Archive for March 2016

Thursday, March 31, 2016

Introducing Safari Technology Preview

Ricky Mondello (Hacker News, MacRumors):

Starting today, there’s a new, convenient way to see what features and improvements are coming to Safari and other applications that use WebKit. Safari Technology Preview is a version of Safari for OS X, distributed by Apple, that includes a cutting-edge, in-development version of the WebKit browser engine. It’s a great way to test upcoming WebKit features and give feedback to the people building them when it’s most useful — early in development.

Safari Technology Preview is a standalone application that can be used side-by-side with Safari or other web browsers, making it easy to compare behaviors between them.

[…]

It’s now possible to programmatically copy and cut text in response to a user gesture with document.execCommand('copy') and document.execCommand('cut'). Having this ability may eliminate some websites’ last need for the Flash plug-in.

John Gruber:

Once installed, updates will come every two weeks through the Mac App Store — but you have to initially install from the website download. And unlike Webkit nightly builds, Safari Technology Preview is signed by Apple, which allows it to work with iCloud features (bookmark and tab syncing, etc.).

Nick Heer:

By the way, I’d just like to point to the Mac App Store review guidelines:

2.6 Apps that are “beta”, “demo”, “trial”, or “test” versions will be rejected

Just in case you thought you might be able to get away with this, as a third-party developer. Not that you did, of course.

I’m seeing a weird issue where Safari Technology Preview keeps relaunching itself after I quit it. I can’t get it to stay out of my Dock. I think this is caused by RescueTime.

This may be related to the fact that installing Safari Technology Preview broke my compiled AppleScripts for Safari. They now try to talk to Safari Technology Preview even when I’m already in Safari. I think this is because Safari and Safari Technology Preview have the same CFBundleSignature (sfri)—not the case with WebKit Nightly—but the preview has a higher version number. Even though my scripts mention Safari by name, the creator code is what gets saved during compilation. The fix is to change:

tell application "Safari"

to:

tell application id "com.apple.Safari"

since the apps have different CFBundleIdentifiers.

A public beta to fix this in EagleFiler is available.

Update (2016-04-13): Ricky Mondello notes that the second version of Safari Technology Preview has a bundle identifier distinct from regular Safari’s. It is now stp1.

Microsoft Is Bringing the Bash Shell to Windows 10

Frederic Lardinois:

Microsoft today announced that it is bringing the GNU project’s Bash shell to Windows. Bash (Bourne Again SHell) has long been a standard on OS X and many Linux distribution systems, while the default terminal for developers on Windows is Microsoft’s own PowerShell.

More importantly than bringing the shell over to Windows, developers will now be able to write their .sh Bash scripts on Windows, as well (or use Emacs to edit their code). Microsoft noted that this will work through a new Linux subsystem in Windows 10 that Microsoft worked on with Canonical.

“The native availability of a full Ubuntu environment on Windows, without virtualization or emulation, is a milestone that defies convention and a gateway to fascinatingly unfamiliar territory,” Canonical founder Mark Shuttleworth said in a statement today.

Dave Winer:

They ported Word and Excel to Mac when they were trying to get the world to adopt Windows. I think you can see where this is headed. Flatten out the differences between the OSes as much as possible. Why not. No one cares about that stuff, that’s the layer that was established 30 years ago. The action is happening 10-levels up the stack.

OmniFocus 2.5 for Mac

Derek Reiff:

In OmniFocus Preferences you’ll see a brand new pane: Style. Inside are both font collections and color palettes. Along with the ability to create your own styles, we’ve included some good-looking pre-made sets.

[…]

If you’re wanting to create your own color palette or font collection, check out this support article for more about what’s involved. Be aware! There are a lot of colors involved—it might be a productivity-breaker!

It’s not just fonts and colors. There are a ton of constants for controlling the spacing and padding. There’s also an OmniFocusColors app to make it easier to edit the property list file.

Update (2016-04-10): Nicholas Riley:

OmniFocus 2.5 finally letting me migrate from v1. Some niggles remain, but… (compare …)

Gatekeeper Bug in Mac OS X 10.11.4

Paul Kim:

Gatekeeper seems to be broken for non-app bundles. Heads up to devs shipping prefpanes, screensavers, plugins, etc.

spctl complains about an “obsolete resource envelope”.

Update (2016-03-31): Daniel Jalkut notes that this even affects Apple’s own Network Link Conditioner preference pane.

Daniel Jalkut:

This is a minor annoyance for folks trying to install an obscure development tool, but it’s a major issue for developers like Noodlesoft whose entire livelihood is built on the distribution of software packaged as a preference pane. The scary wording in the dialog casts doubt on the reputation of the developer, and for the more savvy, on the reputation of Apple’s ability to properly assess the trustworthiness of software that we download.

[…]

Let’s hope Apple can address this problem soon. Although it doesn’t pose a security risk, it seems appropriate that they could include this in a security update. After all, it has everything to do with preserving trust between users, developers, and Apple.

Update (2016-04-06): Paul Kim:

After filing a DTS incident, Apple confirmed it as a bug (I’ve filed rdar://25466753). There was no information about when a fix would be made available and given that Apple is not known for being nimble about these things and that I was losing customers, I followed the advice of some colleagues and took matters into my own hands.

The result is that starting with Hazel 3.3.8, it will ship with an installer app. The installer app still goes through System Preferences as I still think that its installation process works well.

[…]

One can debate how much Apple cares about non-app-bundled software but when the workaround is to suggest people bypass Gatekeeper, they should be very concerned. False positives only erode the confidence people have in your security systems and you don’t want them to get in the habit of casually bypassing them.

Update (2016-05-17): Paul Kim:

10.11.5 fixes the Gatekeeper/prefpane issue. I’ve already switched to shipping an installer app but might be helpful to others who haven’t

Wednesday, March 30, 2016

Fantastical 2.2 for Mac

Flexibits (comments):

The headlining new feature in version 2.2 is native Exchange support. Previously, Fantastical’s Exchange implementation was dependent upon Apple’s built-in calendar support. While this allowed Exchange accounts to work with Fantastical, there were a number of features it couldn’t support. With our own Exchange implementation, these limitations are no more.

[…]

Believe it or not, our next feature is actually one of our most requested: printing. Fantastical now offers the ability to print your calendars and reminder lists in a variety of different views and with multiple, detailed configuration options. We know a lot of you have been asking for this for quite a while now, but we wanted to make sure we got this right.

This is great news, considering that the current version of Apple’s Calendar app is incapable of printing a year’s worth of events. It just gobbled gigabytes of RAM, at a decreasing rate, until an hour later when I finally force quit it. Printing the same time period with Fantastical took seconds and about 30 MB of RAM. Unfortunately, Fantastical does not print the notes, URLs, or locations, so it’s not suitable for the PDF event archive that I was trying to create.

Update (2016-07-12): David Pogue:

For each feature, BusyCal 3 is almost always more flexible and more powerful than Fantastical, but everything is relative. Both programs blow the basic Apple calendar app off the map in these departments.

What to Do When the Mac App Store App Just Spins and Spins

TJ Luoma:

Recently I found myself in a bind: the Mac App Store app on my Retina MacBook would launch, but would not show me anything except a little spinning circle near the top-left corner. I left it like that overnight and when I came back the next morning it was still spinning. Fixing it was tricky, even for an experienced Mac user like myself, so I thought I’d share what worked for me in case you ever find yourself in that situation.

His fix was to show the debug menu, use it to open the hidden downloads folder, delete that folder, and then (required) reboot the Mac.

This is also yet another problem with Mac software that will never show up in crash logs, because the app never crashed, but that didn’t mean it wasn’t broken. I hope Apple is more aware of this type of problem than they sometimes appear to be.

The Big iPad Pro

Katie Floyd:

After spending time with the iPad Pro, there’s no doubt that it is a remarkable piece of engineering, and it is unquestionably the right device for some. Perhaps as a laptop replacement, perhaps as a better iPad, perhaps just as a supplemental device or even a second iPad. But for me, it’s none of those things. I’m glad I tried it, and I learned several things along the way. Here’s my tale of two weeks with an iPad Pro.

[…]

Probably the biggest problem with the iPad Pro was it was just too darn big. I found the iPad wasn’t comfortable to use in places where I typically like to use an iPad. The iPad Pro is a device that’s really meant to be used at a table or another flat service. […] Because of its size, anywhere I took my iPad Pro, it would have been just as easy to take my MacBook Air. If I was going to go the trouble, I personally would have preferred to have my Mac.

The size of the iPad Pro as also a problem in using it in client meetings. I didn’t care for the feel of the keyboard cover, and I found typing directly on the glass to be a clunky experience.

[…]

I personally found using the Apple Pencil more fatiguing compared to pen and paper and the handwriting was generally less clear on the iPad than on paper. I think this was due to having less friction and having to apply more pressure to control the pencil than compared with pen and paper.

Tuesday, March 29, 2016

IFTTT Drops Pinboard and App.net, Blames Them

Maciej Ceglowski:

It’s entirely IFTTT’s decision to drop support for Pinboard (along with a bunch of other sites). They are the ones who are going to flip the switch on working code on April 4, and they could just as easily flip the switch back on (or even write an IFTTT recipe that does it for them). Weigh their claims about Pinboard being a beloved service accordingly.

For users left stranded, I recommend taking a look at Zapier or Botize, which offer a similar service, or at one of the dozens of new sites that will spring up next week to capture the market that IFTTT is foolishly abandoning.

Gabe Weatherhead:

I’m probably done with IFTTT. I’ve waited for a business model and instead I get crazy service integrations I’ve never heard of.

zettt:

I somewhat expected IFTTT would go that route. The reason here is that they got so much investment money, that their growth plan has to involve bigger goals. In the end they need to recoup all of that money, because the investors don’t just spend money because they are nice people. The bigger goal probably means that they need to dominate the market in one way or another, and they think that they have to do this kind of thing in order to do so. IFTTT’s business has always been “blurry” to me. Blurry because it’s hard to understand what their ultimate goal is. It’s way too good to be free forever.

To me, the key point is that IFTTT doesn’t care about preserving the workflows that their users have already created. Instead, the customers are pawns to help them bully the services.

Update (2016-03-30): Nick Heer:

Cegłowski in a tweet from about a year and a half ago:

Right now the IFTTT business model is to charge one user $30M, rather than lots of users $2. The challenge will be with recurring payments

I suspect this is not unrelated.

Update (2016-03-31): I received an e-mail from IFTTT:

We’ve made mistakes over the past few days both in communication and judgment. I’d like to apologize for those mistakes and attempt to explain our intentions. I also pledge to do everything we can to keep Pinboard on IFTTT.

[…]

We made a mistake in asking Pinboard to migrate without fully explaining the benefits of our developer platform. It’s our responsibility to prove that value before asking Pinboard to take ownership of their Channel.

[…]

I also want to address Pinboard’s concerns with our Developer Terms of Service. These terms were specific to our platform while in private beta and were intended to give us the flexibility to evolve our platform in close partnership with early developers. We’ve always planned to update and clarify those terms ahead of opening our platform and we are doing so now. We are specifically changing or removing areas around competing with IFTTT, patents, compatibility and content ownership. The language around content ownership is especially confusing, so I’d like to be very clear on this: as a user of IFTTT you own your content.

Update (2016-05-03): See also: Microsoft Flow.

Universal Links Association Files Crashing iOS Apps

Joe Rossignol:

A significant number of iPhone and iPad users on the MacRumors discussion forums, Apple Support Communities, and Twitter have reported an apparent iOS bug that causes Safari, Mail, Messages, Notes, Chrome, and select other preinstalled and third-party apps to crash or freeze after tapping or long-pressing on web links.

Benjamin Mayo:

Since posting our original story, we have heard from a lot of readers that are affected by iOS 9 crashes or app hangs when tapping links, spanning multiple iOS versions (not just 9.3) and devices. In a statement, Apple has now confirmed that they are working on a fix for the problem, coming in a software update (presumably iOS 9.3.1).

[…]

Previously, we pinpointed Bookings.com as a cause of the bug, although noting it affects other apps as well. On Twitter, it was found that their website association file, used by the system for the universal links feature introduced with iOS 9, was many megabytes, grossly oversized. This would essentially overload the daemon that had to parse these files, causing the crashing. The Booking.com app has since corrected its payload file to be a far more reasonable 4 kilobytes. Users of Booking.com should delete and reinstall the app, to refresh the system caches for the URL association file.

[…]

Unfortunately, it is practically impossible to find out which apps are the misdemeanours. In terms of high-profile cases, we have heard that Wikipedia and Eat 24 are among the apps registering too many domains in their universal link directory.

Rosyna Keller:

The bug has existed in every version of iOS 9, from the very beginning. Booking.com just happened to update their association file last week to a version that triggered the bug. It has nothing whatsoever to do with iOS 9.3.

[…]

There’s no need to harbor any ill will towards booking.com for this. The documentation on Universal Links is extremely sparse. It never talks about the limits or best practices. It never even discusses how apple-app-site-association files are updated on iOS devices.

The file itself is completely valid JSON and passes all correctness tests. It’s just that iOS’ swcd daemon doesn’t like it and chokes hard. It’s nigh impossible for developers to test updates to their apple-app-site-association files from anywhere except the iOS simulator, which doesn’t have all the resource limitations a real iOS device has when shared with multiple other iOS apps.

[…]

Eat24 and Wikipedia are not related to this issue. The wikipedia site association file registers 5 paths. The Eat24 site association file registers only 1 (and it’s 156 bytes total). There’s no need to mention apps that are totally unrelated to this issue. All it does is worry people.

Timothy Hatcher:

New in iOS 9.3: Use wildcards for the domain name associations of Universal Links to help reduce duplication.

Update (2016-03-30): John Gruber:

In the meantime, if you’ve been hit by this bug, Ben Collier has a step-by-step workaround guide. (It’s not simple.)

Gruber says that apps were misusing the Universal Links feature, but that’s not clear to me.

Update (2016-03-31): Federico Viticci:

Apple released iOS 9.3.1 earlier today, bringing a fix for a problem related to Universal Links that caused apps to become unresponsive after tapping web links.

Update (2016-04-21): Apple (via Rosyna Keller):

In iOS 9.3.1 and later, the file must be no larger than 128 KB (uncompressed), regardless of whether it is signed.

Restricting Your Cell Carrier’s Use of Your CPNI Data

Adam C. Engst:

CPNI originally referred to anything that might appear on your bill, but now varies widely by service and carrier. With cellular carriers, it might include your data plan and usage, device info, location history, Web browsing history, and even demographic information.

[…]

Are there any actual abuses of CPNI? Yes. Additional research revealed, among many other stories at the Electronic Privacy Information Center (EPIC), that in 2014 Verizon paid a $7.4 million fine for using CPNI for marketing purposes without informing customers. Worse, AT&T had to pay a $25 million fine in 2015 for disclosing personal information (and misusing CPNI data) for almost 280,000 of its U.S. customers, thanks to crooks paying off employees in three AT&T call centers in Mexico, Colombia, and the Philippines to unlock stolen and/or grey market phones.

It’s important to realize that restricting a carrier from using your CPNI doesn’t prevent it from being collected, so opting out might not prevent such information from being swept up in data breaches like AT&T’s, but it certainly can’t hurt. Regardless, the fact that the FCC felt it was important to require telcos to offer such an opt-out makes me think it’s worth doing.

Monday, March 28, 2016

Finder Drops Keystrokes After Creating New Folder

Pierre Igot:

In practical terms, it means that, after I press command-shift-N on my machine (a 2014 Mac Pro with 32 GB of RAM, with a 1 TB SSD as the startup volume), I cannot start typing the name right away. I have to wait for a fraction of a second before I do so. If I don’t, then the first couple of letters I type fail to appear in the folder name that I typed.

Yes, you read this right: I, Pierre Igot, am a supernaturally fast typist, with whom a powerful machine such as the 2014 Mac Pro is not able to keep up.

[…]

What is really unbelievable to me here is not so much that the Finder needs a fraction of a second after creating the folder. It is that there does not seem to be any kind of text input buffer that keeps my keystrokes in memory until the OS is ready to process them. The keystroke(s) that the Finder fails to register simply disappear into the ether, as if the characters had never been typed.

This is the sort of thing that “just worked” 25 years ago with the classic Finder, but it has been broken for so long in Mac OS X that there must already be lots of duplicate Radars. It works in most other places, though. In Mail, I can start typing an address after creating a new message. In Safari, I can type a search query or URL after creating a new window. I did not have to do anything special to make it work in EagleFiler when creating new folders or files.

I can only guess that the Finder’s folder creation is very asynchronous so that it continues processing events before the folder has been created. So the keys arrive before there is a text field for them to go to. But, at least on my Mac, they don’t go into the ether. They go towards type-selection in the current window. So, for example, if I create a new folder and type “foo”, the Finder selects the first file in the list whose name begins with “f”, and then it creates the new folder, selects it, and types “oo” for the name.

Update (2016-03-28): Vegar Nilsen:

I see the same thing fairly regularly with Spotlight, where it e.g. only captures “witter”, and can’t understand which app I wanted.

Update (2016-03-30): To clarify, I never see the issue in Icons view, only in the List and Columns views.

Swift Colon Care

Erica Sadun:

Since I started programming in Swift, I moved to the “Ash Rule” of left-hugging colons in all uses except ternary, up to and including dictionary references, protocols, etc.

[…]

Dave Abrahams clarified StdLib style on the Swift Evolution list today:

  • Full monty spaces for declarations and extensions
  • Left magnetism for providing values

Clear iOS Caches by Renting a Long Movie

Keir Thomas:

Put simply, renting a title larger than the remaining capacity on your device forces iOS to use a hitherto undisclosed clean-up routine, thereby freeing-up space. Even if the download is way too big, it’ll still try to free-up space. Neat!

[…]

It was originally claimed in the tip on Reddit that you won’t be able to actually rent the movie if you don’t have enough free space. In my tests I DID rent the movie, and got charged for it, but then I live in the UK where the rules are different compared to the US.

[…]

By tapping the Storage & iCloud Usage heading you might see that some free space has already been freed-up, but you must now return to the iTunes Store app and attempt to rent the movie again! And again tap to visit the Settings app. Repeat several times. Each time more space will be freed-up.

There should just be a button in Settings to delete transient app data. Right now, the officially supported way seems to be to erase the device and restore it from backup, which takes a really long time.

It annoys me when the system is supposed to manage a resource automatically but doesn’t do so properly. Mac OS X still gets into situations where the system gets really slow, virtual memory has created huge swap files, and yet quitting every open app doesn’t seem to improve things. Most of the memory should be available, but it isn’t being taken advantage of. The only solution is to reboot.

Previously: iOS 9 Space Savings.

Update (2016-03-28): Michael Rockwell:

This works when trying to download a previously purchased movie, too. No need to initiate a rental.

Friday, March 25, 2016

Surprises With Swift Extensions

Peter Steinberger:

These seemingly innocent extensions were overriding private API. Apple’s private API detection is not super sophisticated and wasn’t triggered when the app was uploaded to the App Store. It’s also not a public symbol so there were no warnings, not even a log message. Unprefixed categories are always dangerous, especially on classes that you do not own, like UIViewController. In PSPDFKit, we use categories for shared code, but prefix any method with pspdf_ to be absolutely sure we do not hit any name clashes. It’s certainly not pretty, and prefixes in Swift look even more alien, yet as you can see in this bug hunt, they are definitely necessary.

[…]

You can use @objc(prefix_name) to keep the name pretty in Swift and expose a prefixed version for the ObjC runtime.

Names That Break Computers

Chris Baraniuk (via Rosyna Keller, comments):

“We moved almost immediately after we got married so it came up practically as soon as I changed my name, buying plane tickets,” she says. When Jennifer Null tries to buy a plane ticket, she gets an error message on most websites. The site will say she has left the surname field blank and ask her to try again.

[…]

Some individuals only have a single name, not a forename and surname. Others have surnames that are just one letter. Problems with such names have been reported before. Consider also the experiences of Janice Keihanaikukauakahihulihe'ekahaunaele, a Hawaiian woman who complained that state ID cards should allow citizens to display surnames even as long as hers – which is 36 characters in total.

[…]

But McKenzie is living proof of the fact that name headaches are a relativistic problem. To many English-speaking westerners, the name “Patrick McKenzie” might not seem primed to cause errors, but where McKenzie lives – Japan – it has created all kinds of issues for him.

See also: xkcd and Explain xkcd.

Previously: Falsehoods Programmers Believe.

To Optional or Not to Optional: IBOutlet

Curtis Herbert:

UIKit was written during the era of nil messaging, and I’ve come to realize it isn’t safe to 100% assume IBOutlets can’t be nil. Going forward I’ll be using optionals for my IBOutlets. I have a task in my bug tracker to scrub all my IBOutlets to covert them from implicitly unwrapped to standard optionals. A few extra question marks never hurt anyone; I’d rather my app not crash.

Update (2016-03-30): Scott Berrevoets:

Applying these three rules means you properly use the optional semantics.

ColorSync Support in iOS 9.3

Jeff Carlson:

Apple’s screens are generally very good, but for photographers and other visual artists and designers, the inability to adjust the color profile has meant that the iPad is excluded from any serious image-processing workflows.

Now, with true color management possible on the iPad Pro, the tablet may find a place in that chain, and perhaps photographers will be able to do final adjustment work on an iPad instead of bringing a laptop.

Thursday, March 24, 2016

Inside Liam

Samantha Murphy Kelly:

Liam is a large-scale robot, with 29 freestanding robotic arms at various skill stations. But while most assembly-line robots help put together products you’ll one day hold in your hands, Liam is hard at work disassembling your ruined, returned iPhones.

[…]

At some stations, robots worked in pairs; because some iPhones come back with corrosion, the first robot may try five times to remove a screw, while the second is free to move on to another task on the same device without slowing down the process. Apple claims that Liam yields a 97 percent success rate for removing each component.

[…]

Liam completes an iPhone disassembly process every 11 seconds, with dozens running through the system at all times. About 350 units are turned around each hour, equivalent to 1.2 million iPhones each year. Apple wouldn’t say when Liam started its work, but emphasized the project is still in the research and development stages.

XCTestExpectation Gotchas

Jeremy W. Sherman:

XCTestExpectation simplifies testing callback-style code, but some of its design choices make tests using it fragile unless they’re mitigated:

  • It explodes if everything works right but later than you expected.
  • It explodes if everything works right more than once.

This article presents two concrete mitigations:

  • Use weak references to ensure the expectation dies before it can cause you trouble.
  • Use a different promise API to do your waiting.

Mac OS X 10.11.4 and iOS 9.3

After updating my main Mac to 10.11.4, it wouldn’t boot. It got stuck with a full progress bar after logging in. I had a similar problem with an earlier release of El Capitan but, unlike then, this one didn’t resolve itself. I spent hours trying different possible remedies—lots of other people have encountered problems like this and posted what worked for them—but none of them worked for me. After restoring from a recent 10.11.3 clone, I tried the update a second time. This time, I didn’t use the combo updater, as multiple people had traced problems to it. Again, it hung after entering my password, but this time after I force restarted it worked.

This experience reminded me that, though it’s great to do a clone backup before updating your Mac, it’s not such a good idea to boot from that backup when you need to restore. I made that mistake, and it took probably half an hour before my clone was booted and usable. I’m not exactly sure what took so long, but Activity Monitor showed a huge amount of Spotlight activity. The backup had probably never been indexed, and it was wasted time because I don’t need it to be indexed. The other problem with booting from a clone is that some apps, like Dropbox and Little Snitch, don’t like to be run from a different disk. (Apparently they track the inode numbers of their files.) So they interrupt you with various windows. Then, after the restore, they see that you changed drives again. Lastly, there’s really no need to run my full array of apps that back up, sync, and otherwise talk to the cloud while I’m restoring from the backup. It’s simpler, faster, and less error-prone to use a minimal boot drive that just has your backup software on it, even though that means connecting two drives rather than one.

I’m happy to report that the Safari t.co bug is fixed. That was an infuriating one that had been hitting me tens of times per day since the fall. (It, or a related bug that also seems to be fixed, also affected loading pages from other sites.)

I love the new feature where iBooks can store your own documents in iCloud and sync them between devices. I have been using this to read the new Advanced Swift ePub, and it even syncs the reading location and annotations.

I’m still seeing the bug where Command-Delete doesn’t work in the Finder.

My iPad mini also had problems logging in after updating to iOS 9.3, freezing with one of the keys depressed while I was typing my passcode. After rebooting, it seemed to work normally.

I have been enjoying Night Shift, although I don’t like its color choices as much as f.lux’s (perhaps just because I’m used to the latter).

The camera-pauses-audio bug is still not fixed.

iOS 9.3 includes some significant improvements to NSUserDefaults, which are not yet in Mac OS X.

Update (2016-03-25): Juli Clover:

Apple has temporarily stopped offering the iOS 9.3 update for older devices like the iPad Air and earlier and the iPhone 5s and earlier due to installation issues some users have experienced. On older devices, iOS 9.3 requires users to input the Apple ID and password originally used to set up the device, which can lead to the device becoming stuck at the Activation Lock screen if the original account information can’t be recalled.

“Older devices” notwithstanding, I ran into this with both my iPad mini and my iPhone 6s, though neither got stuck.

Update (2016-03-30): Glenn Fleishman:

In fact, this feature likely will have little or no effect on most people. Apple hasn’t misrepresented any of the science, but clinical work done to date doesn’t point a finger right at mobile devices or even larger displays. Night Shift also can’t remove enough blue to make a difference if that color is the culprit. And blue light may not be the trigger it’s been identified as. While researchers haven’t tested the new feature yet, several factors add up to at best a placebo effect and a reminder to power yourself down.

John Gruber:

I think the stuff about getting a better night’s sleep is bunk, though.

To me, it’s not about sleeping better but rather getting to sleep more easily (and, secondarily, reducing eye strain). Placebo or not, the color shifting really seems to help for me. Unfortunately, Night Shift doesn’t shift the colors as much as Flux, which may make it less effective.

Update (2016-04-02): Michael E. Cohen:

I regularly make EPUBs, and the ability to check layout, for example, on my various devices (a Mac, an iPad Air, an iPhone 6+, and an ancient iPad 2) without having to sync these devices via iTunes sounds wonderful. And it would be… if everything worked as Apple says it should. Reality, however, begs to differ. With its latest iterations of iBooks, Apple has cooked up a gallimaufry of inconsistencies and unreliabilities.

Wednesday, March 23, 2016

How to Use the 10.9 SDK With Xcode 7.3

Felix Schwarz (via Jeff Johnson):

When Apple shipped Xcode 7, it decided to ship it only with the OS X 10.11 SDK. Unfortunately, this has since put developers of USB kernel extensions between a rock and a hard place.

[…]

In essence, that means you can still write a USB kernel extension targeting older OS X releases and it will continue to just work™ under OS X 10.11, too.

The OS X 10.11 SDK, however, lacks the needed header files for the old USB stack. And that’s why the OS X 10.9 SDK is still needed if you want to build these.

Rich Siegel:

It no longer recognizes older SDKs placed in Developer/Platforms/…/SDKs/. Working around it now by copy/link to $SRCROOT.

I had hoped that the rewritten USB stack in El Capitan would solve the problem I’ve been having with USB 3 drives spontaneously unmounting. However, that is not the case. One of my drives unmounted in the middle of a backup literally while I was reading Schwarz’s post.

Adventures in Troubleshooting AirDrop

Dan Moren:

Just now, as I was writing out this list, I realized I hadn’t tried to force-quit and restart the Photos app, so I did that. And weirdly enough, that seemed to make AirDrop work again—at least for now.

Yet I still can’t be entirely sure that that’s what actually fixed it, and I think this is one reason that we’ve been having, of late, this discussion about the declining quality of Apple’s software.

[…]

All three of those factors taken together make the technology, which can feel magical at the best of times, instead seem downright capricious.

AirDrop is a total mystery to me. Half the time it works great. But half the time it doesn’t work at all, seemingly without me having changed anything, and no troubleshooting checklist ever seems to fix it. Then a few days or weeks later it mysteriously starts working again.

Adobe Jumps the Shark

Glenn Reid:

I have never had such miserable experiences with installers, updaters, subscriptions forced upon me, crashing applications, and overall lack of awesomeness. If Adobe is in decline, it’s Adobe’s own fault. You don’t have to sit back and be old and pointless.

[…]

You have all seen Adobe Air update messages -- two a week for a while there -- without any idea of what Adobe Air is, or why you want it, or why it needs to be upgraded. But this is the one that sent me over the edge today, as I was concentrating on some work that I was doing. Up pops the most useless dialog box ever, to interrupt my concentration. You launch an updater to tell me that I don’t need to update? Really?

[…]

Here’s a little secret: if people start to hate your products and your business practices, you won’t have recurring revenue for long. The recurring part is based on trust and value. At this point, you are losing both.

Update (2016-03-23): See also: Record Adobe Revenue, Oluseyi Sonaiya.

How One Developer Broke Node, Babel, and Thousands of Projects

Chris Williams:

A couple of hours ago, Azer Koçulu unpublished more than 250 of his modules from NPM, which is a popular package manager used by JavaScript projects to install dependencies.

Koçulu yanked his source code because, we’re told, one of the modules was called Kik and that apparently attracted the attention of lawyers representing the instant-messaging app of the same name.

[…]

Unfortunately, one of those dependencies was left-pad. The code is below. It pads out the lefthand-side of strings with zeroes or spaces. And thousands of projects including Node and Babel relied on it.

Azer Koçulu (via Erik Aybar):

When I started coding Kik, didn’t know there is a company with same name. And I didn’t want to let a company force me to change the name of it. After I refused them, they reached NPM’s support emphasizing their lawyer power in every single e-mail CC’ing me.

[…]

I’m apologize from you if your stuff just got broken due to this. You can either point your dependency to repo directly (azer/dependency) or if you volunteer to take ownership of any module in my Github, I’ll happily transfer the ownership.

Update (2016-03-24): Mike Roberts:

We don’t mean to be a dick about it, but it’s a registered Trademark in most countries around the world and if you actually release an open source project called kik, our trademark lawyers are going to be banging on your door and taking down your accounts and stuff like that — and we’d have no choice but to do all that because you have to enforce trademarks or you lose them.

[…]

The wording we used here was not perfect. We’re sorry for creating any impression that this was anything more than a polite request to use the Kik package name on NPM for an open source project we have been working on that fits the name.

David Haney (comments):

I get the impression that the NPM ecosystem participants have created a fetish for micro-packages. Rather than write any functions or code, it seems that they prefer to depend on something that someone else has written. It feels to me as if the entire job of an NPM-participating developer is writing the smallest amount of code possible to string existing library calls together in order to create something new that functions uniquely for their personal or business need.

Dave Winer:

Recently the Node community had a fairly big outage that can be traced to the fact that NPM, the code distribution system, has been taken over by VCs. When NPM became VC-backed, it was obvious that at some point this would cause problems. And it certainly doesn’t stop there. I worry about GitHub. It plays such a central role. But eventually the VCs are going to want an exit. Then what happens?

Tuesday, March 22, 2016

Xcode Upgrades: Lessons Learned

Erica Sadun:

I spent roughly 8 hours all told downloading, installing, and updating Xcode, much of which could have been bypassed by following two simple rules:

  1. Never update Xcode from the Mac App Store
  2. Wait until Apple posts the upload on developer.apple.com/downloads and then update from there.

[…]

Under such circumstances, you’ll always be better off downloading the bossy full-figured 5GB dmg than upgrading a model-thin Chanel-wearing 2.6GB differential, especially when servers are mocking you with NananaNAN completion estimates.

This is why you should always wait for a DMG. No matter how long it takes to appear on the developer site. No matter how slow the download ends up being. The advantages of downloading a DMG are numerous[…]

Seconded. I have nearly always regretted updating Xcode via the Mac App Store. And you’ll probably want the .dmg file to save a copy of that Xcode version, anyway. (I wouldn’t count on an archived copy from the Mac App Store to keep working.)

Apple’s “Loop You In” Event

John Gruber:

If you listen to my podcast, you know how ambivalent I remain about the physical size of the 4.7-inch iPhone 6 and 6S. I was really hoping that the iPhone SE would effectively have iPhone 6S specs — CPU and GPU performance, and similar camera quality. That seems to be exactly what Apple delivered. I honestly think this is the phone I’m going to use for the next six months.

In hand, the iPhone SE is nearly indistinguishable from an iPhone 5S. Other than the matte finish on the chamfered edges, the only difference I could spot is the “SE” on the back of the phone. No curved sides, no curved glass.

I remain ambivalent as well. I’ve found that I like using the 4.7-inch screen. It’s not as easy to use one-handed, but the extra space (both for reading and for typing) is worth it overall. Unexpectedly, what bothers me most about the iPhone 6s’ size is that it’s so uncomfortable in my pocket. I doubt there’s much that can be done about that, short of making it bendable; making it thinner wouldn’t help much.

I don’t think it’s worth trading my 6s for an SE, but if I were buying today it would be a tough decision because the SE doesn’t really match the flagship phone. I’ve gotten used to the much faster Touch ID and editing text with 3D Touch (even though it often doesn’t work the first time). The 6s’ front-facing camera was the first one that I actually use for photos. And I like having 128 GB of storage—not because I’m currently using more than 64 GB, but because I know that I won’t have to worry about it over the next two years.

Regarding the iPhone SE’s design, I’m happy to see the sleep button on the top and that there is no camera bump. Most importantly, it does not have curved edges, after all. The sharp edges are the worst part of the iPhone 6/6s, and for me they make a case essential for the first time. After using several different cases, I’ve settled on the Magpul Field Case. It makes the curved edges comfortable and grippable (without sticking in the pocket), makes the orientation easier to feel than Apple’s cases, and makes the buttons easier to press and yet harder to press accidentally. It also counteracts the camera bump so that the phone lies flat. The downsides: dust collects in the camera cutout, the colors aren’t as good as Apple’s, and the overall design is much less attractive than Apple’s cases or a naked phone. I’m grateful to have found a case that I like, but I wish that it were not necessary. It more than negates any thinness benefit of the 6s vs. the 5s, without filling the space with something useful, such as battery.

Ben Thompson:

The problem is growth: specifically, how many high-end customers are there, and how many of those customers find their current iPhones to be good-enough? And, if Apple believed their market to be increasingly saturated, would the company be willing to cannibalize its high-margin iPhone?

The iPhone SE suggests the answer is yes, and that fact alone made yesterday’s event far more important than it seems. Specifically, Apple is offering top-of-the-line specs for an unprecedented price of $399. In other words, the SE is no 5C. In fact, it seems likely Apple learned some inadvertent lessons from the 5C: I am not at all surprised that the SE looks identical to a 5S; when an integral part of the iPhone value proposition is status what customer wants to advertise that they bought a model that was never a flagship?

The 9.7-inch iPad Pro looks impressive, although what I really wanted to see today was a lighter iPad mini. My first thought was that the iPad Pro’s camera bump would make it not lie flat, but Matthew Panzarino says that it doesn’t wobble.

Manton Reece:

Dan Moren writes for Six Colors about the structure for the 1-hour Apple event today, of which only about half the time was spent on new products[…] I’d like to see this continue at future events. Leave the record sales numbers for the finance call, and instead focus on what good Apple is doing because they are big, not just how they are big.

I would rather see a shorter, more focused event, though Apple probably has good reasons not to do that. This was at least better than repeating the pattern of sales numbers and customer sat, which everyone probably tunes out by now.

Milen Dzhumerov:

I miss Apple Computer Inc. – the company that used to be fully focused on creating the best computers running Mac OS X.

Selena Larson:

Schiller said that 600 million people are using PCs that are over five years old. “This is really sad,” he said.

Brian Stucki:

Apple: Many in-use PCs are more than five years old.

Also Apple: we currently sell a Mac that is nearly 4 years old. And a few other ~2yrs

Sebastiaan de With:

It’s really killing me to see so many great artistic professional friends switch to Windows / PCs because Apple is neglecting Pro Macs.

Joe Rossignol:

While some customers were hopeful that Apple would release new Macs at its “Let Us Loop You In” media event yesterday, the product announcements were focused on the new 4-inch iPhone SE, 9.7-inch iPad Pro, and additional Apple Watch bands.

But those waiting patiently for a Mac refresh may not have much longer to wait, as DigiTimes today reported that Apple will begin shipping new “ultra-thin” 13-inch and 15-inch MacBooks at the end of the second quarter.

When I think of what I want to see in the next MacBook Pros, “thinner” is not even on my list. I want more storage and RAM, better performance, more ports, a larger screen, and cellular. I fear that Apple is going to trade some or all of those for thinness, while also making the keyboard and trackpad worse.

I’m also sad to see that Apple updated virtually all of its operating systems except the one for the Apple TV 3, which is still for sale. It seems like it will be stuck with the discoveryd regression for good.

Update (2016-03-22): Manton Reece:

I keep thinking about the iPhone SE price: $399 for essentially the power of a 6S, which is $649. That’s just a great value. I’ve said on Core Intuition recently that while the 6S and upcoming 7 will always remain the most popular phone, I think the SE could hold its own with the 6S Plus in units sold. Now I wonder if it could even surpass it.

Nick Heer:

I’ve always been a fan of the 5S’ form factor, too — to my eyes and hands, it’s the prettiest and most comfortable iPhone ever.1 But the drawbacks of an SE are not insignificant, compared to a 6S: its display panel isn’t as good, the cover glass isn’t as durable, the Touch ID sensor is the much slower first-generation version, it doesn’t have 3D Touch, and it isn’t available in a 128 GB storage configuration. These are all deal-breakers for me, though they may not be for you.

I’m curious to see how the SE finds its place in Apple’s lineup over the coming few generations. Will it be like the iPad Mini, lagging one generation behind? Will it eventually get redesigned to look a bit more like a 6(S) generation iPhone, or will it perpetually look like a 5(S)? Does it have a permanent place in the lineup, or is it a stopgap?

Update (2016-03-24): Nick Heer:

But his — I assume — improvised “really sad” punchline didn’t land because having a five year old functional computer is not sad, it is impressive. I didn’t replace my MacBook Pro until it was over five years old. My MacBook Air will turn four this year and, while I ache for a better display, I have no immediate intention of replacing it any time soon. The display in my Air, by the way, is effectively the same panel that has been included with MacBook Airs since at least 2010, making it well over five years old.

Riccardo Mori:

I’ll just close with a quip — There are sadder things than five-year-old PCs: the current state of the Mac App Store, to name one.

Update (2016-03-30): Joe Cieplinski:

For one thing, I just got myself into a contract last September via the iPhone Upgrade Program for the 6s Plus. (I recognize that this is was my choice, by the way, so I’m not blaming anyone but myself.) To buy out the remainder of my contract on the 6s Plus and get myself an SE, I’d be out around $900. That’s a lot of money to get myself a smaller phone.

Things don’t get better in September, either, as I reach my 1-year milestone with the 6s Plus. The iPhone Upgrade Program does allow me to upgrade after only one year, but the program doesn’t include the SE. So while I can trade up to the iPhone 7 (or whatever Apple calls the new phones at that time) I can’t trade down to the SE. I’ll be in the same boat. Wait another year, or buy out the remaining contract.

My worry about the iPhone SE is that it’s not top-of-the-line at release, which is already 6 months behind the iPhone 6s, and it will only fall farther behind. I doubt Apple will update it with the other iPhones this fall, and it may end up on a two-year (or longer) cycle. So I’m glad that 4-inch iPhones aren’t gone completely, but this is not really what I wanted.

Andy Grove, RIP

Casey Newton:

Andy Grove, who fled from Nazi and Soviet oppression to become one of the most powerful business leaders in the global tech industry as the chairman and CEO of Intel, died on Monday. He was 79. The cause of death was not reported, though Grove was a longtime sufferer of Parkinson’s disease.

Intel:

Present at Intel’s 1968 founding with Robert Noyce and Gordon Moore, Andy Grove became Intel’s President in 1979 and CEO in 1987. He served as Chairman of the Board from 1997 to 2005. Both during his time at Intel and in retirement, Grove was one of the most influential figures in technology and business, writing best-selling books and widely cited articles, and speaking out on an array of prominent public issues.

Steve Johnson:

During his three decades with the Santa Clara corporation, the gruff and demanding Grove helped mold Intel into a multibillion-dollar Goliath and the world’s biggest semiconductor company. Along the way, he also became a prolific author, donated millions of dollars to charity and was lavished with awards, including being named Time magazine’s Man of the Year.

[…]

Grove fled to Austria at the age of 20 and, with $20 in his pocket, emigrated to the United States, where he changed his name from Grof to Grove, moved in with relatives and was accepted at City College of New York.

[…]

Finishing City College in 1960 at the top of his class with a bachelor’s degree in chemical engineering, he entered graduate school at UC Berkeley and arranged for his parents to leave Hungary and join him in California. After receiving a doctorate degree in chemical engineering in 1963, Grove landed a job with Silicon Valley chip pioneer Fairchild Semiconductor, where he became assistant director of research and development in 1967.

Ian King:

When Steve Jobs and Larry Ellison told Andy Grove he was the only person in Silicon Valley who they would willingly work for, he told them he wouldn’t have hired either because they were “a couple of flakes.”

He was at least half serious and didn’t crack a smile.

[…]

If Grove experienced fear when he came to Intel, that didn’t stop him from using it as a management technique. He influenced a generation of Intel executives who referred to planning meetings with him as a “Hungarian inquisition.”

“Mentoring with Andy Grove was like going to the dentist and not getting Novocain,” said Pat Gelsinger, a former Intel executive who went on to become CEO of VMWare Inc.

Jonathan Kandell:

The first major crisis was linked to the rise of cheaper, high-quality Japanese memory chips beginning in the late 1970s. Instead of cutting costs by laying off staff, Mr. Grove demanded that Intel employees work an extra two hours a day — for free. Almost simultaneously, Intel introduced an advanced chip, the i432 microprocessor, that the company claimed would reshape computing’s future.

Instead, it proved a disaster, running 5 to 10 times more slowly than competitors. Part of the problem, Mr. Grove conceded in a 2001 interview with Wired magazine, was that he initially failed to take microprocessors seriously enough. “I was running an assembly line designed to build memory chips,” he said. “I saw the microprocessor as a bloody nuisance.”

But with Mr. Grove at the helm, Intel soon made the transition from memory chip to microprocessor giant.

Ben Thompson:

That’s why the Grove decision that actually impresses me the most is Intel’s launch of the Celeron processor in 1998. Grove had been introduced to a then-relatively-unknown Harvard Business School professor named Clayton Christensen, who told him about research for an upcoming book (The Innovator’s Dilemma) that explained how companies in their pursuit of margin allowed themselves to be beat on the low-end. Grove took the lesson to heart and directed Intel to create a low-end processor (Celeron) that certainly cannibalized Intel’s top-of-the-line processor to an extent but also dominated the low-end, quickly gaining 35% market share.

Update (2016-04-02): Ken Segall:

Intel’s huge leap in marketing came with the “Intel Inside” campaign. Though it’s grown incredibly tired today, this campaign does hold a place of honor in technology marketing history. It was by advertising the processor inside the PC as a consumer product that Intel became the global powerhouse it is today. It was a huge, bold leap.

Intel’s then-marketing chief, Dennis Carter, has always received credit for the birth of this campaign. But Fortune has a very nice article about Andy Grove (recommended reading), and they report that it was Andy who put his weight behind the campaign when others objected. That’s certainly a feather in his marketing cap.

Camera.app Still Pauses Audio Playback

Ole Begemann:

Taking photos or videos while listening to music is not an edge case. It’s unclear to me whether the current behavior is a deliberate choice by the engineers who wrote the camera app or if nobody really thought about this, but I think it’s a bad default.

I can imagine many situations where I would want music playback to continue while I’m recording a video or taking a photo (Live Photo or not). I almost always listen to podcasts or music when I walk around the city, and this is also a great opportunity for taking pictures. And it’s not even limited to using headphones. Say you’re at a party where people are taking turns at playing songs on the room’s stereo wirelessly from their smartphones. You wouldn’t want your iPhone to stop music playback just because you want to take a video of your dancing friends.

Previously: My iPhone 6s and iOS 9 Experience, iOS 9.2.

Update (2016-03-23): Nick Heer:

Apple does see this as a bug, but it’s inexplicable to me that it remains unfixed after three major iOS 9 updates.

Or, looking at it another way, even if Apple fixes it in the next update it will have been broken for more than half of iOS 9’s life.

Update (2016-05-17): Nick Heer:

One day, listening to music while taking a photo will once again be possible. I have hope.

Monday, March 21, 2016

Update Your Kindle’s Software Today

Kirk McElhearn:

If you don’t update the device by tomorrow, then you’ll have to manually update it. This means you have to download an update file, and transfer it to the device from a computer via a USB cable. More information about determining which software version you need, and which device you own, is here.

When Your Swift Code Breaks the Compiler

MPow (via Natasha Murashev):

Swift is a relatively young language so it’s more common than in the past to spot some bugs, it’s part of the game, just we (or at least me) are not used to it. You may spend some time writing your code, modeling your architecture around protocols and then when you try it out: the compiler crashes.

[…]

This time I just lost half an hour changing the values more or less randomly until I realized that Swift was open source and I should have gone deeper in the compiler and try to debug it.

I haven’t gotten a compiler crash in a while, but I still get Source Kit Service crashes multiple times per day. Sometimes everything seems to keep working; other times, the indexing is messed up until I restart Xcode.

iMessage Attachments Security Flaw

Tim Hardwick (Hacker News):

A flaw in Apple’s encryption systems has been found that enables an attacker to decrypt photos and videos sent over its iMessage instant messenger service.

According to The Washington Post, the security hole in Apple’s code was exploited by a group of Johns Hopkins University researchers, led by computer science professor Matthew D. Green.

Green reportedly alerted Apple to the problem last year after he read an Apple security guide describing an encryption process that struck him as weak. When a few months passed and the flaw remained, Green and his graduate students decided to mount an attack to show that they could break the encryption of photos and videos sent over iMessage.

[…]

Apple said that it partially fixed the problem last fall when it released iOS 9, and will fully address the issue through security improvements in iOS 9.3, which is expected to be released this week.

mtgx:

Another iMessage/iOS design flaw (in the context of its “end-to-end encryption”) is that you can’t disable iCloud sync for the messages alone. It’s an all or nothing proposition. It would be good if in iOS 9.3 they’d allow iMessage sync to be disabled, or even better keep it disabled by default, even when you enable “iCloud sync” (it is after all supposed to be end-to-end encryption, not “end-to-end encryption with centralized storage in our cloud”, at which point saying iMessage is E2E is just a misnomer).

This is the point I keep mentioning. iCloud backup is the only way to back up an iPhone without a Mac or PC, and there’s no way to configure it. Want to back up your important app data? Then you also have to store your iMessages on Apple’s server, encrypted with their key.

Update (2016-03-22): Apple (via Rosyna Keller):

Impact: An attacker who is able to bypass Apple’s certificate pinning, intercept TLS connections, inject messages, and record encrypted attachment-type messages may be able to read attachments

Description: A cryptographic issue was addressed by rejecting duplicate messages on the client.

Matthew Green:

Apple’s fixes are twofold. First, starting in iOS 9.0 (and before our work), Apple began deploying aggressive certificate pinning across iOS applications. This doesn’t fix the attack on iMessage crypto, but it does make it much harder for attackers to recover iMessage ciphertexts to decrypt in the first place.

Unfortunately even if this works perfectly, Apple still has access to iMessage ciphertexts. Worse, Apple’s servers will retain these messages for up to 30 days if they are not delivered to one of your devices. A vulnerability in Apple Push Network authentication, or a compromise of these servers could read them all out. This means that pinning is only a mitigation, not a true fix.

As of iOS 9.3, Apple has implemented a short-term mitigation that my student Ian Miers proposed. This relies on the fact that while the AES ciphertext is malleable, the RSA-OAEP portion of the ciphertext is not. The fix maintains a "cache" of recently received RSA ciphertexts and rejects any repeated ciphertexts. In practice, this shuts down our attack -- provided the cache is large enough. We believe it probably is.

In the long term, Apple should drop iMessage like a hot rock and move to Signal/Axolotl.

Bruce Schneier:

I wrote about this flaw in IEEE Security and Privacy earlier this year[…]

Related: A different iOS flaw was reported last week. Called AceDeceiver, it is a Trojan that allows an attacker to install malicious software onto an iOS device, bypassing Apple’s DRM protections.

Sunday, March 20, 2016

Twitter Won’t Raise 140-Character Limit

Zac Hall:

Twitter upgraded its private Direct Messaging feature last year to increase the character limit from 140 to 10,000 characters, but CEO Jack Dorsey shared in an interview with NBC’s “Today” show this morning that the same change will not be coming to tweets.

[…]

In the past, however, Dorsey has tweeted screenshots of text walls from Apple’s Notes app to communicate a lengthier message that wouldn’t fit in 140 characters, but text shots present their own problems like lack of being found in search and being easily translated in other languages.

Gathering System Information in Swift With sysctl

Matt Gallagher:

The reason why sysctl feels so cumbersome in Swift is:

  • Creating an array of Int32 and passing that by pointer for the first parameter is a nuisance in Swift
  • You basically need to call sysctl twice: once with oldp equal to nil to get the size required for the result buffer and then a second time with a properly allocated buffer.
  • The result is returned as an untyped buffer of bytes which you then need to interpret correctly.
  • There are a few different ways in which failure can occur and we want to reduce these different ways to idiomatic Swift errors or preconditions.

For these reasons, I use a wrapper around sysctl[…]

Saturday, March 19, 2016

Apple TV Home Sharing: Ethernet to Wi-Fi

Apple:

For Home Sharing, all of your devices need to be on the same home network.

Unfortunately, they don’t define “network.” I had hoped that I would be able to connect my Apple TV 3 to Ethernet (because it sometimes loads video content very slowly over Wi-Fi) and use it to access music from my MacBook Pro (which is on Wi-Fi because it isn’t near an Ethernet jack and doesn’t have a spare Thunderbolt port for the Ethernet adapter). I’m pretty sure this used to work. And AirPlay works with this setup. However, currently Home Sharing only works if they are both on the same Wi-Fi network. Thus, using Home Sharing is a multi-step process. The Apple TV must be unplugged from Ethernet, so that it will switch over to Wi-Fi. And the Mac must be switched from the 5 GHz Wi-Fi network to the slower one, because the 5 GHz one always stalls on the Apple TV.

C Undefined Behavior in SQLite

John Regehr (Hacker News):

SQLite likes to use — but not dereference — pointers to heap blocks that have been freed. It did this at quite a few locations.

[…]

At least one uninitialized read that we found was potentially harmful, though we couldn’t make it behave unpredictably.

[…]

SQLite’s vdbe struct has a member called aMem that uses 1-based array indexing. To avoid wasting an element, this array is initialized like this[…]

[…]

SQLite had a place where it called memset() with an invalid pointer and another calling memcpy() with a null pointer. In both cases the length argument was zero, so the calls were otherwise harmless.

Nathan Kurz:

One might wonder why they didn’t just cast the return value to (void), which is a traditional and clearer way of signifying that the return value is intentionally being ignored. It’s because the GCC maintainers don’t believe that the end user should be allowed to do so, and don’t really care what other tools do or have done[…]

Richard Hipp:

Prof. Regehr did not find problems with SQLite. He found constructs in the SQLite source code which under a strict reading of the C standards have “undefined behaviour”, which means that the compiler can generate whatever machine code it wants without it being called a compiler bug. That’s an important finding. But as it happens, no modern compilers that we know of actually interpret any of the SQLite source code in an unexpected or harmful way. We know this, because we have tested the SQLite machine code – every single instruction – using many different compilers, on many different CPU architectures and operating systems and with many different compile-time options. So there is nothing wrong with the sqlite3.so or sqlite3.dylib or winsqlite3.dll library that is happily running on your computer. Those files contain no source code, and hence no UB.

The point of Prof. Regehr’s post (as I understand it) is the the C programming language as evolved to contain such byzantine rules that even experts find it difficult to write complex programs that do not contain UB.

John Regehr:

Richard, I think I can characterize your position as something like “If the code compiles and works today, then by definition it’s not buggy.” I think you should recognize that this is a somewhat extreme position, or at least pretty far towards one end of a spectrum.

Richard Hipp:

John, my views are distorted by 6 years of relentless focus on MC/DC. In that context, UB is like compiler warnings or compiler bugs – issues that should be dealt with but which are not existential threats to the project since they all occur upstream from the point of verification.

When working on other (normal) projects (example: Fossil) where the point of verification is the logical correctness of the source code, then I completely agree that UB should be religiously avoided, since it occurs downstream from the verification point.

Why Don’t We Have Cellular MacBooks?

Accidental Tech Podcast has a good discussion about this. I think this would be a very useful feature. It’s great that I can tether my iPhone, but that has so many drawbacks compared with built-in support. And, presumably, a Mac could have the space and power for a better antenna, offering better reception.

There are a number of ways that Mac OS X could be made more friendly to cellular connections. In my view, this process should have been started years ago, even though there were/are no cellular Macs. The same issues apply to tethering, probably moreso, so the lack of cellular Macs is no excuse. (Apparently, recent versions of Apple Mail are getting better in this regard, after regressing.)

Adding a cellular Mac would encourage both Apple and developers to make their software work better with cellular connections, which would also benefit tetherers and (potentially) those with slower non-cellular connections.

Update (2016-03-19): Geoff Hackworth:

I may be wrong, but I think 3G/4G patent licensing is percentage of product price, so too costly for laptops.

Firewatch: One Month Later

Cabel Sasser:

Firewatch’s budget, while huge for us, was modest for a game of its quality and scope, but we made our investment back in about one day. Firewatch has sold around 500,000 full-price copies in its first month. (It was even the top PlayStation Store digital download in February!) As an indie game, or heck, even as a “real” game, ok fine but not as a Call of Duty or Star Wars game, Firewatch can be considered a sales success.

[…]

I don’t know if you heard, but Panic did an insane thing for Firewatch — at one point you find a disposable camera in the game, and at the end of the game, you can choose to upload the photos you took to our server. […] And then, if you want, you can actually order physical prints of the photos for $15, shipping included.

Now, at that price, this was never designed to be a massive profit center. We saw it as a very special opportunity to try something we’re not sure has ever been done before: give users a customized, personalized keepsake from a virtual journey, on demand, when they beat the game.

Friday, March 18, 2016

Stale “Purchased From” in Apple’s Receipt E-mails

Zac Hall (May 2015):

You may notice a new look on those digital receipts you get in your email inbox after you buy something from iTunes, iBooks, or the App Store. Apple has refreshed its invoices with a new design, friendlier subject line, and cover art images that are clearer on Retina displays.

[…]

Perhaps more importantly, the new invoice format includes a description of what device the purchase originated from, which could be handy in tracking down suspicious purchases or knowing who in the family made all of those in-app purchases.

This is a great idea marred by the fact that it doesn’t actually show the correct device. The e-mails show every purchase made on my iPhone as from “mjt 5s,” the name for the phone that I erased and sold last fall. The first time I noticed this, I was momentarily worried because it looked as though someone had used my retired phone to break into my Apple ID account. But it seems to be just a display glitch. My new phone’s name shows up correctly everywhere else: iTunes, iCloud, and on the phone itself.

Game Center Is Still Broken After Six Months

Craig Grannell (via Josh Centers):

When iOS 9 hit beta last summer, I heard concerns from developers about Game Center. Never Apple’s most-loved app, it had seemingly fallen into a state of disrepair. In many cases, people were reporting it outright failed to work.

Six months later, little has changed. If anything, Game Center has gotten worse, with major problems increasingly widespread. These include the Game Center app launching as a white screen, and Game Center freezing the Settings app when you try to access its options.

Nick Heer:

As Grannell points out, this doesn’t just affect leaderboards — Game Centre is the underlying architecture for many turn-based games in the App Store.

Federico Viticci:

I’ve also come across this problem and heard about it from MacStories readers and game developers.

The TouchArcade forum has a thread about this with 575 posts.

See also: lots of snarky comments about driving Game Center over to Craig’s house.

Update (2016-03-18): Rene Ritchie:

Lack of a core built-in iOS app using it has always been extremely concerning.

Craig Hockenberry:

They even had a game that could have used Game Center, but it got pulled instead.

Why would you want to dogfood an app in the most popular category in your App Store?

OneDrive Filename Restrictions

Bob LeVitus:

The OneDrive menu reports 3,803 problems, and has been reporting them for over a month. The problem is that when I select View Details, it crashes and leaves a broad white stripe across my display that can only be eliminated by Force Quitting OneDrive.

I think it’s fair to say OneDrive is useless to me until this bug is squashed.

So, I wrote to Microsoft technical support about the issue on February 9 providing logs, screen shots, and a complete description. It took a month but I finally got an answer. Not a solution, mind you, but at least I got an answer.

In short, OneDrive has restrictions on the characters that can be in your filenames, and the total path length must be fewer than 255 characters. Nobody seems to be able to build a better shared folder than Dropbox.

Update (2016-04-10): Arq Backup:

PSA: OneDrive allows a max of 150,000 items in a folder. (This limit isn’t mentioned in their documentation anywhere that I can find.)

Safari Root Exploit

Christopher Budd (via Joe Rossignol):

JungHoon Lee (lokihardt): Demonstrated a successful code execution attack against Apple Safari to gain root privileges. The attack consisted of four new vulnerabilities: a use-after-free vulnerability in Safari and three additional vulnerabilities, including a heap overflow to escalate to root. This demonstration earned 10 Master of Pwn points and US$60,000.

Note that Safari’s helper processes are sandboxed, but the application itself is not.

Thursday, March 17, 2016

Apple Starts Using Google Cloud Platform

Kevin McLaughlin and Joseph Tsidulko (via MacRumors):

Since inking the Google deal late last year, Apple has also significantly reduced its reliance on Amazon Web Services, whose infrastructure it uses to run parts of iCloud and other services, said the sources, who all requested anonymity to protect their relationships with the vendors.

Apple has not abandoned AWS entirely and remains a customer, the sources said.

According to the sources, Google executives have told partners that Apple is spending between $400 million and $600 million on Google Cloud Platform, although this couldn’t be independently confirmed. Also unclear is whether this range refers to an annual spending rate or a set amount of capacity.

Juli Bort (via Hacker News):

The secretive Apple has never publicly talked about being an AWS customer, but its use of it, as well as Microsoft’s cloud, Azure, has been widely reported since at least 2011 and was confirmed by Apple in a security document. Apple uses AWS and Azure for parts of its iCloud services, The New York Times reported.

Last month, Morgan Stanley analyst Brian Nowak estimated that Apple spends about $1 billion a year on AWS.

Mark Bergen:

For Apple, though, the deal might portend a move to cut costs ahead of creating its own cloud storage system. Google’s cloud team is in deal-making mode, aggressively seeking to bring in new customers to use its cloud services, and may have sweetened the deal — or been more willing than AWS and Azure to concede to Apple’s demands.

[…]

According to a source familiar with the matter, Apple already has a team working on this; it’s known internally as “McQueen,” as in Steve. It’s unclear if that project will materialize or when. But a source tells Re/code that the codename refers to Apple’s intent sometime in the next few years to break its reliance on all three outside cloud providers in favor of its own soup-to-nuts infrastructure.

I would be shocked if Apple hasn’t been planning a move to its own data centers since before iCloud was announced.

Previously: Dropbox’s Exodus From the Amazon Cloud Empire.

Update (2016-03-23): Jordan Kahn:

Adding to a report from VentureBeat earlier this week, today’s report offers more details on what Apple is doing with “Project McQueen” that could see the company replacing third-party vendors with more of its own cloud infrastructure. The Information reports that Project McQueen is actually just one of at least six internal efforts at Apple including building its own servers, networking equipment, and “systems that could one day help developers to power their apps.”

[…]

And when it comes to building its own servers, the report claims that Apple is partly motivated by the fact that it believes the servers it receives from third-parties have been “intercepted during shipping, with additional chips and firmware added to them by unknown third parties in order to make them vulnerable to infiltration.”

Constraint Activation

Daniel Jalkut:

Starting in OS X 10.0 and iOS 8.0, I was intrigued by the announcement that NSLayoutConstraint now supports a property called “active,” which can be used to, you guessed it, activate or deactivate a constraint. I assumed this would be an answer to my prayers: a constraint could now be left installed on a view for safe-keeping, but its impact on layout would be negated by setting it to be “inactive.” I envisioned setting up competing groups of constraints on a view and simply activating or deactiving them en masse when the need arose.

I assumed wrong.

[…]

So “active” is not a convenience for easily toggling whether an installed layout constraint has an effect or not, but a convenience for the plumbing of installing and removing them.

[…]

Because NSLayoutConstraint supports a mutable “priority” property, you can effectively disable it by setting its priority lower than any other constraints that affect the same view.

iCloud Account Ransom

Thomas Reed:

The hacker had somehow gotten access to Ericka’s iCloud account.

Using this, he was able to remotely lock her computer using iCloud’s Find My Mac feature, with a ransom message displayed on the screen.

[…]

Apple designed Find My Mac/iPhone as an anti-theft feature. It is intended to allow you to take a number of actions on a lost or stolen device, including displaying a message, locking it, locating it physically and even remotely erasing it.

[…]

It’s also important to realize that an attacker with this kind of access could remotely erase all devices connected to that iCloud account. Worse, if you have Back to My Mac turned on, the attacker could gain access to all the data on your Mac.

In my view, Find My Mac is too dangerous to enable. The benefits it offers are minimal. And there is no reason to turn on Back to My Mac if you aren’t actually using those features.

Charlie Rose Interviews Jony Ive

Shawn King:

It’s always interesting (and even soothing) to listen to Ive talk.

Via Mayur Dhaka:

While watching Jony talk, I kept thinking about how closely his unrehearsed narrative resembles the rehearsed narrative in one of Apple’s ads.

[…]

It’s amazing how much one can talk, focused throughout on one topic, and not give away anything that isn’t planned.

Given the speaking styles of Rose and Ive, this seemed like the perfect opportunity to test Overcast’s new uploads feature, so that I could listen with Smart Speed. Unfortunately, it made far less of a difference than usual, perhaps because the audio had a lot of static.

Notification Center Bugs

On the Mac, I cannot prevent Calendar from notifying me with an alert for each event. I keep turning off its notifications in System Preferences, and they keep turning themselves back on. This seems to be a longstanding bug that others are also seeing. I’ve tried remedies such as deleting its database, but nothing has helped.

On iOS, sometimes Notification Center will not appear when I swipe down from the top of the screen. This happens both in apps and on the lock screen. The lock screen even shows the grippy strip, but it won’t budge.

Wednesday, March 16, 2016

Apple Releases Its Proprietary Apple News Format

Eric Slivka:

Apple today opened up its Apple News Format to all publishers, giving independent publishers and individuals tools to offer rich media content within the Apple News app for iOS 9, as noted by Vanity Fair.

Nick Heer:

Creating an Apple News Format (hereafter, ANF) version of a site’s feed is not as straightforward as I had anticipated. Adding an RSS feed is as simple as plopping the link into News Publisher on icloud.com, filling in some contact information, and adding a logo. But ANF requires an API key which can be obtained from Apple and a complete conversion of a site’s feed from RSS to ANF, followed by manual approval. And that’s all before the first article will appear in Apple News. After that, it’s a matter of publishing in a way that pushes out to Apple’s servers for conversion to ANF while maintaining compatibility with your site’s existing CMS.

Why would anyone go through this? Well, the Apple News app doesn’t provide RSS analytics, and there are some additional monetization options exclusive to ANF. Additionally, ANF supports membership roles for writers and editors.

It’s curious that Apple News remains unavailable in most of the world.

Slopes 2.0 Business Model Experiment

Curtis Herbert:

My original napkin math for 2.0 included “if I can just get 1% of my downloaders to become subscribers”, but that goal changed a little with 2.1. If you don’t remember: originally my 2.0 business model was centered around acquiring yearly subscribers. My one month IAP existed as a trial where you’d lose all premium features if you didn’t upgrade. With 2.1, Slopes started following more of a consumable model where buying a one month pass just to cover your big once-a-year trip to Colorado now made sense since the data for that trip wouldn’t expire.

Curtis Herbert (tweet):

The easiest time I’ve had getting press coverage for Slopes was being a well-designed Watch app launching day one along side the Apple Watch. It was easier for me to stand out because Slopes was an example of an app that actually made sense to have on your wrist, not some “why do I need that on my wrist?” gimmick. Slopes also fit the fitness narrative Apple was already pushing with the Watch.

[…]

They had to write those articles, readers expected it looking for reasons to look forward to the Watch, so I was helping them when I pointed them to my app. And it worked: I was a part of dozens of those articles and I got healthy traffic from them.

Kirk McElhearn:

The biggest problem with the way developers of all sizes contact journalists is that they buy lists, and spam people. I don’t use that term lightly; most of the pitches I get are spam. The people sending them know nothing about me or my website, and they don’t know what types of apps I cover, either here at Kirkville, or at Macworld, where I am senior contributor.

Previously: What No Indie Developer Wants to Hear About the App Store.

Massively Speed Up Time Machine Backups

Keir Thomas:

Open a Terminal window, which you’ll find in the Utilities folder within the Applications list, and paste in the following, typing your login password when prompted:

sudo sysctl debug.lowpri_throttle_enabled=0

This command prevents Time Machine’s backup process assuming a low CPU priority, allowing backups to complete insanely quickly. In fact, you’ll see MB and GBs tick past on the Time Capsule progress display in a second-by-second fashion (provided your Mac isn’t very busy with some other task).

Alas, this command is forgotten when you reboot.

I suppose it’s a feature that Time Machine runs at a low priority by default, but this makes it much slower than other backup methods. Sometimes you’re waiting for it to finish and just want it to go faster. And with SSDs, running a backup doesn’t slow down the rest of the system as much, anyway.

Update (2016-03-16): Gwynne Raskind:

Make it stick with echo 'debug.lowpri_throttle_enabled=0' | sudo tee -a /etc/sysctl.conf (SIP-safe).

(however, I agree with the comments which suggest it’s questionable to do this on a global basis)

Update (2016-03-17): Rosyna Keller:

CPU isn’t throttled. The bottleneck is disk I/O. (lowpri_throttle_enabled is an I/O throttle, not a CPU throttle)

You can independently confirm it’s an I/O throttle by looking at the source that uses it.

There are even different throttles used depending on if the device is seen as an SSD or not an SSD by the system!

OS X detects drives in most USB/FireWire enclosures as non-SSD, even if they are SSDs

Update (2016-03-18): Daniel Jalkut:

As an experiment I disabled the low priority support as outlined in the post, and was curious to know whether it would affect the massive performance problems I suffer when browsing Time Machine history from my OS X Server hosted network backup volume.

It did seem to massively improve that experience.

[…]

If indeed I/O priority is throttled for Time Machine, please consider disabling that throttle or raising the priority while browsing backups. In this modal state it would seem like a reasonable thing to consume more of the computer’s I/O capacity in the name of providing a more responsive user experience.

Update (2017-10-13): St. Clair Software:

App Tamer 2.3.3 is now available – it’s a free update for App Tamer 2 users, and a $7.95 upgrade for version 1.x users.

It adds a checkbox that speeds up Time Machine backups, something that’s really helpful if you only plug in your backup drive occasionally, resulting in Time Machine needing to copy lots of data.

Tuesday, March 15, 2016

Dropbox’s Exodus From the Amazon Cloud Empire

Cade Metz (Hacker News):

Over the last two-and-a-half years, Dropbox built its own vast computer network and shifted its service onto a new breed of machines designed by its own engineers, all orchestrated by a software system built by its own programmers with a brand new programming language. Drawing on the experience of Silicon Valley veterans who erected similar technology inside Internet giants like Google and Facebook and Twitter, it has successfully moved about 90 percent of those files onto this new online empire.

[…]

In essence, they built their own Amazon S3—except they tailored their software to their own particular technical problems. “We haven’t built a like-for-like replacement,” Agarwal says. “We’ve built something that is customized for us.”

[…]

But according to Agarwal, the main reason for moving off the Amazon cloud is raw economics—not politics.

[…]

Crowling, Turner, and others originally built Magic Pocket using a new programming language from Google called Go. […] But Go’s “memory footprint”—the amount of computer memory it demands while running Magic Pocket—was too high for the massive storage systems the company was trying to build. Dropbox needed a language that would take up less space in memory, because so much memory would be filled with all those files streaming onto the machine. So, in the middle of this two-and-half-year project, they switched to Rust on the Diskotech machines.

John Gruber:

As Tim Cook says, “We believe that we need to own and control the primary technologies behind the products that we make.”

Dropbox is trying to be more of a platform than a feature.

Update (2016-03-15): A Dropbox engineer is answering questions on Reddit. And on Hacker News he has commented more about Dropbox’s use of different languages.

Update (2016-03-16): Akhil Gupta:

Dropbox was founded by engineers, and the ethos of technical innovation is fundamental to our culture. For our users, this means that we’ve created a product that just works. But there’s a lot that happens behind the scenes to create that simple user experience.

[…]

This is the first of a series of blog posts about the Magic Pocket. Over the next month we’ll share a lot of the technical details around what we learned from building our own high-performance cloud infrastructure.

Update (2016-04-14): Cade Metz:

Dropbox stunned the tech world last month when it revealed it had spent the last two-and-a-half years moving about 90 percent of its operation off of the Amazon cloud. Meanwhile, its biggest rival, Box, is moving the other way.

Remote Codesign Trust

Daniel Jalkut:

The changes are apparently rooted in a legitimate security update made by Apple, but the end result for us developers is pretty bleak. It’s seemingly impossible to authorize use of a code signing identity on a remote server. As my friend Mitch put it, he has to call IT and “get someone to go into the data closet” every time this happens. What a drag!

[…]

I poked around for a solution to this problem, and found it lurking in the answers and comments of a Stack Overflow question. The basic idea is you can convince OS X to trust codesign to use the tool, just as if you had clicked the “Allow” button in that UI prompt. Here is a recipe for doing just that, logged in as a remote user over say Screen Sharing[…]

Update (2016-03-15): Erik Schwiebert:

Clicking keychain dialog buttons via remote access@works again in 10.11.4 beta 4.

Overcast 2.5

Marco Arment:

The new Uploads feature lets patrons upload DRM-free audio files for their own personal use (not publicly shared).

[…]

Tapping inactive episodes now adds them, rather than immediately playing them via streaming. (Tap again to play.) It’s a happy middle ground between the fast 1.0 interactions and the streaming capabilities in 2.0.

Great news. It sounds like you get 2 GB of storage for your own uploads.

Update (2016-03-16): Marco Arment:

Neither the $5-once IAP nor patronage-for-nothing were justifying much continued investment.

Patronage-with-perks is doing better so far.

30 Pounds of Microsoft Office

Jeffrey Friedl:

Going through some closets in our childhood home, my sister came across some software she bought fresh out of college. It’s a blast from the 22-years-ago past, when software came with massive manuals.

In this case, the box weighs 30 pounds (14kg), and the manuals are 9" (23cm) wide.

I had the non-professional Mac version of Office, which I think was more of a cube because it didn’t include Access.

Update (2016-03-16): Lee Bennett:

How about Final Cut Studio?

Monday, March 14, 2016

Why Are We Fighting the Crypto Wars Again?

Justin Sink:

“You cannot take an absolutist view on this,” Obama said at the South by Southwest festival in Austin, Texas. “If your argument is strong encryption no matter what, and we can and should create black boxes, that I think does not strike the kind of balance we have lived with for 200, 300 years, and it’s fetishizing our phones above every other value.”

[…]

“I suspect the answer is going to come down to, how do we create a system that, encryption is as strong as possible, the key is secure as possible, and it is accessible by the smallest number of people possible for the subset of issues that we agree is important,” he said.

Juli Clover:

Obama went on to call on software engineers and technology companies to help the government solve the problem, and he said a thorough, well-formed encryption solution should be established before it’s desperately needed. He cautioned against the tech community disengaging or taking a position that “is not sustainable for the general public as a whole over time,” as it could lead to a stalemate that will ultimately lead to “sloppy” legislation should the political climate change after something “really bad happens.”

John Gruber:

Our phones are either insecure, making life easier for law enforcement — or, our phones are secure, making life more difficult for law enforcement, rendering some potential evidence unobtainable.

Nick Heer:

In many ways, I desperately want tech companies to try to work with lawmakers on this issue, because it’s become very clear that they have no idea what they’re talking about and it’s likely that they will codify regulations that are technically unfeasible now and destructive in the future.

Steven Levy (Hacker News):

Thus began the Crypto Wars. The government warned that unrestrained crypto would empower “bad guys” (terrorists, drug lords, kiddie porn purveyors). Business interests and privacy advocates argued that the only ones hurt would be citizens seeking to protect their information. (Disclosure boast: I wrote the book on this, and it’s still in print!)

[…]

For most of the ’90s, the government’s “compromise” on this issue — or its (pipe) dream — was that you could concoct a system where everything was locked down tight, but some carefully designed kink in the process would let the Feds get the information if they really wanted it. […] It was an unwieldy and impractical idea — especially since people who wanted security had options to buy stuff without Clipper Chips — and its demise helped lead the government to the conclusion that people highly motivated to protect their information were going to use crypto anyway. In theory at least, intelligence and law enforcement agreed to accept the fact that crypto was here to stay, and if they wanted to gain access to encrypted communications and files, they would do so by warrants and their own cryptanalysis, and not by demanding that the systems themselves should be weakened.

Previously: FBI Asks Apple for Secure Golden Key.

The Sadness and Beauty of Watching Google’s AI Play Go

Cade Metz (via Jason Snell, Hacker News):

Even after Lee Sedol returned to the table, he didn’t quite know what to do, spending nearly 15 minutes considering his next play. AlphaGo’s move didn’t seem to connect with what had come before. In essence, the machine was abandoning a group of stones on the lower half of the board to make a play in a different area. AlphaGo placed its black stone just beneath a single white stone played earlier by Lee Sedol, and though the move may have made sense in another situation, it was completely unexpected in that particular place at that particular time—a surprise all the more remarkable when you consider that people have been playing Go for more than 2,500 years. The commentators couldn’t even begin to evaluate the merits of the move.

[…]

Then, over the next three hours, AlphaGo went on to win the game, taking a two-games-to-none lead in this best-of-five contest. To date, machines have beaten the best humans at chess and checkers and Othello and Jeopardy!. But no machine has beaten the very best at Go, a game that is exponentially more complex than chess.

Cade Metz:

AlphaGo had already claimed victory in the best-of-five contest, a test of artificial intelligence closely watched in Asia and across the tech world. But on Sunday evening inside Seoul’s Four Seasons hotel, Lee Sedol clawed back a degree of pride for himself and the millions of people who watched the match online.

[…]

Using what are called deep neural networks—networks of hardware and software that mimic the web of neurons in the human brain—AlphaGo first learned the game of Go by analyzing thousands upon thousands of moves made by real live human players. Thanks to another technology called reinforcement learning, it then climbed to an entirely different and higher level by playing game after game after game against itself. In essence, these games generated all sorts of new moves that the machine could use to retrain itself. By definition, these are inhuman moves.

[…]

At this point, AlphaGo started to play what Redmond and Garlock considered unimpressive or “slack” moves. The irony is that this may have indicated that the machine was confident of a win. AlphaGo makes moves that maximize its probability of winning, not its margin of victory. “This was AlphaGo saying: ‘I think I’m ahead. I’m going to wrap this stuff up,’” Garlock said.

Update (2016-03-14): See also: Kirk McElhearn, Gary Robinson, John Langford, Hacker News, Sam Byford.

Update (2016-03-15): Sam Byford (Hacker News):

AlphaGo has beaten world-class player Lee Se-dol for a fourth time to win the five-game series 4-1 overall. The final game proved to be a close one, with both sides fighting hard and going deep into overtime.

Update (2016-03-16): Kieran Healey:

The Google/DeepMind team has a technical paper in Nature describing AlphaGo, the program they wrote.

Update (2016-03-17): Google:

First, this test bodes well for AI’s potential in solving other problems. AlphaGo has the ability to look “globally” across a board—and find solutions that humans either have been trained not to play or would not consider. This has huge potential for using AlphaGo-like technology to find solutions that humans don’t necessarily see in other areas. Second, while the match has been widely billed as "man vs. machine," AlphaGo is really a human achievement. Lee Sedol and the AlphaGo team both pushed each other toward new ideas, opportunities and solutions—and in the long run that's something we all stand to benefit from.

The Power of Preview

Adam C. Engst and Josh Centers:

The first option for how files should open is often confusing. Let’s say you have a Take Control PDF book open in Preview, and you double-click a JPEG-based photo in the Finder. It will open in the same window as the book!

And if you select the third option, when you select multiple images and open them in Preview, they all open in separate windows, which is overwhelming and makes navigation far more difficult.

The default option, Open Groups of Files in the Same Window, is generally the best choice.

I agree, but I often wish I could override that to open a specific group of files in separate windows. In particular, I usually want PDFs to be opened in separate windows, especially if they are multi-page. Navigation and removing pages is easier this way. I suppose this would be easy to do with a script, but it would be nice if it were built in. I almost always want groups of images to open in the same window, though.

Update (2016-03-14): I wrote the script for Preview.

Friday, March 11, 2016

What No Indie Developer Wants to Hear About the App Store

Rene Ritchie (tweet, Hacker News, Slashdot):

Big apps get all the attention these days, just like big movie, music, or book releases — or big toy releases — and indies get what little is left, when there’s even a little left. The App Store is big business, and that’s how big business works. Only our nostalgia keeps us thinking otherwise. Just like our nostalgia for the corner store in the age of online and big box.

[…]

It is, in a word, heartbreaking. I hate hearing it as much as I hate writing it. It’s far easier to simply blame platform owners for failing to pull levers and influence economies; for treating Facebook or HBO better than they treat the 76th Notes app to launch this year.

[…]

If the absolutely capricious and often maddening review process and lack of attention really did chill innovation, though, it should be easy to point to Google Play and its over half-a-decade of relatively lax approval policies, and see year after year of ground-breaking, platform-making, device-selling apps that would never come to market on the App Store.

There are so many variables that I think it’s difficult to conclude much from two data points. Windows was also an open platform that had unexpectedly few indie success stories.

I broadly agree with Ritchie, but I don’t think it’s a case of either-or. Big apps getting most of the attention doesn’t have to preclude the sustainability of solid indie apps unless the big apps are providing what everyone wants. I don’t think they are. Lots of people look beyond the blockbuster movies for their entertainment. The same will be true of software. Apple’s goal should be to make the App Store friendly to both.

Although I think the domination of “pop” was probably inevitable, things could have been much better if Apple had taken more care in designing the App Store economy. Of course, there is no way to prove a counterfactual. And there is always the possibility that the App Store is functioning as intended—that what we see as bugs Apple sees as features that help it sell more phones, at least in the short term. That what we see as sustainability Apple sees as factors that would lessen its power.

Update (2016-03-14): Chuq Von Rospach:

I don’t think the App Stores are broken; I think they’re doing exactly what Apple wants them to, because Apple’s interest is in supporting the corporate app developers and the larger studio developers.

[…]

I’m a strong believer that the indie developers are where the innovation comes from, not to mention the next generation of experts on the platform, and that it makes sense to invest in supporting them beyond what the revenue their apps will return through sales on the platform, but in all honesty, the revenue numbers and analytics make that a tough sell, and Apple is likely in that place where there are 300 proposals on the project list for the next year, and resources for 50 of them, so how do you choose which ones make the cut? If the decisions are driven by revenue, analytics and by discussions with key partners, you start to see why the indie developer needs get neglected.

Is this not the emerging critique of Tim Cook’s Apple, that too many decisions seem to be driven by data and metrics rather than vision?

First, I’d remove apps that haven’t been updated in three years. Honestly, if you aren’t doing some kind of even minimal bug fixing when Apple releases each new version of the OS, you aren’t really trying and the app is likely abandoned.

[…]

Putting a price tag on entry into the store, even if it’s effectively a token cost, will reduce this kind of store abuse.

[…]

I would like a way to use IAP to enable something like a demo mode that unlocks to a fully enabled app. you can download it for free, once you decide you want full capability, you use IAP to unlock it. Developers can choose this to be a one-time buy (permanent capability, effectively like buying an app today) or as a subscription model with annual renewal.

Brent Simmons:

There was never a golden age for indie iOS developers. It was easier earlier on, but it was never golden.

Daniel Jalkut:

So? Make wooden toys. Metaphorically speaking, I mean.

Update (2016-03-18): Jason Snell:

Just because hand-crafted independent apps won’t rise to the top of the charts or make their developers rich and famous doesn’t mean that there won’t be demand for them. Plenty of indie musicians make a living without ever coming within a couple of orders of magnitude of Coldplay’s album sales. There’s room out there for great stuff to reach an audience that will appreciate it. You don’t have to be a hit to be a success.

[…]

Today’s world is complicated. Building one app with love and precision can still work, but it’s a harder path than it’s ever been. Users expect to switch among platforms and devices and sync with cloud services, and some independent developers won’t be able to keep up.

Update (2016-03-25): Philip Greenspun:

My personal theory about having a successful business is that you need to have either (1) a lower cost of capital than everyone else, (2) knowledge and skill that nobody else has, or (3) experience with customers and a market that few others have.

Update (2016-03-30): See also: Under the Radar, Chris Adamson, Christopher Mims, Nick Heer.

Emoji Fonts Use Undocumented Features

Craig Hockenberry:

As a result, people are looking for ways to create a TrueType font containing Emoji bitmaps. This font will be embedded in iOS and OS X native apps. Conceivably, it could also be used as a web font.

Using Emoji as a part of a product’s branding is not dissimilar to Apple’s own use of Myriad Pro in marketing materials and San Francisco on devices. A font plays a huge role in a customer’s perception of a product.

The problem is that there is no documentation on how to generate an Emoji font that can be used with iOS and OS X.

[…]

Apple’s tools for working with fonts on OS X have not been updated since October 10th, 2011. They do not support Emoji. If Apple has a internal tool for constructing these fonts, it would be very helpful to third-party developers.

Update (2016-03-11): See these tweets from Rosyna Keller.

Script Debugger 6 Preview

Mark Alldritt:

Script Debugger 6 adopts an always-on approach to code signing. Once you enable code signing for a script by selecting a developer ID, Script Debugger signs your script each time you save it. There is no requirement to go through a special Save or Export operation.

[…]

AppleScript’s progress reporting properties (introduced in Mac OS X 10.10 (Yosemite) are fully supported in Script Debugger 6. When a script begins reporting progress information by setting any of AppleScript’s progress reporting properties Script Debugger 6 responds by adding a progress bar display above the script’s source[…]

[…]

Script Debugger’s various explorers now support AppleScript Objective-C object references.

I’m looking forward to it.

Intuit Sells Quicken to H.I.G. Capital

Gregg Keizer (Hacker News, MacRumors):

Intuit yesterday said it had sold its Quicken personal finance software unit to H.I.G. Capital, a Miami-based private equity firm.

[…]

The announcement put an end to a sales process that went public last August, when Intuit told customers it was unloading three parts of its business -- Quicken, QuickBase and Demandforce -- to focus on its most profitable software and services, the QuickBooks small business accounting division and the seasonally-skewed TurboTax tax preparation group. In January, Intuit sold Demandforce to Internet Brands for an undisclosed amount.

David Sparks:

Everybody used it and that’s what made their slow abandonment of the Apple platform so tragic. I know they still sell products for the Mac but it has been years since Quicken has been a top-notch Mac application.

Adam C. Engst:

To address customer complaints, Quicken is hiring a new product manager and will be doubling the size of the engineering team within the calendar year. In its FAQ about the sale, Intuit explicitly mentions Mac support[…]

Eric Dunn:

My team and I know you count on Quicken to help you stay on top of your finances, and we are committed to continuing to improve your experience with Quicken. We’ve already started the journey with the new Quicken 2016 products that launched in November with new features to help consumers stay on top of their bills. In the last six months, we’ve also increased our investment in U.S.-based phone support. This is just the start of what’s to come – I invite you to watch this short video to learn more about why I’m excited about our future together.

Michael Yacavone:

How many times have we been promised a better Quicken? We’re talking maybe ten or fifteen years of bad history here.

WalterBright:

For example, take a simple task: download all your financial data for the last year. Log into your bank’s site. There is no button for “last year”. You have to laboriously enter 01/01/2015..12/31/2015. Then you’re given a choice of formats. Download ALL of them, because sure as shootin’, Quicken will only import one of them, and that’s one is different for every different account! (Stunningly stoopid.)

Then try to get the statements, just try, my pretty. There is no “get me all the statements from last year.” Nope. You download them one at a time, and some of them download to the same file name! So it’s clicking around, then rename the file to “January 2015”, then repeat for the next one, etc.

Oh, you wanted the tax 1099 forms? That’s a whole ’nuther section on the web site.

Buy anything from Paypal? This is the killer. Paypal lists the payee as “Bob”. Your credit card statement lists the payee for the same transaction as “Carol”. The credit card downloaded data file lists the payee as “Ted”. And, Quicken somehow calls it “Alice”. Can you believe it in 2016?

Thursday, March 10, 2016

Google Doesn’t Prioritize iOS Apps

Federico Viticci:

No matter the technical reason behind the scenes, a company the size of Google shouldn’t need four months (nine if you count WWDC 2015) to ship a partial [Google Docs] compatibility update for iOS 9 and the iPad Pro. Google have only themselves to blame for their lack of attention and failure to deliver modern iOS apps.

Other Google apps also lag behind on iOS. Kirsty Styles:

After launching on Android in October last year, a pitstop feature has finally dropped on Google Maps for iOS today.

Update (2016-03-11): David Sparks:

Somewhere along the line, however, things flipped. These days Microsoft’s iPad apps are arguably better than their Mac apps. I’m particularly impressed with Microsoft Word on the iPad Pro, which I’m using just about every day. Google, on the other hand, has declined.

Flickr Limits Free Accounts

Flickr (via Nick Heer):

The biggest change is that we are making the desktop Auto-Uploadr a Flickr Pro-only feature, giving Pro members exclusive access to the tool. This feature lets you effortlessly upload all of your photos from wherever they are being stored, while making them accessible from any device.

Importantly, it sounds like the iOS auto-uploader is unaffected. The differences between the plans are shown here. I still think Flickr is the best game in town.

GitHub Rate Limiting CocoaPods

Michael Haggerty:

The slow fetches and clones (which sometimes time out) that the CocoaPods community is experiencing are caused by automatic rate limiting on our servers, which is done to make sure that extremely high levels of load in one repository cannot impact other GitHub users. The CocoaPods/Specs repository is more or less permanently being rate limited.

[…]

That said, we’re working in the open-source Git project on patches to fix the pathological behavior you’re experiencing (e.g., see here). We think Git’s handling of shallow clones can be improved, but this might take a while. If the Git client needs to be changed, it wouldn’t help until the new client is in the hands of the majority of your users.

The remaining issues, however, are mostly in the hands of the CocoaPods project. I have the feeling that the easiest possible first step would be to address point 2, by changing CocoaPods to use full rather than shallow clones.

Wednesday, March 9, 2016

Retrospect 13

Agen G. N. Schmitz:

Retrospect Inc. has released Retrospect 13, a major new release of the backup software that adds support for integrated cloud backup to Amazon S3, Google Cloud Storage, and other Retrospect-certified cloud storage providers (a full list is available from the Retrospect Web site.

Retrospect was a fantastic app back in the 90s. Then they seemed to drop the ball, and the Mac OS X versions never appealed to me. This new version looks like an interesting development.

Aperture Migration Plan

John Gordon:

Incidentally, while developing this plan I tried out my copy of Aperture Exporter. It didn’t go well. AE creates keywords in Aperture for things like image-album relationships; in my case that resulted in very large numbers of keywords. Probably more than Aperture was ever tested to handle, more than enough to prove the UI doesn’t handle scrolling. If I use AE on the future it will be with a temporary copy of my Library, not the original.

I found Aperture Exporter essential in my migration to Lightroom. This is because Aperture’s own export doesn’t preserve the folder structure. Lightroom’s Aperture importer brings in your low-quality previews—I don’t even have previews, to save disk space—and also doesn’t preserve the hierarchy. Lightroom’s importer is based on PySQLite and feels more like a script than a part of the application; it can’t be canceled.

Aperture Exporter preserves a lot more metadata, but keyword explosion is definitely something to watch out for. I ended up exporting my library into five sub-libraries (that share the same masters). That way, the extra keywords didn’t affect anything in Aperture if I needed to use it again. And dividing the library made the exporting more manageable because Aperture Exporter likes to operate on a whole library.

There were some issues:

Tuesday, March 8, 2016

Apple to Pay $450 Million E-Book Settlement

Greg Stohr (Ars Technica, Hacker News):

Apple Inc. must pay $450 million to end an antitrust suit after the U.S. Supreme Court refused to question a finding that the company orchestrated a scheme to raise the prices for electronic books.

The justices, without comment, turned away an appeal by Apple, leaving intact a federal appeals court ruling favoring the U.S. Justice Department and more than 30 states that sued.

[…]

“Following Apple’s entry, output increased, overall prices decreased, and a major new retailer began to compete in a market formerly dominated by a single firm,” the company said in its appeal.

Mitchel Broussard:

Specifically, the amount will be broken down to have $400 million paid out to e-book customers, $20 million to the states, and $30 million in the form of legal fees. The case saw Apple fighting an accusation that in 2010 it colluded with five publishers -- HarperCollins, Simon and Schuster, Hachette Book Group, Macmillan, and Penguin -- to fix the prices of e-books in order to become a dominant presence in a market overshadowed by companies like Amazon.

Jason Snell:

I believe, based on my layman’s understanding of the case, that Apple and the publishers really did violate the law. The oddity is that the collusion seems to have been an attempt to create more competition in a market previously dominated by Amazon.

John Gruber:

I think they got the shaft.

dilemma:

Amazon uses MFN to be able to match the lowest price available. Apple uses MFN to fix prices so that nobody sells the same titles for less than they do.

[…]

MFN in combination with the five-publisher collusion orchestrated by Apple let them negotiate to increase prices.

Pyxl101:

If you look at emails and communication from people involved, it seems pretty clear to me that Apple knowingly and actively participated in a conspiracy to fix prices. They really took the leading role in organizing the publishers and proposing the illegal-price fixing model. I will give you an overwhelming amount of evidence just in one comment, and a link to explore further details.

[…]

This isn’t about Apple giving the same deal to all publishers. This was about Apple convincing all publishers to give all other retailers the same deal as Apple -- and all at the same time, as a single group across essentially the entire industry, thus resulting in price fixing and price increases.

Update (2016-03-08): Kirk McElhearn:

But even if there’s $400 million that will be spent on ebooks – and, while many people may never spend what they get, others will spend more than what they get, because their share won’t be enough to buy a book – this amount will inject a huge sum of money into the publishing industry.

FlexBright Approved and Then Pulled

Juli Clover:

FlexBright, an app that allows the user to manually adjust the display temperature of an iOS device, was recently approved by Apple, marking one of the first third-party apps that’s able to function in a manner similar to the company’s own Night Shift mode, set to be released in iOS 9.3. The only catch is it must be triggered somewhat manually in response to a notification, rather than continuously, like Night Shift or f.lux.

[…]

According to one of the developers behind FlexBright, using this notification system was the only way Apple would allow the app to change brightness or blue light while running in the background.

[…]

FlexBright is notable because it offers display temperature adjustments for devices that are not compatible with Apple’s Night Shift mode. FlexBright is available on devices running iOS 7 or iOS 8, while Night Shift is limited to devices running iOS 9.3, and it’s also available on non-64-bit devices like the iPhone 5 and earlier.

An update says that FlexBright has been removed from the App Store, for unknown reasons. The developer claims not to have used private API.

Previously: Apple Forbids Sideloading f.lux, Night Shift in iOS 9.3.

Update (2016-03-10): Juli Clover:

FlexBright developer Sam Al-Jamal told MacRumors he had worked with Apple through several app rejections to get FlexBright into the App Store and that no private APIs were in use, something that was seemingly confirmed by the app’s approval, but further review from Apple led to FlexBright’s removal. Al-Jamal has shared Apple’s explanation with MacRumors following an “exhausting discussion” with the Cupertino company. “The bottomline is [Apple] won’t allow apps to change screen colors,” he said.

Why I Started Using Apple Pay

Cade Metz:

As you wait in line with your razor blades and Softsoap, some other poor soul will swipe their credit card through the reader on the counter—and nothing will happen, because it’s one of those new chip cards designed for better security. Then, a (slightly exasperated) cashier will tell this poor soul to push the card into a slot at the front of the reader. The poor soul will do this—and nothing will happen again, because the new chip tech is horribly slow.

[…]

My local drugstore is a CVS, and the card readers are made by a company called Verifone. But all this sorrow is only partly their fault. The problem also lies with the new chip technology itself. The big-name credit card companies are forcing stores across the country to adopt this “EMV” tech (short for Europay, MasterCard, and Visa), and at best, it’s noticeably slower than paying with a good old fashioned magnetic stripe card. At worst, you’re stuck in line at CVS for ten minutes with your razor blades and Softsoap while some sort of archaic cash register reboots itself.

I was initially skeptical of Apple Pay because it didn’t seem like it would be faster, and I have to carry the credit cards, anyway. Since then, Apple made Touch ID much faster. And merchants started using these chip readers that are shockingly slow and often fail to work on the first try.

Nook Cooked in UK

Craig Grannell:

Nook is dead in the UK, and customers who bought books thinking they might actually own them are now being told they might be able to still access some of them once the Nook store implodes, due to a partnership with “award-winning Sainsbury’s Entertainment on Demand”.

Via Kirk McElhearn:

Once again, DRM screws users. Google can tell you how to get rid of DRM on some kinds of ebooks. Not that I’m suggesting it, but to make sure you can read the books you paid for, it’s worth considering your options…

Update (2016-03-19): Craig Grannell:

When it comes to movies and telly, I fear things won’t change for a very long time, due to studios being blinkered and paranoid. Right now, I could download almost any show or movie entirely for free, and would be able to watch wherever and whenever I like. By contrast, I can pay over the odds for a digital file that only works on specific hardware and/or using specific software, and that might vanish from a cloud library without notice. Subsequently, I almost never buy digital TV shows or movies now, preferring streaming; and on those very few occasions I do succumb, it’s either a rare DRM-free download (for example, from a Kickstarter), or for something that’s inherently disposable that I only really want to watch once.

Monday, March 7, 2016

KeRanger Transmission Ransomware

Jim Finkle (via Arnold Kim, Hacker News, Slashdot):

Ransomware, one of the fastest-growing types of cyber threats, encrypts data on infected machines, then typically asks users to pay ransoms in hard-to-trace digital currencies to get an electronic key so they can retrieve their data.

Security experts estimate that ransoms total hundreds of millions of dollars a year from such cyber criminals, who typically target users of Microsoft Corp’s Windows operating system.

[…]

Hackers infected Macs through a tainted copy of a popular program known as Transmission, which is used to transfer data through the BitTorrent peer-to-peer file sharing network, Palo Alto said on a blog posted on Sunday afternoon.

Claud Xiao and Jin Chen:

Transmission is an open source project. It’s possible that Transmission’s official website was compromised and the files were replaced by re-compiled malicious versions, but we can’t confirm how this infection occurred.

The KeRanger application was signed with a valid Mac app development certificate; therefore, it was able to bypass Apple’s Gatekeeper protection.

[…]

Apple has since revoked the abused certificate and updated XProtect antivirus signature, and Transmission Project has removed the malicious installers from its website.

[…]

The two KeRanger infected Transmission installers were signed with a legitimate certificate issued by Apple. The developer listed this certificate is a Turkish company with the ID Z7276PX673, which was different from the developer ID used to sign previous versions of the Transmission installer.

Jeff Johnson:

Surprise, surprise. What I’ve said all along. Gatekeeper is only security theater, because attackers can easily acquire a Developer ID cert.

It’s not full protection, but it’s not useless because in theory Apple can add it to XProtect before it spreads too far.

Kuba Suder:

I guess technically Gatekeeper can’t detect changed developer when you replace the .app, but I think Sparkle does that

Paul McGrane:

Transmission and VLC really ought to be on the Mac App store except Apple has some puritanical fear of them

Ben Sandofsky:

The Transmission malware wouldn’t exist if it were distributed via the Mac App Store.

But the Mac App Store prohibits BitTorrent clients.

TorrentFreak:

Over the past years dozens of apps have been rejected from the App Store because they mention the word BitTorrent.

Apple defended this policy and told developers that their apps were not allowed “because this category of applications is often used for the purpose of infringing third-party rights.”

This is an interesting hypothetical. Would breaking into Transmission’s iTunes Connect account be harder than breaking into its Web site? At least the odds seem better that the developers would notice that this had happened. Would sandboxing help, or would the malicious app be able to trick the user into granting it access to non-BitTorrent data? Could such an app get through App Review?

Dino A. Dai Zovi:

Why couldn’t the ransomware encrypt files in TimeMachine backups? Mac OS X uses TMSafetyNet kext to make the files immutable after creation.

Federighi and Cryptographers on FBI vs. Apple

Craig Federighi (via Tim Hardwick):

Your phone is more than a personal device. In today’s mobile, networked world, it’s part of the security perimeter that protects your family and co-workers. Our nation’s vital infrastructure — such as power grids and transportation hubs — becomes more vulnerable when individual devices get hacked. Criminals and terrorists who want to infiltrate systems and disrupt sensitive networks may start their attacks through access to just one person’s smartphone.

[…]

That’s why it’s so disappointing that the FBI, Justice Department and others in law enforcement are pressing us to turn back the clock to a less-secure time and less-secure technologies. They have suggested that the safeguards of iOS 7 were good enough and that we should simply go back to the security standards of 2013. But the security of iOS 7, while cutting-edge at the time, has since been breached by hackers. What’s worse, some of their methods have been productized and are now available for sale to attackers who are less skilled but often more malicious.

I don’t understand what this second part is referring to. It doesn’t sound like what we were talking about before.

Paul Wagenseil (via Hacker News):

“I don’t think this case is about backdoors,” said Adi Shamir, who with his MIT colleagues Leonard Adleman and Ron Rivest developed the RSA encryption algorithm in 1977. “The FBI is asking Apple to do something very specific. It’s got nothing to do with placing backdoors in millions of phones around the world.”

Martin Hellman, who developed the Diffie-Hellman encryption-key exchange with Whitfield Diffie at Stanford in 1976, disagreed, as did Rivest and Diffie.

[…]

“[Apple] put themselves in a position where they could state they could no longer help,” [Shamir] added. “But they failed because they didn’t close this particular loophole in which Apple can help the FBI. Apple should close this loophole, and then they can really make the argument.”

Indeed, the backdoor is already there in that current phones will accept software updates signed by Apple, without wiping the user data. So, in theory, the FBI could simply compel Apple to hand over its signing key and then build itself the tool that it wants. The line of argument about government conscripting Apple engineers to do custom software development is a red herring.

Likewise, it makes sense to worry about creating a special OS build—because what if it got out? But we face the same situation today if Apple’s key somehow got out. No one seems to be talking about that happening, even though the difference is just a matter of some engineering.

This will all get a lot more interesting when Apple makes a phone that’s secure from Apple itself.

Blake Ross:

Governments decided that allowing crew members to fully override the flying pilot using a key code would be insecure, since it would be too easy for that code to leak. Thus, there is nothing the outside pilot can do — whether electronically or violently — to open the door if the flying pilot is both conscious and malicious.

[…]

What’s striking is that this incident did not prompt any change in cockpit protocol in the United States. The FAA is improving mental health checks, but at 30,000 feet, we still have a security system where the parameters are widely known to criminals; where the method of abuse is clear; where we see no way for people outside the cockpit to stop it; and we’ve still decided the public is best served by keeping the people in the cockpit in charge of the lock.

[…]

Unbreakable phones are coming. We’ll have to decide who controls the cockpit: The captain? Or the cabin?

Update (2016-03-11): Christopher Soghoian (via John Gruber):

DOJ: We tried to be nice. We could just force Apple to turn over the iOS source code and code signing keys.

Ray Tomlinson, RIP

Dante D’Orazio (comments):

The inventor of email, Ray Tomlinson, suffered an apparent heart attack on Saturday, according to reports. He was 74 years old.

The Internet Hall of Fame (via Jason Kottke):

In 1967, he joined the legendary research and development company Bolt Beranek and Newman (now Raytheon BBN Technologies). At BBN, he helped develop the TENEX operating system, including implementations of the ARPANET and TELNET protocols. In 1971, he developed ARPANET’s first application for network email by combining the SNDMSG and CPYNET programs, allowing messages to be sent to users on other computers.

[…]

Tomlinson’s email program brought about a complete revolution, fundamentally changing the way people communicate, including the way businesses, from huge corporations to tiny mom-and-pop shops, operate and the way millions of people shop, bank, and keep in touch with friends and family, whether they are across town or across oceans. Today, tens of millions of email-enabled devices are in use every day. Email remains the most popular application, with over a billion and a half users spanning the globe and communicating across the traditional barriers of time and space.

John Ribeiro:

“I chose to append an at sign and the host name to the user’s (login) name. I am frequently asked why I chose the at sign, but the at sign just makes sense,” he wrote in a post about the first network email. “The purpose of the at sign (in English) was to indicate a unit price (for example, 10 items @ $1.95). I used the at sign to indicate that the user was “at” some other host rather than being local.”

heologic:

Where I first saw email becoming central to a culture is when I got to IBM. PROFS notes, or email, had a massive impact on the entire culture. The combination of calendar and email and the internal culture that had a terminal in every conference room would be familiar with most readers of Hacker news. You could have survived with what they offered in today’s modern world.

[…]

I saw an article on the founder of IBM PROFS email, and so I hunted him down on email while I was at IBM. I regret I cannot remember his name, but I wanted to say he was in research at Almaden, but this may be an human ECC error. However, I do remember that I wanted to know how obvious the creation of email was for everybody, and how much it was embraced. He stated at the time that most people thought that it would not be central to business life.

The Force Quit Fallacy

Kyle Richter:

The only time you need to force-quit an app is if it is frozen, or otherwise misbehaving — beyond that the best battery life can be attained by not force-quitting any apps.

Update (2016-03-10): Mitchel Broussard:

Asked specifically whether Cook quits apps to save battery and if it’s truly “necessary for battery life,” Federighi jumped in with a concise “no and no.” Although far from an official condemnation of the force quit belief by Apple, it is the most the company has directly said about the myth in the six years since multitasking became available in iOS 4.

Friday, March 4, 2016

Swift Asserts

Mike Ash (comments):

Some people prefer to only have asserts in debug builds, under the theory that it’s good to have checks when debugging, but it’s best not to crash the app out in the real world with real users. However, the error is present regardless of the presence of the assert that checks for it, and if it’s not caught right away it’s just going to cause havoc down the road. It’s much better to fail quickly and obviously when it’s practical to do so.

[…]

There is one missing piece from the Swift version of assert. In the simple C version above, the expression for the failed assertion is printed by using #condition to get a stringified version of that parameter. Unfortunately, there is no equivalent in Swift, so while Swift can print the file and line number where the failure occurred, it’s not able to print the expression that was supposed to be true.

[…]

By using @autoclosure for the message argument, assert can avoid evaluating the message expression unless the assert actually fails.

[…]

That means that the full bodies of the various assert functions are saved, in an intermediate form, into the standard library module. Those bodies are then available to be inlined wherever you call them. Since they’re inlined, they have access to the context in which they’re compiled, and the optimizer can remove them entirely when it’s warranted.

Swift Evolution Acceptances

Erica Sadun (comments):

The automatic translation effort (SE-0005) has dropped its effort to strip NS from the start of API names (for the moment, a revised version will return as its own proposal). It adopts the API guidelines in bringing Cocoa signatures into the Swift world.

[…]

First-argument labels are something that have evolved first from Swift 1 to a more Objective-C like Swift 2 and now to a more Swift like Swift 3. They’ve reached a state that’s somewhere between pure C and pure Objective C, hopefully with a better balance than the previous two incarnations.

Previously: Better Translation of Objective-C APIs Into Swift.

Thursday, March 3, 2016

Why Safe C Is Sometimes Unsafe Swift

Matt Gallagher:

In this article, I’ll look at a class of memory safety bug that occurred multiple times while I was writing the previous article. This particular bug occurs only in Release builds and can occur even when your code has no occurrence of the word “unsafe” anywhere in it.

[…]

That is the simple answer to what’s gone wrong in the Swift version: we tried to use a pointer to the first element of a tuple to read and write to the whole tuple. Creating a pointer to the first element of a larger structure and using that as a proxy for the whole structure is common in C and C++ but it’s simply not allowed in Swift.

[…]

For the example in this article, after destructuring the tuple the Swift compiler realizes that – according to the rules of the Swift memory model – only the zeroth field of the string1 and string2 tuples are ever read so the initialization of the remaining fields is marked as a “dead store” and the dead fields 1-9 are omitted from the function entirely (never allocated on the stack).

Previously Downloaded OS X Installers No Longer Work

Josh Centers:

The Apple Worldwide Developer Relations Intermediate Certificate is required for all apps in the Mac App Store, including OS X installers. When used to sign an app, the certificate enables OS X to confirm that the app has not been corrupted or modified by an attacker. This certificate expired on 14 February 2016, causing error dialogs and preventing some apps from launching. Most apps affected have already been updated with the new certificate. But if you downloaded an OS X installer in case of trouble, you may be in for a surprise the next time you try to use it.

[…]

Those who have created any bootable install disks for OS X will need to recreate them with the new installers.

Previously: More Mac App Store Certificate Problems.

Update (2016-03-03): Jeff Johnson:

Signing code with an expiring cert is not a mistake. Certs expire, that is known in advance. It is planned obsolescence.

Katie Floyd:

So, I’m now in the process of re-downloading gigabytes of data, again. That is, assuming you’re allowed to download the Installers. See, Apple won’t allow a newer Mac to download versions of OS X that aren’t compatible with that Mac.

Proposed New Swift Collections Model

Dmitri Gribenko et. al.:

We are proposing a new model for collections, where indices can only be advanced forward or backward by the corresponding collection instance. Indices become opaque tokens representing collection positions, that can be produced and consumed by collection APIs. This allows us to reduce the amount of data stored in indices to the bare minimum.

[…]

Instances of Dictionary point to an indirection, while instances of DictionaryIndex point to the storage itself. This allows us to have two separate reference counts. One of the refcounts tracks just the live Dictionary instances, which allows us to perform precise uniqueness checks.

The issue that we were previously unaware of is that this scheme is not thread-safe. When uniquely-referenced storage is being mutated in place, indices can be concurrently being incremented (on a different thread). This would be a read/write data race.

Where Did All the HTTP Referrers Go?

Stephen Merity (via Hacker News):

This leaves two problematic situations:

  • HTTP websites don’t receive referrers from HTTPS websites -- all traffic appears as direct traffic
  • HTTPS websites will send referrers to any other HTTPS website even if it contains sensitive information

The first situation means we lose any understanding of where traffic is coming from, the second situation leads potentially to security vulnerabilities or information leaks. Essentially, if a HTTP website links to another HTTP website, the author of the secure page is lending extra trust just as it’s HTTPS. In most cases, this is not what was intended.

[…]

These cases are covered under a new HTML5 called the meta referrer. Now a simple tag can be used, such as <meta name="referrer" content="always">, to specify the exact behaviour of the HTTP Referrer regardless of whether we’re using HTTP or HTTPS.

Update (2016-03-03): To be clear, this tag can help you send referrers to sites that you link to. It doesn’t help you see how visitors are getting to your site unless the source sites adopt it.

Update (2016-06-22): See also: Everything you could ever want to know (and more) about controlling the Referer header.

Wednesday, March 2, 2016

Typos in Disk Utility

Stephen Hackett:

In addition to the text being so brief it feels incomplete, it has two grammatical errors […] While this may seem silly, it’s this attention to detail stuff that worries me about Apple software.

If ever there were software you’d want to trust not to be buggy it would be the file system and associated tools. These kind of user interface issues don’t inspire confidence. And, unfortunately, the problems are not just skin deep. Lately I’ve been encountering a problem where SuperDuper cloning fails because the disk is full. It turns out that the underlying diskutil tool sometimes fails to erase the volume but tells SuperDuper that it succeeded. So not only does it not work but also it doesn’t know that it doesn’t work.

Previously: Disk Utility in El Capitan.

Update (2016-03-03): Marco Arment says it’s like having “a typo on your brake pads.”

Life and Death in the App Store

Casey Newton (comments):

Since Kaneko founded the company with Scott Sykora in 2009, Pixite has released eight applications dedicated to photo editing and design. Each has been featured by Apple as a Best New App; photo editor Tangent and design tool Assembly won year-end awards from Apple. Between 2013 and 2014, downloads of Pixite apps jumped from 395,472 to 3.1 million, and annual revenue doubled to $943,000. Pixite grew along with its cash flow, expanding from two to six employees as it explored ways to link its apps together and grow a loyal base of customers.

Then the bottom fell out. Last year downloads flattened, and Pixite’s revenues plunged by a third, to $629,000. Suddenly, a company that needed to bring in $2,000 a day to break even found itself making $1,000 or less.

[…]

But for a large swath of these app developers — particularly those without venture capital and sophisticated marketing tactics — the original App Store model of selling apps for a buck or two looks antiquated. In 2011, 63 percent of apps were paid downloads, selling for an average of $3.64 apiece. By last year, a mere 27 percent of downloads were paid, and the average price had fallen to $1.27. Today, profiting from the App Store most often requires a mix of in-app purchases, subscriptions, and advertising.

[…]

Meanwhile, a fatigue is setting in among customers. There are now more than 1.5 million apps in the App Store (Android users have 1.6 million to choose from), but by 2014, the majority of Americans were downloading zero apps per month. And it turns out people simply don’t use most of the apps they do download. According to ComScore, the average person spends 80 percent of their time on mobile devices using only three apps.

The most telling part to me:

And Pixite clung to using the one-time purchase business model, which led to a perpetual cycle of boom and bust as each launch generated a single revenue spike followed by a rapid decline. […] Pixite aimed to release one app a quarter, giving it just three months to design, code, and ship each product.

This is exactly what Wil Shipley and others predicted would happen given the App Store’s policies of no trials or upgrades.

1Password’s Cleartext IPC

Ross Hosman:

So it appears 1Password is sending data to the browser extensions over the loopback interface in clear text and not only passwords but credit card data as well if you use it for checkout forms. If anyone is sniffing your loopback they can get any data passing between the two.

nbadg:

They’ve made a risk/benefit analysis decision on handling IPC that it’s too difficult to secure, and that effectively any security for the IPC to browser would be 1) functionally meaningless to a targeted attack, like obfuscation, or 2) present undue burden to the people using the software. I’ll +1 their analysis (they also have several blog posts on the topic); makes sense to me. “Once an attacker has broken into your computer, it is no longer your computer.”

Jeffrey Goldberg:

Officially our view is “if a malicious process with user privileges is running on the users machine when they use 1Password, there is little we can do”.

But sometimes we try to do better. The example I raise is the steps we take to make things harder for keystroke loggers. We won’t go to extraordinary measures to enter a battle that we can’t win, but when there are simple things that we can do to make things harder for malware, we will.

Ross Hosman:

The reason I wrote this up is not to let people oh my god the world is ending but to let them know, hey if you are using the browser extension there is clear text passwords being sent over the loopback, if you don’t like that then don’t use their extensions.

You have made very well informed arguments about how hard it is to protect if someone has access to your machine, specifically elevated. But the argument to me seems kind of like “well, it’s hard to protect against then so we just decided to not do anything at all.” It seems like one other password manager company did something, so why wouldn’t you?

pfg:

You can’t read loopback as a normal user. If you have root, you don’t need to read unencrypted loopback traffic to get the passwords - just use a key logger.

Legal Issues for Developers

Adam Silver interviews David Sparks:

Frankly, when you think about it, one of the ways people come after developers and web guys is they don’t just say “You screwed up and I paid you $5,000, so I want my $5,000 back.” They will say “You screwed up and as a result my website was down for two weeks and I lost $150,000 of revenue because of it and I want you to pay me that.” You want to … The contracts I write for my clients, a lot of the times we have, and this is something out there that you should talk to your lawyers about if you are doing this, it is called a “Limitation of Liability Clause”.

[…]

Another thing you do is you put a clause in there that says interest, that allows for interest. Not only if they don’t pay you and your attorney fees, you are going to collect interest on the money. You should also put a clause in there, especially if you are working outside of your home base, a lot of developers work all over the place, is to put local jurisdiction. Make them have to come to court where you live.

Authenticating Support Requests

Matt Henderson:

What I find irritating, is the company’s assumption that the “from” address serves as any kind of authentication, since it’s dead easy to spoof the from address on an email!

Tuesday, March 1, 2016

iPod History and iTunes for Windows

Tony Fadell:

Ironically, when we couldn’t get any more money, I got a phone call from Apple saying, “Hey, come on in. We want to talk to you.” It turned out to be, we have iTunes, we’re making mix CDs, and these MP3 players out there are really bad. We think there’s a way to make an Apple version. Come on as a consultant for eight weeks, see what you can design, and we’ll see what we like. That was it.

[…]

I’d go around to other people in the company because I needed their help. Jack Williams, the COO, he was in one of the very first meetings I was in. I didn’t know who he was. I turned to him and said, “I need you to do this.” He said, “What is this?” “I’m making this music player!” No one believed it. People did not believe it. We’re fighting for our lives here. What are we doing with this little toy? That’s what it looked like.

[…]

I turned to Steve and said, “We can build anything. Give it enough time and money. But how can you guarantee to me that you can sell and market it? Look at Sony. They own every audio category. How do we go up against that?” He said to me, “Look. You make it, and I guarantee I’ll use every marketing dollar I’ve got. I’ll starve the Mac to do it.”

[…]

There was no master plan. We were living day to day. We started with iTunes, so you can rip CDs and make mix CDs. Then people want something more than a CD, something convenient to put their music on. Then they’re ripping CDs to get their music, so there has to be a better way. That was when digital downloads and then iTunes Music Store happened.

Via Juli Clover:

After being pressured by much of the iPod team to get iTunes to the biggest market, Jobs relented, but he insisted that journalist Walt Mossberg, who wrote for The Wall Street Journal at the time, sign off on the design.

Tracking Tasks With Stack Traces in Swift

Matt Gallagher:

Instead of using log files to track asynchronous tasks, I prefer to use a structure that I call a “task journal”.

[…]

We’d have a bit more flexibility if we could use the C function backtrace but in Swift, we can’t. The backtrace function comes from the “execinfo.h” header and is implemented as part of libSystem on OS X and iOS (which all Swift programs link against) but for whatever reason, the “execinfo.h” contents are not exposed to Swift programs.

[…]

The resulting callStackReturnAddresses function is about twice as fast as NSThread.callStackReturnAddresses on the basic tests I’ve tried (roughly 2 million invocations per second per core on my Mac versus 1 million invocations per second for NSThread.callStackReturnAddresses). It’s easily fast enough to gather lots of data in Debug builds – even for fairly intensive computational paths.

Fast Ordered Collections for Swift Using In-memory B-trees

Károly Lőrentey (via Nick Lockwood):

The benchmark above demonstrates this really well: insertion into a sorted array is O(n^2) when there are many items, but it is still much faster than a red-black tree with its attractive-looking O(n * log(n)) solution. At the beginning of the curve, up to about eighteen thousand items, a sorted array implementation imported from an external module is very consistently about 6-7 faster than a red-black tree, with a slope that is indistinguishable from O(n * log(n)). Even after it catches up to quadratic complexity, it takes about a hundred thousand items for the sorted array to become slower than the red-black tree! This remarkable result is due in large part to the vast number of (to a CPU, random-looking) memory references that are needed to operate on red-black trees.

[…]

Note that the big gap between collections imported from stdlib and those imported from external modules is caused by a limitation in the current Swift compiler/ABI: when this limitation is lifted, the gap will narrow considerably, which will reduce the element count at which you’ll be able to reap the benefits of lower asymptotic complexity.

[…]

The all-or-nothing copy-on-write behavior of Array, Dictionary and Set can lead to performance problems that are hard to detect and fix. If the underlying storage buffer is being shared by multiple collection instances, the modification of a single element in any of the instances requires creating a full copy of every element.

It is not at all obvious from the code when this happens, and it is even harder to reliably check for. You can’t (easily) write unit tests to check against accidental copying of items with value semantics!

With standard collection types, you often need to think about memory management.

App Review Needs Big Improvements

Graham Spencer:

Inconsistency from App Review was another major recurring theme in the survey responses. Numerous developers gave examples where App Review had approved an update containing new features, only to reject a subsequent update for those features which had previously been approved. The most frustrating of those examples were when the update was a bug fix – meaning the developer, trying to quickly resolve an issue for their users, would now have to take more time either modifying their app to comply or appeal the decision (which may not succeed).

One such example was when a small bug fix led to App Review rejecting an app because it required registration. But the app, which had been on the App Store for five years, had always required registration and all of their competitors did the same thing. In the end the app was approved, but it took about a month of appeals and several phone calls to Apple from the developer.

Most concerning was the idea, alluded to in a few of the responses, that some apps were being left to stagnate and die because developers felt that going through App Review again was too risky. These developers felt it was better to just let the app die slowly than risk going through what they feel is an inconsistent App Review, which might reject a long-standing feature – the removal of which would instantly kill the utility of the app.

[…]

A few developers wrote in and described how an app had been stuck in the App Review process for weeks and even months. What frustrated many of these developers was not just the excruciatingly long time in review, but the utter lack of communication from Apple as to why they were in App Review limbo. […] There is a mechanism for developers to send messages to the App Review team, but a common sentiment amongst those who commented on it was that it can often be (or at least appear to be) futile. One developer said App Review simply sends them “canned responses” and another developer even described the feeling of communicating with App Review as “like sending a message in a bottle”.

[…]

One developer had an app update held “in review” for 32 days. Whenever the developer contacted App Review during this time, they were told nothing was wrong. Eventually the developer contacted someone at Apple they knew and this resulted in a call back from someone in App Review. They asked the developer why they were using HomeKit devices that were unreleased and that the developer should not have access to. Only wrinkle was, the developer was not using any unreleased HomeKit devices.

Intercalation

Dave DeLong:

This is where another calendrical technique called “intercalation” comes in. Intercalation is the process of inserting or removing a unit of time measurement (like a day) into your calendar to get it to line up with whatever natural cycle off which you’re based.

[…]

This Gregorian system of an intercalary day is well-known to us and we’re pretty used to it. But once you get out of the western mindset of “January - December” and accounting for all the other billions of people around the world who measure time differently, you realize some key things, and one of the big ones is that intercalation is not limited to days or seconds.

[…]

The Japanese calendar is a prime example of not making assumptions about dates. While the days and months are all based on the Gregorian calendar, the year is measured from the day that the current emperor ascended to the throne. And when an emperor passes on, a new year begins the very next day, even if it’s not actually the Gregorian “new year”.

Previously: Falsehoods Programmers Believe.

When AppleCare+ Is Worth It

Ashley Nelson-Hornstein:

I recently shattered the screen of my iPhone 6S. Since then, every Apple fan I’ve spoken with has asked me if I have AppleCare+, and each has given me the same pitying look of sympathy when I say no. “You should really get that,” they say. Well, today I looked at the numbers and I still don’t see a point to Apple’s warranty program for iPhones.

Copyright © 2000–2024 Michael Tsai.