately this hasn’t changed.

[…]

It’s unclear to me why Apple is not opting to treat the iPhone Duo toolbar as a safe area. I have not come across anything discussing their reasons nor educating web developers on the best way to design for this device.

[…]

Apple has decided to examine my web page and pick out a color to use for their toolbar. The process they use to determine this color is complex and not documented.

Previously:

Update (2026-10-26): Jen Simmons (via Léo Natan):

Safari 27.1 does bring one change to users. Now, when someone holds iPhone Duo partially folded like a book while looking at a PDF on the web, Safari 27.1 automatically shows PDFs as two pages side by side. When they open the screen flat or close it fully, Safari switches back to one page.

For web developers, Safari 27.1 on iPhone Duo includes a preview of the Device Posture API and the Viewport Segments API, available behind feature flags.

Previously:

WebKit Blocking Identity Resolution Infrastructure

Lara O’Reilly:

Apple’s latest privacy crackdown left the online ad industry scrambling for answers. Now, the tech giant has finally offered some.

John Wilander et al.:

A “post-cookie” tracking method emerged, called identity resolution. In this scheme, third parties (i.e., not the website owner) invisibly collect your email address when you log in or sign up for a newsletter. They send the email address to their servers, create an opaque tracking ID permanently linked to your email address, and send that tracking ID back to the webpage. The tracking ID is stored on the website and can from thereon be used for arbitrary purposes linked to your email address, such as building a profile of your browsing or targeting ads at you across websites. Logging out or unsubscribing from that newsletter does not remove the tracking ID or your email address stored with the third party.

[…]

Some companies serve as third-party infrastructure to facilitate identity resolution. They are present but invisible on many webpages where you enter your email address or use your email address for login purposes. They are not themselves login providers or newsletter services, they’re just there to track you.

In our iOS, iPadOS, macOS, and visionOS 27 releases, Safari and WebKit block network access to identity resolution infrastructure to prevent cross-site tracking. This stops them from sending your email address to their servers and all the downstream effects of that. The blocking is done on the domain level, meaning they can’t just change the structure of the network request to work around the protection.

Rowena Lam:

  • There is an unreleased update to WebKit that makes this list dynamic, meaning Apple can remotely add new vendor domains to the blocklist at any time without requiring users to download a new OS version.
  • The list is not public facing, domains added to the blocklist don’t appear to be notified of their addition and there does not appear to be any formal appeal process.

Previously:

Wednesday, October 21, 2026

PHP2Shell

Malwarebytes:

If you’ve encountered websites in maintenance mode today, it may be a security precaution. Reports of attacks targeting two critical PHP vulnerabilities have prompted warnings to install emergency updates and consider temporarily taking affected services offline until they can be patched.

[…]

Successful exploitation could let an attacker run malicious code on an affected server without logging in. That code would run with the permissions available to the PHP process, potentially allowing attackers to steal application data, alter website content, or establish a backdoor.

[…]

The PHP team scheduled its emergency security updates for October 21 at 10:00 am ET (14:00 UTC). It has now released fixes in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, and urges users to update immediately. Administrators should check with their hosting provider or operating system vendor for the appropriate updated packages.

Adam Engst:

Expect to see numerous websites go down or serve “Page not found” errors as they update PHP, the programming language that underpins 70% of websites. If you run a WordPress, Drupal, or Joomla site, this affects you directly.

Nick Heer:

Word on the street is that these exploits have leaked, and that remote code can likely be executed all the way back to PHP 5. If you have access to your website’s php.ini file, it might be worth turning off multipart uploads for now.

Vincent Schmalbach:

Two changes reduce the risk until the fixed versions are out. They were checked against PHP’s source code and the PHP manual, but they are not an official PHP mitigation. When someone suggested that turning off session upload progress might be enough, PHP core developer Gina Peter Banyard replied, “The only thing I can say is that the only mitigation is patching / upgrading PHP. I sadly know too much.” Use the stopgaps to lower the risk for a few hours, and update PHP as soon as the fixed builds exist.

Add to php.ini:

session.upload_progress.enabled = Off

Add to .htaccess:

<If "req('Content-Type') =~ /multipart/i">
    Require all denied
</If>

Update (2026-10-22): CJ Moses (Hacker News):

Amazon Threat Intelligence identified a PHP2Shell exploitation attempt dating to Oct. 17, 2026, in MadPot telemetry, four days before public disclosure of CVE-2026-109618 and CVE-2026-109619. The exploit attempt originated from an IP address associated with a commercial anonymization network. While the vulnerability was under embargo, the targeting of a honeypot from an anonymized IP address suggests the activity was conducted by a threat actor, though it remains unclear how the actor acquired exploit information prior to disclosure.

The PHP embargo window was set to be lifted on 2026-10-21 1400 UTC. On the day of the release, Amazon Threat Intelligence identified multiple proof of concept exploits for the vulnerability, with the earliest around 2026-10-21 0200 UTC. Subsequently, from 2026-10-21 0200 UTC to 2026-10-21 0800 UTC, Amazon Threat Intelligence identified additional exploitation attempts of PHP2Shell targeting MadPot from additional anonymized infrastructure. The actual payloads and choices in anonymization infrastructure varied, suggesting these were multiple actors. Technical analysis is ongoing, and it’s unclear if any of these attempts would have succeeded in real-world systems.

DreamHost:

Protections Are In Place - The official PHP security updates have been applied across the entirety of our network.

See also: Bruce Schneier.

Update (2026-10-29): Sergiu Gatlan:

The malicious activity was caught by Adel Karimi, detection and response lead at Perplexity, whose honeypots recorded evidence of confirmed remote code execution against an Apache mod_php installation running PHP 8.4.26.

Wiz (Hacker News):

So far, we have observed a limited number of exploitation attempts in our telemetry and have not identified a publicly available proof of concept (PoC) demonstrating complete, general end-to-end exploitation against an arbitrary target. Some partners have, however, privately disclosed to us exploits that work against a variety of targets and we continue to experiment internally

Update (2026-10-30): ednl:

Explanation why php2shell didn’t have much impact by Dr. Steve Bagley on Computerphile. In short: it requires hitting the same “slot” on the server which works in dedicated targets in VMs but not so much on real world servers where every new request messes up the order of slots used.

Ofcom Concedes Defeat in 4chan Case

Guido Fawkes:

Ofcom boss Dame Melanie Dawes has admitted today that tech firms have paid just two of the eleven fines handed out under the Online Safety Act since March last year. Giving evidence to the Culture, Media and Sport Committee, she conceded nine remain unpaid, four of the offending sites have simply geo-blocked the UK, and three are still up and running with nothing changed.

Via Preston Byrne (Hacker News):

American courts have, by now, provided their preliminary view on the likelihood of Ofcom’s enforcement powers being successful in U.S. courts – the obiter dicta in 4chan v. Ofcom, the opinion in the case we filed against Ofcom in the federal District Court for the District of Columbia a little over a year ago.

[…]

Ofcom can’t enforce the Online Safety Act in America. Ofcom knows it, Ofcom has known it for a long time, and now, Ofcom has, finally, admitted it.

[…]

The GRANITE Act, a foreign censorship shield now before both the House and Senate (H.R. 10174 / S. 5478), is one proposed legal response America could adopt. The HOMEFRONT Act, H.R. 10309, is another. Either of GRANITE or HOMEFRONT would strip sovereign immunity from foreign censors and let Americans targeted by their orders drag those agencies into federal court, where they could be held accountable for their actions.

Previously:

iOS Dev Course Going Out of Business

Sean Allen (via Rebecca Sloane):

iOS dev course sales plummeted due to AI. It costs a lot of money to host my courses online and with sales at basically $0, I’ve cancelled that hosting.

This closes down the site which unfortunately removes access to the courses.

[…]

I’ve put my recent course on sale at a large discount so you can get it before it’s gone and I’ve made old courses available for free if you want to grab those too.

The school will be online until November 24th so you have a few weeks to download these videos at seanallen.teachable.com.

Apple Broke an Essential Presentation Feature of iPads

Teddy Svoronos (Hacker News):

As of iPadOS 27, if you have multiple windows open while AirPlaying (whether or not Stage Manager is on), tapping on anything other than the presenting app will snap the external display into showing your whole iPad screen. This means that my students see all my notes on who I want to call on, or poll results that should be hidden from them. They also get distracted from what we’re learning by all these jarring windows popping up and disappearing. If you’re presenting at a big conference, it’s extremely embarrassing.

[…]

As for what the behavior should be, I’m not a developer, but here’s a proposal: if you’re using an app that is in presenter mode (e.g., PowerPoint playing a presentation, or a GoodNotes document open), it should always get precedence on the external display, until that presentation gets stopped, the document is closed, or the app is quit.

Previously:

Tuesday, October 20, 2026

Selection and Focus in Golden Gate

Howard Oakley:

Now move the pointer to the right edge of the list of folder contents, just far enough to the left to avoid moving the window divider, but not so far as to fully select items from within that folder. Click there and the item will be selected, but in grey, the same as would appear if it had been fully selected but its window was no longer in focus. At this stage, the original folder will still be fully highlighted, as if nothing had been selected inside it, but you can drag that grey unfocussed selection to include other items inside the folder.

On my Mac, if I click on a file icon in the second column, the first column retains focus. The second column only gets focus if I click on a filename (or even farther to the right).

Now using the up and down arrow keys doesn’t move within the items inside that folder, but back with the fully highlighted folder. With a few of the items inside that folder in grey, so they’re selected but not in focus, press the spacebar for a QuickLook preview, and you’ll see the greyed items, not the folder that’s still fully selected to the left.

[…]

In other situations, this becomes infuriating.

In my log browser LogUI, separation of selection from focus can leave you clicking wildly without being able to select log entries.

Previously:

Update (2026-10-21): Philip Savoulidis:

I too was wondering if there was something peculiar with my Mac. Focus seems so broken in Golden Gate that I was expecting macOS reviews to mention it. In this regard, I am glad to see focus problems mentioned here.

The behaviour seems inconsistent. For example, in Finder and Mail the sidebar does not gain focus on click, but it does in Contacts and NetNewsWire (a third-party app). The Passwords app seems like the worst offender: the password list itself does not gain focus on click (e.g. click the search field then click an item and focus remains in the search field).

I spent some time investigating this, and I think it comes down to a SwiftUI bug. List and Table in SwiftUI are affected. Both use NSTableView under the hood, but they never become first responder on click.

But I don’t think NSBrowser is built on SwiftUI, so there are probably multiple issues here.

Update (2026-10-26): Howard Oakley:

That evidence implies that the failure to change focus resulted from a bug in AppKit, which in those specific circumstances didn’t go through the correct state changes, omitting Began, Possible and Cancelled. The Finder still selected the item I had clicked, and passed that to QuickLook for its preview, but failed to change the focus, affecting future actions.

[…]

This bug isn’t consistent, though. While I experience it frequently in the Finder, and it affected a SwiftUI List view in LogUI, others have different experience, and many haven’t come across it in the Finder at all. I have several other apps that use List views in SwiftUI, but LogUI is the only app so affected.

[…]

Given the strong rumours that Apple is about to announce a touchscreen MacBook Pro, I wonder if there are been provisions made to support that in AppKit resulting in a new bug.

Xcode Projects for the Command Line and Coding Agents

Artem Novichkov (via Fatbobman):

Xcode also ships two command-line tools for the new format:

  • xcprojformatter came with the format in beta 2. It’s a formatter for project files, like swift-format for code: it checks that a project.xcproj file is valid and rewrites it with sorted keys and consistent layout.
  • xcodeproj arrived in beta 3. It reads and edits projects from the terminal: targets, build phases, groups, build settings, xcconfig files, and Swift packages.

Neither is on your PATH, so run them with xcrun.

Previously:

Getting a File Path From a Swift URL

Seth Willits (2024, bug):

There’s a deprecation warning in Xcode for URL.path that reads:

WARNING: path will be deprecated in a future version of macOS: Use path(percentEncoded:) instead

The problem is something like this:

Bundle.main.url(forAuxiliaryExecutable: "tool")!.path

… which returns the expected file path (ex: /Applications/MyApp.app/Contents/tool)

would be quickly rewritten as suggested to:

Bundle.main.url(forAuxiliaryExecutable: "tool")!.path(percentEncoded: false)

… which simply returns tool, because the URL returned is relative to a base URL.

[…]

I’ve always found it not-completely-obvious to newcomers how to get a standard file path string from a file URL and this only makes it more confusing.

There are at least three issues here:

  1. url.path returns an absolute path, but url.path(percentEncoded: false) returned a relative path as of his writing. I tested this on macOS 26, and now it returns an absolute path. The documentation now says, “This function will resolve against the base URL.” It seems the behavior of the method changed without it being documented when, so be careful if you’re deploying to a mix of OS versions.

  2. percentEncoded has a default value of true, whereas path did not return an encoded string. In other words, url.path() and url.path are completely different. So this is another case where Apple updated the API but flipped the default—a good way to introduce bugs.

  3. It’s not obvious how to get the full file system path out of a URL. With NSURL, url.path was natural and did the right thing. Now, the URL equivalent is deprecated.

    The natural replacement, url.path(), is wrong. So is Xcode’s recommendation of url.(percentEncoded: false).

    url.absoluteURL.path(percentEncoded: false) is correct but verbose.

    url.absoluteURL.standardizedFileURL.path(percentEncoded: false) is possibly better but even more verbose.

    FilePath(url)?.string uses a newer API but gives you an optional, even though for a file URL it should never fail.

    This seems like such basic functionality, but there’s no API that’s the obvious right choice, concise, and ergonomic.

Previously:

Monday, October 19, 2026

Carson Oliver and Apple’s Gaming Push

Giovanni Colantonio:

Seven years later, Apple Arcade hasn’t gone anywhere, and Apple itself hasn’t slowed its broader gaming efforts either. Between courting major publishers like Capcom to release their games on Mac to launching a proper gaming app, it’s clear that Apple still has its sights set on being a major player.

The latest example of that came this week as Apple launched an App Store event dubbed Indie Games Week. The week-long initiative saw Apple welcoming games like Vampire Crawlers to iOS and announcing an ambitious mobile version of No Man’s Sky. At the center of that push was Carson Oliver, the new head of App Store Worldwide following Phil Schiller’s sudden departure from the role this past August. The fact that one of his first acts in the role was spearheading an indie gaming showcase hints at where Oliver’s priorities might lie.

[…]

While Oliver sells the narrative with carefully worded precision, questions still linger around Apple’s wider gaming efforts. Continued investment in mixed reality gaming is uncertain given that Apple has reportedly cut down production of its Vision Pro headset due to underwhelming sales. And though Apple continues to court publishers and get games on iOS, we haven’t seen the full-throated support from major players like Capcom and Ubisoft in 2026 that was crucial to raising Apple’s gaming profile in 2023.

Previously:

NetNewsWire 7.2

Brent Simmons:

We’ve released NetNewsWire 7.2 for Mac with a new column view layout: choose View > Use Column Layout to switch.

I really missed this feature from the old NetNewsWire, so I was happy to see its return. Now that I’m using it, I have mixed feelings. I love the columns, how I can scan the titles without the feed names and dates getting in the way. But some titles aren’t very informative, so I miss how the iOS-style view shows a little preview of the article’s body. I wish I could see that, either appended after the title itself or in a second line below it.

We’ve also added a second long-requested feature: you can now hide unread counts or replace them with a •, so you don’t have to deal with the anxiety of an ever-increasing unread count and the feeling like you have to get caught up.

Here are the other changes.

Previously:

Update (2026-10-22): Nick Heer:

I am a huge fan. It feels like coming home.

DropDMG 3.7.2

DropDMG 3.7.2 is a maintenance update of my app for disk images and archives.

Previously:

Friday, October 16, 2026

Xcode 27.1

Apple (xip, downloads):

Xcode 27.1 includes Swift 6.4 and SDKs for iOS 27.1, iPadOS 27, tvOS 27, watchOS 27, macOS 27, and visionOS 27. Xcode 27.1 supports on-device debugging in iOS 17 and later, tvOS 17 and later, watchOS 10 and later, and visionOS. Xcode 27.1 requires a Mac running macOS Tahoe 26.6 or later.

Christian Beer:

You can’t run macOS UI tests on Xcode cloud as soon as your app uses „restricted entitlements“[…]

Previously:

iMessage Downgrading

Glenn Fleishman:

The odds of this change in standards causing a security breach and your messages being exposed seem unlikely, at least right now. But after scrolling through conversations and seeing what’s going on, I feel Apple has omitted important signals for users when iMessage suddenly stops being used during a conversation.

[…]

The impact of that hit me while revising my book: when iMessage isn’t available, Apple tells you only inline. Despite all the information Messages displays about iMessage being encrypted, the inverse state is faint. This kind of negative knowledge, or information about something not happening, can often be as important as something that does happen. A warning about a fuel tank approaching empty is the kind of information every driver (or pilot) needs, for instance. If you think end-to-end encryption—or Apple-based encryption—is critical for you, then a pop-up message or other warning is what you would expect.

[…]

If you’d like to prevent Messages from downgrading security, you have options, although they may not be fully desirable. All of these are managed on an iPhone at Settings: Apps: Messages. You can’t control these message settings from an iPad or Mac.

This recently happened to my mother, and it was very confusing for her. For unknown reasons, while at home on Wi-Fi, she got signed out of iMessage. But it was not clear to her that this had happened or that she should try to sign back in. She was not aware that the Messages app supports multiple protocols or what the different bubble colors mean. All she noticed was that certain messages (e.g. ones sharing files) would no longer send and that she was not receiving some of the messages that people were sending to her. She saw the inline warning about encryption and interpreted it as that the sender was using a newer form of encryption that her phone didn’t support, so maybe she needed to upgrade.

I went over to take a look and quickly figured out that she was signed out of iMessage, but I couldn’t fix it. I kept getting errors that iMessage couldn’t be activated, even after rebooting the phone. Eventually, much later and again for unknown reasons, activation succeeded.

Update (2026-10-20): Boris Yurkevich:

My concern is that the Retry as Text Message toggle no longer exist. Just a couple of weeks ago my sister sent me an iMessage while I was flying. I was not reachable. Later she told me that messages turned from blue to green.

Mark Stephens (Robert X. Cringely), RIP

Mary Alyce Stephens (Hacker News, Reddit, TidBITS Talk):

Mark Stephens, known to much of the world as Robert X. Cringely, passed away on October 3, 2026. He was 73.

Mark was a gifted writer, journalist, storyteller, husband, father, brother, and friend. To millions of readers and viewers, he was Robert X. Cringely, the witty and sometimes irreverent observer of the technology world. But to those of us fortunate enough to love him, he was simply Mark-and losing him leaves an emptiness that is difficult to put into words.

[…]

Writing as Robert X. Cringely, Mark became a distinctive voice in technology journalism. He had an unusual ability to understand not only technology but also the human beings behind it-the dreamers, inventors, entrepreneurs, eccentrics, and risk-takers who were changing the world. He could take a complicated subject and make it understandable, entertaining, funny, and deeply human.

Steven Sinofsky (via John Gruber):

Bob wrote “Accidental Empires” that chronicled SV and the tech industry of the PC era, 1970s-90s. It led to the highly regarded PBS series “Triumph of the Nerds” a definitive series of interviews of the era. Through that time he authored the “gossip” column” in InfoWorld on the latest goings on at OG PC companies. Everyone read it in print religiously.

See also: I, Cringely and Wikipedia.

Previously:

Update (2026-10-20): Paul Tyma (Hacker News):

The next day Bob and I went to Sun Microsystems. He and I sat in a room with Jonathan Schwartz (CEO) and Rich Greene (C-something-else) while they defended Java and gave me nasty looks wondering who the hell I was and why the hell I was even there. They seemed plenty interested in impressing Bob though. By the way, Dotnet didn’t squish Java but I did get a Sun t-shirt.

Thursday, October 15, 2026

Passkeys Attestation Trap

The Hack (Hacker News):

Like the Trojan Horse, passkeys are legitimately elegant on the surface, but there is something troubling inside.

What’s important to know is that unlike with any other kind of login credential, you do not have ultimate control over your passkeys. With passwords, you can choose where to write them down; with authenticator apps, you can decide for yourself which ones to use (they’re pretty interchangeable); and with physical security keys you can hand them to your colleague if you really trust them. But with passkeys come a hidden dial that lets the websites you use them on gradually remove your ability to do as you please with them.

[…]

This is the feature that means you no longer get to make the calls about your passkeys. Fortunately, attested passkeys are not yet required on most websites. But the FIDO Alliance standard makes attestation a part of the passkey ecosystem, whether you want it or not. And even if the website doesn’t require attestation now, simply by using passkeys you indicate to the website that your setup supports the FIDO Alliance’s passkey standard and that you as a user are capable of using passkeys. This means that once Twitter (formally X) is satisfied that the overwhelming majority of its users would be unaffected, they can flip the switch – perhaps not all at once, perhaps just for ten thousand users at a time so as not to cause a fuss – and start rejecting non-attested passkeys.

[…]

My expectation is that the industry will start off with very few constraints on your passkeys, and gradually add more and more, not all at the same time, but staggered on different sites, and then in a few years people will forget that they were ever offered a choice in which security measures they want to enable on their passkeys (if they even knew there were different kinds of passkeys at all).

[…]

Remote attestation can allow them to verify that your device is not capable of, say, sending and receiving encrypted messages, or running a competitor’s app, or using social media without verifying your ID.

Apple’s passkey implementation currently does not support attestation, but it sounds like this is only until they can work out how to do syncing:

Attestation was designed to attest to a specific device, exclusively at the point of creation, with a specific set of security properties. It doesn’t make sense for synced credentials for a number of reasons, including syncing to devices with different security properties, changes in security properties that happen after key creation, security properties of the sync fabric, sharing the passkey, or exporting to other passkey providers. We’re working hard with W3C and FIDO to solve these problems.

Ricky Mondello:

The post is predicated on the idea that a feature of WebAuthn called “attestation”, which is only used in high-assurance and usually corporate scenarios, and usually with physical hardware security keys, will be leveraged to hurt people, somehow.

The post posits that a website like X will bait and switch users: first, you get a passkey. Then, later, scary “attested” passkeys! This simply isn’t possible to do because attestation isn’t supported on the web for mass market, consumer authentication.

Attestation for passkeys (software-based, syncable credentials) is antithetical to their mass market goals, and would freeze out independent, non-corporate-backed credential managers. It’s an explicit non-goal of the designers of passkeys, who work together in a forum anyone can join.

And trust me, websites and apps like banks repeatedly asked for attestation at the beginning of the industry’s passkey journey. The platforms, browsers, and credential management apps have held firm that the goal of passkeys is reducing phishing and not some kind of trusted computing scheme. (And I will note: over my dead body!)

I believe this is not the goal of Mondello and some of the others working on this, but so far I’ve not been convinced that they will be able to control it. It sounds like Apple is working on it, and once the technology is out there, what’s to prevent key sites from forcing it on users? It seems like all this would take is the cooperation of a few big credential managers. This would be to their benefit in the sense that it would make their products required. Smaller credential managers who resisted would be frozen out.

varx:

The fact that websites and apps have been asking for attestation just reinforces the main point of the passkeys post! Sure, browsers aren’t supporting it yet, but that’s the sort of thing that can change, and the sort of thing that has changed in the past. See the footnote on Widevine and Firefox. (“Currently not supported” is also very subject to change.)

And we already have sites and apps allowlisting passkey vendors. That’s no theoretical, slippery slope fear -- it’s a real restriction on user freedoms that’s already happening right now.

I don’t think that a couple of bad points (e.g. the TOTP thing) invalidate the main point of the post, because the post wasn’t an argument from authority. The author makes some good points that stand on their own.

Ricky Mondello:

To be clear, the websites have stopped asking for attestation. Or at least, they’ve stopped asking me. Why? Because they know there’s no use in asking — that the OS vendors, browsers, and passkey managers are unified on this front. And now they’ve seen firsthand that passkeys without attestation are awesome and a big step forward.

iinuwa:

This is antithetical to users, as the types of authenticators that can pull this off are difficult to use (security keys). Companies with IT departments who can do account recovery for the user can handle this, an average user cannot. Synced passkeys are the answer to this for consumers and therefore attestation does not belong in the consumer space. Which is why password managers are in the spec groups pushing back against this every time it comes up.

Scott Helme (Hacker News):

If a consumer website decided tomorrow that it would only accept attested passkeys, it would lock out almost all of its own users, instantly. What website is going to do that?

[…]

If you’re worried about attestation creeping into consumer logins, then that’s worth pushing back on, loudly (if it ever happens). But it hasn’t happened, the biggest providers don’t support it, and avoiding passkeys today while you wait for it won’t protect you from anything, it just leaves you open to phishing.

It seems like rejecting passkeys is the only way the average user has to push back. The main thing protecting us is that sites don’t want to lock out their users who rely on passwords and 2FA. Once most people have adopted passkeys, if Apple and Google sell us out, I don’t think it matters much what the rest of the alliance thinks. Sites would be able to require attestation with the assurance that users could easily comply. Safari would probably opt everyone into attested passkeys, as it currently opts you into passkeys in general (unless you uncheck “Allow Automatic Passkey Upgrades”).

Previously:

Copyright © 2000–2026 Michael Tsai.