Archive for April 4, 2019

Thursday, April 4, 2019 [Tweets] [Favorites]

Microsoft Shuts Down E-book Store

Microsoft:

Starting April 2, 2019, the books category in Microsoft Store will be closing. Unfortunately, this means that starting July 2019 your ebooks will no longer be available to read, but you’ll get a full refund for all book purchases. See below for details.

While you can no longer purchase or acquire additional books from the Microsoft Store, you can continue to read your books until July 2019 when refunds will be processed.

Cory Doctorow (tweet, via Chris Turner):

This puts the difference between DRM-locked media and unencumbered media into sharp contrast. I have bought a lot of MP3s over the years, thousands of them, and many of the retailers I purchased from are long gone, but I still have the MP3s. Likewise, I have bought many books from long-defunct booksellers and even defunct publishers, but I still own those books.

Safari Link Tracking Can No Longer Be Disabled

Jeff Johnson (tweet):

Notice that when you hover over the “Ping Me” link, you only see the href URL, you don’t see the ping URL, so you don’t even know that the attribute exists unless you look at the HTML page source. When you click the link, it loads the page http://lapcatsoftware.com/ as expected. But it also sends an HTTP POST request to http://underpassapp.com/ without any visible indication to the user. You can only see it if you do a packet trace. It should come as no surprise that the primary usage of hyperlink auditing is for tracking of link clicks.

[…]

Apple shipped Safari 12.1 last week to the public with no way to disable hyperlink auditing. I hope to raise awareness about this issue, with the ultimate goal of getting hyperlink auditing disabled by default in Safari. Apple claims that Safari is supposed to protect your privacy and prevent cross-site tracking, but hyperlink auditing is a wide open door to cross-site tracking that still exists.

Eric Jacobsen:

If anyone is curious why this attribute was introduced: it’s supposed to be an alternative to those chains of redirects that publishers often put in front of outbound links.

User gets a direct link to destination instead of redirects (good), publishers and advertisers still get their data async (creepy, but arguably better than the alternative)

Imo is fine as long as there’s an opt-out, which chrome and ff have but oddly Safari just dropped.

Is Apple’s reasoning that making it an option would prevent sites from using ping? It’s better to have access to the real URL with a compulsory ping than to be forced to use a redirect chain that’s slower and no more private.

Previously:

With privacy and online tracking being such a large problem and major concern for many users, you would think that browser developers would give you the option to disable anything that could affect your privacy.

Unfortunately, this seems to be going in the reverse direction when it comes to hyperlink auditing.

[…]

Of all the browsers I tested, only Brave and Firefox currently disable it by default and do not appear to have any plans on enabling it in the future.

[…]

It turns out that Google uses hyperlink auditing in their search result pages. Every time you click on a search result link, your browser will also send HTTPS POST request back to a Google url in order to track the click.

Jeff Johnson:

Anchor ping is not an alternative form of tracking, it’s an additional form of tracking. We still have all the other forms of tracking along with this one. It may be true that if advertisers don’t have anchor ping, they’ll just use alternative methods, but the belief that advertisers won’t use alternative methods of tracking if they have anchor ping has proven to be completely false. Anchor ping also turns out to be an advertiser’s dream feature. It’s completely invisible to the user, and it’s more powerful and reliable than the other tracking methods.

[…]

Anchor ping was supposed to be transparent as in easily perceived by the user. Instead, anchor ping has become “transparent” as in invisible to the user. The browsers never informed the user about the ping notifications. And now browsers such as Safari and Chrome are removing the ability of the user to disable the notifications. As far as privacy is concerned, this is not “a wash” compared to previous tracking methods. It’s a cover-up.

I still can’t figure out what users gain by not being informed of both the target URL and the redirect. When links are being used for tracking purposes, it makes sense to show the contents of the href so that users aren’t misled; but, if we start assuming all browser features will be used maliciously, it is easy to see why the ping attribute should also be visible to the user.

Researchers have found that the HTML feature called hyperlink auditing, or pings, is being used to perform DDoS attacks against various sites. This feature is normally used by sites to track link clicks, but is now found to be abused by attackers to send a massive amount of web requests to sites in order to take them offline.

[…]

The yo.js script, shown below, would randomly select one of the above sites and create a HTML ping URL with that site as the ping target. It would then programmatically click on the link as shown by the link.click() command.

The JavaScript would then create a new HTML ping URL and click every second. So the long a user was on this page, the most clicks they would generate.

Just turning off the Ping attribute or the Beacon API doesn’t solve the privacy implications of link click analytics. Instead, it creates an incentive for websites to adopt tracking techniques that hurt the user experience. In effect, the choice between supporting Ping and not is not one of privacy, rather it is a choice between a good user experience and a bad one.

[…]

Until recently, Safari supported an internal User Defaults flag to disable support for the Ping attribute. It was never our intention to surface this flag as a customer setting. We think it’s misguided to offer users the ability to disable web-facing features if doing so doesn’t disable or prevent the ends of that technology. Instead, Intelligent Tracking Prevention and Content Blockers offer users different levels of support for categorically affecting link click analytics.

However, currently it seems like neither can be used to categorically block pings.

Jeff Johnson:

The Chromium team is finally coming around[…]

[…]

I think Apple just found itself on the wrong side of history, now as the only browser vendor defending a user tracking technology.

Ricky Mondello:

We agree that <a ping> should be more transparent. I publicly filed this bug to track improving this for WebKit and Safari[…]

This is weird because his bug notes that Safari is not to spec, yet Wilander’s blog post makes it sound like the Safari team likes the current behavior.

Fortunately, I have a solution for you now! Last night (as soon as I could get approved by Apple) I released StopTheMadness 6.0 in the Mac App Store. If you click on a link with the “ping” attribute, StopTheMadness 6.0 will now remove that “ping” attribute, thereby preventing your clicks from getting tracked by hyperlink auditing.

Mozilla has told BleepingComputer that they will be enabling the tracking feature called hyperlink auditing, or Pings, by default in Firefox.

[…]

After Mozilla’s response, we also contacted Brave Software to ask if they had any plans to enable hyperlink auditing in their browser.

“Disabling hyperlink auditing is a crucial privacy feature, and Brave has always disabled this by default,” Catherine Corre, Head of Communications at Brave Software, told BleepingComputer via email. “Brave users expect this protection from our browser.”

Jeff Johnson:

Today, Google shipped Chrome 74 to the public, and this hidden preference is now indeed gone for everyone. The change log for Chrome 74 includes the removal of disable-hyperlink-auditing from Chromium.

macOS 10.14’s Software Update Release Notes

John Gruber:

But the sheet containing the release notes can’t be resized. You see about 9 lines of text at a time, and there’s nothing you can do about it.

Worse, the text can’t be selected, so you can’t even copy and paste it into TextEdit or some other app to read it comfortably. They even have URLs at the bottom of the note, pointing to support pages on apple.com which contain even more details about the update — but the URLs aren’t clickable. Can’t copy them, can’t click them — the only way to actually open these URLs is to retype them manually.

Apple’s newest Mac software designs just don’t seem to work very well.

Steven Aquino:

What @gruber doesn’t mention here is worth a shout by me: Reading release notes on the Mac—or anything else—is damn near impossible if you’re visually impaired. You could use Zoom, but again, 10.15 better bring Dynamic Type to macOS.

Previously: macOS 10.14 Mojave Released.

BBEdit Returns to the Mac App Store With Subscription

Bare Bones Software (tweet, Phil Schiller, 9to5Mac, MacRumors):

In the spring of 2018, Bare Bones and Apple announced that, subsequent to the release of macOS Mojave (10.14) and the accompanying refresh of the Mac App Store, BBEdit would be returning to the store.

This was made possible by changes to the OS itself which allow Mac App Store versions of BBEdit to function to their fullest extent while complying with Mac App Store rules; as well as changes to the Mac App Store business mechanics which make it possible for us to distribute our software through the Mac App Store as part of a sustainable business model.

[…]

There are two levels of paid subscription:

  • Annual: US$39.99 per year (may vary in other locales)
  • Monthly: US$3.99 per month (may vary in other locales)

You may install BBEdit at no charge via the Mac App Store, and use it either with a paid subscription or in Free Mode.

They are still offering “perpetual” licenses for $50. There’s been a paid upgrade every three years. BBEdit 12 was a $40 upgrade, BBEdit 11 was a $30 upgrade, BBEdit 10 was a $40 upgrade, and BBEdit 9 was a $30 upgrade (with a full price of $125).

Steve Troughton-Smith:

If you’re curious about BBEdit’s MAS entitlements, as I was, you can see them here; it says a lot that everybody is still relying on ‘temporary’ sandbox exceptions just to make life in the MAS possible

Jeff Johnson:

There’s a kind of dilemma with having both MAS subscriptions and non-MAS 1-time licenses:

If you ever want to have a non-MAS paid upgrade again, you’ve got to hold back new features. But then subscribers get nothing new for their continued payments.

Paulo Andrade:

I always thought the argument that subscriptions allow developers to not bundle features in major versions a bit moot. Having a big update makes it a lot easier to do marketing around it and that’s kind of a big deal. Having a subscription doesn’t change that.

Previously:

Update (2019-04-05): John Gruber:

The App Store has welcomed BBEdit back warmly, with a nice top-of-the-front-page feature on developer Rich Siegel and BBEdit’s incredibly long history as a Mac stalwart, along with two other features: “BBEdit: A Writer’s Secret Weapon” and “Tame Your Text Files” — both good guides to BBEdit’s rich feature set. (Those App Store articles will open in the App Store apps on Mojave or iOS.)

Wojtek Pietrusiewicz:

I can’t read the @bbedit @AppStore features on my iPad. First of all I found the links to the stories on @gruber’s @daringfireball. Clicking the links does nothing on my iPad however. One tried to open iTunes and failed, the other just silently failed.

Previously: App Store Covers RSS Readers.

HomePod Price Reduced to $299

Tim Hardwick:

Apple today cut the price of HomePod on its online store by $50, with the smart speaker now listed for $299, down from $349. The price drop follows recent promotional discounts at several third-party retailers across the U.S.

I wonder whether that will affect sales much. My gut feeling is that $250 would have been a lot more interesting and that there are not that many more people who would want a HomePod for $300 than for $350.

Joe Rossignol:

In a new entry in its Machine Learning Journal, Apple has detailed how Siri on the HomePod is designed to work in challenging usage scenarios, such as during loud music playback, when the user is far away from the HomePod, or when there are other active sound sources in a room, such as a TV or household appliances.

Previously:

Update (2019-04-05): Marco Arment:

It’s a lot like the Apple Watch: great at a few core things, mediocre for some others, and regularly fails at simple tasks.

Great for music, as long as it’s Apple Music. Great for HomeKit. Mediocre for assistant tasks. Mediocre for timers.

Siri makes — and breaks — the HomePod.

If music quality is a high priority, it’s a good option.

But if so, you’ll really want two of them in a stereo pair, which is a HUGE improvement in music quality. Budget accordingly.