Friday, November 26, 2021 [Tweets] [Favorites]

Xcode’s Environmental Pollution

Daniel Jalkut (tweet):

After a lot of trial and error, I came across the strangest observation: if I invoke “xcodebuild” from within my Python-based build script, the warning is emitted. If I invoke it directly from the Terminal, it isn’t. In fact, if I simplify my build script to simply invoking “xcodebuild”, the warning happens. Stranger still? If I change the script from “python3” to just “python”, the warning goes away again.

[…]

Sure enough, the environment variables differed when I ran the script with “python” vs. “python3”.

[…]

That “CPATH” entry for example only exists when invoking the script with python3, and it’s this very environment variable that is creating the unexpected Xcode warnings!

I was perplexed about how or why the version of Python could impact these environment variables, but then I remembered that python3 is bundled in Xcode itself, and the version at /usr/bin/python3 is a special kind of shim binary that directs Apple to locate and run the Xcode-bundled version of the tool. Apparently, a side-effect of this mechanism causes the problematic environment variable to be set!

New Rowhammer Techniques

Catalin Cimpanu (via Hacker News):

Google says Rowhammer attacks are gaining range as RAM is getting smaller A team of Google security researchers said they discovered a new way to perform Rowhammer attacks against computer memory (RAM) cards that broaden the attack’s initial impact.

[…]

Initial Rowhammer attacks targeted RAM DDR3 memory cards, but academics kept researching the topic. In the following years, they also discovered that Rowhammer attacks could also impact RAM DDR4, that attacks could be executed via JavaScript code loaded on a web page, or even via network packets sent directly to a computer’s networking card.

Furthermore, researchers also found that Rowhammer attacks could also be used to exfiltrate data from the RAM (not only alter it) and that attacks could also be accelerated by using locally installed GPU or FPGA cards.

[…]

In a new attack variation named Half-Double, researchers said they managed to carry out a Rowhammer attack that caused bit flips at a distance of two rows from the “hammered” row instead of just one.

Computer Security Group (via Bruce Schneier):

We demonstrate that it is possible to trigger Rowhammer bit flips on all DRAM devices today despite deployed mitigations on commodity off-the-shelf systems with little effort.

[…]

As the search space of non-uniform patterns is huge, we conducted a series of further experiments to determine the structure of patterns that effectively bypass TRR. Our experiments showed that the order, regularity, and intensity of accessing aggressor rows in non-uniform patterns are essential. We noticed that our observations nicely match with common parameters of the frequency domain, namely frequency, phase, and amplitude. We used these parameters to design frequency-based Rowhammer patterns that can effectively explore the space of non-uniform patterns. We implemented these patterns in a black-box fuzzer named Blacksmith that determines suitable parameter values crafting effective patterns targeting a specific device.

Previously:

Metal-cpp

Apple (via Hacker News):

Metal-cpp is a low-overhead C++ interface for Metal that helps developers add Metal functionality to graphics apps, games, and game engines that are written in C++.

[…]

No measurable overhead compared to calling Metal Objective-C headers, due to inlining of C++ function calls.

[…]

For convenience, you can alternatively use metal-cpp as a single-header include in your project.

[…]

Metal-cpp follows the object allocation policies of Cocoa and Cocoa Touch. Understanding those rules is especially important when using metal-cpp because C++ objects are not eligible for automatic reference counting (ARC).

It’s not often that Apple encourages using C++.

Previously:

2021 E-reader Roundup

Jason Snell:

Which brings me to page-turn buttons. The Paperwhite still doesn’t have them. Amazon has decided that page-turn buttons are a premium feature that should only be available on its $270 Oasis. (This is one of the reasons I recommend the Kobo Libra 2.) Clicking a button is just a better way to move through a book than moving your finger from the edge of the device’s bezel to over the screen for a single tap or swipe, and then putting your finger back on the bezel.

[…]

If physical page-turn buttons are something you care about, and you don’t mind a screen that’s recessed into the bezel, the $180 Libra 2 is a great choice.

If you can’t countenance a recessed screen and want a larger screen, the $260 Kobo Sage is a big, beautiful e-reader with some fancy features like Dropbox support—and of course, physical page-turn buttons.

[…]

Beyond compatibility, though, the Kobo experience is remarkably similar to the Kindle. You can buy books on Kobo’s store, either on the device or on the web. The prices are the same as those found on the Kindle Store. Of course, Kindles have access to Amazon services like Kindle Unlimited. On the other hand, Kobos are much better citizens when it comes to borrowing e-books from your local public library.

Previously:

Wednesday, November 24, 2021 [Tweets] [Favorites]

Apple Sues NSO Group

Apple (PDF, Hacker News, Reddit):

Apple today filed a lawsuit against NSO Group and its parent company to hold it accountable for the surveillance and targeting of Apple users. The complaint provides new information on how NSO Group infected victims’ devices with its Pegasus spyware. To prevent further abuse and harm to its users, Apple is also seeking a permanent injunction to ban NSO Group from using any Apple software, services, or devices.

Nicole Perlroth:

The lawsuit is the second of its kind — Facebook sued the NSO Group in 2019 for targeting its WhatsApp users — and represents another consequential move by a private company to curb invasive spyware by governments and the companies that provide their spy tools.

[…]

The sample of Pegasus gave Apple a forensic understanding of how Pegasus worked. The company found that NSO’s engineers had created more than 100 fake Apple IDs to carry out their attacks. In the process of creating those accounts, NSO’s engineers would have had to agree to Apple’s iCloud Terms and Conditions, which expressly require that iCloud users’ engagement with Apple “be governed by the laws of the state of California.”

The clause helped Apple bring its lawsuit against NSO in the Northern District of California.

John Gruber:

Apple repeatedly refers to the “FORCEDENTRY” exploit by name. This is not PR bullshit — they’re talking about a very specific exploit. Second, they refer to Android as their compatriot, not their competitor. There’s a time and place for Apple to brag about iOS being more secure than Android, but this isn’t it. The message here: “This isn’t just about us, NSO Group is after everyone.”

John Gruber:

I genuinely wonder what Apple’s goals are with this suit. Is it just to bring NSO Group’s activities to light? If this goes to trial, the testimony should really be something to see. How much in damages will Apple seek at trial? Enough to bankrupt NSO Group?

Jason Snell:

Say what you will about Apple’s policies regarding bug bounties and other security issues—the company is capable of spending a nearly infinite amount of money on lawyers who will try to make NSO Group’s existence painful for a very long time.

Maxwell Swadling:

are you taking any steps to improve platform security processes to prevent what happened over the last 2 years? Such as addressing security disclosures quicker, opening up the security researcher program or catching more issues internally that project zero picks up externally?

Stefan Esser:

NSO has managed what a lot of legitimate security researchers have been unable to do: make people see the security of iPhones in a more realistic light. Furthermore Apple going after people who discover security problems in their products is just normal Apple tactic anyway.

Never forget that when NSO was first caught and the first time the general public learned about PEGASUS it was Apple who threatened Lookout to not release samples to the public. Nice AppStore app you have there. It would be a shame if something happened to it.

Yeah also never forget that System and Security info which was capable of finding PEGASUS on your iPhone was banned from the Apple App Store because Apple did not want their customers to be able to see if they were infected.

Steve Troughton-Smith:

Observation from Apple’s NSO complaint: Apple, curiously, completely omits any mention of App Store or lack of sideloading as a fundamental security measure of iOS. Almost as if they no longer believe they can rely on that point to remain in their favor.

Orin Kerr:

According to its CFAA claim filed today, Apple thinks that when your iPhone’s operating system is hacked, Apple is hacked-- and it can sue-- because Apple still owns the operating system on your iPhone.

Hmm, seems like a pretty big stretch to me.

Apple:

Apple threat notifications are designed to inform and assist users who may have been targeted by state-sponsored attackers. These users are individually targeted because of who they are or what they do. Unlike traditional cybercriminals, state-sponsored attackers apply exceptional resources to target a very small number of specific individuals and their devices, which makes these attacks much harder to detect and prevent. State-sponsored attacks are highly complex, cost millions of dollars to develop, and often have a short shelf life. The vast majority of users will never be targeted by such attacks.

If Apple discovers activity consistent with a state-sponsored attack, we notify the targeted users in two ways[…]

Nick Heer:

One of the minor privacy flaws of iMessage is that it will automatically tell you whether someone else has enabled it. All you have to do is type an email address or a phone number into the “To:” field in Messages; if it turns blue, it is an iMessage account and, therefore, associated with an Apple ID and an Apple device. In a vacuum, this is not very meaningful, but it appears that NSO Group was using a similar technique to figure out where to send its spyware.

[…]

I cannot find any reports of Apple notifying potential victims of state-sponsored attacks, so this appears to be a new policy. Twitter was doing this in 2015, and Google in 2012.

Previously:

The MacBook Pro Notch

Tom Warren:

Snazzy Labs owner Quinn Nelson has posted two videos on Twitter demonstrating some of the early notch issues. The main video demonstrates what appears to be a bug in macOS. Status bar items like Apple’s battery indicator can get hidden underneath the notch when status bar items are extended.

Nelson demonstrates this with iStat Menus, which can be hidden under the notch or can force system items like the battery indicator to be hidden underneath the notch. While Apple has issued guidance to developers on how to work with the notch, the developer behind iStat Menus says the app is just using standard status items and that Apple’s dev guidance “won’t solve the issue presented in the video.” This doesn’t appear to be intended behavior, as the notch works differently inside certain apps.

Jason Snell:

You could imagine this notch being a major pain point for developers and users alike, but it’s not. And that’s thanks to the menu bar, a Mac convention since day one that provides the perfect place to hide a display cutout. The menu bar has been given a little extra height to completely encompass the notch, and menu items automatically move to the other side of the chasm if there isn’t room for them to fit.

It takes no time to get used to having a notch at the top of the display. And it’s a good use of space since moving the menu bar up into what would otherwise have been unused bezel means that there’s more room downstairs for everything else. (I see now why Apple changed the metrics on the menu bar in macOS Big Sur—it was clearly laying the groundwork for this display. Add in the curved-edge highlights that appear when you click on a menu-bar item and the whole approach really looks great.)

Howard Oakley:

If you obsess about it, I’m sure it could become irksome, but I barely notice it.

John Gruber:

The notch in the menu bar for the camera is very weird at first. The mouse pointer passes under it, so it justs disappears when in the center of the menu bar. That’s really weird! If I had written this review a week ago, after my first day with the machine, I’d have written a lot more about the notch. One week in, I’m just not noticing it. One notch-related change I’m still getting used to is the taller menu bar. It makes the menu titles look even more disconnected from the actual menus. It’s interesting that last year’s redesigned menu bar in MacOS 11 Big Sur was seen by some as laying UI groundwork for future touch screen support in MacOS, but it now seems clear it was redesigned to more elegantly fit with the notch. You’ll notice that most of Apple’s product photography for these new MacBooks shows them with dark desktop pictures. With default translucency settings, a dark desktop gives you a dark menu bar, and a dark menu bar disguises the notch.

D. Hardawar:

Upon first glance, it’s almost laughable that Apple is leaning even more into a design element that everyone hates. But, honestly, the notch isn’t a big deal.

Stephen Hackett:

A week in, I’ve mostly forgotten it’s there.

Nilay Patel and Monica Chin:

But to me, rather than thinking of the notch eating into the display, I think of the display getting larger except in that one spot. The MacBook Pro effectively has a 16:10 display with a little extra bit at the top where the menu bar and the notch live. You stop noticing it after just a few minutes, just like you stopped noticing the iPhone notch.

Riccardo Mori:

On the Mac, the notch visually splits the menu bar, a UI element you interact with all the time. The notch covers, occupies a part of the menu bar that could be devoted to displaying menu items and menu extras. This isn’t a real problem when you have apps with just a few menus. But with more sophisticated and professional apps, with many menus on the menu bar reaching and even surpassing the middle point, then yes, the notch is definitely in your way and you can’t tell me you’re not going to notice it. When you launch an app with lots of menus on one of the new MacBook Pros, all the ‘excess menus’ will get moved on the right, and the notch will of course be a sort of gap between them. So, according to Linda Dong (Apple Design Evangelist), developers now need to take the notch into account when designing their apps (more unnecessary work for them, but who cares, right Apple?)

Fred McCann:

It’s tempting to call this bad design, but this looks more to me like someone who was responsible for making a product level decision refused to make a decision about what was the most important thing and shipped a broken compromise.

[…]

What’s not evident from this screenshot is that menu items are under the hole, inaccessible. Unlike menus which wrap around the hole, menubar items simply disappear. This isn’t some Bartender behavior, this is the default behavior in the operating system.

[…]

What were the product people at Apple thinking? I can’t know for sure but I suspect they thought thin bezels, a better webcam, and a nicer screen were all equally important. This is another way of saying is no one at Apple actually decided what the most important thing was. They punted.

[…]

The one thing the product people at Apple thought wasn’t important was a working menubar.

Previously:

MacBook Pro 2021 Reviews

Jason Snell:

The new 14- and 16-inch MacBook Pro models usher in a new era in Apple laptops. These are the first high-end Macs to be powered by Apple-designed processors, and that’s a big deal—but they also reject the minimalist design mid-2010s Apple, which achieved design simplicity by forcing complexity and frustration on users.

These new MacBook Pros are a success story not just because of Apple’s custom-built processors, but because Apple has admitted (in deeds, if not words) that the previous generation of laptops were a misstep.

[…]

I’m happy to report, it’s true—all of it. Apple has undone its mistakes of the past few years and created a laptop that’s essentially a Mac Pro you can slide into a backpack.

John Gruber:

A few factors contribute to this sense of thickness. The first is that the new MacBook Pros are more rectilinear. We tend to think of the MacBook Air as the tapered MacBook, but MacBook Pros have been tapered for years. Looking at the new model next to last year’s M1, it’s striking just how far from flat the previous design is. The 13-inch MacBook Pro is 0.61 inches thick only in the middle. The new 14-inch MacBook Pro is 0.61 inches thick from edge to edge, front to back.

[…]

Apple’s best products have always been both tools for work and objects of art. Almost every single change with these new MacBook Pros is in the name of making them better tools for work. Conversely, the controversial decisions that went into the Touch-Bar-era MacBooks were in the name of artistic purity. Minimalism trumping practicality. They were out of balance.

[…]

That, to me, explains the entirety of this new MacBook Pro. The differences between a MacBook Pro and MacBook Air should not be subtle. Let the truck be a truck, true to its purpose. Let the MacBook Pro be unabashedly pro.

D. Hardawar (Hacker News):

But lean in a bit closer and you’ll notice some retro flourishes. They’re slightly thicker, with more bulbous edges that hearken back to Apple’s notebooks from the 2000’s. They’re also heavier than you’d expect: the 14-inch model comes in at 3.5 pounds, while the 16-inch varies between 4.7 and 4.8 pounds, depending on the chip you choose. That’s about half a pound heavier than the last 16-inch MacBook Pro.

Nilay Patel (tweet):

It’s easy to be excited about the new MacBook Pros — it feels like Apple finally listened to everyone and brought back the best parts of the beloved 2015 MacBook Pro, while pushing the display and performance to new heights.

Austin Mann:

I really wish there was a matte/non-glare screen option. Years ago, this was an option on Apple’s laptops, and with the recent Pro Display XDR “nano-etch” anti-glare option, I was crossing my fingers we might see something similar on the MacBook Pro.

Stephen Hackett:

For the nearly nine years between the two machines, the keyboard’s feel isn’t radically different. The new keys seem slightly larger, have less space between them and feel more stable, somehow. The sound is a little deeper, but I’ve gotten used to the new keyboard pretty quickly.

[…]

My new 14-inch machine packs a lot more pixels than my 15-inch Retina MacBook Pro.

Nilay Patel and Monica Chin (tweet):

So yes, the ports are definitely more convenient, and totally fine for most situations, but there are still reasons to visit dongletown. For example, macOS Monterey now supports variable refresh rate external displays using a Vesa standard called Adaptive-Sync, but Apple tells me you’ll need a Thunderbolt to DisplayPort dongle for that. I also ran into a strange bug where sending audio out over HDMI resulted in stuttering video and glitchy audio, which Apple says it is looking into.

[…]

Lastly, the speakers on these new MacBook Pros are terrific. The first thing we did with these when we got them was open up a video to check out the new displays, but the first thing we noticed was that the speakers are so good. They are clear and crisp, with some actual low-end from four woofers, and they get super loud. It’s impressive — and while the 14-inch speakers are really good, the 16-inch models in particular have the best speakers we’ve ever heard on a laptop.

[…]

A lot of you asked whether the extra money for the M1 Max is worth it, and after all that, we think the answer is: no, not for most people. Carrying around all those extra GPUs has an impact on battery life [10 hours vs. 16] whether you’re using them or not.

Jon Porter (Hacker News):

But it’s hard to ignore the broader context of these improvements, which is that they effectively bring the company’s 2021 MacBook Pros back in line with the features they were already offering from 2012 to early 2016. Arguably, the primary reason these new MacBooks are being greeted with overwhelming enthusiasm now is that Apple made the wrong bet on where laptop design was headed back then.

Juli Clover:

It’s officially MacBook Pro launch day, and customers around the world who pre-ordered after last Monday’s event are receiving their devices today. We’ve already seen reviews of the new MacBook Pro models from media sites, but now first impressions from everyday users are available.

Paul Haddad:

This is pretty hilarious. Rosetta results for the M1 Pro/Max vs my 10850k 10 core real Intel machine.

Jason Snell:

[Here’s] a pic of how deep the SD card slot is in the new MBP

It sticks out a lot more than on my 2012 MacBook Pro.

Marco Arment:

Based on this, I’m guessing the new SD slot won’t safely support those nearly-flush adapters that could hold a MicroSD card for extra semi-permanent storage.

John Gruber:

Here are the effective “looks like” resolutions for the new 14-inch MacBook Pro

Moshen Chan:

13" M1 MBP vs. 14" MBP. Mini-LED ‘Liquid Retina XDR’ showing huge contrast difference.

Saagar Jha:

Interesting, it looks like the new MacBook Pros can’t really go from black to light colors very well. There’s a fairly noticeable “ghosting” effect where it first tries to turn on the right LED regions and then gets to the right color.

Computer Clan:

I love how Apple went from removing the escape key to making the biggest escape key ever on a Mac. 😂

Paul Haddad:

I’ve not seen any performance difference in the various reviews between the 14” and 16”. I have seen several instances of the fans being significantly louder on the 14” under any kind of sustained load. Add to that longer battery life and bigger screen…

Joe Rossignol (Hacker News):

iFixit has shared a teaser of its 14-inch MacBook Pro teardown, and one noteworthy detail is the inclusion of pull tabs for the battery cells, which the repair website said will allow for easier do-it-yourself battery replacements.

Juli Clover:

In Final Cut Pro, a video export test saw the M1 Max machine export a 6-minute 4K video in one minute and 49 seconds, a task that took the M1 Pro 2 minute and 55 seconds. When it comes to 8K RAW footage, both machines were able to handle the load. The M1 Max MacBook Pro performed close to flawlessly, while the M1 Pro had a few issues with dropped frames and stuttering, but was ultimately able to keep up.

Howard Oakley (Hacker News):

The internal SSD is the fastest that I have ever tested, although as it’s the 2 TB model, it’s expected to be significantly slower than the results quoted by Apple, which are for 8 TB versions. Using my own app Stibium, it attains transfer rates of 6.7 GB/s read and 6.9 GB/s write. Maximum speeds were found between 60-400 MB transfer sizes.

I’m going to look in more detail at how the M1 Pro uses its cores in tomorrow’s sequel to this article. For the moment, though, I’ll give you a teaser that, like the M1, the M1 Pro runs lowest QoS processes on its Efficiency cores, which includes most macOS services like Time Machine. Although the M1 Pro has only two Efficiency cores, compared to the M1’s four, numerical tests run on them in the M1 Pro complete in around 67% of the time of the M1. The M1 Pro’s Performance cores are managed quite differently from those in the M1 too.

Swift Package Index:

Overall, it’s remarkable that the M1 MacBook Air already had the best performance before Apple introduced the new MacBook Pros, but the M1 Pro and Max chips take this further. They improve on the M1 Air’s best result of 47 seconds with a build time of less than 31 seconds. Those extra cores matter, and the ~35% improvement is in line with what you’d expect, going from a 4+4 performance/efficiency core setup to an 8+2 configuration.

Brian Webster:

OK, the M1 Max benchmark that matters for me: a clean build of PowerPhotos (~80,000 LOC, about 1/3 Swift, 2/3 ObjC)

2017 5K iMac: 160 seconds
2018 MacBook Pro Core i9: 159 seconds
2021 MacBook Pro M1 Max: 76 seconds

Michael Love:

Up and running with 14" M1 MacBook Pro. Thoughts so far:

- Very fast; build times roughly halved vs 2019 Intel 16"
- Android dev on M1 has a few glitches but basically OK
- Notch is fine; stupid, but ignorable
- No difficulty driving 4K@120 external monitor (Gigabyte M32U)

Marco Arment:

I’ve now had the 16” M1 Max MBP at full sustained CPU load (800%+) for 3 hours.

I do, finally, hear the fans — but just barely. It’s quieter than my iMac Pro was at full sustained CPU load.

Hard to notice above ambient noise from a few feet away. Gotta put your ear up close.

Ben Sandofsky:

Build times for @halidecamera

2019 Macbook Pro
2.4ghz, 8-Core, 32GB RAM
𝟔𝟑 𝐒𝐞𝐜𝐨𝐧𝐝𝐬

2021 MBP M1 Pro
10-Cores, 32GB RAM
𝟐𝟖 𝐒𝐞𝐜𝐨𝐧𝐝𝐬

…and the 2021 model was $300 cheaper.

See also: iFixit, MacRumors, Accidental Tech Podcast, The Talk Show.

Previously:

GitHub’s Commitment to npm Ecosystem Security

Mike Hanley:

Today, we are sharing details of recent incidents on the npm registry, the details of our investigations, and how we’re continuing to invest in the security of npm. These investments include the requirement of two-factor authentication (2FA) during authentication for maintainers and admins of popular packages on npm, starting with a cohort of top packages in the first quarter of 2022.

Previously:

Tuesday, November 23, 2021 [Tweets] [Favorites]

Black Friday 2021

My apps are on sale for Black Friday and Cyber Monday, and here are some other good deals that I found:

Stores:

Accessories:

Books:

Photos and Video:

Lists of Deals:

Previously:

Dropbox and Maestral

Hartley Charlton:

An official Dropbox support thread, shared by Mitchell Hashimoto on Twitter, reveals a fiasco around native support for Apple silicon Macs. Dropbox is seemingly insisting that a significant number of community members will have to vote for native Apple silicon support for it to be implemented. There are also multiple repetitious requests with different phrasing, fragmenting users’ votes for support.

[…]

In a reply on Twitter, Dropbox founder and CEO Drew Houston apologized for the confusion sparked by the “not ideal” support responses and said that Dropbox is “certainly supporting Apple silicon” with a native Apple silicon build planned for release in the first half of next year.

Steve Troughton-Smith:

Not the full story, at all. There are technical issues & negotiations at play. It shouldn’t surprise anybody that Apple doesn’t really want companies making kexts anymore

Apple wants apps to use the new File Provider extension API instead, but from what I’ve heard it’s limited and unreliable.

Ryan Jones:

Exploring Dropbox alternatives?

I did ~6 months ago. Fully installed Box, G Drive, One Drive, and tried iCloud Drive.

I ran back to Dropbox and paid for Plus. For speed, simplicity, and less bullshit.

Marco Arment:

Had enough with the Dropbox Mac app? Me too.

I switched to maestral.app a few weeks back and couldn’t be happier. ~7x less RAM, ~10x less disk space, doesn’t burn 100% CPU during Xcode unzips.

Only drawback is it doesn’t sync xattrs, which doesn’t affect my usage.

Maestral:

Maestral is an open-source Dropbox client written in Python. The project’s main goal is to provide a client for platforms and file systems that are no longer directly supported by Dropbox.

Maestral currently does not support Dropbox Paper, the management of Dropbox teams, and the management of shared folder settings.

[…]

The focus on “simple” file syncing does come with advantages: on macOS, the Maestral App bundle is significantly smaller than the official Dropbox app and uses less memory.

Maestral uses the public Dropbox API which, unlike the official client, does not support transferring only those parts of a file which changed (“binary diff”). Maestral may therefore use more bandwidth that the official client.

Max Seelemann:

🏎 Ulysses clean build on M1 Max: ~65s.

🚀 Same but with Dropbox app NOT running: ~55s.

Quitting Dropbox saves 10s or ~15% for me! Reproduced multiple times.

See also: Accidental Tech Podcast.

Previously:

Booting an M1 Mac From an External Disk With Monterey

Howard Oakley:

One of the stumbling blocks to using an external boot disk with an M1 Mac is that it may not cope if you update macOS on the internal SSD, then try booting from the external disk to update that. You may be prompted to assign an authorised user to that external disk, only to be informed that the version of macOS on that disk isn’t bootable and needs to be replaced.

[…]

If you’re unable to boot from a bootable disk using an older (non-current) version of macOS, change its boot policy to Reduced Security and it should then become bootable again.

Use Reduced Security to update bootable external disks, and to maintain older bootable versions of macOS.

If you’ve updated a bootable disk to the current version of macOS, change its boot policy back to Full Security.

This is done in the Recovery Assistant.

Howard Oakley:

Unlike a T2 Mac, M1 Macs don’t set one boot security policy for the Mac, but a policy for each bootable disk. This is attractive, as it means that you can still ensure that, when it boots from its internal SSD it does so in Full Security, but your M1 Mac can be more relaxed when it boots from an external disk instead.

[…]

At present, the odd situation is when LocalPolicy is set to Full Security and the macOS versions don’t match, but the external disk is connected via USB-A rather than USB-C or Thunderbolt. In that circumstance, it appears that booting continues despite the conflict in macOS versions. This could be a simple bug, but I suspect that it’s a limitation of the USB-A bus (I recall historical issues in which USB-A had problems with security systems which could be related).

[…]

The final piece in this jigsaw puzzle is the macOS full installer app. In response to user outcry when it removed the macOS 11.2 installer as soon as 11.2.1 was released, Apple now leaves full installers available for each version of Big Sur. However, they don’t appear to be of much use to those with M1 Macs, as all attempts to install an older version of macOS on an external disk appear to fail.

Howard Oakley:

On M1 Macs:

  • Carbon Copy Cloner 6 can now create full clones of bootable system volume groups in containers on an external disk;
  • making a full clone of the internal SSD works, but it can’t readily be booted, and is strange in other ways too. Unless you have a compelling reason for doing so, avoid this;
  • booting from a full clone of the internal SSD is to be avoided;
  • making a full clone of an external SSD works, but has little or no advantage over performing a full install of macOS on that disk.

Howard Oakley:

I’m delighted to report that five months after I wrote that M1 Macs had problems starting up from external disks, Apple has finally fixed Big Sur 11.4 so that they now work fully.

[…]

Changing between external boot disks is normally simple and direct using the Startup Disk pane. Changing back to the internal SSD when booted from an external disk usually requires a visit to recoveryOS, where you need to authenticate in Recovery Assistant. After a long pause, once that has been accepted as successful, select the Restart button.

[…]

Check LocalPolicy for your bootable systems using sudo bputil -d, which should then list available macOS installations by the UUID of their boot volume group[…]

[…]

If your external disk connects by USB-C rather than Thunderbolt and you experience problems, try connecting it using a USB-C data cable rather than a certified Thunderbolt cable. If that doesn’t help, and you have a USB-A port available, use a USB-C to USB-A cable instead, which appears to be the most reliable.

Howard Oakley:

When Apple released Big Sur 11.4 update, nothing in its release notes indicated that any change had taken place in support for bootable external disks. Indeed, as far as I can tell, Apple hasn’t mentioned these problems, and anyone considering buying an M1 Mac would probably be completely unaware of their gross unreliability with bootable external disks.

[…]

There’s an obvious explanation which I came across when looking at what had changed in the 11.4 update: a brand new kernel extension AppleVPBootPolicy.kext which is concerned with the management of LocalPolicy, which determines security level on boot disks.

[…]

The evidence is that these problems were the result of bugs in managing and implementing LocalPolicy, which were fixed by that new extension, and other changes in macOS 11.4. In other words, M1 Macs didn’t work properly for a period of six months because their Secure Boot system was broken.

Howard Oakley:

As Apple doesn’t yet appear to provide complete instructions for the creation of a bootable external disk in recent versions of macOS, and the information which it does provide is at best misleading in places, this article attempts to remedy this for both Intel and M1 Macs.

Howard Oakley:

I hope this has dispelled some of the rumours about using external boot disks with M1 series Macs, which seem still to be based on Big Sur before 11.4. Installing, configuring and using them is now highly reliable, quick and simple. I’m sure that someone will be able to find a model of SSD which doesn’t yet work perfectly, but this demonstration is based on a regular retail Samsung SSD fitted inside an anonymous case bought cheaply from Amazon, and a regular Thunderbolt 3 cable. No witchcraft or incantations were involved.

Previously:

Monday, November 22, 2021 [Tweets] [Favorites]

Chromium’s URL Blocklist Can Now Prevent Viewing Page Source

Thomas Claburn:

Future Chromium-based browsers under administrative control will be able to prevent users from viewing webpage source code for specific URLs, a capability that remained unavailable to enterprise customers for the past three years until a bug fix landed earlier this week.

[…]

Evidently, tech savvy students were viewing the source code of web-based tests to determine the answers.

Nick Heer:

The rationale for this bug seems pretty weak. If exam software is revealing answers in the page source, it should be rewritten. In this case, it was Google Forms, which makes this bug fix from Google’s Chromium project look especially hinky.

[…]

If the web were still primarily a venue for document viewing, as I naïvely believe it ought to be, I would see this through a more debilitating lens. But the web is basically an operating system and viewing the source tells you little these days. I think that is a bigger regression, but it is only tangentially related to this bug.

Reviewing Content Instead of the App

Sean Hollister (tweet):

You pissed off people by somewhat breaking your app, and they’re leaving angry reviews. How can you salvage your reputation? Apple just found one incredibly effective way — get listeners to submit better reviews by interrupting their podcast experience with an in-app prompt to submit a rating.

That’s how the Apple Podcasts app went from a publicly embarrassing 1.8-star score all the way to 4.6 stars in a little over a month without any actual fixes, as developer and App Store watchdog Kosta Eleftheriou points out.

[…]

But do those people actually love Apple Podcasts? Because if you really look at the reviews, it seems like some funny business is going on. There are new, positive reviews, but they aren’t reviews of the Apple Podcasts app at all — they’re reviews of podcasts themselves.

Juli Clover:

The top review in the App Store right now starts out with “Best Podcast Ever!”, with the reviewer lauding the podcast they had been listening to at the time the review prompt popped up.

The rest of the reviews are a mix of one star comments about the design of the Podcasts app and positive reviews for podcast content.

[…]

Looking at the reviews of third-party podcast apps, the majority of the ratings are for the apps themselves, and customers do not seem to be accidentally offering reviews for podcast content as is happening with the Podcasts app.

Kuba Suder:

people reviewing content is unfortunate, it’s maybe a UI problem, but I know it happens in other apps too (eg. Yelp)

Previously:

Safari Forgets Your History

Jeff Johnson:

Clicking a link in a web browser changes the URL, and if you look at the browser’s history after clicking, you’ll see both the old URL and the new URL. The URL can also be changed programmatically, using the JavaScript Location API. After a new location is assigned in JavaScript, you should also see the old URL and the new URL in the browser’s history. You should, and you do in Chrome and Firefox. But not in Safari! For some reason, Safari forgets the URLs. This bug appears to be many years old: it occurs in the latest version 15.1, and it occurs in the oldest version that I could test, Safari 11 on macOS 10.13 High Sierra. You can reproduce the bug by simply clicking the button below.

[…]

If you want to see how this Safari bug plays out in “the real world” as opposed to just my contrived test, take a look at your history after searching the web with DuckDuckGo. Below you can see that I’ve clicked on a DuckDuckGo search result, but the new URL is missing from my Safari History.

This bug has been bothering me for years, and it does seem to primarily affect pages that I visited via search results.

The Unexpected Return of JavaScript for Automation

Armin Briegel:

One reason python became so popular with MacAdmins, was that the pre-installed python on Mac OS X, also came with PyObjC, the Objective-C bridge for python.

[…]

I’ll be honest here and admit that working with JXA seems strange, inconsistent, and — in weird way — like a step backwards. Putting together a Command Line Tool written in Swift feels like a much more solid (for lack of a better word) way of solving a problem.

However, the Swift binary command line tool has one huge downside: you have to install the binary on the client before you can use it in scripts and your management system.

[…]

However, as flawed as it is, JXA can be a simple replacement for the classic python “one-liners” to get data out of a macOS system framework. Other interesting use cases are being discovered, such as JSON parsing.

Python is no longer the favored choice because “Monterey will now throw up dialogs warning the user.”

AppleScriptObjC is built-in, however.

Previously:

Update (2021-11-26): See also: Hacker News.

The Reincarnation of the Touch Bar

Luc P. Beaudoin:

The obvious advantage was providing configurable, direct access to context sensitive commands.

[…]

To reduce the need to look down towards the physical keyboard, macOS could present a virtual command bar on the main screen. This would be triggered by some event, such as a physical key, keyboard shortcut, Siri, hand gesture, eye gesture, or facial gesture (see next section). This virtual keyboard could be presented as a single row of buttons, or a 2-D array of buttons.

As someone who really hated the actual Touch Bar, I do think there’s something to the idea of providing similar functionality in other ways. (Ideally it would be much more configurable than the Touch Bar was.) I’m thinking something like the old System 7 Control Strip, but with an area for application-specific functionality, too. To a certain extent, this idea lives on in menu bar status items. But the menu bar fills up easily, and the old Control Strip could be resized, hidden, and shown, including via keyboard shortcut. In Big Sur, Apple freed up some menu bar space by consolidating popular status items into a single Control Center icon, but it doesn’t have a keyboard shortcut and isn’t keyboard navigable. It doesn’t even activate via the “Move focus to status menus” shortcut.

Previously:

Friday, November 19, 2021 [Tweets] [Favorites]

Click to Subscribe, Call to Cancel

Sarah Scire:

Publishers tend to think of this as “retention.” A study of 526 news organizations in the United States found that only 41% make it easy for people to cancel subscriptions online, and more than half trained customer service reps in tactics to dissuade customers who call to unsubscribe.

The Federal Trade Commission, meanwhile, recently made it clear that it sees the practice as 1) one of several “dark patterns that trick or trap consumers into subscriptions” and 2) straight-up illegal. The FTC vowed to ramp up enforcement on companies that fail to provide an “easy and simple” cancellation process, including an option that’s “at least as easy” as the one to subscribe.

[…]

Translation? If you can subscribe online, you should be able to cancel your subscription online.

Previously:

AOL Exploits Bug in Own Software

Geoff Chappell (in 1999, via Hacker News):

In e-mail of dubious origin sent to security expert Richard M. Smith, it is alleged not only that the AIM client software has a so-called “buffer overflow” bug but also that AOL actually does use its knowledge of this bug to induce users’ machines, which are running the AIM client software, to execute code that is downloaded from the AIM server. AOL is said to do this as a way for the AIM server to distinguish AIM clients from MSN clients so that the latter may be denied service.

[…]

An ordinary, though certainly not necessary, effect of a program’s corrupting memory on its stack is that the program crashes some time later. The particular packet presented in the e-mail to support the allegations against AOL fits case 0013h but contains 0118h bytes of string data. This is too long and will indeed induce the AIM client to corrupt memory, as described above. However, the AIM client does not crash.

The reason is that the packet data, as received from the AIM server, is contrived so that the corruption of memory by the AIM client is carefully controlled. The buggy routine in the AIM client is made to “return” to an address at which it is known there will be the bytes for a call esp instruction (actually provided in the bitmap for an icon in the AIM.EXE resources). The effect of this instruction is to start executing some of the packet data.

Previously:

Update (2021-11-23): Sherief, FYI:

Check out the section titled “(s)elf-exploitation”

Unicode and Copying and Pasting Code

Glenn Faison:

I recently saw first-hand why I should never copy and paste any code I found online (or anywhere, for that matter).

[…]

To cut the long story short, what looks like a loose inequality check on line #4, is deceptively an assignment operation, which reads like (environmentǃ = ENV_PROD)! In JavaScript, assignment operations return the assigned value, which in this case is truthy (will be treated as true wherever a boolean value is expected).

But isn’t environmentǃ an invalid variable name in JavaScript, you ask? It’s complicated. You’d be right to say an exclamation sign cannot be part of a variable name. However, the ǃ you see there is in fact not the everyday exclamation sign you know. It’s an obscure character that happens to be accepted as regular text by the JavaScript interpreter, and thus can be a valid part of a variable name.

This particular example is unlikely to happen in Swift, both because assignments don’t have values and because the compiler is picky about whitespace around operators.

Via Nick Lockwood:

This is why unicode (outside of string literals) in programming languages was a mistake.

[…]

Support for unicode in variables adds a massive new surface for hiding security exploits in plain sight (see also: unicode urls).

The supposed benefit of being able to use mathematical symbols for custom operators is mostly just an attractive nuisance since you can’t type them.

Inclusivity is good, but unicode variables offer little practical benefit to non-English speakers if the platform APIs and dominant 3rd party frameworks are not localized, and unicode is neither necessary nor sufficient to solve that (it should ideally be handled at IDE-level).

CVE-2021-42574 (via Daniel Martín):

The Rust Security Response WG was notified of a security concern affecting source code containing “bidirectional override” Unicode codepoints: in some cases the use of those codepoints could lead to the reviewed code being different than the compiled code.

Previously:

First MacPaint and MacWrite Public Demo

level1807 (via John Siracusa):

The well-known presentation already available on YouTube is from January 24 of 1984. What’s not so well remembered: Jobs did it all twice, in less than a week. Six days after unveiling the Mac at the Flint Center on the De Anza College campus near the company’s headquarters in Cupertino, Calif., he performed his show all over again at the monthly general meeting of the Boston Computer Society.

“That’s the first time I touched the keyboard.” Atkinson later refers to the Feature key.

Thursday, November 18, 2021 [Tweets] [Favorites]

Forgotten Image Formats

Ernie Smith (via Gus Mueller, Hacker News):

Around this time 30 years ago, two separate working groups were putting the finishing touches on technical standards that would come to reshape the way people observed the world. One technical standard reshaped the way that people used an important piece of office equipment at the time: the fax machine. The other would basically reshape just about everything else, becoming the de facto way that high-quality images and low-quality memes alike are shared on the internet and in professional settings. They took two divergent paths, but they came from the same place: The world of compression standards. The average person has no idea what JBIG, the compression standard most fax machines use, is—but they’ve most assuredly heard about JPEG, which was first publicly released in 1992. The JPEG format is awesome and culture-defining, but this is Tedium, and I am of course more interested in the no-name formats of the world.

Are TIFF, BMP, and PCX really considered to be forgotten?

XCRemoteCache

Bartosz Polaczyk (Hacker News):

We are excited to be open sourcing XCRemoteCache, the library we created to mitigate long local builds. As the name suggests, this library is a remote caching implementation for iOS projects with an aim to reuse Xcode target artifacts generated on Continuous Integration (CI) machines. It supports Objective-C, Swift, and ObjC+Swift targets and can be easily integrated with existing Xcode projects, including ones managed by CocoaPods or Carthage.

[…]

A remote cache is a popular technique to speed up builds of big applications by applying the “compile once, use everywhere” approach. As long as all input files and compilation parameters are the same, instead of building a target locally, one can download artifacts that were built and shared from some other machine. A key success factor for remote caching is finding an optimal caching level. Caching units that are too granular, where every single piece of the compilation step is cacheable, may lead to extensive network traffic overhead, which can offset CPU savings. On the other hand, putting the entire codebase into a single cacheable unit may significantly degrade the caching hit rate; every single local change invalidates remotely available cache artifacts, triggering a full build, locally.

The main Spotify iOS application is highly modularized and contains more than 400 independent modules configured as separate Xcode targets. Applying target-level caching was natural, and as we found out later, the right decision.

Previously:

WebKit E-mail Formatting Bug

Adam Engst:

Now and then, we get a report from a reader whose TidBITS issue has an entire article formatted as a column of text that’s a single character wide. I could tell what happened in at least two cases, but I’m utterly stumped as to what might be causing it. The problem doesn’t appear to originate on our end.

In one report where the reader forwarded the badly formatted issue to us, the problem stemmed from CSS corruption.

I’m not sure what causes this, but I’ve seen it happen to a variety of e-mails (though none from TidBITS) starting with Catalina, both in Mail itself and in my app that uses WebKit to render HTML e-mails. For me, at least, it’s a transitory problem that goes away if I relaunch the app and view the same e-mail again.

See also: Peter Steinberger.

Pacifist 4.0.1

Filipe Espósito:

Pacifist is a popular file extractor for macOS that lets users view and extract multiple file formats, including PKG, DMG, XAR, and TAR.

CharlesSoft:

Completely rewritten in Swift 5

[…]

Added command-line interface

[…]

Support for Asset Catalog files

Support for Mac OS 9 Installation Tome files

It’s $20 or $10 to upgrade.

Previously:

How to Use Apple’s Legacy Contact Feature

Juli Clover:

Apple in iOS 15.2 is making it easier for your loved ones to access your personal data in the event of your death with the addition of a Legacy Contact feature. A person set as your Legacy Contact gets a special code that can be provided to Apple alongside a death certificate to unlock your device.

The Legacy Contact that you set will have access to your Messages, photos, notes, and other sensitive data, plus the ability to remove Activation Lock from your devices, so it is an opt-in feature and should be reserved for your most trusted contact. This how to walks you through how to enable Legacy Contacts, covers how to get to the data after a death, and outlines some of the data that will be accessible.

On macOS 12.1 Beta 3, I see a way to add a Recovery Contact in System Preferences but not how to add a Legacy Contact.

Previously:

Wednesday, November 17, 2021 [Tweets] [Favorites]

Apple Self Service Repair

Apple (MacRumors, Hacker News):

Apple today announced Self Service Repair, which will allow customers who are comfortable with completing their own repairs access to Apple genuine parts and tools. Available first for the iPhone 12 and iPhone 13 lineups, and soon to be followed by Mac computers featuring M1 chips, Self Service Repair will be available early next year in the US and expand to additional countries throughout 2022.

Matthew Gault and Jason Koebler:

This move from Apple does not necessarily mean the right to repair movement is over, or that there isn’t still work to be done. John Deere and other tractor manufacturers promised similar access to repair parts and manuals in an agreement several years ago and then used it to argue that right to repair legislation was not necessary. But the version that tractor manufacturers offered was a watered-down version of what activists were looking for, and the ultimate rollout of its consumer repair program was slow and underwhelming.

Repair.org, an advocacy group that fights for the right-to-repair, greeted the news with joy but had some cautions. “We’re delighted to see Apple get on board with expanding access to their parts and tools directly to consumers. It’s a big step forward for one of the most dedicated opponents to Right to Repair, and frankly unexpected,” it told Motherboard in an email. “Holes remain. We don’t know if independent repair providers will be able to buy parts and service information. We don’t know if the pricing to consumers will make sense, nor if consumers will be able to use competitively priced parts from 3rd parties.”

I’m betting that a sticking point will be that this is only open to individuals, and that independent providers that don’t agree to Apple’s onerous contract will not be allowed to order parts. And even the ones who do still aren’t allowed to maintain stock.

Matt Birchler:

I’m super curious to see how this is received by people on both sides of the right to repair argument. Will people who support right to repair see this as a win or an empty gesture distracting from their real concerns? Will people who have argued against right to repair because it would mean bulky products be annoyed because this shows that’s not really the case?

Stephen Hackett:

In terms of the cost of parts and tools (and what a self-service repair does to your warranty) we don’t know much, but I am hopeful this will be a viable option for the more savvy consumers out there.

Dan Moren:

One chief impetus for this is no doubt the growing push for “Right to Repair” legislation across the U.S. (my home state of Massachusetts having been an early adopter of this movement).

Of course, this doesn’t mean that Apple’s products will necessarily become any easier to repair. iFixit—a longtime proponent of Right to Repair legislation—and others have long provided detailed teardowns Apple products, and while there has been some improvement in places, don’t expect Apple to let you, say, replace your own RAM (especially given that its now basically part of the system on a chip package).

Jeff Johnson:

Apple 2 weeks ago: DIY software installation is too dangerous for iPhone users.

Apple today: Announcing DIY hardware installation for iPhone users!

Previously:

Update (2021-11-23): Kyle Wiens:

Let me share my life’s story and why Apple’s repair announcement is a big deal to me.

Adam Engst:

While the Self Service Repair program was a surprise, The Verge’s Maddie Stone notes that the timing was likely related to a shareholder resolution that could have gone to the US Securities and Exchange Commission. Apple says the program has been in the works for longer and wouldn’t comment on whether shareholder pressure influenced the timing of the announcement.

Regardless of how it came about, I applaud Apple for creating the Self Service Repair program. I hope not to need it personally, but if I do, I might give it a try since I’ve replaced batteries in older iPhones and done major surgery on 27-inch iMacs. Or I might not—replacing the battery in an iPhone 5 was nerve-wracking (see “Replace a Dying iPhone 5 Battery,” 5 March 2014).

That said, I have some issues with how Apple is positioning Self Service Repair and what downstream effects it might have.

John Gruber:

This appears to be a cause for celebration in right-to-repair circles, but I don’t see it as a big deal at all. Almost no one wants to repair their own cracked iPhone display or broken MacBook keyboard; even fewer people are actually competent enough to do so.

Nick Heer:

I think you may be underselling how great it is for people to buy parts independently and then get someone else to install them, especially in parts of the world with few Apple Stores.

John Gruber:

There’s also this factor: if the device in need of repair is still usable — say, an iPhone with a cracked but functional screen, or a MacBook with one or more broken but nonessential keys — it might be a lot more appealing for a user who doesn’t live near an Apple-authorized repair shop to go to a local independent shop for same-day service than to ship their device to Apple for official service.

[…]

On the flip side, though, I think a lot of the “Apple’s repair policies are screwing people” sentiment is based on the misconception that Apple grossly overcharges for repairs.

[…]

The new Self Repair Program requires you to submit the damaged device’s serial number to Apple first, then Apple sends the necessary parts on a need-to-use basis. I’m back to my original opinion, that the Self Service Repair Program is just what it says on the tin — a program for people who really do want to repair their own devices — and thus is irrelevant to all but a small sliver of actual users.

Dave Mark:

It used to be relatively easy to customize and repair your gear. As parts have given way to part assemblies (glued/soldered assemblies that become a single replaceable requirement, even if a single part fails) and the quest for smaller makes devices harder to open, harder to take apart, the ability to repair your own gear has become harder, almost impossible.

So those small numbers John points out are real. But should this be the way it is? Again, wouldn’t you love the ability to swap out a display as easily as you used to be able to swap out RAM on your old Macs?

[…]

Going into an Apple Store with a problem has never felt like a money grab scheme to me. I’ve always felt like the support staff wants me to leave satisfied. If they can find a way to get me a fix without spending money, they’ll do so. But when there’s no way but to replace a parts assembly for $900 on an out-of-AppleCare device, that’s what they do.

John Gruber:

But: times change. Apple hasn’t moved away from user replaceable memory and storage components out of spite. Integrating memory and storage into the chips themselves is the reason why devices have gotten thinner and lighter and much, much faster. The incredible performance of Apple silicon — for both iOS devices and Macs — is part and parcel with integrating memory and storage directly onto the SoCs.

And in terms of replacing screens on iPhones, consider waterproofing and device aesthetics. To my knowledge, no company makes a mainstream smartphone with an easily-replaced display, because a smartphone with an easily replaced screen wouldn’t sell because of all the design trade-offs that would be involved.

Adam Demasi:

Hard for me to trust Apple’s goals with the new Self-Service Repair. Last time Apple faced pressure they started the Independent Repair Program, which we later learned is set up in a way that’s basically a PR stunt. I hope Apple proves my scepticism wrong.

Cory Doctorow:

Apple’s announcement caught us all by (pleasant) surprise. Right up to that day, the company was adamant that letting us fix our stuff would lead to identity theft and exploding phones.

[…]

They still hate independent repair and will do whatever they can to minimize or extinguish the activity. There are lots of ways to accomplish that goal while still offering a “Self-Service Repair” program.

[…]

As Apple independent repair maven Louis Rossman explained in his vlog on the new announcement, the Independent Repair Program was a bit of theater that did virtually nothing to enhance independent repair. Shops that signed up for it found themselves forced to sign onerous NDAs and were subjected to impossible conditions. For example, IRP repair shops were banned from holding inventory of common parts like batteries or screens. Instead, they were required to gather invasive customer data on anyone who showed up looking for a repair, submit that data to Apple, wait for it to be processed and approved, and only then would Apple send the part. The customer, meanwhile, was deprived of their phone or laptop while they waited for this rigamarole to run its course.

Dave Mark:

One question that Louis does raise, that we won’t know for some time, is how granular a repair Apple’s new program will allow. Can I order just the part I need (say, a $100 MacBook LED display vs a $900 display assembly)?

Hartley Charlton:

CIRP’s research suggests that almost all iPhones in use have a display in “useable” condition and most iPhones have a battery in “useable” condition. 12 percent of iPhone displays are cracked but useable, and just six percent are unusable and in need of replacement. 26 percent of iPhone batteries are said to provide battery life lasting half a day without charging, and 14 percent need to be charged every couple of hours. Battery replacements are therefore likely to be among the most common repairs, but comparatively few active devices are in need of replacing either of these parts that are subject to a high level of wear and tear.

The small number of active devices in need of replacement parts, combined with the fact that many users will not be comfortable completing their own repairs, indicates that very few iPhone users will actually take advantage of the Self Service Repair program.

Joe Rossignol:

In an internal memo obtained by MacRumors, Apple provided a few more details about the program, including that repair manuals will be made available on the Apple Support website, confirming the location of where customers will be able to review this information prior to ordering parts for a self-service repair.

Apple’s memo also said that its online parts store will be operated by an unspecified third party.

See also: Dithering, Reddit.

Update (2021-11-24): Jesper:

In reality, repairs with authorized service providers have to abide by glacial policies that prevent at least non-Apple Stores from stocking up on spare parts. Over the years, and across many separate incidents, I have had repairs of iPhones and MacBooks take many days beyond what the actual repair work would take. For devices that are intended to be used every day, this is not acceptable, and is the worst kind of business decision: the one that maintains control and policy at the expense of customer convenience. This is exactly as stupid as that pirated-vs-original comparison.

In reality, there exists two axes: qualified vs not, as well as Apple-blessed vs not. The Self Service Repair program highlights the absurdity of the emerging narrative: a random person at home, taking things carefully, can be trusted to do a job that an independent repair shop, which lives and dies by its reputation and literally does this all day can’t be. Apple’s previous position deserves some back-handed credit, in that at least “only we could do this” was free of such loops of logic – it was plainly and obviously wrong, but it was not that particular brand of ludicrous.

[…]

And it is particularly not an excuse to perpetuate the myth that knock-off parts are a choice in all cases, and are preferred by individual repair shops, which are therefore dishonest and/or not about to do a good job anyway. The entirety of the market, and the quality of its collective outcomes, depends on Apple’s policies. They can change it tomorrow.

Why Won’t That Help Book Open?

Howard Oakley:

The Help system in macOS is another of those areas which has become sadly neglected. The last time it had a thorough overhaul was back in High Sierra 10.13.4, when it was taken off life support and left hospital walking unaided. With macOS 11 Big Sur and later it has relapsed, and in some cases can’t open an app’s Help book at all. I suspect that this may not be its fault, but the result of a revamp of UTIs, which are used to identify file types.

[…]

If you inspect a Help book, it’s now displayed as a plain folder, implying that it’s no longer recognised as it has been in the past. Not only that, but macOS itself no longer matches the folder name extension of .help as representing a Help book bundle, but gives it a temporary UTI.

Surface Laptop SE

Tom Warren (tweet):

Surface Laptop SE will be sold exclusively to schools and students, starting at $249. It’s part of a much broader effort with Windows 11 SE, a new student edition designed to compete with Chrome OS that will ship on a range of low-cost laptops in the coming months.

[…]

Intel’s Celeron N4020 or N4120 power the Surface Laptop SE, combined with 4GB / 8GB of RAM and 64GB or 128GB of eMMC storage. Microsoft is including a 1-megapixel front-facing camera that offers 720P support, so it should hold up okay for Teams meetings. The Surface Laptop SE also includes a single USB-A port, one USB-C port, a regular barrel-type DC connector, and a 3.5mm headphone jack.

[…]

Microsoft is committing to a big repairability effort with the Surface Laptop SE, allowing schools to replace components inside the laptop. The base of the Surface Laptop SE has standard screws that will allow IT admins to replace the display, battery, keyboard, and even the motherboard.

Previously:

Picture This Clothing and App Tracking Transparency

Jamie Finney (via Daniel Jalkut):

Along with a massive drop in sales, the little hits keep coming. In August, there were updates to the costs involved with shipping overseas that caused us to stop all overseas shipping for the foreseeable future.

Removing overseas sales is a big deal for a small shop like ours. As much as I wish we weren’t dependent upon social media in terms of people learning about us, we are. And we have seen a drop in sales and social engagement like never before since the iOS 15 Apple ad opt-in release.

Previously:

Tuesday, November 16, 2021 [Tweets] [Favorites]

Twitter Improves API and Restrictions

Amir Shevat and Sonya Penn (Hacker News):

Essential access includes immediate access to the Twitter API v2 upon signup, one App environment and the ability to retrieve up to 500k Tweets per month. This should meet the majority of developers’ needs, especially early on.

[…]

We know that when you build solutions for people who use Twitter, you often have to build or replicate some of the features that already exist on Twitter. So, to encourage more of this innovation, we’ve removed language in our Developer Policy that restricted some elements of how you build with Twitter’s core features and limited the number of users you can support through your app.

Twitter:

The Twitter API v2 is ready for prime time! Over the past 14 months, we have been steadily releasing net new and v1.1 replacement endpoints to Twitter API v2, and today 90% of all existing apps built on the Twitter API v1.1 can be fully supported on v2 with new key features and increased access.

[…]

Specifically, we’ve removed terms that restricted replication of the Twitter experience, including Twitter’s core features as well as terms that required permission to have high numbers of user tokens.

Paul Haddad:

The quadrants of doom are finally gone!

Previously:

Update (2021-11-17): Nick Heer:

This week’s announcement appears to be Twitter’s mea culpa, but developers are right to be cautious. A third-party client cannot search tweets older than one week, view likes or retweets with comments, use bookmarks, or vote in polls — among many other limitations. Some of these things are on Twitter’s roadmap for API V2, but it is unclear whether all of them will come to fruition. One thing seems certain: we are not going back to the days when users’ posts were available as an RSS feed.

GitHub Notifications and Mail Privacy Protection

Peter Ammon:

#macOS Monterey users, are you finding your #GitHub notifications are all marked as read? It’s probably Mail loading GitHub’s tracker pixels remotely. Uncheck “Protect Mail Activity” and the notifications come back.

Tracker pixels are mainly used for shady purposes, so even benign and clever uses like this seem destined to break.

To be sure, “Protect Mail Activity” is a great feature and I’m keeping it enabled. My intention was to highlight why notifications go missing in GitHub’s Inbox after upgrading to Monterey. I wish GitHub had an option to disable these tracker pixels.

Hartley Charlton:

Apple’s legal documentation on Mail Privacy Protection indicates that the feature is available for iPhone, iPad, and Mac only, but security researchers and developers Talal Haj Bakry and Tommy Mysk have discovered that since the Apple Watch does not hide a recipient’s IP address, it can compromise the overall security provided by Mail Privacy Protection.

Previously:

Tim Sweeney Calls for Single, Universal App Store

Hartley Charlton:

Epic Games CEO Tim Sweeney has today renewed his attack on Apple and called for a single, universal app store that works across all platforms (via Bloomberg).

[…]

Sweeney added that Epic Games is working with developers and service providers to create a system to allow users to “to buy software in one place, knowing that they’d have it on all devices and all platforms.”

Jack Wellborn:

Sweeney isn’t just talking about Apple and Google there, he’s talking about all console makers. My bet all along has been that Tim Sweeney wants the Epic Games Store to become the Amazon of software, and that ambition necessarily goes beyond Android and iOS.

Previously:

Update (2021-11-17): Thomas Clement:

Single app store that works across all platforms?

Maybe we could try this thing called the Internet that has web pages on it.

Update (2021-11-26): John Gruber (tweet):

I’ve been arguing all along that, if victorious in their lawsuits against Apple and Google’s mobile app console platforms, Epic would surely turn its sights on Nintendo, Sony, and Microsoft’s game console platforms, using their win over Apple and Google as precedent. When pressed on this — why Epic was going after the iOS and Android app stores, but not the Switch, PlayStation, and Xbox game stores (and in fact, gave those game console stores a 20 percent discount after launching their seemingly ill-fated jihad against Apple and Google) — Sweeney has previously given a hand-wavy justification about game console platforms being acceptable because the hardware itself isn’t profitable.

Curtis Herbert:

I’ve (and a few others) have been saying this all along - Epic is no champion of the indie; they just wanted to expand their relativly new PC game store (a shitty Steam wannabe) to all platforms to A) save $$ to platform fees B) take a cut of our indie money.

Russell Ivanovic:

Counter point: it doesn’t actually matter. I didn’t support Epic because I like them or think they are benevolent, I support them because they might just be big enough to get Apple to fix their egregious App Store policies.

Steve Troughton-Smith:

It’s been repeated ad nauseam based on a badly-phrased quote, but this ‘single app store’ idea isn’t about Epic owning ‘The one and only App Store’, it’s about Epic’s App Store (alongside the others), spanning multiple platforms, meaning users don’t need to buy again — like Steam

Tim Sweeney:

I’ve said all along - including in emails to Apple and Google executives produced in the litigation - that Epic wants to offer a software store on iOS and Android. Fortnite was the first game to support ownership of items across all 7 platforms.

So, as I’ve said in many interviews, we want a customer to be able to buy software once and own it on all of their devices. Wouldn’t this be better than the status quo where a user buying a paid cross-platform app across iOS, Android, and PC has to pay for it three times?

Epic’s own store supports purchases made on multiple other PC stores with no fee to Epic. Wouldn’t it be awesome if all platforms agreed to honor purchases made on other platforms? Epic is eager to support this with all willing partners.

Monterey Network Quality Tool

Dan Petrov (via Hacker News):

Apple has quietly added a new tool in macOS Monterey for measuring your device’s Internet connectivity quality. You can simply call the executable networkQuality, which executes the following tests:

  • Upload/download capacity (your Tx/Rx bandwidth essentially)
  • Upload/download flows, this seems to be the number of test packets used for the responsiveness tests
  • Upload/download responsiveness measured in Roundtrips Per Minute (RPM), which according to Apple, is the number of sequential round-trips, or transactions, a network can do in one minute under normal working conditions

The capacity is roughly the same metric you could expect from tools like Fast.com from Netflix, or OOkla’s Speedtest.

Previously:

Update (2021-11-24): Jason Snell:

I’ve written a small SwiftBar plugin (requires python3) to run networkQuality and report the results in the menu bar every 20 minutes. You can download it here if you’re interested.

Monday, November 15, 2021 [Tweets] [Favorites]

Apple Buys Google Ads for Subscription Apps

Hartley Charlton (tweet, Eric Seufert, Hacker News):

Apple allegedly buys Google ads for popular subscription-based third-party apps to bolster its collection of commission on in-app purchases, according to an investigation by Forbes.

Apple has purportedly been buying Google ads for subscription-based third-party apps, including HBO, Masterclass, Babbel, Tinder, Plenty of Fish, and Bumble, for at least two years. A marketer speaking to Forbes suggested that many of the brands Apple appears to be advertising for have been assertive about attempting to circumvent App Store policies. The ads are said to be placed without the developer’s consent and Google apparently refuses to remove them.

The ads do not disclose that they are paid for by Apple, but redirect to the App Store rather than subscription sign-up pages on the brand’s website.

My first reaction is that isn’t this sort of a win-win? All things being equal, I’d rather that Apple use some of the fees I’m paying to help sell more copies of my apps. That seems like something a good business partner would do. But, as far as I can tell, it’s not buying ads for indie apps. The situation for the big apps is a bit different:

Hartley Charlton:

Apple has now clarified that it has placed ads to promote products it distributes for five years now, and these ads are clearly marked as being from the App Store.

Apple indicated that this is no different from retailers running ads for the products they sell, and is a very standard business model. Apple is granted conventional legal rights to advertise in this way in the agreements it has with developers.

Apple says that the allegation that it is "secretly" or "quietly" purchasing ads for developers without their knowledge or consent is an overt mischaracterization. On the contrary, the company says that it regularly engages in conversation with developers about the ads it places and many developers express their appreciation for this support.

However, Apple doesn’t seem to have commented on the allegation that there’s no way to opt out. Apple would say that all these developers opted in as part of agreeing to be in the App Store, but they didn’t really have a choice in that aside from the sweet solution.

Previously:

Mouse Pointer Memory Leak

Howard Oakley (Hacker News, MacRumors):

Soon after the release of macOS 12.0.1, reports appeared that some apps, notably Firefox, could suffer large and progressive memory leaks until they took 70 GB or more of app memory, and the Mac simply ran out. At first this appeared confined to certain apps, including Firefox, Microsoft Word, and even Safari.

[…]

The cause has now been isolated to a single group of settings in one preference pane, Accessibility. All Macs which appear to suffer this leak are using custom pointer controls in the Pointer tab of the Display, specifically a larger than normal Pointer size and custom outline and fill colours. The latter two items are one of the new features in Monterey, and have proved popular with users.

[…]

Apps which feature many and frequent changes in pointer type, such as browsers, therefore leak memory more quickly than those that change the pointer type less often. However, every app with an interface in which the pointer can change type will leak until this bug is fixed in Monterey.

I’m also seeing reports of this happening on Big Sur.

Update (2021-11-15): Steve Troughton-Smith:

This is crazy. You can literally wiggle the mouse cursor over the sidebar divider in Finder and watch its memory usage go up by a couple MB every time the cursor changes

Update (2021-11-16): Josh Centers:

On 9to5Mac, Ben Lovejoy argues that the custom pointers aren’t the sole cause of memory leaks, although he says resetting the pointer is worth trying. However, Howard Oakley points out that this leak is associated with any pointer change—such as from the arrow to the text insertion bar—so any app with frequent pointer changes, like a Web browser, will suffer from this issue.

See also: Hacker News, Reddit.

Update (2021-11-23): Kyle Howells:

Just a casual 124GB of ram being used by Control Centre, no big deal.... No memory leak here. Everything completely under control.

Gregory McFadden:

So glad I got 64GB of memory on my new Mac so I can use 26GB of it for control center... Wait... what.

Howard Oakley:

I can now describe a total of four [memory leaks], three of which I can reproduce here, and one which I can’t. This article summarises them, and how to avoid becoming victim to them.

Microsoft Blocks EdgeDeflector to Force Windows Users Into Edge

Tom Warren (via Nick Heer):

Microsoft has already made it more difficult to switch default browsers in Windows 11, and now the company is going a step further by blocking apps like EdgeDeflector. Third-party apps like EdgeDeflector and even Firefox have offered workarounds to Microsoft forcing people to use Edge in Start menu search results, even if their default browser is not Edge.

Microsoft has been forcing Windows 10 and Windows 11 users into Edge and its Bing search engine in the Start menu search results, and now with the new Widgets panel in Windows 11. It’s a frustrating part of Windows that doesn’t respect your default browser choice. EdgeDeflector lets you bypass these restrictions, and open Start menu search results in your default browser of choice.

Update (2021-11-17): Dave LeClair (via Hacker News):

The upcoming Windows Update won’t block you from changing the default browser in Windows 11. The patch will force links using the microsoft-edge protocol to always open in Edge. These are specific links opened through Windows 11, such as those directly from the taskbar’s search feature. Firefox’s workaround and EdgeDeflector made it so these links would still open in your default browser. Microsoft is about to roll out an update that disables this workaround, calling it “improper” on Mozilla’s part

[…]

As you might expect, the developer of EdgeDeflector isn’t thrilled, as outlined in a blog post. “Microsoft isn’t a good steward of the Windows operating system. They’re prioritizing ads, bundleware, and service subscriptions over their users’ productivity,” developer Daniel Aleksandersen said.

“The 500,000 EdgeDeflector users were probably never more than a nuisance to Microsoft,” said Aleksandersen. “However, last month both the Brave and Firefox web browsers either copied EdgeDeflector’s functionality or signaled it was on the roadmap.”

Apple Software Quality in 2021

Dan Moren (Hacker News):

But one challenge with continually moving the state of the art forward is that sometimes it comes at the expense of making sure the technology that’s already here works as well as it can. After all, if you have to add a dozen new features in a year, that could mean taking away from work enhancing reliability, and squashing bugs in existing features.

We’ve all encountered a slew of problems—some simple (if ridiculous) to fix, others are maddeningly difficult to troubleshoot. As our devices get more and more complex, it’s all too easy for some of those problems to persist for years. And though the best part of the Apple experience has long been “it just works,” the question is…what happens when it doesn’t?

I think Monterey is probably the best update since High Sierra in terms of not introducing too many new problems. On net, I think it fixed more significant bugs than it added. However, in total, Monterey still feels more buggy than Mojave or earlier, and the goal should be to get to much better than Mojave: more like El Capitan or Snow Leopard.

The yearly release cycle continues to be a problem. On the developer side, a quarter of the year is spent dealing with potential breakage (made more real by public betas) and another quarter or more with actual breakage. On the customer side, there aren’t enough months for Apple to polish one release before moving on to the next. Even security updates aren’t getting enough attention now.

Andrew Cunningham (Hacker News):

News is making the rounds today, both via a write-up in Vice and a post from Google’s Threat Analysis Group, of a privilege escalation bug in macOS Catalina that was being used by “a well-resourced” and “likely state-backed” group to target visitors to pro-democracy websites in Hong Kong. According to Google’s Erye Hernandez, the vulnerability (labeled CVE-2021-30869) was reported to Apple in late August of 2021 and patched in macOS Catalina security update 2021-006 on September 23. Both of those posts have more information on the implications of this exploit—it hasn’t been confirmed, but it certainly appears to be yet another front in China’s effort to crack down on civil liberties in Hong Kong—but for our purposes, let’s focus on how Apple keeps its operating systems up to date, because that has even wider implications.

On the surface, this incident is a relatively unremarkable example of security updates working as they ought to. Vulnerability is discovered in the wild, vulnerability is reported to the company that is responsible for the software, and vulnerability is patched, all in the space of about a month. The problem, as noted by Intego chief security analyst Joshua Long, is that the exact same CVE was patched in macOS Big Sur version 11.2, released all the way back on February 1, 2021. That’s a 234-day gap, despite the fact that Apple was and is still actively updating both versions of macOS.

Previously:

Update (2021-11-16): Rui Carmo:

Even though the article could be a lot more detailed, I hope it gets enough exposure to bring this topic back on the agenda. […] As this sprawling thread on Hacker News points out, there is an overall feeling of neglect and change for the sake of change in many aspects of Apple’s software experience, and it isn’t as if they don’t know.

Nick Heer:

I was too generous when I gave Apple’s software quality in 2020 a four out of five. It was certainly better than the preceding year, but I should have graded it a whole point lower, at least. 2021 has been even rockier for me, and not just with Apple’s software and services. I feel increasingly as though big software vendors are taking customers’ business for granted.

Quality used to be one of the factors that differentiated Apple’s products from its competitors — not just in the big picture of things “just working”, but also in the details. That feels much less true than it used to. There are big problems: MacOS Monterey bricked a bunch of T2 Macs, and the version of Shortcuts that debuted across Apple’s operating system lineup this year shipped in an unusable state. But the thousand tiny cuts are perhaps more grating[…]

[…]

So it turns out that a shared Pages document can be edited on a newer version which silently breaks compatibility, and the only way someone will find out is when they decode a cheery update notification. I would not mind except this sort of stuff happens all the time in software and services from Apple and plenty of other vendors.

Previously:

Friday, November 12, 2021 [Tweets] [Favorites]

Offline Translation in Monterey

Howard Oakley:

The basics are very simple: select the text you want to translate, which could have been recognised and converted using Monterey’s new Live Text feature, bring up the contextual menu (Control-click, two-finger tap, etc.) and from that select the Translate … command.

[…]

I therefore recommend that, for the time being at least, and for those languages you’re most likely to use, you enable offline translation and download the supporting files required.

Do this by clicking on the new Translation Languages… button at the foot of the General tab in the Languages & Region pane.

This is a useful feature, but I ran into some issues with how it’s implemented:

Revised Messages Communication Safety Feature in iOS 15.2

Juli Clover:

Communication Safety is a Family Sharing feature that can be enabled by parents, and it is opt-in rather than activated by default. When turned on, the Messages app is able to detect nudity in images that are sent or received by children. If a child receives or attempts to send a photo with nudity, the image will be blurred and the child will be warned about the content, told it’s okay not to view the photo, and offered resources to contact someone they trust for help.

When Communication Safety was first announced, Apple said that parents of children under the age of 13 had the option to receive a notification if the child viewed a nude image in Messages, but after receiving feedback, Apple has removed this feature. Apple now says that no notifications are sent to parents.

Previously:

Notability’s Subscription Transition

Tim Hardwick (Reddit):

Notability users have been left frustrated and annoyed after the developer of the popular Mac and iOS note-taking app revealed on Monday that it has switched to a subscription-based model, and that key features included in original app purchases will stop functioning after one year.

Previously available as a one-off $8.99 purchase, Notability for iPhone, iPad, and Mac is now free to download on the App Store, but not all the features are available in the “freemium” version, and those that are included have editing limitations.

To get “the full Notability experience” offered by version 11.0 of the app now requires an annual $14.99 subscription[…]

[…]

As many users have pointed out, on the face of it, the change appears to violate Apple’s App Store Review Guidelines, which state “if you are changing your existing app to a subscription-based business model, you should not take away the primary functionality existing users have already paid for.”

Isn’t this the sort of thing App Review should be checking?

Notability (via MacRumors):

We heard the disappointment from our existing customers, and we want to correct our course. […] Everyone who purchased Notability prior to our switch to subscription on November 1st, 2021 will have lifetime access to all existing features and any content previously purchased in the app.

Matt Ronge:

When switching to subscriptions, talk to lots of people about it. You want to ensure that you don’t have any blind spots. Talk to some existing customers one on one, see how they react to the news. Put together a message announcing the switch, share it with your team and others you trust. Ask them what they take away from the message. Rinse and repeat this process until you’re happy with the reaction.

[…]

Despite all of this, I still think consumer subscriptions are the right choice for most productivity apps on the market – paid upgrades would also be another good option, but I highly doubt Apple is ever going to give those to us. Just be careful when making the switch!

Ryan Jones:

Any biz owner who makes this choice is not swimming in money and trying to make more! They are dying, with 2 choices:

Option 1: Work on it out of the goodness of my heart, make no money, risk my family’s wellbeing, and it dies anyway for all users in 2 years.

Option 2: Pre-announce a systemic change. Royally piss off 10% of users. Hopefully new ones ask for a refund. Surely old ones got amortized value of $3/year. Esp if they love it.

Then we at least have a chance to live, and they have a chance to use the app in years 2+.

Paul Haddad:

I’ll say for us it was definitely a matter of permanent maintenance mode or sub + a lot of on going development to justify it.

I’ll also say I think they should’ve released a new version or grandfathered everyone in (yuck).

Apple really needs to provide better upgrade options.

Michael Love:

To me, the key problem here is that they sold specific add-ons as permanent IAP (admittedly not for very much money) but now are not only converting the app to subscription-only but are also doing so for those paid features.

Some of this may have been hard to avoid - if for example they’re using a different handwriting recognizer with new royalties - but also, grandfathering old purchases is annoying and time-consuming and means keeping around lots of awful old code; it’s tempting to skip that step.

But Notability is a great example of a bad dev + user experience that could have been avoided if Apple allowed paid upgrades.

If it’s imperative people be able to buy a new $1000 iPhone without having to give “greedy developers” any $, mandate x years bug fixes for old versions.

Francisco Tolmasky:

I don’t think this is a users vs. devs issue, but a result of the @AppStore making it hard to continue using old versions forever (since that requires changing the app name). Normally you’d just have Version N+1 be subscription & say “keep using version N as long as you want.”

Francisco Tolmasky:

[Having] a version frozen in time (so as to manage two code paths for grandfathered users and avoiding them accidentally upgrading due to iOS auto upgrades is not easy (without changing app name), whereas its the default off the AppStore.

[…]

This is not the way it works in a “if you have the binary it works” model like on the desktop. You can change everything and have zero legacy around.

The fact that most users will just have the app auto-update from underneath them exacerbates this. My point is that “grandfathering in” in @AppStore land unnecessarily also creates tech debt, at which point there are incentives other than revenue for “forcing” it on everyone.

If I had a similar situation as Notability, I think I would feel compelled to do the same as they did, just to keep the app clean, as opposed to taking on the burden of special casing past features in future versions.

Previously:

Update (2021-11-15): Max Seelemann:

We’ve chosen the „new app“ approach that had also a lot of downsides to it 🧐

Christopher Atlan:

Apple doesn’t give a shit about paid purchases and anything relating to it like bundles. Bundles are broken. The new API to lookup purchases based on the receipt number? Not for paid apps.

If you don’t follow along the company line, freemium preferred with subscription, you’re in a world of pain and “are you fucking kidding me?”

Copyright © 2000–2021 Michael Tsai.