Archive for September 2019

Monday, September 30, 2019

From iOS to Android and Back Again

Greg Morris:

Indeed Android is the more useful operating system, it makes it much easier to interact with notifications and find things you need instantly.

[…]

I am always fascinated by Android handsets, a huge selling point for Android is that it is far more exciting from a hardware perspective. You are guaranteed to find an handset that is suited to you use case however niche it might be.

[…]

In exchange for giving up control you get the best source of high quality, diverse and sometimes expensive software in existence. Apples App Store still trumps Google Play for quality of apps by a long chalk, although the standard on Android is much better than even a couple of years ago.

Previously:

Decreasing iOS Information Density

Kyle Howells:

iOS 13 and the iPhone 11’s continue the trend of making phones bigger while making the UI even bigger, to get less information density than the small devices used to have.

iOS 13 Photos app for example has gone 3 photos wide, instead of 4.

So now the photos are giant, the app feels like Duplo, and I can see hardly any photos at once.

scott:

The original music app on the 3.5" iPhone had more information density than Apple Music does today, and it did so while also having a persistent tool/navigation bar.

Marco Barrios:

This is so true. I have the iPhone XR that is uncomfortable to hold because it is too large but I can only see 3 messages at a time.

Kyle Howells:

The worst thing iOS 7’s redesign did was kill information density.

When you remove all visual affordances except white space and color UI’s balloon and bloat massively.

Kyle Howells:

This is an anti pattern I’d really like to see the industry outgrow.

It became fashionable with Metro & iOS 7 to get rid of borders and all UI affordances in favour of just adding more white space, but it’s less usable, balloons UI sizes and massively reduces information density

Again, the bottom one looks more fashionable but is much harder to use.

Keep the new colors but reintroduce the borders, tighten the spacing slightly (now you can as you have borders) and it’s much nicer to use.

Previously:

Update (2019-10-11): Tanner Bennett:

I made this a while back. The red is empty space.

Visual Voicemail Implemented via IMAP

Michael McNeela:

Visual Voicemail on iPhone is …an IMAP email account behind the scenes, with each voicemail message being an email message with an attached audio file

When someone leaves a message, your mobile network sends a silent SMS to iOS; so it knows to download it.

Mauricio Freitas:

This is how the old Exchange 2003 Activesync protocol used to work... SMS to mobile device, which in turn would fetch emails from server. All different after always-on connections... But very old idea

Justin Santamaria:

Many years ago, I was responsible for writing the VVM spec at Apple to distribute to carriers - it was pretty clear that an off-the-shelf solution would allow adoption faster than anything custom and there was no need to reinvent the wheel (and the chase bugs involved therein).

So IIRC we provided the spec, carriers to implement, but there is an industry of 3rd party software for carriers, so I think a lot has to do with whether your carrier’s solutions supplier supported it and agreed to license it.

Also some had their own separate VVM implementations and were resistant to have another one.

Here’s the specification.

Sergej Schmidt:

The first thing we recognized was the format of the account name (as already seen in network traffic) as well as the password, which is stored in cleartext. Knowing the server IP address, we already reach the critical amount of sensitive information becoming available through sniffing the network traffic. As the IMAP protocol on port 143 is used for communication, we were able to test the retrieved connection data and credentials by using a standard email client. Unsurprisingly it worked out well. The screenshots show how we used thunderbird to read the folder structure of the mailbox itself. Voice calls are basically implemented as emails with an .amr audio file attached.

Previously:

Software as Business

Oluseyi Sonaiya:

Web applications have certain advantages, such as every user being updated to the latest version whenever you want, but also come with certain expectations such as user-created data being stored remotely and needing to be exported/downloaded to a local device. This expectation allows web app publishers a measure of leverage, in that they can charge a fee to grant users access to the data they create using the app.

[…]

The demand for performance at scale drives them to something they can install locally, and use local file assets against, simply periodically syncing to remote (“cloud”) storage. This is the Adobe Creative Cloud model, charging for continued access to the programs[…] These petitions were unsuccessful, but I firmly believe that the response to this change by Adobe spawned dozens of new design and creative applications, almost all of which opted for the “traditional” pay to purchase/license in perpetuity model: Pixelmator, Procreate, Affinity Photo, Affinity Designer, Sketch, LumaFusion, etc.

[…]

Overlapping all of this were changes in user expectations around the price of downloaded and installed application software, driven primarily by Apple’s App Store. While early apps had price points comparable to desktop software of the early and mid-2000s, the competition for audience and the willingness of publishers of substitutes to undercut each other on pricing created a “race to zero,” such that today the average app’s price is barely $1.

Update (2019-10-11): Isaiah Carew:

i think many assume the app store price pressure is the new normal. that user expectations simply changed for all software one day.

but outside of mobile app store the $1 app expectation never took root. there is pressure to reduce prices sure, but nothing like the app store.

Isaiah Carew:

I believe (and base my business strategy - what there is of it anyway) that there is still a very active market for pro-sumer productivity software priced under $100.

the market is much smaller than mobile, but the user-base is willing to pay reasonable prices for useful tools.

Friday, September 27, 2019

Apple’s Use of Swift in iOS 13

Alexandre Colucci (Hacker News):

The new iOS 13 features have with no surprise been built with some Swift code in their corresponding application. This is the case of the FindMy, Reminders and Sidecar apps. Also worth noting is the use of Swift in the Health, Book and Shortcuts apps.

[…]

If we exclude the Swift libraries, iOS 13.1 contains 141 binaries using Swift, more than doubling the number from iOS 12[…]

Previously:

iOS 13 Autocorrect Is Drunk

John Gruber:

One thing I and others have noticed is that when you type a dictionary word correctly — meaning you hit the exact right keys on the on-screen keyboard — iOS 13 autocorrect will replace it with a different dictionary word that makes no contextual sense. Even beyond dictionary words, I’m seeing really strange corrections.

I think this has been going on since before iOS 13.

Previously:

Update (2019-10-11): Philip:

It is so bad. I could rely on iOS 12 to propose the right words and correct typos. iOS 13 feels like I have to re-teach the AI. Also umlauts in German are a mess. It never propose the right word.

Tanner Bennett:

iOS 11 is when they switched to a “machine learning” based autocorrect engine, which is the cause of all this.

Riccardo Mori:

That’s why after switching from my iPhone 5 with iOS 10 to the new iPhone 8 with iOS 12, my initial impressions were that autocorrect was simply worse and felt ‘untrained’. I didn’t realise that what messed things up was the keyboard switching while writing a word.

But even within a single language, autocorrect under iOS 12 does indeed feel less smart than under iOS 10.

BlockBlock 0.9.9.4

Patrick Wardle (via Leo M):

Malware installs itself persistently, to ensure it’s automatically re-executed at reboot. BlockBlock continually monitors common persistence locations and displays an alert whenever a persistent component is added to the OS.

[…]

This alert contains the name and path of the process that installed the persistent component, as well as details about the actual persistent component. Moreover, it shows if the process (that created the persisted item) is signed by Apple, signed by a 3rd-party, or is unsigned[…]

It’s the equivalent of LittleSnitch for auto-launching background processes.

Previously:

Is Single-user Mode Dead?

Howard Oakley:

Even with Recovery Mode available, there have still been some reasons for wanting to enter SUM. One of them has been to run command tools to check memory for faults, as in SUM the system takes as little memory as possible, allowing you to run checks on all the rest. Sometimes fsck run from SUM could fix problems which Disk Utility in Recovery Mode couldn’t.

[…]

The biggest problem comes with Macs equipped with a T2 chip, and its Secure Boot. If it were available, a traditional SUM would bypass Secure Boot, so it isn’t allowed if your Mac has a T2 chip: Command-R will take you to Recovery, and that’s as close as your Mac can get, unless you disable Secure Boot by setting the Startup Security Utility to No Security. And you have to do that in Recovery anyway.

Subscribers Are Your True Fans

David Barnard (tweet):

Paying once for an app really only makes sense if the app provides minimal functionality of limited value and won’t benefit from continued improvement.

[…]

With paid apps, people often end up buying several apps just to figure out which one best fits their needs. Let’s say they spent $3 each on 4 apps, that’s $12 they were willing to pay for a great app, but that great app they settled on only gets $3. Since most subscription apps have free trials, and many even have ad supported free tiers, people can try multiple apps and then only pay for the one they actually use.

[…]

Sure, some potential customers (or existing customers if you transition from another business model to subscriptions) are going to complain about the subscription model. It’s hard to hear someone tell you that they don’t value what you’ve built, but the smart thing to do is focus on the people who are subscribing, your true fans. Figure out who they are and look for ways to reach more people like them instead of focusing on the vocal minority that complain.

Julian Schiavo:

My apps been rejected with a short message basically saying ‘your app can’t use auto renewing subscriptions’, any tips/experience on this? All the other apps of this type use auto renewing subscriptions 🤷‍♂️

Reginald Braithwaite:

The simple model I keep in my head, is that your revenue model should parallel your expense model.

If they don’t, you’re both running a business AND engaging in arbitrage. That’s two things you have to get right, instead of one.

David Barnard:

This tweet reminds me of a chart by @macguru17. When you’re building an app, even one that doesn’t have ongoing costs like weather data or servers, the cost of continued development keeps putting you underwater before each update.

I don’t think most people realize how much most indie developers sacrifice to keep the lights on. In 11 years, I’ve probably only been cash flow positive 48 months. With paid apps, I’d build up a war chest with a big launch/update/sale, then spend it down working on the next.

I’ve even gone into debt to squeak by until the next big update. People seem to think all developers are rich & greedy. But it’s like any other small business. Most struggle, some do well, a few really well. But businesses don’t drop prices because they are doing well. 🙃

Previously:

Twitter “Hide Replies” and Timeline Swiping

Tim Hardwick:

Twitter today rolled out its new “Hide Replies” feature in the U.S. and Japan, providing Twitter users with more control over the replies that are visible following a tweet.

The idea behind the feature is to give people more control over the conversations they start on the social media platform, so they can hide replies that are offensive and the hidden reply won’t show up to others as a response to the original tweet.

Khedron:

So people can post false information and hide/censor anyone who calls them out on their lies or conduct.

Ben Sandofsky:

Decided to try the “Hide Reply” feature, and I noticed the hidden tweets got way more attention than if I’d just ignored them.

It turns out this pop up appears when you visit my tweet.

Juli Clover:

Twitter today implemented a feature that’s designed to allow lists of Twitter users to be pinned to the Home screen and swiped between, allowing for easy access to multiple customizable timelines.

Update (2019-09-30): Colin Devroe:

Also, Lists do not suffer from the Home timelines terrible algorithm. For that reason alone it is worth building a List or two.

[…]

I cannot imagine using Twitter without Lists. So I’m glad they are investing in the feature rather than removing or ignoring it.

Update (2019-11-01): Devon Zuegel:

Fun to see people use Twitter’s new “Hide reply” feature to clean up threads!

They’re adapting the new tool—originally intended to remove abusive/spammy comments—for increasing the signal:noise ratio by hiding low-value responses (e.g. @threadreaderapp requests)

New Stack Overflow CEO

Ingrid Lunden (in 2017, via Hacker News):

TechCrunch has learned and confirmed that the startup has conducted a substantial number of layoffs across the company as it looks to steer the business more towards its core Q&A products and away from areas that were seeing less demand. As part of this, the company is also closing its offices in Denver.

[…]

A source that contacted TechCrunch claimed that the number of people affected worked out to about 20 percent of Stack Overflow’s 300 employees, or 60 people.

[…]

As some of the jobs affected pointed to staff in the company’s recruitment business Careers, our source said that the company was “looking to pivot away” from this business, but Stack Overflow has confirmed this is not the case in a second statement it issued after the first one.

Joel Spolsky (Hacker News):

Last March, I shared that we were starting to look for a new CEO for Stack Overflow. We were looking for that rare combination of someone who could foster the community while accelerating the growth of our businesses, especially Teams, where we are starting to close many huge deals and becoming a hyper-growth enterprise software company very quickly.

[…]

At Rackspace, Prashanth [Chandrasekar] really proved his mettle, creating from scratch a completely new business unit inside the company, the Global Managed Public Clouds Business. This group serves companies around the world who need help running on AWS, Azure, Google, and so on. Under his leadership, Rackspace successfully pivoted from a leading managed hosting company to a cloud services company. And he did this while working with developers both inside Rackspace and outside, so he understands our vision of “writing the script for the future” better than anyone I’ve met.

Dunedan:

[Too] bad they’re on the hyper-growth train now as well, but I guess their investors want to get some money back. I’d preferred seeing them grow slow and stable, because I feel that focusing solely on growth often leads to decisions not in the interest of the users.

patio-chill:

They have def given up their regular users in this point. Ads thing shared here is one item recently. Also think they can re license my content without asking.

Mad Scientist (via Hacker News):

The trigger for this issue was a report that one of the ads on SO was trying to start an audio context in the browser. One of the answers shows that the main purpose of the suspect script is to fingerprint the browser. I looked a bit at that script myself, and that ad contains a ~80 kB minified Javascript file that really looks like the only purpose of it is to query all kinds of obscure details about the environment, and I can’t see any other purpose for this except tracking users without the restrictions cookies or other systems impose.

[…]

This is still there on the original post and not retracted. The later meta post by SE paints an entirely different picture. It is evasive and in my opinion missing the point entirely. The Stack Exchange response claims that no PII is collected, which is really not what this is about. Fingerpinting is about being able to track a user across sites without the browser security getting in the way, identifying the user is a separate process. You don’t have to collect PII to fingerprint users, but it’s still a very invasive thing to do with a drastic effect on the privacy of users.

mandevil:

it seems clear that SO Jobs didn’t work, but enterprise sales is the key, just based on what they emphasized in the announcement. Using the SaaS website as a loss leader advertisement for the shrinkwrap software is an interesting model

Dunedan:

Maybe Stack Overflow Jobs would work better if they’d publicly state what their job ad pricing is and if they’d improve the user experience (e.g. there is no way to get a nice looking printable version of the developer story).

sytelus:

So the new CEO is MBA and doesn’t even seem to have profile on StackOverflow. This tell me he has little clue how this complex community hangs on balance and what makes it tick. It’s also painful to see that we have now one of the largest website for developers run by guy who isn’t a developer.

[…]

I can’t help but reminded of Jobs bringing in Scully with enthusiasm to do “business things”. I have admired Joel’s writing and wisdom for years but this somehow feels wrong given they could have chose almost anyone from their vast highly dedicated user base who understands the complex dynamics in SO community. Do we expect full blown value destroying commercialization of SO from now on?

xibalba:

I predict Microsoft will acquire SO in the next 5 years.

Previously:

Thursday, September 26, 2019

AltStore

Riley Testut (tweet):

AltStore is an alternative app store for non-jailbroken devices. Unlike other unofficial app stores today, AltStore does not rely on enterprise certificates, which Apple has been cracking down on more and more recently. Instead, it relies on a lesser known developer feature that allows you to use your Apple ID to install apps you’ve developed yourself with Xcode[…]

AltStore is a fully native, sandboxed iOS application that allows you to sideload apps by essentially “tricking” your phone into thinking it’s installing apps that you made yourself, when really they can be any apps whatsoever. Since this is an actually supported installation method by Apple, it’s far less fragile than other distribution methods in the past[…]

[…]

Unlike apps distributed with a paid Apple Developer account, you can’t install apps distributed with a free Apple ID over-the-air. This means that while we can prepare apps for installation from the AltStore app, unfortunately there is no way to actually install apps directly from the iOS device. However, as it turns out this restriction does not apply to installing apps via iTunes WiFi sync, which is where AltServer comes in.

[…]

All apps signed with a free Apple ID are only valid for 7 days, at which point they expire and can no longer be launched. To compensate for this, AltStore will periodically refresh all your installed apps in the background, or alternatively you can manually refresh the apps yourself from within AltStore.

[…]

Delta of course is not allowed in the App Store due to Apple’s stance on emulation, but why make a clipboard manager when so many already exist in the App Store? Simple: there is no App Store-approved way for apps to run continuously in the background, which means you need to remember to manually open up these apps for them to save your history.

Looks like great work, but I hope Apple Sherlocks it and adds a built-in way for users to sideload apps.

Previously:

Update (2019-10-04): Nick Statt:

For Testut, AltStore arose from him just “wanting to get Delta out” and in the hands of people who’d want to try it. “It just made sense. If I’m building this whole process for Delta, just to build it out for anyone to use,” he says. “I’m also hoping that because I was so motivated to do this, and I build this whole process, other people can now start making more apps to bring to it. I’m doing it because I want to also improve the quality of apps that you won’t find in the App Store, but that could still exist on the platform.”

Mail in iOS 13

Dan Moren:

No, the only place you’ll find the multicolored flag options is, somewhat nonsensically, under the Reply button from a message itself.

iOS needs a menu bar or something.

Tap the Flag button there and you’ll get a sub-menu that lets you choose one of seven colors, as well as an option to remove a flag.

Whatever color you’ve picked there most recently will be treated as the default on that device until you pick another color. So, if you go to flag a message using one of those other methods after choosing a color, you’ll see the Flag button color changed to reflect that. But jump from your iPhone to an iPad and you may have a totally different color.

[…]

But my other favorite improvement to Mail in iOS 13 is an iPad-only capability that came along with the multitasking features: message composition windows can be dragged into Split View mode, so you can write an email while referring to another email.

Peter Kafka:

I updated to the new iOS yesterday and have since accidentally deleted at least 6 emails instead of replying to those emails and that does not seem like a great feature.

Update (2019-09-27): Craig Grannell:

The previous grab shows Mail in iOS 12 (left) and iOS 13 (right). On the left, you have immediate access to options that let you flag, file, archive/delete, reply, and start a new message. It’s not overly complicated, and it looks fine. Also: all these actions are fundamental to rapidly dealing with email. Now, you only get archive/delete and reply.

Update (2019-09-30): Kyle Howells:

iOS 13 Mail app moves the reply/move controls into a fake toolbar in the email content, which means if you have a slow network and it takes a while to load you also can’t access any of those controls until it’s loaded.

Update (2019-10-03): Kyle Howells:

The mail app on iOS 13 does feel almost like a web app.

The design direction needs to be rapidly reversed for that app.

Dr. Drang:

Filing an email message used to mean tapping the folder button in the bottom toolbar. Now it means tapping the curvy arrow, then scrolling up to expose the Move Message button, and then tapping it.

Michael Rockwell:

Why would Apple remove quick access to so many useful features in favor of this “archive plus junk drawer” setup? Luckily for me, the vast majority of the email I receive is simply archived. But for anyone that frequently perform other actions, this change is terrible.

Nicholas Riley:

Despite the way it is worded in settings the swipe actions work in the message view too.

Brian:

For me it means tapping the trash by mistake because it’s right next to the arrow with blank space everywhere else, then shaking to undo like an idiot, then finally hitting the arrow

Update (2019-10-11): Riccardo Mori:

You wonder why people are criticising Mail’s UI in iOS 13? Look at this: all the controls and UI elements have been remained consistent from iOS 6 to iOS 12.

Update (2019-10-21): Michael Kosta (Marcin Krzyzanowski):

Why didn’t @apple move the delete button over 1 inch? Big mistake.

Update (2019-10-25): Craig Hockenberry:

Muscle memory is a bitch.

I would also love to understand the design decisions that went into the latest version of Mail.

So much hidden functionality, but why?

Update (2019-11-27): John Gruber:

And it just seems odd to me that they moved all these features there in the first place. The iPhone really only has room for five toolbar buttons. Flag, Move, Trash, Reply, and New Message seemed like good ones. What’s the point of having only two buttons and all that unused whitespace on the left side? In addition to the fact that it’s not intuitive to look for Flag and Move commands behind a button that clearly looks like “Reply”, it’s also a bit frustrating to me that there’s no longer a way to just create a new message from this screen — you have to go back one level in the navigation controller to the list of messages to create a new (non-reply) message.

At the very least, if the toolbar is only going to have these two buttons, why not place the Trash button on the far left, and put the whitespace between the two buttons? That would eliminate inadvertent taps on the Trash button from either pre-iOS 13 muscle memory or from proximity to the Reply button.

Nicholas Riley:

I suspect not putting anything on the left of the message toolbar had to do with making room for “See More”. Not that I think this is a good idea!

Mike Rundle:

I’ve been upset for months that I couldn’t long-press on the refresh button in Safari to turn off content blockers anymore and I just found this stupid menu hanging off a totally unrelated icon that I never press. Nice, Apple. Real nice.

Update (2020-03-27): Chance Miller (tweet):

Tesla and SpaceX CEO Elon Musk knocked Apple during an event this week, criticizing the company’s recent updates for iOS.

[…]

“What I was referring to is that technology does not automatically improve,” Musk said. “People are used to the phone being better every year. I’m an iPhone user, but I think some of the recent software updates have like been not great, certainly feeding into that point. It, like, broke my email system. . .which is quite fundamental.”

Safari 13 and Extensions

Apple (Hacker News):

Removed support for Legacy Safari Extensions

1Password:

Moving forward, the use of 1Password with Safari will require 1Password 7, which fully supports the latest Safari and macOS releases.

[…]

We’ve been asked if it would be possible for us to provide the extension such that it could be installed regardless of the Safari Extension Gallery’s status. Since Safari 12 does not allow .safariextz extensions to be installed from anywhere except the gallery, and Safari 13 does not allow such extensions to be installed from any source, if we were to provide the extension files, they could not be installed. As such this will not be a feasible solution.

janfoeh:

It really, really is a shame that they removed proper extensions. While Safari never had a good extension story, it was at least bearable, and in all other regards its simply the best Mac browser.

Now I have to take a really hard look at switching back to Firefox, and that would be a downgrade in almost every regard I care about. Pity.

dantondwa:

Just opened it again out of curiosity and the first message I got is that the Bitwarden and Pocket extensions are not supported anymore. Oh, well, as much as I’d like to use it, a desktop browser without extensions is dead to me. There are some extensions that provide me with little quality of life improvements and whatnot. Since, when I’m using my computer, I’m almost always using a browser, these things become important.

I wonder why Apple decided to axe extensions and not support WebExtensions, that at this point have become a standard shared by Firefox and Chrome. Too bad.

glogla:

Apple removed the ability to use uBlock Origin or similar.

I tried few ad blocker from the app store, but non of them block Youtube’s video ad, making it useless.

We still have Firefox for now I guess.

Geoff Duncan:

I appreciate Apple adding privacy protections to Safari. However, since Safari 13 for macOS cannot run legacy extensions that worked—which cannot generally be replaced with the new, more-limited extension apps that don’t—Safari is now off my list of “usable browsers.”

Mark Hughes:

So I hit upgrade, and I regret everything.

Obviously, this is the release where they break Safari Extensions, they now have to be apps. uBlock Origin is dead. I’ve installed Ghostery Lite for the moment but I have no real solution for the future[…]

[…]

Yeah, obviously I could change to another browser. But I hate every other browser.

Jeff Johnson:

There are 2 separate questions that are getting conflated:

1) Why did Apple deprecate the JavaScript API “canLoad” in favor of content blockers?

2) Why did Apple deprecate safariextz in favor of Safari app extensions?

Apple did 1 and 2, but they could have done 1 without 2.

The problem with 2 is that it limits the pool of extension devs to experts in both JS and AppKit. Very small pool.

Web devs don’t want to learn AppKit. Not even iOS devs want to learn AppKit. And Catalyst apps don’t support Safari extensions!

Jeff Johnson:

Apple: iPad is a real computer.

People: Real computers have browser extensions.

Apple: [kills most Safari Mac extensions] You were saying?

Catalin Cimpanu (via Hacker News, Slashdot):

Over the course of the last year and a half, Apple has effectively neutered ad blockers in Safari, something that Google has been heavily criticized all this year.

But unlike Google, Apple never received any flak, and came out of the whole process with a reputation of caring about users’ privacy, rather than attempting to “neuter ad blockers.” The reasons may be Apple’s smaller userbase, the fact that changes rolled out across years instead of months, and the fact that Apple doesn’t rely on ads for its profits, meaning there was no ulterior motive behind its ecosystem changes.

[…]

The latest to fall is uBlock Origin for Safari, another ad blocker, which shut down for good two weeks ago. In a post on GitHub, the extension’s developer recommended that users who care about running an ad blocker either switch to using Firefox for Mac, where ad blockers still work just fine, or remain on an older Safari version, which is not really an option.

The other alternative was that users switch to using one of the new Content Blocker-based ad blockers; however, he described the new Content Blocker system as being “extremley limited in adblocking functions.”

[…]

On the other side, when Apple rolled out the new Content Blocker API, it enforced a maximum limit of 50,000 rules for each new extension that wanted to block content inside Safari.

bad_user:

Safari’s content blockers are super easy to circumvent by anti-ad-blocking tech.

That many publishers don’t do that already is a mystery, probably because visitors with ad-blocking are still a minority and publishers don’t want to piss them off.

Will Lesieutre:

When Apple says “We’re designing this API in a way that allows you to block ads without having full visibility to monitor everything that any user does every web page they visit” it’s totally believable because it’s in line with the last 10+ years of their product direction.

Yeah, it makes ad blockers less powerful. It also makes them less of an enormous security risk in that all of your web traffic is redirected through them, and a compromised extension could do whatever it wanted with that.

Kuba Suder:

I don’t like the dropped support for old Safari extensions, because I will need to spend some time to look for a replacement for @Ghostery (the Lite isn’t as good)…

Previously:

What Time Machine Doesn’t Back Up

Apple:

You can use Time Machine, the built-in backup feature of your Mac, to automatically back up all of your files, including apps, music, photos, email, documents, and system files.

Maxwell Swadling:

Time Machine backups skip a bunch of files. Some you might expect, some might surprise you!

[…]

The Voice Memos iPad App On The Mac seems to exclude the one bit of data it is responsible for saving... recordings...

[…]

I covered in another blog post that the key Photos Photo Library database file is missing[…] Missing this and all its associated files needed to restore Photo Libraries without data loss.

I don’t use Photos enough to know what its database stores that isn’t in iCloud Photo Library. But print projects definitely don’t sync using iCloud, and they can represent a huge time investment. It looks like some project-related files do get backed up—maybe Photos is able to rebuild them into a new database?

But I would feel more comfortable with everything backed up and not relying on a potentially lengthy or buggy rebuild. Some other backup software will exclude files by default, but you can adjust the settings to manually include them. That’s not possible with Time Machine.

Maxwell Swadling:

I was genuinely surprised iCloud Drive wasn’t backed up because I think of time machine as having the “go back in time a year and see what the file was” feature, which doesn’t work on iCloud Drive files!

This sounded really bad to me, because iCloud Drive files don’t necessarily get stored in the cloud, either. Your Mac may not currently have a network connection, and sometimes uploads get delayed or wedged. Once in the cloud, the files are subject to beta bugs, and you have only a very limited ability to restore the latest version of individual files that it thinks you deleted.

But Howard Oakley says iCloud Drive does get backed up, and I do, in fact, see the files in my Time Machine backups.

Maxwell notes that Time Machine doesn’t back up folders which are found in iCloud Drive, but in my experience it’s not as simple as that. The rule seems to be that Time Machine does back up the contents of your current iCloud Drive, but only those items which are currently stored locally. Any items which have been evicted to iCloud, and are only represented by local stub files, aren’t backed up.

[…]

For Time Machine to be able to back up a file evicted to iCloud Drive, that file would need to be downloaded to local storage first. Imagine having a 512 GB internal SSD, and over a terabyte of documents in your iCloud Drive, almost all of which were evicted from local storage.

This makes sense and is probably the only reasonable thing for Time Machine to do. But, to me, it’s yet another reason to avoid the Optimize Mac Storage option. If your files in iCloud Drive are important enough to sync between devices, they’re probably important enough that you want to have your own backups of them.

Previously:

Update (2019-09-27): Jesse Squires:

Now that we sort of understand the layout of ~/Library/Mobile Documents/, where the hell are our iCloud Drive documents stored? Those live in com~apple~CloudDocs/. If you cd there, you should see all of the “custom”, non-app-specific files that you’ve stored in iCloud Drive. These should match what is viewable in Finder.

This is the directory that we want to backup. We can use rsync to do that. (Side note: the way that rsync handles paths is a bit odd. It doesn’t like relative paths, or ~, or escaping spaces in directory names. Thus, this script uses absolute paths with spaces.) You just need to fill-in the USER and DEST variables.

Update (2021-09-08): See also: Howard Oakley.

iPhone 11 Pro Display Tests

Raymond M. Soneira (via MacRumors):

The iPhone 11 Pro Max has an impressive Top Tier display with close to Text Book Perfect Calibration and Performance!

Based on our extensive Lab Tests and Measurements the iPhone 11 Pro Max receives our DisplayMate Best Smartphone Display Award earning DisplayMate’s highest ever A+ grade by providing considerably better display performance than other competing Smartphones.

[…]

OLED displays now have tremendous performance advantages over LCDs, so high-end and flagship Smartphones need OLED displays in order to compete at state-of-the-art performance levels, securing OLED as the definitive premier display technology for Top Tier Smartphones in the foreseeable future over the next 3-5 years. With the continuing improvements in OLED hardware performance, picture quality, and precision accuracy, it will be much harder for new display technologies to challenge OLED.

But OLED displays have problems with movement, and it seems their tests don’t cover that.

iPhone Drop Tests

Michael Potuck:

After Apple announced at its iPhone 11 event that its newest phones have the “toughest glass in a smartphone” it’s no surprise that we’re seeing that put to the test on launch day. The first drop tests show how the iPhone 11 Pro and iPhone 11 Pro Max fare from up to 11-foot drops on concrete.

So far we’ve got some drop tests from Tom’s Guide and YouTuber EverythingApplePro. The results from Tom’s Guide were disappointing as the iPhone 11 Pro cracked on the first drop. However, EverythingApplePro had a totally different experience with both Pro iPhones lasting over 8 drops each before the glass cracked.

Juli Clover:

According to SquareTrade’s Breakability Score tests, the new iPhone 11 and 11 Pro models had more durable glass and better handled small drops, but were still prone to shattering in major drops.

In a series of 6 foot drop tests conducted both face up and face down, all three of the iPhones broke and suffered damage of varying degrees. In a tumble test, though, where the iPhones are tumbled around in a metal cylinder, the new devices fared a bit better.

[…]

According to SquareTrade, the iPhone 11 Pro is the first iPhone that’s ever been able to survive the tumble test intact. SquareTrade says the iPhone 11 Pro is the “most durable iPhone” it’s tested in generations.

Lexy Savvides:

While neither of the phones cracked like we’ve seen in previous years, they didn’t emerge totally unscathed: The iPhone 11 Pro had some damaged pixels and the iPhone 11’s rear camera stopped working after our final drop.

Colin Cornaby:

Long ago I worked for a school district that drop tested Mac laptops to figure out how kids were breaking them. A lot of what we figured out is that gear doesn’t break like you think it does.

We were surprised when we had really good results from high drop distances, so much that it didn’t match with what we were seeing students do. But device damage isn’t necessarily based on height.

A drop from a very short height could damage the device significantly as long as it hit in just the right location. Corners are especially vulnerable, which is one reasons I suspect Apple has been rounding device corners more and more.

Már Másson Maack (via Ben Lovejoy):

Last year, photographer Haukur Snorrason was on an aerial photo tour of the Skaftá river in South Iceland to grab pictures of the yearly glacier river floods. Unfortunately, when he grabbed his iPhone [6s] to film the flood, the phone got swept away by a gust of wind. Falling 60 meters (200 feet) down on rocky terrain — where a massive river was overflowing and rupturing roads — the time came for Haukur to say goodbye to his phone forever – or so he thought.

Or so he thought, until 13 months later, when he received a phone call from people that had found his phone while hiking. After falling from a plane, and spending over a year exposed to the harsh Icelandic elements, it still worked!

Wednesday, September 25, 2019

Patent for Even Thinner MacBook Keyboard

Malcolm Owen (Hacker News):

In a patent published by the US Patent and Trademark Office on Tuesday titled “Keyboard assemblies having reduced thickness and method of forming keyboard assemblies,” Apple seeks to do just that.

In Apple’s filing, the company suggests the use of a single membrane sheet adhered directly to the printed circuit board (PCB). A switch housing can optionally be affixed directly to the membrane layer or to the PCB, sandwiched between the two, and a dome switch coupled directly on top to the membrane layer.

Generally the membrane is not typically attached to the PCB, but is used to help facilitate the closing of a connection, to trigger the key press. By attaching the membrane completely across the PCB, this eliminates any wasted space and brings the components closer together.

This sounds like it would offer less travel and make repairs more difficult.

Chrome Updater Bug Prevents Macs From Booting

Tim Hardwick (Avid, Hacker News):

Variety reports this morning of a possible computer virus attack or critical software failure affecting Mac Pro workstations across Los Angeles.

According to social media chatter, Hollywood Film and TV editors discovered late on Monday that “trashcan” Mac Pros running older versions of macOS and AVID’s Media Composer software were refusing to reboot after shutting down.

Mr. Macintosh (Hacker News):

After further investigation it was found that AVID was not the problem!

[…]

After investigation from some of the top minds in the MacAmins Slack Chat #varsectomy channel it was found that the Google Keystone Updater was at the heart of the issue.

Google:

We recently discovered that a Chrome update may have shipped with a bug that damages the file system on macOS machines with System Integrity Protection (SIP) disabled, including machines that do not support SIP. We’ve paused the release while we finalize a new update that addresses the problem.

[…]

To recover a machine that has been affected by this bug, please boot into recovery mode, and then from the Utilities menu open the Terminal application.

In the Terminal application, you can run the following commands[…]

Rich Trouton:

The now-pulled Keystone update attempts to remove the /var symlink, which is usually protected by Apple’s System Integrity Protection (SIP) security feature.

On Macs where SIP was disabled, this protection did not apply and the Keystone update was able to remove the /var symlink. This symlink is not a directory itself, but points to another directory (/private/var) which contains software necessary for the operating system to boot and function correctly, so removing the /var symlink rendered the affected Macs unbootable.

Update (2019-09-26): Jeff Johnson:

Something fishy with Google’s latest comment. Seems to be shifting the blame. Why act as if the updater doesn’t have root?

John Gruber:

Why in the world would a web browser’s software updater be doing anything at all at the root level of the boot volume? The arrogance and presumptuousness here boggles the mind. This is like hiring someone to wash your windows and finding out they damaged the foundation of your house.

The other question is why in the world so many users would disable System Integrity Protection. The answer seems to be that it’s the only way macOS will let the AVID customers use third-party video cards.

See also: Hacker News.

Update (2019-09-27): Jeff Johnson:

People: Why does a web browser installer need to modify the system?!?

Me: $ lsbom /System/Library/Receipts/com.apple.pkg.Safari13.0.1MojaveAuto.bom | grep /System/

Jeff Johnson:

The Google Keystone bug isn’t a justification for System Integrity Protection. In fact, if SIP didn’t exist, Google would most likely have noticed the bug before shipping it. So in a sense, SIP is partially to blame for the disaster.

This is true, but it doesn’t mean SIP was a bad idea. Rather, SIP is treating the symptoms rather than helping to identify the causes. It certainly could do more of the latter, e.g. if it maintained an audit log. I don’t mean the gigabytes of console spew that we currently get for SIP and sandbox violations. Instead, there should be a friendly window that concisely shows what each app was thwarted from doing. The Chrome developer—or even Chrome users—would be able to see at a glance that it tried to delete the /var folder 39 times and would then be able to ask why.

Jeff Johnson:

Every app outside the Mac App Store has to roll its own software updater. This is how we get software update problems. Apple has left this gaping hole in the system forever. Why is there no system process and API for 3rd party app updates?

It’s a totally obvious idea that could have been done 20 years ago. And it would be more helpful today in that updating sandboxed apps is harder. But it’s also kind of a strategy tax. Making life better for directly sold apps (and their users) would cost services revenue and reduce the value proposition of the Mac App Store.

Update (2019-10-13): To be clear, the Chrome updater only asked for root access if you enabled the option to Automatically update Chrome for all users.

The Business Side of Apple Arcade

Amanda Farough (via Dave Mark):

As it turns out, Apple is fronting development costs. This makes the relationship closer to a traditional publisher/developer deal. And Apple stepping in means these weird, interesting, oddball mobile games that might not have had a chance anywhere else have been given a platform that has the potential to house almost half of the world’s mobile market.

[…]

When a developer agrees to launch their never-released game on Arcade, Apple covers development and marketing costs, as well as providing technical expertise. This is part of how Arcade’s compensation works for developers, although Apple hasn’t provided any additional clarity as to the details of that revenue share or agreement. But we’ve learned that Arcade’s payment structure is consistent with how Apple approaches compensation with music, television, etc.

The most important thing that a developer needs to know is that because Apple doesn’t consider itself a publisher for Arcade (even though they do functionally act as a hybrid of platform holder, distributor, and publisher), developers retain the rights to their own games.

Eli Schiff:

Toxic Apple. If you cancel @AppleArcade free month trial subscription, you lose access the instant you cancel.

Unlike other apps which all let you continue access until the period is over, despite canceling.

Apple News+ does this, too.

Previously:

Update (2019-09-26): scott:

It’s absolutely unbelievable how many indie devs whose projects I’ve been following for years have had those games move to Apple Arcade.

Someone at Apple is doing amazing work, I’m actually a little jealous this is someone’s job.

Benjamin Mayo:

Apple’s marketing describes the Arcade library as a collection of “groundbreaking” titles that “redefine” games. I don’t get that feeling. The games are not really innovative, they are pretty standard. It’s almost like putting the Steam indie catalogue on your phone. I haven’t seen any Arcade game so far that surprised me with an innovative premise. I don’t care. I like that the games are new releases, offering new content, and I like that they are fun. Being “groundbreaking” is not what interests me.

Update (2019-09-27): Juli Clover:

Less than two weeks later, Google announced its own gaming service called Play Pass, which also offers unlimited access to games. In our latest YouTube video, we went hands-on with both services to compare them.

Both Apple Arcade and Play Pass are priced at $4.99 per month. Apple offers a one-month free trial while Google offers a 10-day free trial, but for the first year, Google is offering a deal that drops the price of Play Pass to $1.99 per month.

Update (2019-10-13): Michael Love:

The big question is if they’ll be able to keep up this pace - 200-300 new titles a year - long term, or if they’re just flushing out launch titles and the rate will drop once they’ve released their initial slate.

If Apple can release 5 new games every week forever then Arcade will potentially swallow almost the entire iOS gaming market.

And honestly that’s not inconceivable; 10 million subscribers = $600M/year, which could easily bankroll 200 games. 100 million = $6B/year and with that kind of money you can pretty much fund any talented developer who wants to make an iOS game.

watchOS 6 Review

Alex Guyot:

This is a year for iteration, and Apple has been iterating on all cylinders. watchOS 6 is a quiet giant, adding or redesigning more first-party apps at once than we’ve seen in years, dropping the largest batch of new watch faces since watchOS 1, providing a new way to track fitness over time, and kicking off a nascent foray into Apple Watch independence.

Previously:

iOS 13 Full Access Keyboard Extensions Bug

Apple (Hacker News):

Third-party keyboard extensions in iOS can be designed to run entirely standalone, without access to external services, or they can request “full access” to provide additional features through network access. Apple has discovered a bug in iOS 13 and iPadOS that can result in keyboard extensions being granted full access even if you haven't approved this access.

Previously:

Update (2019-09-27): Mark Gurman:

iOS 13.1.1 is out: restore, battery life, Siri, Safari search, Reminders bug fixes + repairs the third party keyboard security issue.

iOS 13 and 13.1

Federico Viticci:

For the first time since I started reviewing Apple’s annual iOS updates, it feels like the company is now keenly aware that a new iOS version has to cover an array of themes that can’t be pushed back for scheduling reasons.

[…]

As a result, there’s something for everyone in iOS 13 and all the recurring themes of Tim Cook’s Apple are touched upon this time around.

[…]

From this standpoint, there are two sides to iOS 13: on one hand, an underlying tide that raises all platforms, featuring a distillation of themes Apple comes back to on an annual basis; on the other, a fork in the road, opening a new path for the iPad’s next decade.

Samuel Axon:

Apple hasn’t tempered expectations for iOS 13 this year, so users might be expecting a big leap forward. iOS 13 does bring a new look to the software that runs on iPhones, overhauls a few oft-criticized first-party applications, and puts additional emphasis on user privacy. Most of all, it adds new, powerful interactions for power users—some of which we thought we’d never see in Apple’s mobile software.

iOS 13 is successful at most of what it sets out to do, even though it leaves some things that users have wanted to see overhauled—like the home screen—relatively untouched.

Apple (Hacker News, video):

Part of the magic of iPad is that almost anything can be done with Multi-Touch using simple, intuitive gestures. And now iPadOS makes it easier and faster to select and edit text using just your fingers.

Copy, paste, undo, and more with simple new gestures.

Lauren Goode:

Something atypical for Apple is iOS 13’s notably buggy rollout.

John Gruber:

13.0 is really buggy — I’ve been using it on my iPhone 11 review units.

[…]

Best theory I’ve seen so far as to why Apple is going ahead with a wide 13.0 release instead of just waiting until next week for 13.1 — Apple Watch Series 5 requires iOS 13 on the iPhone it’s paired with. So people getting new watches tomorrow need to update their iPhone to iOS 13 tomorrow. This raises the question of why Apple didn’t delay the release of the Series 5 watches until iOS 13.1 was out.

Lauren Goode:

iOS 13.1, the next (and presumably more stable) version of the software will ship September 24, not September 30 as previously expected & reported.

Marco Arment:

Software quality is not important enough to delay the release of the iPhone.

It’s not the way we may want it to be — and not the way THEY probably want it to be — but that’s the way it is.

Buck:

I wish they would uncouple iOS releases from iPhone releases - at least occasionally - so we could have a longer cycle of focusing on fixing existing issues. Each new release just starts over a new round of “never really fixed” problems.

See also: Steve Troughton-Smith.

Marcel Weiher:

Well that was special: my SE with fresh install of iOS 13 just drained its battery from 100% to 20% in about 8 minutes, so 10% per minute. Impressive!

You could basically watch the percent indicator go down.

Marcel Weiher:

Wow! Apple’s Reminders app was always pretty useless. In [iOS 13], it is actively hostile, “upgrading” the calendars, and thus deleting them from every other app.

Mattt Thompson:

Although the lion’s share of attention has been showered on the aforementioned features, not nearly enough coverage has been given to the rest of iOS 13 — and that’s a shame, because this release is among the most exciting in terms of new functionality and satisfying in terms of improving existing functionality.

So to mark last week’s release of iOS 13, we’re taking a look at some obscure (largely undocumented) APIs that you can now use in your apps.

Josh Centers:

Personal automations let you do things like start playing a particular playlist whenever you open a certain app, dim the screen brightness when Low Power Mode turns on, or turn off your cellular data connection when you connect to your home Wi-Fi network.

[…]

iOS 13.1’s new audio sharing feature lets two pairs of AirPods listen to audio from a single device. (This feature also works with Beats earbuds and headphones powered by Apple’s W1 or H1 chip.) The “broadcast” device needs to be relatively recent, like an iPhone 8 or later. While one iOS 13.1 device is playing audio, place another iOS 13.1 device paired with a second set of AirPods or the like nearby to see an option to share audio.

[…]

Even after the release of iOS 13.1, some promised iOS 13 features are still missing and continue to be promised for later this year, perhaps in iOS 13.2 or later.

Jeff Hunter:

Guess what, the navigation bar / search controller bug introduced in the iOS 13.1 betas has not been fixed in 13.1 GM!

I’m waiting for at last another release.

Max Seelemann:

Xcode 11 GM2 broke localization of static take view cells in storyboards. 😞 (FB7302304)

Anybody know when this is traditionally going to be fixed? Also when do we get iOS 13.1 Simulators? Anybody ever test this?

Marcin Krzyzanowski:

How fucked up must be the schedule, that something like this goes in the release. Release that is already delayed.

Previously:

Update (2019-09-26): Daniel Terhorst-North:

Ok now I’m cross. #iOS13 update has broken all kinds of things on my iPhone XS. The worst, the absolute worst, is it has removed all my contacts’ numbers and placed a note in each contact saying:

none = [the deleted number]

[…]

Update: and also copied some phone numbers to other contacts, so now the phone can’t tell who is calling. You couldn’t make these bugs up @Apple !!

Chris Liscio:

PSA: If you lost stuff in your iCloud Drive during the Catalina / iOS 13 betas, get yourself over to http://icloud.com/settings, and use the “Restore Files” link (under Advanced) to get your stuff back. I was ~10 days away from losing almost 800 files, myself!

Monday, September 23, 2019

Sending E-mail for Sign in With Apple

Manton Reece:

Apple’s private email relay server is almost completely undocumented. In this blog post I’ll describe how I got it working.

The key issue is that the “return path” of your emails must be using a subdomain that can be verified by Apple. This blog post from SendGrid describes the solution in detail.

[…]

Upload the apple-developer-domain-association.txt file from Apple to the new subdomain web site. Wait a few extra minutes to make sure the DNS has changed before clicking Verify at Apple.

Previously:

Update (2019-09-25): Curtis Herbert:

For Slopes this is sitting at 75% of users opting to use the email relay.

Intelligent Tracking Prevention 2.3

John Wilander:

By limiting the ability to use any script-writeable storage for cross-site tracking purposes, ITP 2.3 makes sure that third-party scripts cannot leverage the storage powers they have gained over all these websites.

[…]

Our research has found that trackers, instead of decorating the link of the destination page, decorate their own referrer URL and read the tracking ID through document.referrer on the destination page.

ITP 2.3 counteracts this by downgrading document.referrer to the referrer’s eTLD+1 if the referrer has link decoration and the user was navigated from a classified domain. Say the user is navigated from social.example to website.example and the referrer is https://sub.social.example/some/path/?clickID=0123456789. When social.example’s script on website.example reads document.referrer to retrieve and store the click ID, ITP will make sure only https://social.example is returned.

[…]

Safari on macOS Catalina now has ITP Debug Mode.

[…]

Our blog post on ITP 2.1 provided guidance on how to protect cookies. We specifically encourage the use of Secure and HttpOnly cookies.

Previously:

Swift 5.1 Released

Ted Kremenek:

Swift 5.1 builds on the strengths of Swift 5 by extending the stable features of the language to compile time with the introduction of module stability. With module stability it’s now possible to create and share binary frameworks that will work with future releases of Swift. Swift 5.1 also extends the capabilities of the language and the standard library with new features such as property wrappers, opaque result types, key path member lookup, diffing for appropriate collection types, and new APIs for String. Altogether the new features of Swift 5.1 make it easier to design better APIs and reduce the amount of common boilerplate code.

John Sundell:

While that’s still possible, the scope of Self has now been extended to also include concrete types — like enums, structs and classes — enabling us to use Self as a sort of alias referring to a method or property’s enclosing type, like this[…]

Note that this is just syntactic sugar. It’s not like instancetype in Objective-C.

Previously:

Update (2019-09-24): As Joe Groff notes, I misinterpreted Sundell’s comments about Self. It doesn’t refer to the lexically enclosing type, but rather to the dynamic type. So, when used in an expression, it’s like type(of: self):

class Base {
    class func printClass() {
        print("Base")
    }
    
    func selfPrintClass() {
        Self.printClass()
    }
}
class Derived: Base {
    override class func printClass() {
        print("Derived")
    }
}
Derived().selfPrintClass() // prints Derived

This will be useful when calling helper functions from initializers.

His comment that it’s “purely syntactic sugar” only applies to this use of Self. When used to specify the return type, Self is not a mere substitution of the current class name. Instead, it refers to the type of the object (not the type that the method was defined on). So it’s just like instanceof in Objective-C. And you can similarly use it to declare factory methods, in which case Swift will require you to implement them in terms of required initializers:

class Base {
    required init() {} // must be provided unless Base is final

    class func make() -> Self {
        return Self.init()
    }
}
class Derived: Base {}
Base.make() // makes a Base
Derived.make() // makes a Derived

So, Self is really cool, and it can now be used in many more places than before. It’s still not allowed as a parameter type, though. I have a case where I want to ensure that a method has a parameter of the receiver’s own type. I wasn’t able to do this with Self, but I found a workaround using a protocol with an associated type.

Thursday, September 19, 2019

APFS Enumeration Performance on Rotational Hard Drives

Mike Bombich:

My APFS-formatted rotational disks have always felt slower than when they were HFS+ formatted. The speed of copying files to them felt about the same, but slogging through folders in the Finder was taking a lot longer. At first I shrugged it off to the filesystem being new; “It just needs some tuning, it will come along.” But that performance hasn’t come along, and after running some tests and collecting a lot more data, I’m convinced that Apple made a fundamental design choice in APFS that makes its performance worse than HFS+ on rotational disks. Performance starts out at a significant deficit to HFS+ (OS X Extended) and declines linearly as you add files to the volume.

[…]

After the very first simulation, APFS starts at a deficit — APFS takes three times as long to enumerate a million files on a rotational disk compared to HFS+ enumerating the exact same collection of files on the exact same hardware. This result on its own is staggering. As you add and remove files from the volume, however, the performance continues to decline. After just 20 cycles, APFS enumeration performance is 15-20 times worse than HFS+ performance.

This seems to be because it doesn’t keep the filesystem metadata contiguous.

Previously:

Scanbot Goes Freemium

doo (tweet):

To start with the most important point: none of our users gets taken away something they have had before. That means that every feature that was unlocked by purchasing the ‘Scanbot Pro’ upgrade before the release of Scanbot 9 will stay valid and every unlocked feature will remain available.

[…]

We provide a lot of functionality for very little money: In the most extreme case, a user that bought Scanbot Pro in 2014 for as little as 0.99$ has enjoyed 9 fully featured major versions with over 400 internal builds of Scanbot.

[…]

Just additional new features that will be released from now on will only be unlocked with the subscription.

It’s $22.49/year, whereas it used to be $7 one-time. They offered me the first year for $4.49, since I’d purchased before.

Via Greg Hurrell:

The thing about a scanner app is it’s a bit like a screwdriver: you want it to do one thing, and once you have a tool that does that thing well you’re pretty much happy with it as-is. You don’t want to be locked into a a recurring payment contract just to keep screwing in screws.

The developers make the argument that a subscription model will allow them to keep working on the product. Sure it will, but it misses the point: people don’t need or want them to endlessly evolve an already-working screwdriver.

[…]

Sadly, I don’t think I’ve ever seen a small subscription based app that justified its ongoing costs: no number of pointless “bug fixes and performance improvements” releases will deliver me any perceptible value

Maybe the plan has changed since he updated, but as described it sounds like a win-win. If you don’t want the extra features, you get the basic stuff at no additional charge, forever. You can also buy certain features through one-time IAPs.

But he raises a good point about screwdriver apps. Some apps just don’t need a stream of new features, but all apps need maintenance. How do you fund that? Relying entirely on new customers doesn’t seem like a good plan. In theory, a very cheap subscription would be fair to both sides. But I haven’t seen that done. One issue is how to get your installed base to subscribe if you’ve already delivered the features they want. Another is that even if the subscription is cheap, a lot of customers will search for any non-subscription alternative. So the math no longer works, and you need a much more expensive subscription.

Previously:

Update (2019-09-27): Penbook tried the $1/year subscription.

Update (2019-10-04): Riccardo Mori:

Speaking as a customer, this drive towards subscriptions is killing my interest in looking for new apps for my iOS devices.

[…]

One of the main reasons developers constantly bring up to justify their switch to a subscription model is that subscriptions are needed to fund the continued development (or maintenance) of their apps. Okay. Do you know what more than a few regular folks have told me about this? That it sounds like a poor excuse. They have been updating the app so far without subscriptions, what exactly has become so expensive all of a sudden?

I have wondered that, too, and the answer seems to be that (for lots of apps) times have changed because growth slowed. So the older purchasers had been in effect getting free updates subsidized by newer purchasers. I also think a lot of developers were counting on Apple to eventually make paid upgrades work with the App Store. Instead, they added subscriptions.

John Voorhees:

I suspect the growth from new users was enough to keep things going for quite a while. Of course that’s not sustainable though.

Ryan Jones:

As always, John nailed it.

In 2013 it looked like growth for $3-5 apps was unbounded.

Wednesday, September 18, 2019

IAP Using Audible Credits

App Store Review Guidelines:

3.1.1 In-App Purchase:

If you want to unlock features or functionality within your app, (by way of example: subscriptions, in-game currencies, game levels, access to premium content, or unlocking a full version), you must use in-app purchase. Apps may not use their own mechanisms to unlock content or functionality, such as license keys, augmented reality markers, QR codes, etc. Apps and their metadata may not include buttons, external links, or other calls to action that direct customers to purchasing mechanisms other than in-app purchase.

[…]

3.1.3(a) “Reader” Apps: Apps may allow a user to access previously purchased content or content subscriptions (specifically: magazines, newspapers, books, audio, music, video, access to professional databases, VoIP, cloud storage, and approved services such as classroom management apps), provided that you agree not to directly or indirectly target iOS users to use a purchasing method other than in-app purchase, and your general communications about other purchasing methods are not designed to discourage use of in-app purchase.

3.1.3(b) Multiplatform Services: Apps that operate across multiple platforms may allow users to access content, subscriptions, or features they have acquired elsewhere, including consumable items in multi-platform games, provided those items are also available as in-app purchases within the app.

And yet it looks like you can now purchase audiobooks in-app, using Audible credits.

Steve Moser:

Wow, Apple must have changed its stance on using credits in iOS apps not bought through IAP. What will we see next — using coins in iOS games that were not bought through IAP?

You can’t always directly buy credits for money:

If you’ve run out of credits for your Gold/Platinum monthly or annual Audible membership before your renewal, occasionally a special offer will appear where you can purchase additional credits at a discounted rate.

But this does seem like a significant change that could be applied to other types of content.

Previously:

Pocket Casts Goes Freemium

Morgan Wynn (via Jeff Perry, Hacker News):

Starting today, podcast fans all over the world can download Pocket Casts for free. Known for its beautiful design and robust set of controls, Pocket Casts is making the entirety of its existing features available at no charge. Power users looking for even more customization can upgrade to Pocket Casts Plus for USD$0.99 per month (USD$10/year). With these changes, we are now more closely aligned with the open-access model of our public media ownership.

[…]

Pocket Casts Plus, for those power listeners looking for even more control, offers:

  • Desktop apps including macOS, Windows and Web apps
  • Cloud storage for creators and listeners who want to use Pocket Casts for all of their audio and video files
  • Exclusive app icons and themes

The other way of looking at this is that some stuff that was previously covered with a one-time $9 payment is now under a $10 subscription. You get a three-year credit if you had previously paid.

Previously:

Update (2019-09-27): Owen Grover (tweet):

Although we intended to demonstrate our appreciation to our most loyal users, we know many of you feel we missed the mark. With that in mind, today we’ve decided to provide any user who previously purchased our Web version with lifetime access to Pocket Casts Plus. This includes the Mac and Windows apps as well. No renewal, no monthly charge, no questions asked.

Serializing Heterogenous Arrays With Codable

Nick Lockwood:

Something I’ve spent time on recently is the problem of serializing heterogenous arrays (arrays containing multiple types) in Swift using Codable.

Here’s a pattern I’ve found that works pretty well, using a protocol and a type-erased wrapper.

Normally in Swift you do polymorphism by either using a protocol or an enum (for open or closed sets, respectively). This approach requires you to use both, which is slightly odd, and it inherently only supports closed sets, but it’s relatively little code to add new cases.

[…]

The other disadvantage is that containing types must use Array<AnyFoo> rather than Array<Foo>, otherwise they can’t use automatic Codable synthesis.

This is necessary because, unlike NSCoding, Codable does not store the type information in the archive. It has to be provided when decoding.

Drew McCormack:

I used a similar approach when messing with genetic programming last year. Began with a switch like you, but in the end went to a dictionary mapping of types.

Ian Keen:

If the underlying format doesn’t matter I have a fairly nice generic solution here.

the DecodingRoutine is just a wrapper around Decodable.inits that you’d normally create specific boxes for. And the ones I’ve provided take advantage of the fact AV cases without values are functions

Tuesday, September 17, 2019

iPhone 11 Reviews

John Gruber:

My biggest problem is that I wrote this review last year. I re-read my review of last year’s iPhones XS (regular and Max) and at almost every single paragraph I found myself wanting to say the exact same thing again this year. Not that these phones are the same as last year’s phones, but that the year-over-year improvements are equally impressive and at times mind-boggling.

[…]

The bad news is, Haptic Touch is a bit slower. With 3D Touch, when you pressed, the action was instantaneous. With Haptic Touch, because it’s sort of a long press with pressure, there’s a very brief pause before it fires. […] The iPhone 11 Pro and Pro Max have bigger batteries than their XS counterparts, using the space freed up by omitting 3D Touch.

[…]

Another bit of magic. There are two new options in Settings → Camera: “Photos Capture Outside the Frame” (off by default) and “Videos Capture Outside the Frame” (on by default). When these options are turned on, when you shoot with the 1x or 2x lenses (wide or telephoto), the Camera app will use the next widest lens to capture additional footage outside the frame of the lens you’re shooting with. In post, this allows you to rotate the photo or video — typically, to fix a crooked horizon — without cropping.

[…]

QuickTake seems the closest to marketing spite, by which I mean this is such a great idea that I really think it ought to be part of the Camera app for all iPhones running iOS 13.

Matthew Panzarino:

Phone 11’s Night Mode is great. It works, it compares extremely well to other low-light cameras and the exposure and color rendition is best in class, period.

Nilay Patel:

These are some of the most well-balanced, most capable phones Apple — or anyone — has ever made. They have excellent battery life, processors that should keep them relevant for years to come, absolutely beautiful displays, and a new camera system that generally outperforms every other phone, which should get even better with a promised software update later this fall.

[…]

My iPhone 11 and 11 Pro review units are running iOS 13.0, and iOS 13.0 is pretty damn buggy. I saw all kinds of glitches and crashes during my week of testing, as did Verge executive editor Dieter Bohn with his iPhone 11 review unit running iOS 13.

Rene Ritchie:

Apple says the batteries on the iPhone 11 Pro and iPhone 11 Pro Max will last — wait for it — 4 and 5 hours longer than last year’s iPhone XS and XS Max. And no, that’s not a typo. I checked. Thrice: Up to 18 hours of local video playback for the Pro and 20 for the Max, 11 hours and 12 hours of video streaming, and 65 and 80 hours of wireless audio.

[…]

Water resistance has improved on the Pro models as well. The XS was already IP68 and rated for up to 30 minutes at up to 2 meters. The Pros will go all the way down to 4 meters, though.

[…]

Apple's latest, greatest system-on-a-chip, the A13 Bionic, manages to be both faster and less power hungry at the same time. 20% faster across the efficiency, performance, graphics, and neural engine cores, and 40, 25, 30, and 15% less power hungry respectively.

Michael Love:

N.B.: the highest Geekbench 5 single-core score for any Mac is 1262. (2019 iMac 3.6) So the iPhone 11 now offers the fastest single-core performance of any computer Apple has ever made.

Sebastiaan de With:

The biggest notable change across the board this year is what we already teased: the max ISO of the sensors has gone up significantly. The Wide camera’s maximum ISO sensitivity is up 33%; the telephoto 42%!

See also: MacRumors, MacStories.

Previously:

Update (2019-09-19): Austin Mann (Hacker News):

Of course, I’ve also been anxious to see what this Ultra Wide lens can do, so shortly after the performance I popped out to the countryside to find some epic landscapes and have been out exploring this big, beautiful country ever since.

Update (2019-09-25): John Gruber:

Is there a setting to make holding down the shutter shoot a burst instead of video? No, there is no setting for this. There should be, though.

See also: Joanna Stern, Brian X. Chen, John Gruber.

Juli Clover:

According to iMore’s Rene Ritchie, bilateral inductive charging wasn’t pulled from the iPhone 11 because it was never slated for production to begin with. Ritchie says there is no hardware in iPhone 11 models that would allow such a feature to be enabled later.

Matt Birchler:

Given the leaks and the marketing images, I was not prepared for how small the camera bump would be on the 11 Pro.

Rene Ritchie:

There’s a new Night King in town. At least that’s what some people are saying. As usual, Apple wasn’t first to computationally enhanced low light photography, just like they weren’t first to multiple cameras or depth effects, or even phones at all.

Now that they are, they’re doing it in typical Apple style. It doesn’t do everything. You can’t force it on manually. You can’t use it with the focus-pixel-free ultra-wide-angle. But what you can do, you can do well. With good detail recovery, texture preservation, and tone mapping.

In a really opinionated, maybe even controversial way.

Ryan Cash:

From left to right:

iPhone 5
iPhone 6
iPhone XS
iPhone 11 Pro

Handheld and unedited.

Jay Freeman:

I just spent an hour using an iPhone to take videos of iPhones taking video of an iPhone (with a fifth iPhone to take a video of the rest) to verify this: the iPhone 11 Pro Max on iOS 13 has an additional 50-66ms of latency in its camera preview vs. the iPhone XS Max on iOS 12.4.

[…]

I did this as I was having a subtle-yet-annoying feeling of motion sickness using the iPhone 13 Pro Max camera that I have never experienced with an iPhone before and wanted to be 100% sure I wasn’t making it up; a 100ms input latency was already “pushing it”: 166ms is “too far”.

Gannon Burgett:

Not all of the cameras are made equal though. In addition to not having optical image stabilization, it’s been revealed the ultra-wide camera unit on all three models isn’t yet capable of capturing Raw image data or manual focus, unlike the wide-angle camera (and telephoto camera on the iPhone 11 Pro models).

Nick Heer:

These are curious limitations that put the ultra-wide camera on a similar level to the fixed-focus front-facing camera that only captures compressed image formats. It’s expected on the front, but a little disappointing for a back-mounted camera, especially as the other cameras don’t have these restrictions, so it’s a little inconsistent.

Update (2019-09-26): See also: Samuel Axon and Juli Clover.

Update (2019-10-04): John Gruber:

0.5× always uses the ultra-wide camera, because you can’t get that field of view otherwise. 1× always uses the wide angle, because that camera has the best sensor and fastest lens. But 2× doesn’t mean you’re always using the telephoto camera — in low light it will use the wide-angle camera and digital zoom. Previous iPhones with dual camera systems have done the same thing in low light conditions, but a lot of us — myself included — made the wrong assumption about Night Mode and “2× zoom”.

It occurs to me that this is why Apple has been somewhat obfuscatory about Night Mode working only with the regular wide angle camera, despite being very forthcoming about explaining other technical details (like Deep Fusion) at great length: it means the iPhone 11 can shoot the exact same “2×” Night Mode shots as the iPhone 11 Pro, because on both phones 2× Night Mode shots are cropped and digitally zoomed from the 1× camera sensor.

Update (2019-10-18): John Gruber:

“HD” video is usually 1920 × 1080, but Quick Video shoots 1920 × 1440 because it always records with a 4:3 aspect ratio. That’s not what I expected, but you don’t lose anything — the 1920 × 1080 image recorded by default in the “Video” mode is a 16:9 center crop of the 4:3 sensor.

Breaking the NSData.description Contract

Mattt Thompson (tweet via Cédric Luthi):

iOS 13 changes the format of descriptions for Foundation objects, including NSData:

// iOS 12
(deviceToken as NSData).description // "<965b251c 6cb1926d e3cb366f dfb16ddd e6b9086a 8a3cac9e 5f857679 376eab7C>"

// iOS 13
(deviceToken as NSData).description // "{length = 32, bytes = 0x965b251c 6cb1926d e3cb366f dfb16ddd ... 5f857679 376eab7c }"

Whereas previously, you could coerce NSData to spill its entire contents by converting it into a String, it now reports its length and a truncated summary of its internal bytes.

[…]

Was Apple irresponsible in making this particular change?

No, not really — developers shouldn’t have relied on a specific format for an object’s description.

The documentation promises—still, as of this writing—that description returns:

A string that contains a hexadecimal representation of the data object’s contents in a property list format.

Perhaps it would be a mistake to rely on the exact format of the string, e.g. where the spaces are inserted. But, clearly, it is supposed to contain the entire data’s contents, in a format that can be reconstituted by the property list API. That is no longer the case, and the fault for any resulting breakage lies with Apple, not with developers who were relying on the API to do what it said it would do.

Apple hasn’t explained why it made the change, or even documented it in the release notes. In fact, there don’t even seem to be Foundation release notes yet.

Previously:

Update (2019-09-17): Joe Groff:

It doesn’t break anything until you build with Xcode 11. The new behavior is based on the linked SDK version, so existing binaries keep working. If you want to upgrade your Xcode, you need to fix your code, though

Cédric Luthi:

Haha, I remember thinking “why did they introduce -UUIDString and not just used -description” for that purpose. Turns out, Apple thought about it too and changed the implementation of -[NSUUID description] in recent OS versions.

Seems like they should have provided a similar replacement on NSData for people relying on the old format.

Update (2019-09-18): Peter Steinberger:

Took the time to decompile [NSData description] on iOS 13 GMv2 and can verify that Apple did the sensible thing here: output only changes if linked SDK is > 12. Existing apps continue to work (forwards to debugDescription) once you adopt Xcode 11 they need to be fixed tho.

See also: this thread.

Update (2019-12-23): Sarah Edwards:

Anyone know how to make Xcode/plutil to stop truncating BLOBs? Seems to have started with macOS 10.15. Previously could see entire BLOB and export to hex editor, etc. Would prefer not to have to use 3rd party or conversion. This is driving me crazy.

This seems to be consequence of the change to NSData.

The Internet Relies on People Working for Free

Owen Williams (tweet):

But when software used by millions of people is maintained by a community of people, or a single person, all on a volunteer basis, sometimes things can go horribly wrong. The catastrophic Heartbleed bug of 2014, which compromised the security of hundreds of millions of sites, was caused by a problem in an open-source library called OpenSSL, which relied on a single full-time developer not making a mistake as they updated and changed that code, used by millions. Other times, developers grow bored and abandon their projects, which can be breached while they aren’t paying attention.

[…]

Survival of cURL is thanks to a set of sponsors who fund the project’s hosting and other costs — though Stenberg says no major company pitches in — and contributors like Stenberg that give their time away for free. Stenberg says he believes that it’s important that open source exists and that he has never regretted making cURL open source. What frustrates him is when companies demand his help when things go wrong.

Last year, a company overseas contacted him in a panic after they paused a firmware upgrade rollout to several million devices due to a cURL problem. “I had to explain that I couldn’t travel to them in another country on short notice to help them fix this […] because I work on cURL in my spare time and I have a full-time job,” Stenberg says.

[…]

When Stenberg asked the company that needed him to fly to a different country to troubleshoot their problem to pay for [a support contract], they refused.

Previously:

Update (2020-01-30): See also: Igal Tabachnik.

Apple Tweaks Rules for Children’s Apps and Sign-in

Matthew Panzarino:

The changes announced at Apple’s developer conference in the summer were significant, and raised concerns among developers that the rules could handicap their ability to do business in a universe that, frankly, offers tough alternatives to ad-based revenue for children’s apps.

[…]

Both of those rules are being updated to add more nuance to their language around third-party services like ads and analytics. In June, Apple announced a very hard-line version of these rule updates that essentially outlawed any third-party ads or analytics software and prohibited any data transmission to third-parties. The new rules offer some opportunities for developers to continue to integrate these into their apps, but also sets out explicit constraints for them.

[…]

Third-party contextual ads may be allowed, but only if those companies providing the ads have publicly documented practices and policies and also offer human review of ad creatives. That certainly limits the options, including most offerings from programmatic services.

[…]

Sign in with Apple will not be required in the following conditions[…] Most of these were sort of assumed to be true but were not initially clear in June.

It’s hard to write good rules.

Jacob Eiting:

I only wish they had done this in the first place. If they had talked to the top 20 apps in the Kids category beforehand, they would have realized what a mess an ambiguous ban was going to be.

But, props to them for listening and changing course.

Previously:

Google’s Privacy Sandbox

Justin Schuh:

First, large scale blocking of cookies undermine people’s privacy by encouraging opaque techniques such as fingerprinting. With fingerprinting, developers have found ways to use tiny bits of information that vary between users, such as what device they have or what fonts they have installed to generate a unique identifier which can then be used to match a user across websites. Unlike cookies, users cannot clear their fingerprint, and therefore cannot control how their information is collected.

This has been criticized unfairly, I think. Mass cookie blocking really did start an arms race that led to fingerprinting. And now we can’t turn back the clock to when the old privacy techniques worked. He’s not saying that turning off cookie blocking will improve your privacy; it’s a comment on the second order effects of everyone blocking them.

Second, blocking cookies without another way to deliver relevant ads significantly reduces publishers’ primary means of funding, which jeopardizes the future of the vibrant web.

This part is also disputed, the implication being that advertisers are vastly overpaying for targeting that doesn’t actually work. I suppose that’s possible, but I don’t find it intuitive.

We want to find a solution that both really protects user privacy and also helps content remain freely accessible on the web. At I/O, we announced a plan to improve the classification of cookies, give clarity and visibility to cookie settings, as well as plans to more aggressively block fingerprinting. We are making progress on this, and today we are providing more details on our plans to restrict fingerprinting. Collectively we believe all these changes will improve transparency, choice, and control.

Bennett Cyphers:

But hidden behind the false equivalencies and privacy gaslighting are a set of real technical proposals. Some are genuinely good ideas. Others could be unmitigated privacy disasters. This post will look at the specific proposals under Google’s new “Privacy Sandbox” umbrella and talk about what they would mean for the future of the web.

Of course, none of this is to say that Google isn’t also doing all sorts of stuff to track you.

Previously:

Monday, September 16, 2019

Faster Xcode Rename Refactoring

Daniel Martín:

Tip: If you use the rename refactoring in Xcode a lot, you can save some time by skipping the code folding animation:

defaults write com.apple.dt.Xcode CodeFoldingAnimationSpeed -int 0

I’ve tended to do it manually with Find/Replace, both because the animation was so annoying and because the refactoring would often fail with an error or not actually find all the occurrences. With this default and Xcode 11, I’m going to start trying it again.

Previously:

Recreating Mac Desktop Picture Photos

Oliver Haslam:

Have you ever wondered where your Mac’s macOS wallpaper was taken? Sure, we know roughly where, but do you want to know exactly where those iconic shots were captured? YouTuber Andrew Levitt apparently did. So he set about tracking down the location of each macOS wallpaper along with photographer Taylor Gray and videographer Jacob Phillips.

The result is a 13-minute video showing their escapades as they attempted to recreate the images we’ve been seeing on Mac desktops for years.

The video is here.

Update (2019-11-27): Stephen Warwick:

YouTuber Andrew Levitt and two friends, Jacob Phillips and Taylor Gray have teamed up in their latest attempt to recreate Apple’s default macOS wallpapers, this time taking a stab at the iconic shot of Catalina island from macOS Catalina.

TextMate 2.0

Allan Odgaard (via David Heinemeier Hansson, Hacker News):

After far too long, there is no longer any qualifier suffix in the version string, so it is now finally just “TextMate 2.0”

[…]

Not everything on the wishlist made it into 2.0, but TextMate remains a work in progress, so don’t despair :)

Congratulations are definitely in order after so many years of development. It is apparently a free update. There are tons of changes listed, but unfortunately they aren’t (yet?) organized in a way that’s very helpful for those who haven’t been using the app and following along with its development. In any case, it’s great to see continued development of native Mac text editors.

jacobolus:

Allan had been making very fast progress on TextMate for the first several years, and the community was full of excited “early adopter” types, who were very chatty and supportive, and were actively engaged in improving the TextMate language “bundles”, trying out new features, etc. I found the ##textmate IRC channel at the time to be the best place to get technical help with pretty much any programming language.

Then at some point Allan decided that he had made some suboptimal design choices in pretty much every component of TextMate 1, and wanted to improve those with new designs. But he thought it would take more work to incrementally swap new parts in that were compatible with all of the other stuff he wanted to eventually replace, so he started in on what was a substantial rewrite of everything.

That (a) took away his incremental improvement of TextMate 1, (b) took his time away from being as responsive to user questions/ideas, (c) caused bundle authors to slow down on improvements to TM1 bundles while they waited to see what new features TM 2 had in store.

At the same time, the creation of an “insider” IRC channel took away some of the activity from the main IRC chat, the migration from one big SVN repository to a bunch of separate per-language Git repositories damped a lot of the bundle development activity as people were no longer exposed to every change to every bundle, so the bundles didn’t cross-pollinate as much.

Previously:

Notarization Provider IDs

Daniel Jalkut (tweet):

The steps for automating notarization involve running the “altool” command from Terminal. Everything in the guide linked above should work perfectly unless you’re a member of more than one development team. If you have more than one team associated with your Apple ID, the back-end at Apple doesn’t know which one it should notarize on behalf of.

[…]

All that said, here is a surefire list of steps for obtaining your ITC Provider ID, or as it’s described in the altool man page, your ASC Provider Shortcode.

  1. Create a new App-Specific Password from your Apple ID management page.
  2. From Terminal, invoke iTMSTransporter with the following options: 
    xcrun iTMSTransporter -m provider -u <yourAppleID> -p <yourAppSpecificPassword>
  3. At your discretion, revoke the App-Specific Password you created for this process.

It seems to be my name concatenated with the old “person number” for my developer account.

See also: Notarizing Your Flash/Air Applications For macOS (tweet).

Previously:

MRT Updates: Informed Security

Howard Oakley:

We’re not informed about when these updates occur, nor of their purpose, nor do we know what changes they bring. In the past, Apple’s security tools used to refer to malware using names which, although not always the best-known, at least enabled us to know what they protected us from. Then last year Apple switched to using internal code names, so we now know that the latest MRT update enables that tool to remove MACOS.87fabeb and MACOS.07758e9. Oh boogaloo.

If you went to your physician and they said that you needed an immunisation but refused to tell you what it protected you from, would you consider that informed consent? Surely, everyone would be suspicious and refuse.

[…]

I keep trying to imagine who Apple thinks it’s protecting by this prolonged silence and refusal to inform. It’s not the malware developers, who will quickly be able to tell the effect of any changes that Apple makes to the protection in macOS. It’s not the users, who are unable to make informed decisions about whether third-party protection is worthwhile. It’s not system administrators, who are as baffled as anyone else on the receiving end.

Update (2019-09-17): Rosyna Keller:

Not all things in MRT have names. Some updates may just be to cover unnamed variants too.

Friday, September 13, 2019

User Tracking via Custom Fonts

Peter Steinberger:

Firebase Crashlytics installs its own font?

Crashlytics:

Crashlytics will only install the font for users who have registered to install pre-release apps via the Beta by Crashlytics product. The font includes a unique identifier that allows us to determine that a crash has come from an app distributed via our Beta product.

Ben Sandofsky:

Turns out custom fonts can be abused for tracking users.

Jiang Jiang:

Yes, that is why Safari is not allowing user installed font access, and the new iOS 13 font installation feature always require user consent to access any user install font.

John Gruber (tweet):

Most users, I suspect, would just allow this, thinking fonts are harmless — but at least those of you reading this are forewarned.

PLCrashReporter Stewardship Moving to Microsoft

Chris Campbell:

Given that the App Center team was already very familiar with PLCrashReporter, and that they had expressed interest in contributing their changes upstream, it seemed like a natural fit for Microsoft to take over as stewards of PLCrashReporter. To that end, we talked it over and they have graciously agreed to take on responsibility of the PLCrashReporter repository and related sites. To be clear, the licensing of PLCrashReporter isn’t changing, and Microsoft looks forward to working with the community on this open source project.

It’s been said that Microsoft’s core competency is developer tools.

Previously:

Billing Grace Period for App Store Subscriptions

Juli Clover:

Apple today announced a new billing grace period for subscriptions, which will let subscribers who experience unsuccessful auto-renewals continue to use an app’s paid content while Apple attempts to collect payment.

This is a feature that developers can opt into.

TylerL:

What about the opposite problem?!

I would like a grace period when a subscription I forget I even had renews automatically. Even a single day-long grace period would suffice where you can cancel and get a refund on an unwanted periodic subscription.

Previously:

AppleCare+ Indefinite Subscriptions

Michael Potuck:

Last year, Apple rolled out the option to pay monthly for some of its two (in some cases three) year AppleCare+ plans for iPhone, iPad, and Apple Watch. Today, Apple quietly changed how it works so customers can buy an indefinite monthly AppleCare+ subscription.

[…]

This sounds like customers can choose to continue the monthly AppleCare+ coverage as long as they’d like or until Apple can’t service the device anymore.

[…]

It’s also good to keep in mind that compared to the normal two-year terms (three years for Apple Watch Hermés and Edition), Apple charges more for the monthly subscription compared to the upfront price. For example, two years of coverage for the iPhone 11 or XR will run $191 if paid monthly versus $149 upfront.

Unfortunately, this doesn’t seem to be available for Macs, where it would be an even better fit—both because AppleCare for Macs costs more up-front and also because Macs will likely be in service for more years.

Previously:

The Apple U1 Chip in iPhone 11

Nick Statt:

One of the understated components of Apple’s iPhone 11 and iPhone 11 Pro is the new U1 chip. It didn’t get a prominent callout onstage at today’s announcement event, but it will underpin what Apple says are “amazing new capabilities” coming to iOS devices in the future, including a more accurate, directional version of AirDrop coming with iOS 13.

Brian Roemmele (Hacker News):

The “U” in the U1 chip relates to the Ultra-Wide Band Radio Technology (UWB) technology it uses. UWB can be used for many application and use cases. One use case that will become very large for Apple as they move to AR/MR technology and Apple Glasses is to be able to track spatial relationships of objects. One way to do this is using lasers and IR systems, and Apple is already doing this to some degree with FaceID and Animoji. The other way to do this is via the radio spectrum.

The Apple U1 Chip most assuredly uses a variant of the IEEE 802.15 WPAN from the IEEE 802.15.4z Enhanced Impulse Radio group of which Apple is an active member. IEEE 802.15.4z to put in simple terms wants to absorb, in some ways, and extend Bluetooth, NFC, WiFi and other network standards and protocols.

The early concept of this technology was used in an all but abandoned Apple initiative called iBeacons [2]. This technology was centered around Bluetooth and Bluetooth Low Energy (BLE). The idea was sound, however the technology was low resolution, so low that it would be hard to be with-in a few feet without triangularization of 3 or more iBeacons and even then it can drift significantly with heat and obstacle issues.

[…]

I feel rather strongly the Apple U1 Chip, over time will be seen as one of the most important aspect of the September 10th, 2019 Apple Event. We will see it as the start of the HyperLocal world of computing that ultimately will lead to less of a need for the cloud.

Previously:

Update (2019-09-17): Jason Snell:

The Apple marketing copy has it right—UWB’s technological trick is allowing devices to pinpoint one another’s locations in the real world with great precision. From raw data alone, UWB devices can detect locations within 10 centimeters (4 inches), but depending on implementation that accuracy can be lowered to as much as 5 millimeters, according to Mickael Viot, VP of marketing at UWB chipmaker Decawave.

[…]

The speed of light and a roundtrip signal allows for a precise measuring of distance, but UWB can also determine the angle of arrival of the radio signals by measuring the phase shift that comes when receiving the signal from multiple antennas. Put the distance and angle together and you’ve got incredible precision—enough for, the rumors suggest, Apple to use an augmented-reality display to mark the precise location of another device.

How Apple Uses Its App Store to Copy the Best Ideas

Reed Albergotti:

Developers have come to accept that, without warning, Apple can make their work obsolete by announcing a new app or feature that uses or incorporates their ideas. Some apps have simply buckled under the pressure, in some cases shutting down. They generally don’t sue Apple because of the difficulty and expense in fighting the tech giant—and the consequences they might face from being dependent on the platform.

The imbalance of power between Apple and the apps on its platform could turn into a rare chink in the company’s armor as regulators and lawmakers put the dominance of big technology companies under an antitrust microscope.

John Gruber:

The thrust of the Post’s story is clear from its headline. But I don’t think it holds any water. What’s the alternative? For Apple never to add any features to the OS that exist in third-party apps?

[…]

When Apple implements a feature or app idea, they do it in a way that has the broadest possible appeal (or at least try to). The key to competing with Apple as a third-party developer is to focus on segments of the audience that want more than the basics.

[…]

The debate over what’s fair game for Apple (or Google, or Microsoft) to copy from third-party developers has nothing to do with app stores. A popular app is a popular app, and the platform vendors have always known all the popular apps.

Every developer is, in a sense, worried about being Sherlocked. But I don’t think this is anywhere near the top of their list for what to change about the App Store. And, as Gruber says, it’s not clear what the solution would be, anyway. That said, I think app stores do change things a bit, in that the platform vendor can get better data sooner, without having to rely on indirect tactics.

Previously:

Update (2019-09-17): Jeff Johnson:

The issue isn't Apple competing with and copying other developers. It's that Apple artificially restricts and unfairly disadvantages competition.

Apple software isn't subject to App Store (or OS) restrictions, rules, and rejections. It also doesn't have forfeit 30% of revenue.

Raphael Sebbe:

What’s not fair is this (number 5): they know all past and present market data that even the copied developer doesn’t know himself. About his app. About all similar apps.

Thursday, September 12, 2019

How to Restore BridgeOS on Your T2 Mac

Mr. Macintosh (tweet):

This article will go over how to restore BridgeOS on your T2 Mac. This is not something that you will ever normally have to do. Restoring or reinstalling BridgeOS would only be needed in the following situations.

  • 1. Failed macOS Upgrade
  • 2. Failed macOS Combo or Delta Update
  • 3. Failed macOS Security Update
  • 4. Failed macOS Reinstall
  • 5. Command Option R fails to boot your T2 Mac to the current version of macOS Recovery. (10.14 is out but the Mac boots to 10.13)

[…]

I tested the BridgeOS restore on multiple Macs for this article. One of my test devices failed in fantastic fashion. What I thought happened was the BridgeOS update just failed on a fluke. What really happened was Apple Configurator 2 attempted to downgrade BridgeOS from Catalina’s version down to the Production version of Mojave. When Apple Configurator 2 attempted to downgrade on the 3rd step it failed leaving the Mac in a Unusable state. Apple straight up does not allow downgrading BridgeOS. I still have my Air that does not boot.

So if you can’t downgrade, and Apple Configurator won’t let you restore the current (beta) version, I guess you’re just out of luck if you need to do this after installing a macOS beta.

See also: Howard Oakley.

Previously:

Is Perl 6 Being Renamed?

Ovid (via Hacker News):

By now, many of you have seen the Perl 6 Github issue “Perl” in the name “Perl 6" is confusing and irritating. The issue suggested renaming Perl 6. While some may think that the name of the issue is trolling, or offensive, the actual issue was created by Elizabeth (Liz) Mattijsen, one of the core Perl 6 developers, a long-time Perl 5 developer, and with her spouse, Wendy, has long been an enthusiastic support of Perl 5/6. There is no trolling here. There is a lot of deep thought, careful discussion, and a genuine desire to find a way to bypass some deeply divisive issues in the Perl community.

While the proposed name was “camelia”, Damian Conway made a strong argument in favor of “raku” and it appears the community is leaning towards this name for various reasons.

[…]

The far, far too terse backstory: the Perl 6 community seems to be split between those who view Perl 6 as a sister language to Perl 5 and those who view Perl 6 as a successor to Perl 5.

The Perl 5 community, meanwhile, is split between “f*ck yeah” and “f*ck you”.

Previously:

Update (2019-10-22): Perl 6 has been renamed to Raku (via Hacker News).

See also: Perl is dying quick (via Hacker News). It’s not going to be “extinct by 2023,” but it does seem to have declining mindshare.

Sunsetting Python 2

Python Software Foundation (Hacker News):

We have decided that January 1, 2020, will be the day that we sunset Python 2. That means that we will not improve it anymore after that day, even if someone finds a security problem in it. You should upgrade to Python 3 as soon as you can.

[…]

We did not want to hurt the people using Python 2. So, in 2008, we announced that we would sunset Python 2 in 2015, and asked people to upgrade before then. Some did, but many did not. So, in 2014, we extended that sunset till 2020.

It’s been a long transition because the initial releases of 3.x were rough, broke a lot of code, and didn’t seem to offer compelling reasons to upgrade. Even if you wanted to upgrade, your code might have dependencies that hadn’t yet. So it kind of followed the path of Perl 6, even though it was a much less ambitious update.

Contrast this with Swift, where there’s a little breakage each year, which people complain about, but most active code (unfortunately not most code posted on the Web) does get updated rather quickly. Granted, Swift had the benefit of a smaller and younger installed base.

If you need to get fixes for Python 2, there’s Tauthon (via Hacker News):

Tauthon is a backwards-compatible fork of the Python 2.7.16 interpreter with new syntax, builtins, and libraries backported from Python 3.x. Python code and C-extensions targeting Python 2.7 or below are expected to run unmodified on Tauthon and produce the same output.

Victor Stinner (via Hacker News):

Python 3.0 was released 10 years ago. It’s time to look back: analyze the migration from Python 2 to Python 3, see the progress we made on the language, list bugs by cannot be fixed in Python 2 because of the backward compatibility, and discuss if it’s time or not to bury Python 2.

Chris Siebenmann:

Let me translate this: filenames, command line arguments, and so on are no longer portable abstractions. They fundamentally mean different things on Unix and on Windows. On Windows, they are ‘Unicode’ (actually UTF-16) and may include characters not representable as single bytes, while on Unix they are and remain bytes and may include any byte value or sequence except 0. These are two incompatible types, especially once people start encoding non-ASCII filenames or command line arguments on Unix and want their programs to understand the decoded forms in Unicode.

[…]

I’ll note that Python 2 is not magically better than Python 3 here. It’s just that Python 2 chose to implicitly prioritize Unix over Windows by deciding that filenames, command line arguments, and so on were bytestrings instead of Unicode strings. I rather suspect that this caused Windows people using Python a certain amount of heartburn; we probably just didn’t hear as much from them for various reasons.

Python Software Foundation (via Hacker News):

“Python’s batteries are leaking,” said Brown. She thinks that some bugs in the standard library will never be fixed. And even when bugs are fixed, PyPI libraries like Twisted cannot assume they run on the latest Python, so they must preserve their bug workarounds forever.

[…]

Brown identified new standard library features that were “too little, too late,” leaving users to depend on backports to use those features in Python 2. For example, socket.sendmsg was added only recently, meaning Twisted must ship its own C extension to use sendmsg in Python 2. Although Python 2 is nearly at its end of life, this only holds for the core developers, according to Brown, and for users, Red Hat and other distributors will keep Python 2 alive “until the goddam end of time.”

[…]

Van Rossum argued instead that if the Twisted team wants the ecosystem to evolve, they should stop supporting older Python versions and force users to upgrade. Brown acknowledged this point, but said half of Twisted users are still on Python 2 and it is difficult to abandon them.

Anthony Shaw (via Hacker News):

One of the features proposed for CPython 3.8 is PEP554, the implementation of sub-interpreters and an API with a new interpreters module in the standard library.

This enables creating multiple interpreters, from Python within a single process. Another change for Python 3.8 is that interpreters will all have individual GILs[…]

Previously:

Wednesday, September 11, 2019

Removing Amazon Cloud Drive From Transmit

Panic:

Amazon e-mailed to tell us that Transmit 5 can no longer support Amazon Drive. Our sincere apologies to anyone using Transmit to access that service. As a heads up, we’ll be removing it very soon — most likely in Transmit 5.6.1.

(We’d have said something sooner but Amazon gave us just 19 days notice! 19 days to update Transmit, and QA test the changes, and update Panic Sync, and QA test those changes, and update the website, and update the screenshots, and update the video, and update the docs, and…)

And to be clear: this is just Amazon Drive, their cloud storage, Dropbox-like service. This will not affect Amazon S3 in any way!

I wonder whether it will still work with Arq.

Wil Shipley:

I, myself, cannot believe Amazon would change their terms and suddenly discontinue service.

Previously:

Apple’s Fall Release Schedule

John Voorhees:

Apple announced a lot of dates today. Here’s a rundown of all the dates mentioned in the keynote[…]

Federico Viticci:

iOS/iPadOS 13 features coming “later this fall” (not Sept. 30th)

- AirPods audio sharing
- HomeKit Secure Video & routers
- iCloud Drive folder sharing
- HomePod/AirPlay 2 in scenes & automations
- Image Capture API
- Screen Time communication limits
- Announce Messages w/ Siri

Federico Viticci:

This split iOS/iPadOS release could get a bit messy. For example:

- If you upgrade to iOS 13 (iPhone) and switch Reminders to the new format, it’ll stop syncing with iOS 12 (iPad)
- Shortcuts: if you modify an existing one on iOS 13, it’ll break the format on 12

Juli Clover:

Code found in the golden master version of Xcode 11 confirms that Apple is working on an augmented reality headset of some kind, and perhaps planned to announce it at the event but scrapped the debut last minute.

9to5Mac’s Guilherme Rambo and developer Steve Troughton-Smith found that Xcode 11 features an ARDisplayDevice framework with references to codenamed Apple headsets that are in development, including Franc, Luck, and Garta (which pertains to HoloKit, a third-party device).

Steve Troughton-Smith:

The fact that ARDisplayDevice is in the iOS 13 public SDK (check the headers in Xcode!), not a private framework, makes it very clear that this head-mounted ARKit UX was supposed to launch in the iOS 13 timeframe. With iOS 13’s delays, very easy to see how that could get punted

Axel Kee notes a very rough edge in the Xcode 11 GM, which looks like it could have used some more time to bake.

Previously:

How to Flip an App for Profit

Becky Hansmeyer (tweet):

Background used to be a good app. You can tell from its early reviews that its users genuinely enjoyed browsing and making use of its hand-curated selection of iPhone wallpapers. In fact, its reviews are generally positive up until late June, when an update began causing some issues. From that point on it becomes clear that Background is no longer owned or updated by its original developer. It’s been flipped.

[…]

The gold standard seems to be a 3-day trial that moves into a $9.99/week subscription, but there’s flexibility here, depending on precisely how evil you want to be. Make sure to hide these new payment options from your pre-acquisition users. After all, you don’t want them updating their glowing past reviews. Oh, and for those new users you’re about to acquire? Make sure it’s darn near impossible for them to find the “x” to close your subscription view (or, for fun, make it completely nonfunctional!).

Ryan Jones:

At this point we must believe they aren’t willing to make the hard judgement call of scam vs not. Which, I should point out, is the entire point of a walled garden. There’s just no other explanation.

[…]

What violation?

Hint: they are violating none except for overcharging 1,000x

[…]

It’s apple’s fault, but they are technically within the (bad) rules.

fluffy fox:

In an ironic twist Android is not walked yet the Play Store allows you to report apps and Google actively takes action against offending apps. It even has bug bounties to find misbehaving apps do they can be dealt with.

Previously:

Clark Goble, RIP

Larry Anderson:

Sad news: for those of you who might know him, former ADN user @ClarkGoble has died of a stroke.

Clark left behind a wife and five children. There’s a GoFundMe to assist them.

His obituary is here. I knew just a small slice of him through his tech blog, comments here, and posts on Twitter and the defunct App.net.

Oluseyi Sonaiya:

Clark Goble may have been the single best human I ever interacted with on the internet. Patient, kind, always engaging in good faith. I admired him tremendously.

Update (2019-09-17): Dan Frakes:

So sad. I knew Clark only online, but if he was half as good of a person IRL as he was here, he was an outstanding human being.

See also: John Gordon.

Apple Arcade Pricing Announced

Apple:

Apple today announced that Apple Arcade will be available on the App Store on Thursday, September 19 with iOS 13, offering an all-new way to enjoy games without limits. With a subscription to Apple Arcade for $4.99 per month, users get unlimited access to the entire catalog of over 100 new, exclusive games, all playable across iPhone, iPad, iPod touch, Mac and Apple TV. Apple Arcade is launching with a one-month free trial, and users will not find the games on any other mobile platform or subscription service. Apple Arcade games can all be played offline, and a single subscription includes access for up to six family members with Family Sharing.

Craig Grannell:

The question is where this leaves pretty much all other gaming on Apple platforms – particularly iOS. At launch, Apple Arcade will have dozens of titles, and over 100 will arrive within “the coming weeks”; Apple is planning to add more titles every month. So for the price of a single premium iOS game each month, you’ll get access to hundreds. Quite how premium games are going to compete – even in the short term – I’ve no idea.

[…]

It’s an interesting time for Apple and games, then, and one that is filled with much promise. But it does feel ironic that the one time Apple finally gets interested in games, it may make the rest of the iOS gaming ecosystem even less viable.

Update (2019-09-13): John Gruber:

Apple should have played this video in Tuesday’s event instead of wasting so much time on a handful of live game demos. This video conveys excitement, and makes it feel like there are going to be a lot of games with a lot of variety.

Update (2019-09-17): Juli Clover:

Apple this morning started rolling out access to Apple Arcade, giving a handful of people early access to the $4.99 per month service.

Apple Arcade isn’t launching with the more than 100 titles Apple has said are in development, but there are over 50 games to download across a wide range of categories. All of the games are listed below.

John Siracusa:

If you’re confused by the platform list because you thought Apple Arcade titles were “exclusive,” the rule is that Apple Arcade titles are not available on any other mobile platforms. And Apple doesn’t count Switch as “mobile.”

Tuesday, September 10, 2019

iPhone 11 and iPhone 11 Pro

Mark Gurman:

By naming this event “By innovation only,” Apple is really raising expectations for Tuesday, an event thus far expected to focus on iterative iPhone and Apple Watch updates. Internally, I’m told, attention has turned to more groundbreaking 2020 devices. Let’s see.

That seems to have been accurate.

Apple (MacRumors, Hacker News):

iPhone 11 Pro introduces a transformative triple-camera system with all-new Ultra Wide, Wide and Telephoto cameras, deeply integrated into iOS to create a pro-level camera experience designed for everyone.

[…]

A redesigned camera interface provides a more immersive experience that works together with the triple-camera system and all-screen display to let users see and capture the area outside of the frame. For the first time, users can easily record video without switching out of Photo mode with QuickTake by simply holding the shutter button to start recording.

What if you want to take burst photos? Hopefully, there’s a preference.

Tim Hardwick:

Apple’s new Night Mode (not to be confused with the new Dark Mode interface option in iOS 13) is Apple’s rejoinder to Google’s Night Sight, and from the little we’ve seen so far, the results do look at least on par with the Pixel.

When using the camera app on any of Apple’s 2019 iPhones, the new Night Mode feature comes on automatically when an indoor or outdoor scene is dark enough to warrant brightening, resulting in natural colors and reduced noise.

In short, new iPhone users should see an immediate improvement when shooting in low light environments, without having to adjust any exposure settings.

However, despite Apple’s boast that the year-old iPhone XR remains faster than the competition, Night Mode seems to be exclusive to iPhone 11, whereas Night Sight works on the Pixel 2 from 2017.

Ben Bajarin:

The new backs on iPhone 11/pro are actually more tacky and less slippery than XS. Quite nice feel in hand IMO.

Previously:

Update (2019-09-11): Ben Thompson:

Gurman isn’t necessarily wrong about the highly iterative nature of the hardware announcements (although I think that an always-on Apple Watch is a big deal), but that doesn’t necessarily mean he is right about the innovation question.

[…]

In the second chart you can see how Apple in 2017 not only raised prices dramatically on its flagship models, but also on the mid-tier model relative to previous flagships. This was important because it was these mid-tier models that replaced previous flagships in Apple’s usual “sell the old flagship for a $100 less per year” approach. That meant that 2017’s price hike filtered through to 2018’s 1-year old model, which increased from $549 to $599.

That means that this year actually saw three price cuts[…]

Mark Gurman:

Nothing shown today really qualifies as meeting high “innovation only” expectations: Apple delivered the smallest Watch update ever, an iPad with a slightly bigger screen and nothing more, and iPhones with cameras equal to or less than many other devices. Apple needs a big 2020.

Jonathan Deutsch:

The new iPhone 11 Pros have gained a bit of weight.

• Two iPhone SEs equal one 11 Pro Max.
• The iPhone 11 Pro weighs 16g more than the 6 Plus!
• Speaking of, that iPhone 6 was damn light for its size
• Heck, you could carry NINE Watch Sports (series 0) for one 11 Pro Max

Update (2019-09-13): John Gruber:

Google beat Apple to the “night mode” game last year, but Apple’s implementation seems more natural to use. It just comes on automatically, when needed. (There is a way to turn it off, very much like turning off the camera flash.) On a Pixel, Night Sight is an entirely different mode, which I find a little weird. My guess has been that Google made Night Sight its own mode because Night Sight images, though often amazing, are also often quite unnatural. It’s so effective that it often makes nighttime scenes look like they were shot in daylight — like an old Hitchcock movie where they shot day-for-night. I hope Apple’s implementation results in more natural images — the goal should be to make it appear that the camera can see in dim lighting, not to make dark scenes look brightly lit.

[…]

Some folks will look at that list and say the iPhones 11 Pro aren’t really “pro”. I look at that list and say the regular iPhone 11 is almost just as “pro” at significantly lower prices. This is a very different dynamic between pro and non-pro models compared to MacBooks, Mac desktops, and iPads, where the pro models have very obvious performance differences.

[…]

In person, the most impressive thing about the new iPhones, to me, is the way that the entire back is made from a single piece of glass. The square section around the camera systems is milled from the same piece of glass as the rest of the back.

Ryan Jones:

As happens, I got curious and went too far… may I present to you: the complete history of iPhone’s camera bump.

Mitchel Broussard:

Below you’ll find tech specs for iPhone 11 and iPhone 11 Pro, with each difference bolded.

See also: iPhone 11 vs. iPhone XR.

Ryan Jones:

iPhone 11
+25% RAM, 3 → 4GB
+6% battery, 2942 → 3110 mAh

iPhone 11 Pro
+50% RAM, 4 → 6GB
+20% battery, 2658 → 3190 mAh

iPhone 11 Pro Max
+50% RAM, 4 → 6GB
+10% battery, 3174 → 3500 mAh

Apple Watch Series 5

Apple (MacRumors, Hacker News):

Apple Watch Series 5 features an innovative new display that allows the time and important information to remain visible at all times. Each watch face has been carefully optimized for the new display and to preserve battery life, the screen intelligently dims when a user’s wrist is down and returns to full brightness with a raise or a tap. Several advanced technologies work together to deliver this new feature, including the industry’s only low-temperature polysilicone and oxide display (LTPO), ultra-low power display driver, efficient power management integrated circuit and new ambient light sensor. This combination of hardware innovation and incredible software design allows Apple Watch Series 5 to offer all-day 18-hour battery life.

Didn’t see that one that coming. I still can’t see anything Apple Watch does that’s worth $400 to me, but it will be more interesting when this eventually makes it into the base model.

Ryan Jones:

5 years later, Apple launches the TOTALLY FRIGGIN OBVIOUS way to sell Watches.

Update (2019-09-13): Michael Kummer:

In this article, I’ll look at what Series 5 has to offer and how it compares to Apple’s previous wearable, the Series 4. Hopefully, the information I provide here will help you decide if you should upgrade to the new model or stick with the one you have.

Update (2019-09-25): Jeremy Horwitz:

During my testing, Series 5’s battery life was noticeably worse than Series 4’s. After a normal day of use, the new watch was at 35%, while its predecessor had twice the remaining power. So while Apple’s promise of “all-day” battery life is still accurate this year, that’s only because the official 18-hour number hasn’t changed, despite undisclosed annual advances in prior models. Unless Apple improves watchOS, it looks like you’ll have to avoid using Series 5’s new features to get Series 4-like battery results.

Update (2019-09-27): Marques Brownlee:

Gave it a 2-week shot, but I’m finally gonna have to turn off the always-on display on Apple Watch Series 5.

It nukes through battery about 30% faster with it on and I don’t care about it enough to keep it. Back to gestures ¯\_(ツ)_/¯

Nick Heer:

iFixit took apart a couple of the new Apple Watch models and found a wildly different battery in the 40mm model than in the 44mm. They also took the time to snark about the recycled aluminum case.

Update (2019-09-30): M.G. Siegler:

I like the new Apple Watch. The always-on screen is great and I’m okay with a trade-off. But come on, let’s just be honest: the battery life is far worse than the previous couple generations as a result.

A few folks following this tweet noted that the WatchOS 6.1 beta helps a lot with the battery issues. Seems like a bunch of little tweaks they can do with software (i.e. maybe don’t need to immediately fully illuminate screen on casual raise, etc). Here’s hoping. 🤞⌚️

Matt Birchler:

The newest Apple Watch is an odd duck when it comes to updates for Apple’s “more personal device ever.” Depending on your measurement, it’s either the most or least significant update to the hardware Apple has ever put out, and that just makes it a funky product to review.

Update (2019-10-15): Matt Birchler:

The worst part of the Series 5 Watch is that it doesn’t automatically turn off the always-on screen when you’re sleeping. I’d also take a much dimmer always-on mode.

Not for battery saving which isn’t a problem for me, but because it lights up the whole bed.

Update (2019-10-21): Rene Ritchie:

It’s so good I sometimes still forget it’s in always-on mode and I need to tap to return it to normal before I can check notifications. That’s how well integrated it is.

[…]

As for me, both on the aluminum at first and the titanium now, I’m getting a little less with always-on-on than I got with no always-on at all on the Series 4. I typically finish the day with between 20 and 40%, depending on how intense my usage is. That’s down from between 30 and 50% on the Series 4. But, it’s not much of a price to pay at all for always-on, at least not for me.

Apple Music on the Web Beta

Josh Centers (MacRumors, Hacker News):

Apple has quietly launched the beta of a Web app for Apple Music, allowing Apple Music subscribers to access all their Apple Music content using a modern Web browser. Just about every feature you’d expect is there, except for the capability to upload music, smart playlists, some music videos, recently played custom radio stations, and curiously, Beats One radio.

Alan Stonebridge:

MacRumors story about Apple Music web beta doesn’t seem to explicitly mention that it provides access to your personal library, not just Apple Music’s.

Federico Viticci:

Apple Music now has a better iPad layout as a beta web app than a native iPad app 😬

Previously:

Update (2020-04-17): Eric Slivka:

As of today, Apple Music on the web has exited beta and is now available at music.apple.com.

Longtime Finder Alias Keyboard Shortcuts Now Mutate Photos

John Gruber:

And to top this all off — truly, this is genuinely hard to believe — these ⌘R and ⌘L shortcuts not only break 27-year-old Finder shortcuts, but they aren’t even consistent with Photos, which uses ⌘R for “Rotate Counterclockwise” and ⌥⌘R for “Rotate Clockwise”. So in Photos the R maps to Rotate not Right, and the direction for an image rotated using ⌘R is left/counterclockwise.

[…]

There is some consistency to using ⌘L and ⌘R as shortcuts for “Rotate Left” and “Rotate Right” — those are the same command names and shortcuts that Preview uses. But there’s no reason Preview doesn’t use the same command names and shortcuts as Photos, and Photos’s use of “Clockwise” and “Counterclockwise” is, in my opinion, more clear than “Right” and “Left”.

Brian Gerfort:

Oh shit! So THAT’s why I occasionally find rotated photos on my machine! I’ve been wondering why that happens. And guess what I do constantly every day: Build and run in Xcode (Cmd+R) ..accidentally have a Finder window/desktop with an image file in focus? Boom.

Steve:

The biggest problem with the change is not that command-R no longer reveals but that it rotates photos without any real feedback. I’ve got a ton of rotated photos now. Fuck whoever made this change, and especially didn’t put it in the menu bar so it could be disabled.

You can’t disable it, but you can use System Preferences to assign the keyboard shortcuts to other commands, i.e. back to “Make Alias” and “Show Original”. Then you run into this bug.

Peter Kamb:

in 2019 ⌘R should be either “Refresh” or no-op. Browser muscle memory overrides everything else for those big shortcuts like ⌘R, ⌘T, ⌘W.

Manipulating the System Policy Database with Configuration Profiles

Tom Bridge:

The spctl binary that is part of macOS’s command line interface, and has been for a very long time, are responsible for controlling what Gatekeeper looks at. These both write to a sqlite3 database stored at /var/db/SystemPolicy, and think of it a lot like a database of ID cards that the security guard at the desk will review. If your card is recognized, you pass through security without more than a passing hello at the barrier. If you card is not recognized, your ID is checked, your destination cleared, your name jotted down, and you’re granted a card if you belong.

[…]

This system can be directly manipulated via configuration profile, and those configuration profiles can be delivered by a capable MDM. Moreover, this has been the case since macOS 10.12. Hidden away in Apple’s documentation is the SystemPolicyRule payload type, which can allow you to embed whitelisted objects in an MDM Profile.

[…]

While all of the above is intended for the operation:install key, operation: execute would allow you to run non-notarized Applications without Gatekeeper dialogs for those applications that are downloaded in their entirety without an installer package. You will need a separate profile if you want to whitelist both an installer and an application.

Previously:

Monday, September 9, 2019

What I Want From the 2019 iPhones

  1. A shape that’s more comfortable to hold. I don’t care whether it’s rounded like the original iPhone/3G/3GS or more square like the iPhone 4/5/5s/SE. But the iPhone 6 and later just don’t feel good in hand without a case.

  2. A more grippy texture. Again, I want to go back to not needing a case.

  3. An antenna that’s better at picking up weak signals.

  4. iPhone 8 size or smaller, at least as an option, without compromising the core specs.

  5. LCD screen, unless they can fix the weird scrolling glitches with OLED ones.

  6. Touch ID alongside Face ID.

  7. Optical zoom for the rear camera.

  8. A better front-facing camera.

  9. Battery life at least as good as the iPhone XR’s.

  10. USB-C—I think. If they’re going to switch, do it now, and update the AirPods, too.

Update (2019-09-10): See also: Michael Rockwell and Fred Wilson (Hacker News).

Apple Apps in App Store Search Results

Joe Rossignol:

Apple recently adjusted its App Store search algorithm so that fewer of its own apps appear at the top of search results, senior executives Phil Schiller and Eddy Cue confirmed in an interview with The New York Times.

[…]

Mr. Schiller and Mr. Cue said the algorithm had been working properly. They simply decided to handicap themselves to help other developers.

“We make mistakes all the time,” Mr. Cue said.

“We’re happy to admit when we do,” Mr. Schiller said. “This wasn’t a mistake.”

[…]

Even after the change, analytics firm Sensor Tower found Apple apps ranked first in the App Store for over 700 search terms, even when the Apple apps were less relevant and less popular than ones from its competitors.

Jack Nicas and Keith Collins (Hacker News, AppleInsider):

Before Apple Music arrived in the App Store, Spotify was for years the first result in searches for “music.” Shortly after Apple Music was added to the store in June 2016, it took the top spot. By then, Spotify had fallen to fourth place. In Feb. 2018, Apple apps suddenly appeared in the top six results for “music”. By the end of 2018, there were eight, some of which were unrelated to music. At this point, Spotify was the 23rd result.

[…]

When multiple Apple apps packed the search results, such as in searches for “music,” the Apple executives attributed the results to a feature of the App Store search engine that sometimes grouped apps by maker. They tweaked that feature in July so Apple apps would no longer look as if they were receiving special treatment. Many Apple apps dropped as a result.

[…]

An Apple spokeswoman said the company could not verify the data because it did not keep a record of historical search results.

[…]

“I find it hard to believe that organically there are certain Apple apps that rank better than higher-reviewed, more downloaded competitors,” said Todd Dunham, chief executive of the ASO Project, which consults app makers on how to rank higher in the results.

[…]

The search algorithm in the App Store was built by a small team of engineers in Cupertino, Calif., some of whom said in a separate interview arranged by Apple that they hadn’t noticed for months that Apple was dominating search results for music and other categories.

Search is one of the biggest problems with the App Store. Why does it have such a small team? How can they improve it without keeping historical results or having automated checking for things like this?

See also: David Heinemeier Hansson.

Previously:

Update (2019-09-10): David Barnard:

Given how crude the search algorithm is, I don’t think @pschiller and @cue are lying about Apple’s apps making it to the top organically.

[…]

And this chart makes a ton of sense when you realize that iOS 10 is when Apple started allowing system apps to be deleted. From that point on Apple released more and more of their system apps on the App Store which created a feedback loop of momentum.

[…]

Here’s an example of just how bad search has been on the App Store and how blatantly developers have been manipulating with complete impunity[…]

[…]

Apple might not be lying about manipulating search themselves, but it’s 100X more embarrassing that they have allowed one of the most important experiences on their $50B/yr platform to be so broken and easy to manipulate for more than a decade.

See also: Jason Fried and Hacker News.

Update (2019-09-13): John Gruber:

Barnard’s whole thread is worth reading, and I found myself nodding along in agreement. Basically, The Times’s results are much better explained by the theory that App Store search sucks than the theory that Apple has been gaming results to harm competitors.

[…]

The fact that Apple made both Schiller and Cue available to The Times shows how seriously they take accusations of anti-competitive behavior. Let’s hope they start taking accusations of incompetent stewardship of App Store search just as seriously.

DOJ Asks Apple to Identify Users of Gun Scope App

Mikey Campbell (MacRumors):

Detailed in an application for a court order filed on Thursday, the DOJ seeks names, phone numbers, IP addresses and other personal data of iOS and Android users who downloaded the Obsidian 4 app, reports Forbes.

The app, developed by American Technologies Network Corp, enables owners to connect to and control rifle scopes manufactured by the same company, specifically models in the ATN X-Sight 4K and ThOR 4 product lines. With Obsidian 4, users can connect to a compatible scope via Wi-Fi and stream live video, review images and movies stored on the scope’s microSD card and adjust hardware settings.

[…]

The DOJ is issuing the order to assist in an Immigration and Customs Enforcement investigation of illegal exports of ATN scopes.

It will be interesting to see how Apple responds, because this is not a case where it can say that it’s being asked to hack its own devices. The requested data is likely already easily accessible on its servers. And it’s not from a particular known suspect like Syed Farook; rather, this is a fishing expedition. It could also set a precedent for other types of apps that other governments want information about.

Previously:

Twitter Is Finally Working on Search for DMs

Jon Fingas:

Twitter isn’t just launching a deluge of tests -- it just announced that a few sought-after features in the pipeline. Most notably, it’s developing a long-overdue search for direct messages. Although there aren’t many specifics at this point, it’s reasonable to say this will spare you from digging through a conversation to find a crucial message from days ago. The social network added that it’s “re-energizing” its work on DMs, so this is really just the highlight of a larger strategy.

Via John Gruber:

The lack of any search at all for Twitter DMs makes iMessage search seem useful.

At least you can somewhat search DMs from the Web interface or from a mail client, if you have notifications enabled. And you can search iMessage archives using EagleFiler. But, yeah, both of these new types of messaging have, for many years, had a worse search experience than e-mail and the forms of chat that preceded them.

Update (2019-10-04): Juli Clover:

Twitter today announced that its Direct Message (DM) search feature is now available to all users, allowing anyone to search through the DMs they’ve received.

Friday, September 6, 2019

Apple Responds to Project Zero

Apple (Hacker News):

Last week, Google published a blog about vulnerabilities that Apple fixed for iOS users in February.

“A blog,” rather than “a blog post”? I love how Apple is subtly trying to discredit Project Zero by implying that it’s a mere blog. And let’s be sure everyone knows it’s affiliated with Google, the privacy bad guys, even though it’s a responsible, technically focused group. Of course, the quote you’re reading is not from a blog by Apple PR. It’s an “Apple Statement.” From the Newsroom. Which has an RSS feed, like blogs do. (Though the feed isn’t discoverable from the statement page.)

First, the sophisticated attack was narrowly focused, not a broad-based exploit of iPhones “en masse” as described.

Project Zero literally referred to “a small collection of hacked websites” that received “receive thousands of visitors per week.” And it does seem like a particular subpopulation was targeted “en masse.” The sites in question were on the public Internet; it wasn’t links being sent to target particular individuals. Apple is blaming the messenger for things it didn’t even say.

The attack affected fewer than a dozen websites that focus on content related to the Uighur community.

Oh, I get it. Most people would consider “fewer than a dozen” to be “a small collection.” But in Apple-speak, there were “a small number” of corrupt App Store binaries causing crashes, and “a small number” of MacBook Pro users experiencing butterfly keyboard problems, not to be confused with the “very small number” of iPhones that unexpectedly shut down. So, yeah, I can see why Apple wants people to know that this “small collection” doesn’t mean “millions.” Although there are apparently 10 million Uigurs in China…

Google’s post, issued six months after iOS patches were released[…]

It’s great that Project Zero reported this in a responsible way, because now we can downplay it as old news.

Second, all evidence indicates that these website attacks were only operational for a brief period, roughly two months, not “two years” as Google implies.

I’m not sure how they know that there weren’t other sites than the ones they considered. Why would someone go to the trouble of targeting iOS 10.0.1 separately from iOS 10.3—or even target iOS 10 at all—if the attack was only for two months in 2018 (after iOS 12 was out)?

We fixed the vulnerabilities in question in February — working extremely quickly to resolve the issue just 10 days after we learned about it. When Google approached us, we were already in the process of fixing the exploited bugs.

Apparently, this is because they were tipped off by the FBI first, but mentioning that would make this seems more serious than Apple wants. This way they get to pretend that they’re smarter than Google.

Overall, an odd response from Apple. Maybe this is really smart PR before the big event next week. But, from my perspective, it is not a good look.

Lorenzo Franceschi-Bicchierai:

I’ve never seen a more smug statement after a breach. Let’s remember that this affects a minority that is actively being suppressed and effectively annihilated by the Chinese government. Perhaps dismissing the gravity of the hacks is not the best approach.

Daniel Sinclair:

This is trash. The us vs them is just gross and disingenuous. Project Zero is doing all of us a service, and Apple PR should be embarrassed for having written this.

Ryan Mac:

In a blog post, the iPhone-maker took issue with some of the findings released by Google researchers[…]

“A blog post”!

In a response Friday, a Google spokesperson said the company stood by its research, “which was written to focus on the technical aspects of these vulnerabilities.”

John Gruber:

Reading between the lines here, what Apple is pushing back on is the fact that Google’s report on this attack against the Uyghur community only mentioned iOS. […] Conspicuously unmentioned in Apple’s response: “China”.

Of course, Project Zero does also publish blogs about Android exploits. And nothing is stopping Apple’s security team from publishing a blog about Android.

Zack Whittaker:

One of the sources told TechCrunch that the websites also infected non-Uygurs who inadvertently accessed these domains because they were indexed in Google search, prompting the FBI to alert Google to ask for the site to be removed from its index to prevent infections.

Bruce Schneier:

This upends pretty much everything we know about iPhone hacking. We believed that it was hard. We believed that effective zero-day exploits cost $2M or $3M, and were used sparingly by governments only against high-value targets. We believed that if an exploit was used too frequently, it would be quickly discovered and patched.

None of that is true here. This operation used fourteen zero-days exploits. It used them indiscriminately. And it remained undetected for two years.

Previously:

Update (2019-09-06): I’m still fascinated by the “fewer than a dozen” phrasing. Surely, Apple would want us to know if it were fewer than ten, i.e. single digits. So the number is likely ten or eleven, yet they didn’t want to say the exact number. And I don’t think the number of sites is actually that important. A single popular site would be worse than many small ones. The number that matters is how many people were affected, and it’s likely not small. Yet this is the lead “fact” that Apple wanted to communicate.

It’s also worth noting that this response dropped on a Friday, and that it doesn’t include a link to the post it’s critiquing, or mention its title or author. So if you don’t actually read it for yourself, you’re left with the implication that it was some sort of dishonest corporate smear campaign.

See also: MacRumors, The Verge, Zeynep Tufekci.

Lorenzo Franceschi-Bicchierai:

A former Apple security employee criticized the company’s reaction and its statement, saying it was misleading. For example, the former employee said, the fact that the the attack was narrowly focused “doesn’t say anything about the security of iOS, merely about the restraint of Chinese attackers.”

“There was nothing keeping the Chinese from putting their exploit(s) in an advertising iframe and paying Huffington Post to serve it. They could easily have compromised tens of millions of iPhones, but chose not to. As a result, we didn’t find out about these attackers for years,” the employee, who spoke on condition of anonymity, said.

Josh Centers:

I don’t care a whit for the drama at play here. Bottom line: iOS isn’t nearly as secure as Apple led us to believe.

Here’s the thing: Apple took away a lot of freedoms in exchange for two promises:

  1. No junk apps.
  2. No major security isssues.

Apple is not upholding their end of the bargain.

Update (2019-09-07): Nick Heer:

So why did Apple respond to that Project Zero disclosure anyway? The researchers stated that the exploits had been patched months ago. Apple offered no new information in their statement. What was the point?

I think it’s because some of the reporting sensationalized Project Zero’s work and didn’t make it clear that the patches were already in place. Apple chose to attack Google, rather than the media responsible for that coverage.

That might also have been avoided if Apple had kept its own customers informed about its products, instead of leaving its competitor to disclose the biggest security incident in iOS history. Now, every time Apple touts how secure its stuff is, you have to wonder whether there are more incidents like this that they are hiding from you, which is a shame because I think they’re doing a pretty good job with the actual security work.

Alex Stamos:

Apple’s response to the worst known iOS attack in history should be graded somewhere between “disappointing” and “disgusting”.

First off, disputing Google’s correct use of “indiscriminate” when describing a watering hole attack smacks of “it’s ok, it didn’t hit white people.”

[…]

Even if we accept Apple’s framing that exploiting Uyghurs isn’t as big a deal as Google makes it out to be, they have no idea whether these exploits were used by the PRC in more targeted situations. Dismissing such a possibility out of hand is extremely risky.

[…]

Third, the pivot to Apple’s arrogant marketing is not only tone-deaf but really rings hollow to the security community when Google did all the heavy lifting here.

[…]

Apple does some incredible security work, but this kind of legal/comms driven response can undermine that work.

Update (2019-09-09): James O’Leary:

mind-boggling own goal to bring this up, unprompted, days later, much less pick a fight with project zero, that never ends well

Something seems up with Cook the last year or so, this + the Spotify response were obfuscatory, unnecessary, and reeked of defensiveness

Om Malik:

I read Apple’s response, which was clearly very defensive. While I dismissed Google’s efforts as a chance to puncture Apple’s privacy blimp (Google is really good at shifting attention away from its own dirty privacy tricks), but Apple’s statement is what has raised some red flags for me. What are they not telling us? And why are they telling us now, so long after the fact? Why not come clean earlier?

Nick Heer:

The series of exploit chains Google wrote about are entirely different. They’re comprehensive — they span multiple major and minor versions of iOS. They’re targeted to surveil an entire persecuted group of people, which makes them far more exposed than specific user applications but not as indiscriminate as a computer virus. Make no mistake: this was an exploitation deployed “en masse”, exactly as Google says.

Apple’s acknowledgement that users would be exposed only if they visited one of “fewer than a dozen websites” is a little misleading as well.

[…]

Neither company has disclosed which websites were spreading these exploit chains, however, so it’s impossible to say whether your iPhone is likely to be affected. Apple’s disputes seem to be about little more than language choices.

[…]

Their statement says nothing, but it does remind people of a reputational failure. […] If Apple did not want to engage with the troubling abuse of their platform to help surveil Uyghurs — and I think they should have, for what it’s worth, but I understand the economic risks of speaking up against the Chinese government — why not issue a succinct release solely about security?

Matt Blaze:

Aside from everything else, using PR to minimize the significance of discovered vulnerabilities is number one on my list of things that make me trust a vendor’s products less. The response to a flaw tells us far more about the security of a product than the flaw itself.

Alex Stamos:

The time-to-patch tells you something about the security and engineering teams. The PR response teaches you about the exec suite.

David Heinemeier Hansson:

This is also a classic case of Apple taking the wrong token. They went with “it’s no big deal” when they should have gone with “it’s the end of the world”. They could have asked @gassee, who used to run Apple France, for a primer on this concept.

Update (2019-09-10): See also: Slashdot.

When I Took My Zipcar Into the Wilderness

Annie Lowrey (via Hacker News):

If you take a vehicle loaned out by Zipcar—a rental service where drivers use RFID cards or a mobile app to open up the car—to an area without cell reception, there’s a chance the car will not work. The doors won’t open, and even if they do, the engine will not start. And because you will be in an area with no cell reception, it might be impossible for you to call for help.

[…]

Zipcars in general work just fine when they do not have cell service, he said, as they have some internal memory that lets them function even when out of touch with the company servers. Indeed, making sure that the cars work when out of reception is a “mission-critical success factor” for the company, he said. Still, cars without reception become vulnerable in a few scenarios: when members lose or do not have their physical Zipcard with them, when they exceed their reservation time or want to extend their Zipcar reservation, or when the vehicle battery dies. That last scenario was the one my family and I found ourselves in, though we did not know it at the time.

[…]

He was amazed—and I was amazed—in part because Zipcar does not warn users that they need to take extra precautions in areas without reception, whether the bowels of parking garages or overlook points on mountainous roads.

I wonder if the car battery died because it was continually searching for a faint cell signal.

Thursday, September 5, 2019

In-Screen Touch ID Coming Back to iPhone

Mark Gurman and Debby Wu:

The upcoming fingerprint reader would be embedded in the screen, letting a user scan their fingerprint on a large portion of the display, and it would work in tandem with the existing Face ID system, the people familiar with Apple’s plans said.

[…]

Apple is considering including this in-screen touch sensor in the 2020 iPhone model if testing is successful, the people said. Suppliers have proven their ability to integrate the technology into iPhones, but the company has not managed to mass-produce it yet, one person familiar with the development work said.

Having redundant sensors sounds wasteful, but I’m looking forward to this. The longer I use Face ID, the more I’m annoyed at how much slower it makes the common case of unlocking my phone as I pull it out of my pocket. Yet I don’t want to switch back to only Touch ID because there are cases where it doesn’t work at all.

Previously:

Update (2019-09-06): John Gruber:

If true, I would guess this would be an optional way to increase security by requiring both Face ID and Touch ID authentication.

Update (2019-09-09): Joe Rossignol:

“Certainly, we’ll continue to put [Face ID] on more devices but also Touch ID will continue to have a role - it’s a great technology on our iPad lineup and we don’t see it going away anytime soon,” said Joswiak.

Update (2019-10-25): Josh Avant:

Apple is apparently curious about how many people miss Touch ID. (Source: Apple consumer survey for iPhone)

They also seem to know exactly why Touch ID is the superior unlocking technology.

Search Ads for Competing Products

Jason Fried:

When Google puts 4 paid ads ahead of the first organic result for your own brand name, you’re forced to pay up if you want to be found. It’s a shakedown. It’s ransom.

Tobi Lütke:

It’s totally crazy for google to get away with charging what’s basically protection money on your own brand name. “Nice high intend traffic you got there, would be a shame if something were to happen to it”

John Gruber:

And of course, Google doesn’t let you target any of their own trademarks this way, and won’t even let you mention “Google” in your ad text. And Google no longer visually styles paid results distinctively from actual search results — just the little “Ad” icon before the result URL.

I think it’s useful to be able to find out about related products through ads. What feels wrong is that the ads don’t really look like ads. It looks like a list of results where the organic one, which is almost certainly what the person wants, is never at the top. So, (a) you have to pay to be where you should have been anyway, and (b) some customers will click the first result and end up somewhere unexpected.

Pieter Gunst:

Lots of misleading ads also...

Jason Snell:

See also App Store ads

Dominik Wagner:

E.g. search for Things, then the first and full scale entry is a competitor that paid.

Paul Haddad:

Apple sure is better than Google.

At least Apple uses a different color for the ad.

Sascha Rucks:

We even got a call from an Apple sales rep who made clear that we need to bid on our own keywords/brand name to make sure that we are at first place and not one of our competitors…

For once, maybe it’s good that the Mac App Store doesn’t have feature parity.

Cale Guthrie Weissman:

Data from Jumpshot says that more than 50% of Google searches in June didn’t result in a click. The results show that organic search clicks are going down even as paid Google search clicks are going up, as are searches to result in no clicks whatsoever. For brands, businesses and marketers who rely on organic Google search results to drive commerce, this means recalibrating how they think of Google in their plans.

David Heinemeier Hansson:

Google is slowly but surely choking the web. This is what monopoly power inevitably leads to. The noblest of founding intentions is no match for the imperative.

Juli Clover:

For basic searches like “maps,” Apple’s apps ranked first more than 60 percent of the time in the WSJ’s testing. Apps that generate revenue like Music or Books showed up first in 95 percent of related searches.

[…]

Apple says that it uses an algorithm that uses machine learning and past consumer preferences, leading to app rankings that often fluctuate. Apple suggested that its apps ranked first in the WSJ’s testing because those apps are popular with consumers. Apple says that all apps are subjected to the same search algorithm, including its own.

Previously:

Update (2019-09-06): Kyle Howells:

It’s shameful how Google has regressed from clearly showing ads, to gradually trying to hide them and trick people into thinking they are the search results.

Update (2019-11-27): David Heinemeier Hansson:

This is frustrating. We’d so much rather spend our money providing Basecamp for free for personal use than pay the Google tax to defend against predatory, VC-boosted ads squatting on our brand. *sigh*

Especially from company that’s on that growth-uber-alles path with no need to turn a profit. I mean when you’ve raised over $200,000,000, you’re not exactly bound by the same laws of business as the rest of us.

And Google of course does nothing. We filed for trademark protection three months ago, which they granted (so ads can’t use our TM in their ad text), but they simply refuse to enforce their own policy. Of course. Because they make more money doing nothing!

Brent Simmons:

They do the same thing to OmniFocus — and they don’t even get the capitalization right. I don’t expect better from them, but I’d like better from Google.

Wil Shipley:

I continue to be impressed with how incredibly useful and user-friendly ads in the App Store are. Such a good idea!

Update (2019-12-20): Marco Arment:

App Store search results for “podcast”:

[Ad] Podbean Podcast App
Your podcast app for iPhone

Apple Podcasts

The Podcast App
Podcast App for iPhone

The Podcast App Premium
for The Podcast App

Overcast
Award-winning podcast player

The Podcast Player
Podcast app by Castbox

Update (2021-05-06): Tom Warren:

Tim Sweeney getting angry at Apple in 2018 over Fortnite not being the number 1 result in the App Store. All because Microsoft, PUBG, and others kept buying ads in the App Store for search results

Both Apple and Google apps appeared at the top of the list when searching for “Dropbox”, and the Dropbox app wasn’t even on the first page.

Update (2021-10-28): Sebastiaan de With:

Here’s me searching for the name of my app. Lightroom is the top result and almost all of my screen.

Significant iOS Vulnerabilities Used Against Uyghur Muslims in China

Rich Mogull:

On 29 August 2019, Google’s Project Zero security research team released the details of a major series of attacks against iOS using sophisticated, zero-day exploits on a scale unprecedented in the iOS world. (Wired has a less technical summary of the Project Zero report, which is aimed at security professionals.) This is the most significant iOS security incident we are aware of since the launch of the iPhone. And while it’s extremely unlikely that any TidBITS readers had their devices compromised, the news remains a concerning development.

[…]

Infection was easy: if a user visited one of the hacked Web sites using an iOS device, that device would be infected with implanted malware without having to interact with the user in any way. That malware could monitor the infected device’s GPS location data in real time, up to once per minute. It could also steal files on the device[…]

[…]

First off, because Google reported all the exploits to Apple quickly, and Apple responded by patching them all in iOS within days, you’re protected from these particular attacks as long as you’re running an updated version of iOS. The implant malware could also be removed merely by restarting the iPhone.

Catalin Cimpanu:

The Zerodium CEO said “the zero-day market is so flooded by iOS exploits” that they are now refusing them

Also, check out this statement regarding iOS security.

Gmail for iOS Can Now Block Web Bugs

Chance Miller (via Yan Zhu):

Google today has rolled out an update to the Gmail app for iOS that gives users the ability to further curtail email tracking. The latest update adds a new setting that allows users to block external images in emails from being displayed automatically.

With today’s update, users can choose to be asked each time whether or not to display external images in an email. This includes email trackers that can be hidden in the body of emails.

Every e-mail client should offer this.

Previously:

Wednesday, September 4, 2019

Notarization Requirements Relaxed

Apple:

As a reminder, Mac software distributed outside the Mac App Store must be notarized by Apple in order to run on macOS Catalina. To make this transition easier and to protect users on macOS Catalina who continue to use older versions of software, we’ve adjusted the notarization prerequisites until January 2020.

You can now notarize Mac software that:

  • Doesn’t have the Hardened Runtime capability enabled.
  • Has components not signed with your Developer ID.
  • Doesn’t include a secure timestamp with your code-signing signature.
  • Was built with an older SDK.
  • Includes the com.apple.security.get-task-allow entitlement with the value set to any variation of true.

This makes a lot of sense because the main benefit of notarization is the malware scan. It was never necessary to bundle that with all the other requirements.

Rosyna Keller:

It’s super important to check the logs because the warnings will become fatal errors again come January, 2020!

Mark Munz:

IMO, they have failed at both the end-user level and the developer level. This delay, while helpful, doesn’t address the core issues.

There is no easy way to tell if an app is notarized. End-users can’t tell which apps are or are not notarized.

I agree that there remain problems, but I don’t think this is something that end users need to be concerned with checking. Except for unusual ways of getting an app onto a Mac, and manually bypassing the launch check, the system is going to enforce that everything is notarized.

Tom Bridge:

This does still mean you need to get notarized packages, zips and disk images for your environment if you intend to have 3rd party non-AppStorer software installed directly by end users. If you are installing tools via Munki’s LaunchDaemons or Jamf’s framework, this doesn’t apply yet.

Previously:

Update (2019-09-06): Howard Oakley:

It’s also worth noting that some developers have reported that apps which have been successfully notarized don’t always complete Catalina’s first run Gatekeeper checks successfully, and as a result Catalina may refuse to open them.

Update (2019-09-09): Isaiah Carew:

relaxing the deadlines does not solve the terrible user experience issues.

nor the issue that you can’t staple a notarization receipt to a zip file.

even just in the public beta, the problems are already so numerous that i have a one-button form response to the issue.

Howard Oakley:

As a user though I’m now left in doubt. Was all this performance with notarization and claims of its security benefits actually genuine? If so, why is this being postponed further, giving another three or more months of exploits? Or maybe Apple had overstated its benefits, in which case how is Catalina going to improve security, other than with its read-only system volume? If hardening and strict notarization do bring significant security benefits, why doesn’t macOS let me know which apps are well-prepared, and which are not?

Update (2019-09-10): Rosyna Keller:

Plugins are able to be stapled since Xcode 10.2.

See also: Howard Oakley.

Update (2020-02-04): Howard Oakley:

From today onwards, there’s only one class of notarized software. All new notarizations must follow strict rules, which require the hardened runtime to be enabled, every component properly signed with the developer’s certificate(s) and a secure timestamp, built using a recent version of the macOS SDK, and a few bits more besides.

Update (2020-02-24): Matt Deatherage:

It all seems like a standard (if accelerated) rollout of a critical security feature, and it was—with one exception. You may recall that Apple tied notarization to its Hardened Runtime environment, one that disallows several low-level features unless explicitly authorized by the developer in the code-signature.

Apple did not document the Hardened Runtime until WWDC 2019. Developers were asked to use a runtime environment that was not even explained to them.

Oh, sure, Apple made allowances for that. Until early 2019, developers could notarize absolutely anything, signed or not. Then there was a period where the Developer ID signing certificate did not have to match the certificate submitted with the notarization request. Both those periods ended in 2019 before Apple published Hardened Runtime documentation.

[…]

More resources on the Hardened Runtime might have fixed this, but one thing certainly would have. Hardened Runtime and notarization should never have been tied together. They are both security features that Apple wishes to require to protect its customers, but the binding of the two systems led to a 2019 full of “You have to notarize to launch on Catalina, but that means you have to use this other environment that we’re not really explaining yet.”

What Beta Means

Brent Simmons:

Here are my definitions:

development (d): everything is in progress and the app might be completely unusable.

alpha (a): the app is feature-complete and has no known bugs — but, importantly, it’s had very little testing.

beta (b): the app is feature-complete, has no known bugs, and has been tested — but further testing is still warranted. Every beta is a release candidate.

The definitions I like to use, which I think originally came from Apple’s guidelines, are the same except that known bugs are allowed in the alpha stage. In any case, Apple and most of the rest of the world have moved on to other definitions. All of Apple’s betas these days have known bugs, and they’re usually not feature complete.

Run Commands, the ‘rc’ in ‘.bashrc’

Wikipedia (via Hacker News):

Tom Van Vleck, a Multics engineer, has also reminisced about the extension rc: “The idea of having the command processing shell be an ordinary slave program came from the Multics design, and a predecessor program on CTSS by Louis Pouzin called RUNCOM, the source of the ‘.rc’ suffix on some Unix configuration files.”

Previously:

How to Manage Audiobooks in a Post-iTunes World

Kirk McElhearn:

You can move your audiobooks to the Books app, which offers a number of features for playback that are more appropriate for listening to spoken word. For example, you click buttons to skip ahead or back by 15 seconds, set a sleep timer, and more. However, these files are stored on your startup disk, and you may simply not have enough space on this disk[…]

[…]

Or you can keep your audiobooks in your Music library. If you rip audiobook CDs, their files can stay in your Music library, and you can listen to them in the Music app, sync them to an iOS device, and even put them in your iCloud Music Library, if the bit rate is 96 kbps or above.

Previously:

Tuesday, September 3, 2019

iCloud Drive Features Removed/Postponed

Max Seelemann:

PSA: Even iOS 13.1 beta did not bring back iCloud folder sharing. (Dropped in 13.0 beta 4 or 5?)

Catalina beta 7 still seems to be lacking major iCloud prime-time stability.

It seems that Apple has done a full rollback of basically all iCloud changes from Catalina / iOS 13.

The sync agent “bird” is back, as is “brctl”. Gone is the new “iCloudDrive” agent. No folder sharing until at least iOS 13.2, it seems. Maybe even iOS 14?

Better for us that this time, the rollback came during beta. I applaud that they rather don’t ship features then ship them in a broken state.

John Gruber:

Interesting but unsurprising news: it appears most/all of the iCloud Drive improvements announced at WWDC (pinned files that remain downloaded locally, shared folders) will have to wait until iOS 13.2 at the earliest.

iCloud Drive is simply far too important for it to be buggy.

Ish Abazz:

My iCloud drive is littered with duplicate folders. I’m not sure when in the beta cycle this happened but it’s a mess.

Anton Sotkov:

If app folders are missing from iCloud Drive on macOS Catalina beta 7:

  1. 1. Disable iCloud Drive in System Preferences → Apple ID
  2. 2. Run this command in Terminal: find ~/Library/Mobile\ Documents/*/Documents -type l -maxdepth 0 -exec rm '{}' ';'
  3. 3. Enable iCloud Drive.

Previously:

Update (2019-09-05): Craig Hockenberry:

And when I say lost, I mean really lost. Entire folders were either gone or corrupted. Apple’s mechanism to recover deleted files was of no help. The customers with weird folder duplicates were the “lucky” ones.

[…]

A few weeks later, Apple finally indicated that there were some issues with iCloud and the beta release. In the same week, they released a public beta and sent out an email to customers encouraging them to try out iOS 13.

We did our best to understand the situation and provide information to Apple, but it felt like we were tossing bug reports into a black hole. The most discouraging part was when we tried to open an incident with Apple Developer Technical Support (DTS). After writing up a detailed report, we were informed that they don’t support beta releases!

[…]

If a device is using an Apple ID that’s also being used on a non-beta device, then iCloud shouldn’t be allowed. If you install an iOS beta on your iPad, it doesn’t get to use any cloud services because it puts the data on your iPhone or Mac at risk.

[…]

As it is now, Apple is effectively telling you that your storage device will be unreliable for a few months. It’s like having a hard drive where the manufacturer tells you it won’t work well for ¼ of the year. Would you purchase storage with a caveat that “the drive mechanism may not work properly during the hot summer months”?

Previously:

Gus Mueller:

I’ve been doing this long enough to remember when the .Mac APIs were built against an SDK. I understand why Apple ties iCloud API updates to OS releases, but I really wish they wouldn’t. Apple’s coders are smart enough to make things backwards compatible, and being able to deploy new iCloud APIs to last year’s OS release would be a nice win for everyone.

[…]

I’ve barely tested it this year, precisely because of the iCloud issues people were encountering.

Drew McCormack:

I think it is fair to say that Apple have always struggled with iCloud Drive, as this post from 2015 shows.

Markus Müller-Simhofer:

This years iOS/iPadOS release cycle was a mess. The first public beta was surprisingly early considering how broken the first beta seeds were. Even in the current beta many things are still too buggy. I’ll recommend everyone who asks me to wait for 13.1!

Michael Rockwell:

But I actually think having the ability to backup and restore all of your iCloud data is a more attainable first step that would mitigate a lot of fear from situations like this in the future. Essentially, Apple could prevent beta releases of iOS from touching iCloud data unless the service first confirms that the user has completed a download of an iCloud backup file. Then, if anything goes wrong, the user can at least restore from that point.

Michael Love:

A positive in this is that it makes it considerably easier for us to drop our long-suffering iCloud support in 4.0 and consign it to the curmudgeon-accommodating Pleco Legacy app.

I literally have a support email in my inbox right now about somebody losing their iCloud-synced flashcards due to an iOS 13 beta bug; if Apple’s willing to ship a public release with broken iCloud then it’s clear it can no longer be relied upon.

Update (2019-09-09): Jacob Pritchett:

I’m a musician, and within a couple of days of installing iOS 13 on my iPhone, my Logic Pro X projects (I store them in iCloud) were all replaced with 0 kB shells.

Even though I hadn’t installed Catalina on any of my Macs.

I’m also a digital artist, and I lost most of my art too.

The result is that I lost the better half of a decade of my music, including dozens of unreleased tracks. It was absolutely devastating.

I would never have thought that installing a beta on my iPhone (I’m an iOS app developer by trade, so I need to) could possibly cause issues on my Mac, which I specifically avoided updating to a beta because I use it for important projects.

Update (2019-10-11): Tim Hardwick (tweet):

Apple has delayed the introduction of iCloud Folder Sharing in macOS Catalina until spring 2020, according to its website.

Red Eye Rejected From The Mac App Store

Jesse Squires:

I recently released a menu bar Mac app called Red Eye. It’s free and you can download it here. It prevents your Mac from going to sleep.

[…]

Unfortunately, Red Eye was rejected from the Mac App Store. I wanted to distribute there, as well as independently. The first reason was a Human Interface Guidelines violation, because you have to right-click Red Eye in the menu bar to open the menu to quit the app, which reviewers said is “confusing to users”. I think that’s debatable. The second reason for rejection was for “duplicate functionality that already exists in the Mac App Store”, which I think is bullshit and arbitrary. I counted three dozen Markdown editors in the Mac App Store before I got tired of scrolling through the search results. It is especially frustrating when the Mac App Store is also full of fucking scams.

Monday, September 2, 2019

Time Tracking with Timeular

David Sparks:

Lately, I’ve been trying a new time tracking gizmo, a Timeular device. It’s a polygon-shaped piece of plastic and electronics that connects to my iPhone. I can assign a different task to each side, and when I switch modes, say going from screencasting to legal clients, I just flip the gizmo to put the briefcase icon (legal) sunny side up, and the iPhone app starts tracking time toward the new task.

I love how this is a physical device that’s always available in front of you. No need to switch apps on your iPhone or find the right window on your Mac. With that being said, I do sometimes like seeing a running counter and often work with my iPhone in a Qi dock, displaying Hours.

With the current summer sale, Timeular costs $53 for the hardware and basic features, $9/month for advanced features, or $299 for “lifetime” tracking with no subscription. You need the subscription or lifetime package in order to be able to export your data—not cool.

A potential downside:

Can I use the Tracker without internet connection?

No, in order to enable real-time sync across your devices and for the software to work, your device (laptop or smartphone) must be connected to the internet. You do not need a wifi connection, a cellular connection works as well.

I don’t want to send my time tracking data to the cloud, and I especially don’t want to spend cellular data to do so.

Previously:

Thirty Years of Fetch

Jim Matthews:

Of the thousands of other Mac apps on the market on September 1, 1989 I can only think of four (Panorama, Word, Excel and Photoshop) that are still sold today.

[…]

I imagined a new Fetch that had all the improvements that I’d daydreamed about, and none of the old code that made it so hard to implement new features.

This, of course, is one of the classic blunders in software development. It was exhilarating to be free of the shackles of our legacy code. But with a blank slate and no clear destination or deadline, we spent years without getting anywhere close to having a product that we could actually sell. Meanwhile Fetch 5 stagnated, and customers who needed more than Fetch 5 could offer moved on.

[…]

In January, 2018 I finally accepted that I wasn’t going to make Fetch 6 happen. Apple had made it clear that 32-bit apps like Fetch 5.7 weren’t long for this world, so it looked like the time had come to lay Fetch to rest for good. But I wasn’t quite ready to say goodbye, and it occurred to me that there was a third option, something between finishing Fetch 6 and letting Fetch die: I could port Fetch 5.7’s Carbon user interface to Cocoa and make a 64-bit Fetch 5.8.

Previously:

PrivilegedHelperTools and Checking XPC Peers

Objective Development:

It all began with a security improvement by Apple in macOS High Sierra (10.13). Apple had revoked access to the folder /Library/Logs/DiagnosticReports for non-admin users. The protection goes so far that even a root process spawned by AuthorizationExecuteWithPrivileges() cannot access the folder.

[…]

Every installer application which needs root permissions is now urged to install a system-wide daemon for this purpose. This system-wide daemon is usually left behind, because Apple provides no API for removing it.

[…]

In an internal code review, another developer looked over the code and verified all assumptions. He did not find a proof for the assumption that XPC connections are authorized by the system. Since there was little information available, he made a test project and could exploit our privileged helper tool!

[…]

The helper (and the app using the helper) should check the identity of the peer before performing any operations. Even if an AuthorizationExternalForm is already used. The most secure way for such a check is the code signature.

[…]

Note that this example uses the private NSXPCConnection.auditToken property. If we want to avoid using a private property, we need to use the Unix process ID. But this is inherently insecure (see Don’t trust the PID! by Samuel Groß). We therefore decided to use auditToken anyway.

So, because Apple decided to protect the logs folder, and the documentation is not very good, the Little Snitch developers ended up introducing a privilege escalation vulnerability, and even now they can’t make it fully secure without using private API. These are smart developers with a long history building a highly regarded security-focused product. Of course it sounds like a good idea to make the logs secure, but I think we can ask whether it was worth the cost in collateral security and engineering time. And why should it be so difficult and error-prone for an app to facilitate the customer sending in a diagnostic report?

See also: CVE-2019-13013.

Joe Auricchio (in 2016, via Jeff Johnson):

It’s better to keep using the deprecated SM functions than to run launchctl. Sorry, but replacements are not yet available.

There isn’t presently API for a system-wide LaunchDaemon to open a Mach IPC or XPC connection to a LaunchAgent, which I’d guess is closer to what you’d really like to do? This would be a good enhancement request, please file one!

Ending the “npm Install Funding” Experiment

Feross Aboukhadijeh (via Yan Zhu):

The idea was this: whenever users install open source software, the funding package would display a message from a company that supports open source. The sponsorship would pay directly for maintainer time. That is, writing new features, fixing bugs, answering user questions, and improving documentation.

[…]

Right now, the status quo is that maintainers create massive amounts of value and then for-profit companies and SaaS startups capture almost all of it.

[…]

As long as significant personal sacrifice is a prerequisite for open source participation, we’ll continue to exclude a lot of smart and talented folks. This isn’t good for anyone.

And we’re forcing the folks who are able to participate to make extreme sacrifices that inevitably lead to burnout.

The Changelog:

In this episode we’re shining our maintainer spotlight on Feross Aboukhadijeh. Feross is the creator and maintainer of 100’s of open source projects which have been downloaded 100’s of million of times each month — projects like StandardJS, BitMidi, and WebTorrent to name a few. This episode with Feross continues our maintainer spotlight series where we dig deep into the life of an open source software maintainer.

Previously:

Update (2019-09-03): See also: Simon Cropp.

Google Begins Penalising Domain Leasing

Barry Schwartz (via Hacker News):

Google issued a warning about sites that lease out its own subdomains and subfolders so that other companies can rank their content better on leased domains. Well, now it seems Google is taking action by penalizing those sections of sites that have these leased out sections.

I don’t quite understand how they decide whether a subdomain or subfolder is considered legit. And likewise for links. Some types of sponsored links are OK, but certain topics will kill your Page Rank.

Copyright © 2000–2024 Michael Tsai.