Allowing a Remote Computer to Access Your Mac

Apple:

Turn on Remote Login to access your Mac from another computer using SSH (Secure Shell Protocol) or SFTP (SSH File Transfer Protocol).

This had been working for me for a long time, but at some point something happened to my TCC database and then rsync started failing:

rsync: opendir "/Users/mjt/Documents/C-Command/." failed: Operation not permitted (1)
rsync: failed to set times on "/Users/mjt/Documents/Code/Git": Operation not permitted (1)

This looked like a Full Disk Access problem, but the old solution of adding sshd and rsync to System Settings ‣ Privacy & Security ‣ Full Disk Access didn’t help.

The trick is that there’s now a separate Allow full disk access for remote users setting, but it’s under General ‣ Sharing instead of Privacy & Security ‣ Full Disk Access. And it’s now only visible if you click the little i button next to Remote Login. With this selected, you don’t need to give sshd Full Disk Access.

There is no corresopnding setting in the i next to File Sharing, so perhaps you still have to give smbd Full Disk Access manually.

Previously:

• Resetting TCC
• Fixing SMB File Sharing in Ventura
• Ventura Drops Older SSH Support
• macOS 11.5
• Overview of TCC Bypasses by Accident and Design
• Mac Software Updates Open Up sshd
• mount_apfs TCC Bypass and Privilege Escalation
• Catalina Data Protections Break File Sharing
• macOS 10.14.1

File Sharing Mac macOS 13 Ventura Networking rsync Screen Sharing Security Server Message Block (SMB) SSH System Preferences Transparency Consent and Control (TCC)

Belkin Connect USB-C Hub

Juli Clover:

Popular Apple accessory maker Belkin recently introduced the Connect 4-Port USB-C Hub, which is the company’s first U.S. product made from post-consumer recycled plastics (PCR).

[…]

Made to be compact, the hub includes four USB-C 3.2 Gen 2 ports, and it supports pass-through charging of up to 100W.

[…]

Belkin says that its new USB-C hub is the only hub on the market able to deliver a maximum of 10Gb/s, which is 2x faster than other available hubs.

This seems like a pretty good deal at $44.99, but if you use one port for PD it really only gives you an additional two USB-C ports. We’re now about eight years into this transition, and there still seems to be no way to attach a large number of USB-C devices without using adapters.

My peripherals still use a mix of ports. Hotels and other public charging places use mostly USB-A. These days I’m carrying cables and adapters for USB-A, USB-C, Micro-USB, Lightning, MagSafe, and Apple Watch. Some devices need multiple cables, because sometimes I want to charge them from my MacBook Pro (USB-C only) but other times from USB-A.

Previously:

• EU Passes Law to Switch iPhone to USB-C
• USB-C Is Still a Mess
• The Impossible Dream of USB-C
• The 12-inch MacBook

Update (2023-05-01): This is not the first such hub, as I mentioned the Sitecom CN-386 three years ago. However, the reviews for that one weren’t great; I have more faith in this one given Belkin’s reputation. Marco Arment says that perhaps the lack of USB-C hubs with lots of ports is due to the inability to support so many full-speed connections. If so, I would certainly welcome hubs with a mix of fast and slow ports, as were common with earlier versions of USB. That complexity would be a small price to pay to get more ports—and not need to use adapters or daisy-chain hubs.

Belkin Hardware Mac Power USB USB-C

MacStealer Malware

Jovi Umawing (Hacker News, MacRumors):

Users are manipulated to download and execute this file onto their systems. Once achieved, a bogus password prompts users in an attempt to steal their real password. MacStealer then saves the password in the affected system’s temporary folder (TMP).

The malware then proceeds to collect and save the following also within the TMP folder:

• Account passwords, browser cookies, and stored credit card details in Firefox, Chrome, and Brave
• Cryptocurrency wallets (Binance, Coinomi, Exodus, Keplr Wallet, Martian Wallet, MetaMask, Phantom, Tron, Trust Wallet)
• Keychain database in its encoded (base64)form
• Keychain password in text format

[…]

MacStealer being an unsigned DMG file is also a barrier for anyone, especially beginners, attempting to run the program on a modern mac, said Malwarebytes’ Reed. “Its attempt at phishing for login passwords is not very convincing and would probably only fool a novice user. But such a user is exactly the type who would have trouble opening it.”

I wonder whether this last point means to say that the app is unsigned or unnotarized. An unsigned disk image is not more difficult to open. It just means that the app will run under translocation, which doesn’t seem like it would provide any protection in this case.

I’m surprised we haven’t heard about more malware like this.

Previously:

• Gatekeeper Path Randomization

Bitcoin and Cryptocurrency Code Signing Disk Image Keychain Mac macOS 13 Ventura Malware Privacy

Bypassing Little Snitch With Empty TCP Packets

Jeff Johnson:

When you look at the implementation of Little Snitch, the interpretation of the word “data” becomes crucial. Technically, unless you allow the connection, Little Snitch does indeed prevent HTTP data from getting sent. Nonetheless, Little Snitch does not prevent TCP (Transmission Control Protocol) data from getting sent. This TCP data includes your IP address, which can often be used to personally identify you. The server knows that you, i.e., your IP address, tried to connect to the server, even when Little Snitch “denies” the connection.

[…]

Objective Development told me that Little Snitch uses deep packet inspection to try to get a name for the connection.

[…]

An HTTP connection over TCP has to initiate a 3-step “handshake” before any actual data—such as HTTP headers—can be sent over the connection. Every TCP packet, including any packet involved in the handshake, contains the IP addresses of the sender and the receiver.

Ryan Gerstenkorn:

If you set up a TCP connection and close it before sending any data, an alert will not be triggered by Little Snitch.

[…]

This behavior is enough to enable two-way communications between a server and a client running behind Little Snitch without being detected by using the destination port to encode data.

[…]

To demonstrate exfiltrating data we will be encoding it across eight ports where each port maps to a bit in memory. All bits default to zero, when a connection is established to port X, the associated bit X is set to one. Once we have made all the connections needed, and the bits are set correctly in memory, we can then send a connection to a ninth port, indicating to the server that the current cycle is complete. The current byte is read, flushed to stdout, and the server state is then reset.

Jeff Johnson:

The addendum of the blog post notes that I had briefly tested LuLu and saw some of the same behavior. After I published my blog post, I sent a link to Patrick Wardle, the developer of LuLu, who has been very responsive and helpful. Moreover, LuLu is open source, so I was able to examine how it works exactly. On further testing with LuLu, I came to believe that there’s actually a bug in the macOS network filter extension implementation. I’ve now filed FB12088655 with Apple: Privacy: Network filter extension TCP connection and IP address leak.

Update (2023-06-09): Christian Bender:

Since we are no longer allowed to ship a kernel extension, we are required to code against this new programming interface. So the question transforms into: “Why does the Network Extension framework allow these data packets?”

[…]

The clever move is to run two tasks in parallel: While the three-way handshake is in progress, Apple simultaneously asks all Network Extensions whether to allow or deny the connection. The Network Extensions have at least 20 milliseconds time to respond without degrading performance. That just enough to run complex filters and send responses back to the kernel. The downside is, of course, that the server receives the SYN packet. If it turns out that the packet should be denied, a RST (Reset) packet is sent instead of the SYN/ACK to abort the connection.

[…]

We tried to report a successful connect to the app, although the handshake packets were held back. This resulted in an inconsistency in the TCP/IP implementation of the kernel and triggered either a kernel panic or various other errors. […] We therefore assume that it’s hard, even for Apple, to inspect the first data packet without allowing at least the initial handshake.

[…]

Considering the different types of attackers, it is unlikely that exploiting the TCP SYN packet will be widely used for large-scale attacks targeting multiple computers. […] However, this method could be of interest to user tracking and analytics, allowing them to gather rough information about installations and some aspects of user behavior. […] It would be naive to think that Little Snitch alone can protect you from [targeted attacks].

Update (2023-06-13): Jeff Johnson (Mastodon):

I’m not persuaded that performance over privacy is a good tradeoff for network extension users. And we don’t even get the choice. Apple is imposing its decision on everyone, with no options. And speaking of performance, do you know what else can degrade it? iCloud Private Relay! […] Additional latency may be the price of protecting your privacy, and that’s a price I’m willing to pay.

[…]

Safari is never waiting on the content blocking extension to provide a verdict on individual URL loads.

It seems to me that Apple could do network content filter extensions the same way. Why couldn’t Little Snitch provide its rules to the kernel in advance and let the kernel itself do all of the filtering, without having to switch contexts?

[…]

One of the questions I raised in my blog posts was not answered by Objective Development: why does Little Snitch leak your IP address on every TCP connection attempt, when LuLu and my own sample network filter extension do not?

Bug Little Snitch LuLu Mac Mac App macOS 13 Ventura Network Neutrality Privacy TCP

Designing for Colorblindness

Andy Baio:

For some people, colorblindness is a serious liability that closes doors on career dreams. It’s hard to become a pilot, train conductor, or pathologist if you can’t differentiate colors in critical instruments, signals, or tissue samples. For others, it seriously impacts their day-to-day ability to do their jobs, like surveyors spotting flags, doctors looking at skin conditions, or electricians looking for colored wires.

But for me, it’s just a lifelong series of unnecessarily confusing interactions, demonstrating that the world wasn’t designed for people like me.

Jason Snell:

Basically, Tot’s launch screen was utterly baffling to me because I’m (mildly) colorblind and it was asking me to do things based on whether a tiny ring was green or red. I couldn’t see it.

Craig Hockenberry:

The initial releases of Tot didn’t have great accessibility. We knew it needed improving, but experience has shown us the folks who need these features have great ideas and happily share their opinions.

[…]

Luckily we have a tool that let me approximate what Jason was seeing. xScope’s vision defect simulator confirmed that Tot’s colored circles had serious issues.

Accessibility Color Design iOS Mac Tot Web Wordle

Swift Foundation Preview

Tony Parker (tweet):

This preview provides a unified implementation of Foundation, written in Swift, that is faster, safer, and more approachable to new contributors.

A new Foundation Workgroup will run reviews of proposed Foundation API and coordinate the needs of the Swift community with Apple engineering.

[…]

The following types are available in the preview package, with more to come later. Many types, including JSONEncoder, Calendar, TimeZone, and Locale are all-new Swift implementations. FormatStyle and ParseStyle available as open source for the first time.

Here’s the repo.

Previously:

• The Swifty Future of Foundation

Update (2023-05-22): See also: Hacker News.

Previously:

• Mojo Programming Language

Update (2023-06-09): Ben Cohen:

In What’s new in Swift I mention the performance improvements from the new Swift implementation of Foundation. Performance came up a lot when we first put the open source package live, but wasn’t easy to talk about until the new OS betas were available.

One common trope at the time was “it isn’t faster than using Objective-C, this is just to reduce Swift bridging costs” and while that’s true, it’s important to note Swift is just plain faster, as seen even when calling into it from ObjC.

Previously:

• WWDC 2023 Links

Cocoa iOS Mac NSDateFormatter Open Source Optimization Programming Swift Codable Swift Programming Language

Apple’s Guidance for StateObject Initialization

Jordan Morgan (Mastodon):

In an attempt to put an end to our StateObject woes in a more paradigmatic manner, Luca Bernardi let us know that Apple’s official documentation now tackles the matter. Specifically, there is now text detailing how to handle dependency injection with StateObject. This is exactly the kind of material we need from Apple, and it clears up a lot of confusion and advice I’ve been reading.

[…]

SwiftUI only will initialize a state object the first time you call it within its view.

[…]

All of this basically boils down to - dependency injection with state object initialization works great if parties outside of the view housing it are feeding it data that doesn’t change either.

[…]

If you did need the autoclosure to fire again, you could set the identity of the view to the value you’re interested in. […] Since the state object isn’t recreated when view inputs are changed (and it certainly shouldn’t), but when the view’s identity changes, this route forces the initializer to run again. But again, I can’t really see this being a viable route for most projects.

Previously:

• Lifetime of State Properties in SwiftUI
• A Huge Year for SwiftUI

iOS iOS 16 Mac macOS 13 Ventura Programming Swift Programming Language SwiftUI Testing

countryd

Filipe Espósito:

You can use an iPhone or iPad almost anywhere in the world, but some iOS features are only available in specific places. In some cases, these restrictions are related to local regulations (such as FaceTime not being available in the UAE). 9to5Mac has now learned that Apple has been testing a new, more modern system hidden in iOS 16 to restrict features based on the user’s location.

Based on our findings, the new system internally called “countryd” was silently added with iOS 16.2, but is not being actively used for anything so far. It combines multiple data such as current GPS location, country code from the Wi-Fi router, and information obtained from the SIM card to determine the country the user is in.

[…]

Code seen by 9to5Mac makes it clear that this system is designed to set restrictions determined by government regulators.

Nick Heer (Mastodon):

A question remains about how Apple may restrict sideloading to only European devices. For many past location-gated features, Apple’s guardrails have been flexible. For example, switching an iPhone’s region to “United States” — in Settings, General, Language & Region — is often enough to enable features like Apple News or Apple Pay Cash. It is not possible complete setup of Apple Pay Cash without U.S. payment information, but it is surfaced merely through this Settings change. Sideloading is tempting for some users; it is not beneficial for Apple. It is obviously reluctant to embrace the changes mandated in the European Union, and it appears it is building a more robust way to ensure it is only active where legally required.

Josh Calvetti:

It’s an incredibly shortsighted move to save a few dollars and yes it will absolutely be abused. Once the feature exists, it’s much harder to tell governments something isn’t possible.

It’s so frustrating and truly discouraging to have so much hardware optimism met with such terrible software decisions, all in the name of pinching pennies. I hope this rumor has no legs.

Previously:

• Sideloading Rumored for iOS 17
• iOS 16.2 and iPadOS 16.2

App Store GPS iOS iOS 16 Sideloading Strategy Tax

Zero-Click Exploits Against iOS 16

Citizen Lab (Hacker News):

Our ensuing investigation led us to conclude that, in 2022, NSO Group customers widely deployed at least three iOS 15 and iOS 16 zero-click exploit chains against civil society targets around the world.

NSO Group’s third and final known 2022 iOS zero-click, which we call “PWNYOURHOME,” was deployed against iOS 15 and iOS 16 starting in October 2022. It appears to be a novel two-step zero-click exploit, with each step targeting a different process on the iPhone. The first step targets HomeKit, and the second step targets iMessage.

[…]

Logs from another PWNYOURHOME-exploited device from the 2022 global target pool examined in the course of this investigation showed the homed process decoding what appears to be an unusual NSKeyedUnArchiver when it crashed.

It sounds like Apple was not using NSSecureCoding.

Logs from yet another PWNYOURHOME-exploited device from the 2022 target pool show that, following the homed phase of PWNYOURHOME, the phone downloaded PNG images from iMessage. Processing these images caused crashes in the MessagesBlastDoorService process. These crashes give us glimpses of what the exploit was doing at various stages, and suggest that the exploit may have circumvented pointer authentication codes (PAC) in some cases by repurposing PAC-valid pointers already present in memory, such as signed pointers to callback functions present in constant structs.

Bruce Schneier:

One interesting bit is that Apple’s Lockdown Mode (part of iOS 16) seems to have worked to prevent infection.

Zach Cutlip:

What follows is a writeup of the kernel bugs NSO Group’s Pegasus spyware exploited in iOS 9, specifically versions 9.3.4 and earlier. The spyware was discovered and the vulnerabilities patched roughly six years ago.

Previously:

• Lockdown Mode in iOS 16.4 Breaks Web Forms
• Lockdown Mode
• Apple Sues NSO Group
• Zero-click iMessage Attacks
• Through the Blast Door
• Scanning Your iPhone for Pegasus
• iMessage’s BlastDoor Sandbox

Exploit HomeKit iMessage iOS iOS 15 iOS 16 Lockdown Mode Programming Security

Microsoft Edge Leaking Browsing History to Bing

Tom Warren (Hacker News):

Microsoft’s Edge browser appears to be sending URLs you visit to its Bing API website. Reddit users first spotted the privacy issues with Edge last week, noticing that the latest version of Microsoft Edge sends a request to bingapis.com with the full URL of nearly every page you navigate to. Microsoft tells The Verge it’s investigating the reports.

[…]

“Microsoft Edge now has a creator follow feature that is enabled by default,” says Rivera in a conversation with The Verge. “It appears the intent was to notify Bing when you’re on certain pages, such as YouTube, The Verge, and Reddit. But it doesn’t appear to be working correctly, instead sending nearly every domain you visit to Bing.”

Bing Mac Mac App macOS 13 Ventura Microsoft Edge Privacy Web

The Four Types of Safari Extension

Jeff Johnson (Mastodon):

Apple’s Safari web browser first added support for extensions in version 5, and since then—we’re now at Safari version 16—there have been four different extension formats!

1. Safariextz: 2010 Mac, 2019 RIP
2. Safari content blocker: 2015 Mac and iOS
3. Safari app extension: 2016 Mac
4. Safari web extension: 2020 Mac, 2021 iOS

[…]

There’s a widespread misconception that Safari extensions on the Mac can only be distributed via the Mac App Store, and while this is true of Safari web extensions—one of the few Mac API that for some strange reason are limited to the App Store—it’s not true of Safari app extensions.

[…]

Due to the strict limits of their API, Safari content blockers are inferior to Chrome and Firefox extensions such as uBlock Origin at blocking ads and other annoyances. When support was introduced for Safari web extensions, people were excited about the prospect of uBlock Origin returning to Safari. There was previously a Safariextz version of uBlock Origin that of course died when Safariextz did. The hopes for a rebirth were in vain, unfortunately, for as I mentioned earlier, a number of features of the WebExtensions API are currently unsupported by Safari.

Previously:

• Where Are the Safari Web Extensions?
• Safari 13 and Extensions
• Goodbye, Safari Extensions Gallery
• The Mac App Store Safari Extensions Experience
• Ghostery Lite
• The State of Safari Extensions
• Safari 10 Brings Native App Extensions

iOS iOS 16 Mac macOS 13 Ventura Safari Safari Extensions

Google Authenticator Adds Syncing

Christiaan Brand (Hacker News, MacRumors):

We are excited to announce an update to Google Authenticator, across both iOS and Android, which adds the ability to safely backup your one-time codes (also known as one-time passwords or OTPs) to your Google Account.

[…]

Since one time codes in Authenticator were only stored on a single device, a loss of that device meant that users lost their ability to sign in to any service on which they’d set up 2FA using Authenticator.

With this update we’re rolling out a solution to this problem, making one time codes more durable by storing them safely in users’ Google Account. This change means users are better protected from lockout and that services can rely on users retaining access, increasing both convenience and security.

I’m not sure why this took so long. Maybe they were working on some way to make sure it’s extra secure, but the announcement doesn’t talk about that.

Mysk (Hacker News):

We analyzed the network traffic when the app syncs the secrets, and it turns out the traffic is not end-to-end encrypted. As shown in the screenshots, this means that Google can see the secrets, likely even while they’re stored on their servers. There is no option to add a passphrase to protect the secrets, to make them accessible only by the user.

[…]

Also, 2FA QR codes typically contain other information such as account name and the name of the service (e.g. Twitter, Amazon, etc). Since Google can see all this data, it knows which online services you use, and could potentially use this information for personalized ads.

Surprisingly, Google data exports do not include the 2FA secrets that are stored in the user’s Google Account.

With no backup/syncing from Google Authenticator, I switched from Google Authenticator to 1Password as soon as it supported OTPs, and these days I use Apple’s password manager. But I don’t want to rely on it too heavily, for a variety of reasons, so for important accounts I use it only for OTPs, with the actual passwords in PasswordWallet.

Previously:

• 1Password to Add Telemetry
• iPhone Thieves Locking Users Out of Their Apple Accounts
• Changing Apple ID Password Using Only a Device and Passcode
• Requesting Your Personal Data From Apple

Update (2023-04-27): Mysk:

If you have already enabled syncing in Google Authenticator and now changed your mind and want to use the app offline, opting out won’t delete your tokens and their metadata from Google servers.

To remove your data from the cloud and use the app offline, you need to follow these steps[…]

See also: MacRumors.

Update (2023-05-01): Christiaan Brand (via Accidental Tech Podcast):

E2EE is a powerful feature that provides extra protections, but at the cost of enabling users to get locked out of their own data without recovery.

To make sure we’re offering users a full set of options, we’ve started rolling out optional E2E encryption in some of our products, and we have plans to offer E2EE for Google Authenticator down the line.

Mysk:

This shows that adding end-to-end encryption to Google Authenticator wasn’t planned at all, leaving the data of at least 100M+ users at risk.

Update (2023-08-31): Mysk:

A quick reminder that Google hasn’t updated its Authenticator app to support end-to-end encryption when syncing secrets with Google servers. It has been 4 months since they promised to support e2ee.

1Password Apple Password Manager Google Authenticator iOS iOS 16 iOS App PasswordWallet Security Syncing Two-Factor Authentication (2FA)

1Password to Add Telemetry

Pedro Canahuati (Hacker News):

1Password is beginning an internal test of our new, privacy-preserving in-app telemetry system.

[…]

We’re only interested in how people use the app itself, what features and screens they interact with – not what they store in their vaults, what sites they autofill on, or anything like that.

[…]

This data will be gathered from a randomized selection of accounts, de-identified, and processed in aggregate.

[…]

Over the years, we’ve relied on our own usage in conjunction with your feedback to inform our decision making. This presents a challenge, though: we don’t know when you run into trouble unless you tell us. […] But there are millions of people using 1Password now, often in cool and innovative ways! If we’re going to keep improving 1Password, we can no longer rely on our own usage and your direct feedback alone.

I don’t really understand how they plan to figure out these cool and innovative uses from anonymized, aggregate data. But it does have the potential to identify hot spots that they should be paying attention to. And it’s good that they’re going to offer a way to opt-out. Of course, my preference is for a password manager to make no network connections at all.

rdl:

Telemetry in a “trust us, this closed-source application which contains all your secrets, which we provide you and which we update periodically, is only contacting us for “privacy protecting telemetry” and not exfiltration, intentionally or not, of your most sensitive of all data” application is a hard pass for me. This seems like an IQ test kind of question.

(So many times error reporting, etc. have accidentally leaked highly sensitive data, which was then the source of a major compromise, in other systems. Maybe 1Password won’t get it wrong, maybe 1Password will never be subject to any pressure to get it wrong…)

Casey Liss:

In and of itself, no, telemetry doesn’t bother me. And rolling it out to your own internal users first is 👍🏻

But it seems pretty clear that this isn’t a problem that needs solving: customers have been SHOUTING FROM THE ROOFTOPS explaining what is wrong.

Mostly, I have been hearing about problems with the browser extensions.

torstenvl:

Users: We want standalone non-subscription licenses!
1Password: I really wish we knew what users wanted.

Users: Please don’t move to Electron, I don’t want Chrome bugs in my password manager.
1Password: I’m just baffled. We never hear from users.

Users: Please, for the love of God, give us control over our vaults. Don’t go cloud-only, we’re begging you!
1Password: Better turn on telemetry. It’s the only way to solve this mystery for the ages.

The fundamental issue is that they decided to focus on a larger market that has very different concerns than their original customer base. This sets up the situation where they feel like they are listening, and in many ways the product is better for its target audience; yet some us feel like we’ve been ignored for the last 7 years or so, with each successive version straying farther from what we originally liked.

Previously:

• Google Authenticator Adds Syncing
• 1Password 8 for Mac
• 1Password Series C Funding Round
• 1Password Standalone Vaults and PasswordWallet
• 1Password Travel Mode
• 1PasswordAnywhere No Longer Works With Dropbox

Update (2023-04-27): Daniel Jalkut:

For 20 years it seemed 1Password knew exactly what customers wanted, how they used their software, and how it could be improved. They’ve been taking a PR beating the last couple years, at least in my circles. They used to be the obvious choice, and now most people I know are looking for other options (or older versions). I don’t think telemetry will fix that.

I find this troubling in ways that are comparable to Apple’s “bad years” of MacBook Pros with unreliable keyboards. It was still the main thing I’d recommend to folks, but I couldn’t do so effusively.

Update (2023-06-23): Matt Grimes (Hacker News):

After months of development and refinement, we’re now confident we can deploy this system in a way that helps us build a better 1Password without compromising on our commitment to protect your privacy.

Later this summer, you’ll see the option to participate in our telemetry system and help improve 1Password. You don’t need to take any action right now, and we won’t collect any usage data without your awareness and consent first. Participation will be optional for Individual and Family plan customers. And at this time, our telemetry system won’t be rolled out to any team or business using 1Password.

1Password iOS iOS 16 iOS App Privacy

Netflix Ads, Password Sharing, and DVDs

Tim Hardwick:

Netflix said that it would be increasing the video quality of its Basic With Ads tier to 1080p at no extra cost to subscribers. Additionally, it said it would increase the number of simultaneous streams from one to two.

[…]

Netflix revealed in its earnings report that its Basic with Ads plan already brings in more revenue than its Standard plan, which costs $15.49 per month and offers HD quality streaming.

Juli Clover:

Netflix is planning a “broad rollout” of the password sharing crackdown that it began implementing in 2022, the company said today in its Q1 2023 earnings report [PDF].

[…]

When Netflix brings its paid sharing rules to the United States, multi-household account use will no longer be permitted. Netflix subscribers who share an account with those who do not live with them will need to pay for an additional member. In Canada, Netflix charges $7.99 CAD for an extra member, which is around $6.

[…]

Netflix users will need to establish a primary location, and subscribers who are not at this location will not be able to use the service through that account. There are allowances for travel or second homes, with Netflix requiring users to open the Netflix app at the primary location once per month.

David Pierce (Hacker News):

Even in 1998, when the company mailed its first DVD — the 1988 cult classic Beetlejuice, in case you’re wondering — it was already imagining a world without discs. The company was called Netflix, after all, not DVDsByMail.

[…]

Now, Netflix is officially getting out of the DVD business. The company announced along with its quarterly earnings that it is planning to shutter DVD.com, which is the new name for its DVD by mail business. (You might remember when Netflix tried to spin out this business under the name Qwikster, which remains one of the worst product names of all time and lasted all of about a week. But the less we talk about Qwikster, the better.) It will ship its last discs on September 29th, and I have a sneaking suspicion you won’t need to return them.

Kate Hagen:

At this moment, Netflix is streaming about 3800 films - less than half of what the average Blockbuster used to carry.

As for films made before 1990? Only 79 titles are currently streaming. If we go to 1980 or earlier, that drops to 36 (!)

Previously:

• Arrested Development Leaving Netflix Soon
• Netflix Homes and Games
• The Former Netflix DVD Library Is a Lost Treasure
• Netflix vs. Blockbuster Total Access
• Netflix and Qwikster

Update (2023-04-27): Clara Hernanz Lizarraga and Thomas Seal (via Hacker News):

Netflix Inc. lost more than one million users in Spain in the first three months of 2023 according to market research group Kantar, a sign that the streaming giant’s crackdown on password-sharing could face pushback.

Update (2023-05-24): Zac Hall (Hacker News):

The company’s crackdown on password sharing has been ramping up across the globe for a while now, and starting today, Netflix is bringing it to the United States.

In a post on its Innovation blog, Netflix announced that it will now begin notifying subscribers who are sharing accounts between households of the need to pay up.

Paul Haddad:

Wait a second, I'm on the highest Netflix plan which I thought was a family plan? Now they want me to pay extra just because I have kids off at college? Makes me want to either just downgrade or cancel all together.

Update (2023-06-13): Juli Clover:

Just after putting an end to multi-household password sharing in the United States, average daily signups to Netflix reached 73k per day, a 102 percent increase from the prior 60-day average. Netflix saw close to 100,000 daily signups on both May 26 and May 27, beating out signups even during COVID lockdown periods.

Update (2023-06-26): Chris Adamson:

We worried that streaming was going to reinvent the cable TV subscription, by costing just as much to subscribe to all the different services. We never imagined it was going to reinvent broadcast TV from the 70s, when shows get canceled and taken down, never to be seen again.

Or, for older shows, only seen on DVD.

Update (2023-06-27): David Friend:

Netflix Canada is done with being basic.

The streaming giant says it’s phasing out the $9.99 “basic” option from its price plans, taking away the cheapest subscription without ads.

Update (2023-07-26): Juli Clover (Hacker News):

Netflix today quietly eliminated its most affordable ad-free plan in the United States and the United Kingdom, raising the price of ad-free streaming options.

In the U.S., the Basic plan was priced at $9.99 per month, and with its removal, ad-free streaming now starts at $15.49 per month. Netflix subscribers can opt for the $6.99 per month “Standard with ads” plan, but that price point includes advertisements.

Juli Clover:

Netflix earlier this year began cracking down on password sharing in the United States and other countries, and the effort has been successful, the company said today. Netflix gained 5.9 million new global subscribers in the second quarter of 2023[…]

Jose Fernandez, Ed Barker, Hank Jacobs:

Basic with ads was launched worldwide on November 3rd. In this blog post, we’ll discuss the methods we used to ensure a successful launch[…]

Update (2023-08-24): Nikki Main (via John Gordon):

Netflix’s DVD subscription platform will allow subscribers to keep their final delivery of DVDs as the company prepares to close its 25-year-old service, the company announced on Monday.

Update (2023-12-08): Janko Roettgers:

But as old-school as Netflix’s DVD business might sound, the service has been anything but low-tech. In order to send out more than 5 billion discs to millions of subscribers over the years, the company deployed cutting-edge automation, embraced machine learning before it was cool, and laid the technical and financial foundation for what would ultimately become the massive, worldwide streaming business Netflix is known for today.

[…]

At first, Netflix introduced machines to stuff its iconic red envelopes, to the tune of 4,500 discs per hour, and sort them by zip code for shipping. Then, it also automated the processing of returned DVDs. Netflix commissioned Bronway, an Ireland-based company that had been building machines to pack and ship CDs and DVDs for clients like Microsoft and Nintendo, to make a machine for its incoming mail.

Juli Clover:

Netflix has been “completely satisfied” with the pace of the password sharing crackdown it initiated in the United States earlier this year, Netflix co-CEO Ted Sarandos said today at the UBS Global Media and Communications Conference (via Variety).

[…]

According to Netflix, an estimated 222 million paying households were sharing with an additional 100 million households that were not being monetized.

Following the password sharing crackdown, Netflix said that it saw strong subscriber growth in countries where password sharing was restricted. Netflix in Q2 2023 added six million subscribers, including more than a million in the U.S. and Canada. Revenue increased in every region where paid sharing was rolled out, and signups ultimately exceeded cancelations.

Business Netflix Passwords Sunset Web

Cheating Is All You Need

Steve Yegge (via Hacker News, Mastodon):

LLMs aren’t just the biggest change since social, mobile, or cloud–they’re the biggest thing since the World Wide Web. And on the coding front, they’re the biggest thing since IDEs and Stack Overflow, and may well eclipse them both.

[…]

In one shot, ChatGPT has produced completely working code from a sloppy English description! With voice input wired up, I could have written this program by asking my computer to do it.

[…]

All you crazy MFs are completely overlooking the fact that software engineering exists as a discipline because you cannot EVER under any circumstances TRUST CODE. That’s why we have reviewers. And linters. And debuggers. And unit tests. And integration tests. And staging environments. And runbooks. And all of goddamned Operational Excellence. And security checkers, and compliance scanners, and on, and on and on!

So the next one of you to complain that “you can’t trust LLM code” gets a little badge that says “Welcome to engineering motherfucker”. You’ve finally learned the secret of the trade: Don’t. Trust. Anything!

Francisco Tolmasky:

Conversations with ChatGPT probably reveal a lot about how you yourself program. I’ve asked ChatGPT very few actual coding questions like what I see online (“what function does this” or “write this for me”), but I spend a lot of time asking ChatGPT to help me design or name things. If I think back, a lot of my “coding time” is in fact spent just thinking about how to lay things out vs. generating tons and tons of view code or whatever.

One way of looking at this is like ChatGPT being the “ultimate rubber duck” for “rubber duck debugging”. Just someone that will listen to your programming thoughts and bounce ideas off of.

yosito:

With GPT so hot in the news right now, and seeing lots of impressive demos, I’m curious to know, how are you actively using GPT to be productive in your daily workflow? And what tools are you using in tandem with GPT to make it more effective? Have you written your own tools, or do you use it in tandem with third party tools?

I’d be particularly interested to hear how you use GPT to write or correct code beyond Copilot or asking ChatGPT about code in chat format.

But I’m also interested in hearing about useful prompts that you use to increase your productivity.

Horace He (via Hacker News):

I suspect GPT-4’s performance is influenced by data contamination, at least on Codeforces.

Of the easiest problems on Codeforces, it solved 10/10 pre-2021 problems and 0/10 recent problems.

This strongly points to contamination.

Sternsafari (via Dan Luu, Hacker News):

My Job is different now since Midjourney v5 came out last week. I am not an artist anymore, nor a 3D artist. Rn all I do is prompting, photoshopping and implementing good looking pictures. The reason I went to be a 3D artist in the first place is gone. I wanted to create form In 3D space, sculpt, create. With my own creativity. With my own hands.

It came over night for me. I had no choice. And my boss also had no choice. I am now able to create, rig and animate a character thats spit out from MJ in 2-3 days. Before, it took us several weeks in 3D. The difference is: I care, he does not. For my boss its just a huge time/money saver.

Ben Thompson:

Hawkins theory is not, to the best of my knowledge, accepted fact, in large part because it’s not even clear how it would be proven experimentally. It is notable, though, that the go-to dismissal of ChatGPT’s intelligence is, at least in broad strokes, exactly what Hawkins says intelligence actually is: the ability to make predictions.

Dan Grover:

Since the implosion of web3, the raising of interest rates, and layoffs in FANGs, the tech world has been searching for a new bright spot and has, for now, seized on generative AI.

[…]

So I – and most people I know now – use it just about every day. I have a fraught relationship with it. I send my boss a spec I labored over researching for hours, and he gets back to immediately with “oh, I found one issue — ChatGPT says we should also support X.”

[…]

The iPhone comparison is probably the most apt one — the iPhone, like ChatGPT, was just a skillful combination of existing, well-understood technologies in a nice package. But it feels like magic.

[…]

But the most underlooked impact of the current generative AI explosion — more than what is actually directly possible with these models — is giving so many people a fun and motivating entry point into the field. Regardless of anything OpenAI may do, it seems a certainty that there will be more and more “script kiddies” at every level learning how to customize AI for their own problems, either by tweaking someone else’s models, fine-tuning, or making their own.

Previously:

• GitHub Copilot X
• GPT-4
• ChatGPT for Apple Platforms Development
• What Is ChatGPT Doing and Why Does It Work?
• ChatGPT
• Midjourney and Stable Diffusion

Update (2023-04-27): Ldorigo:

Just paste in a chunk of systemd (or whatever) logs and start asking questions. Often just pasting in the logs and pressing enter results in it identifying potential problems and suggesting solutions. It helped me troubleshoot a huge amount of issues on linux desktops and servers that would have taken me a lot longer with google - even if it doesn’t always give the right solution, 99% of the time it at least points to the source of the error and gives me searchable keywords.

Matt Birchler:

The fact that things (code or otherwise) generated by these models is imperfect means we need to be careful with how we use them, but it does not mean they are useless. As always, I like to look at these things as practically as I can, and the video below shows me adding a feature to Quick Reviews in real time, and I think is a good example of how these tools can help, without replacing the need to understand what you're doing.

Update (2023-06-15): Erik Dörnenburg:

But how would Copilot fare with a less common language and code that’s involving more complicated data structures? To find out I turned to Crellinor, my genetic programming / artificial life simulator written in Rust[…]

Artificial Intelligence ChatGPT Midjourney Programming Web

Apple Wins Antitrust Battle With Epic Games

Sarah Perez (Hacker News):

In today’s decision, the appeals court panel affirmed the district court’s denial of antitrust liability and its corresponding rejection of Epic’s illegality defense to Apple’s breach of contract counter-claim, the ruling said. However, it also noted that the district court had erred in defining the relevant antitrust market and in holding that Apple’s DPLA (Developer Program Licensing Agreement) fell outside of the scope of the antitrust law known as the Sherman Act.

But it said those errors were ultimately “harmless” and that Epic, regardless, had “failed to establish, as a factual matter, its proposed market definition and the existence of any substantially less restrictive alternative means for Apple to accomplish the procompetitive justifications supporting iOS’s walled- garden ecosystem.”

In other words, while these types of contracts can be within the scope of a Sherman Act claim, that wasn’t relevant to the court’s decision in this case.

Tim Sweeney:

Fortunately, the court’s positive decision rejecting Apple’s anti-steering provisions frees iOS developers to send consumers to the web to do business with them directly there. We’re working on next steps.

Juli Clover:

Apple was ordered to implement App Store changes that will allow developers to use metadata buttons, links, and other calls to action to direct customers to purchasing mechanisms outside of the App Store , paving the way for developers to implement alternate payment options.

[…]

According to Apple, the proposed App Store changes could “upset the careful balance between developers and customers provided by the App Store,” resulting in irreparable harm to Apple and consumers. Apple also said that it needed time to figure out the “complex and rapidly evolving legal, technological, and economic issues” that the update would cause.

Previously:

• Epic v. Apple Appellate Hearing
• Dutch Anti-Steering Ruling for Dating Apps
• Apple Wins Delay on Anti-Steering Injuction
• Apple Denied Anti-Steering Stay
• Apple Appeals Anti-Steering Ruling in Epic Case
• The Epic Anti-Steering Injunction Is Narrow
• Anti-Steering Ruling in Epic v. Apple
• Relaxing Anti-Steering Rules for Reader Apps
• Cameron v. Apple Settlement

Update (2023-04-26): Here is the actual opinion from Judge Smith.

Antitrust App Store Apple Epic Fortnite iOS Lawsuit Legal

Ads in the Windows 11 Start Menu and in iOS

Thomas Bandt:

So I pulled a Dell laptop from a drawer under my desk and set up Windows 11.

[…]

First, there was news about a mass shooting that had occurred only recently. In the middle of the search menu. The menu which was supposed to be one of the first touch points with that computer for the kid.

[…]

So, there is basically little you can do with Windows out of the box but buy subscriptions and log into pre-installed social media apps. One thing I knew right on the spot: That’s not an environment I want my kid to make his first steps “on a real computer.”

Matt Birchler (Hacker News):

The weather info you clicked on occupies 4% of the pixels (I actually counted), and the rest is devoted to garbage from the MSN home page. And don’t worry, it does infinitely scroll, so you can browse this bullshit to your heart’s content.

And no, there is no way to turn this news feed off. The best you can do is “manage interests” which kicks you out to msn.com to have you tell it what topics you prefer. If you can believe it, my preferences say I only care about sports!

Oh, and to be clear, this isn’t some OEM addition, this is core Windows…you can’t escape this with a Surface device: this is the Windows experience as Microsoft sees it.

Eric Schwarz:

Although Bandt is talking about Windows 11, a lot of these things started to creep in with Windows 10, a vast departure from the stay-out-of-your-way nature of old versions like Windows XP.

Nick Heer:

I am thankful I use a Windows 11 computer at my day job because it puts things into perspective. Apple’s operating systems are also full of ads for its services but it is somewhat less intrusive than what I experience on my office desktop. Neither is good for users, however. The more computer companies see their operating systems as vehicles for converting users to subscription-paying advertising-clicking customers, the more it feels like we are being taken advantage of.

Jeff Burt (Hacker News):

Microsoft is looking for user feedback on ads it’s putting into the Windows 11 Start Menu for its products and services. If responses on Reddit is any indication, the response hasn’t been great.

The software vendor has for months been playing around with putting ads – or at least in the case of the Start Menu, notifications – about its services in the operating system as well as the Bing search engine, PCs, and other products.

[…]

With the Windows 11 Insider Preview Build 23435 that was dropped into the Dev Channel late last week, the company is “continuing the exploration of badging on the Start menu with several new treatments for users logging in with local user accounts to highlight the benefits of signing in with a Microsoft account (MSA),” Amanda Langowski, principal product manager for the Windows Insider Program, and Brandon LeBlanc, senior program manager at Microsoft, wrote in a blog post.

Kyle Barr:

Microsoft’s Windows 11 Start Menu is becoming more and more like a dancing inflatable tube man gesticulating wildly outside a used car lot. The last Windows 11 update added advertisements for Microsoft’s OneDrive cloud backups for some users when they click on the little Windows icon on the desktop. Now the Redmond, Washington company wants to bombard you with more ads for its other “free” services every time you go to sign out.

[…]

But more importantly, the company shared details on its controversial in-OS advertising scheme that it’s now dubbed “badging.” These not-ads appear for local user accounts as small messages hovering right above the sign out button when clicking on the Start menu.

Via Nick Heer:

Last year, Microsoft began testing upsell ads in File Explorer. Subscription services have created a conflict of interest for platform builders as they choose to relentlessly promote their revenue opportunities in parts of the system previously treated as users’ space.

Darren Allan:

What’s also a concern here is the flagging of the ad with a yellow warning circle and exclamation point, which suggests that there’s something seriously wrong with your system setup. That’s not fair, and some might argue a cynical way of cajoling less tech-savvy folks into signing up for a Microsoft account (or whatever else the ad might be pushing).

John Gruber (Mastodon):

I’ll sometimes set up as new (and use a spare Apple ID dedicated to testing) to see the factory-fresh Cupertino default experience. Is it too much advertising? I don’t know — but it’s a lot. One thing that’s clear is that Apple sees Music and TV as Apple-service properties. Yes, you can use them for listening to your own music and watching your own video files, but first and foremost these are client apps to Apple’s Music and TV+ services. These are not the iTunes and Video apps of yore.

[…]

For the last several weeks, I’ve noticed an ad in Settings on my iPhone, in the iCloud section at the very top of the first screen: “Apple Arcade Free for 3 Months”. The reason this is dumb is that I pay for a family account for Apple One, so we already have Apple Arcade. But here’s Apple badgering me to sign up for a 3-month free trial that I don’t need.

[…]

We — including Apple itself and Tim Cook personally — decry the invasiveness of the surveillance advertising complex, by which they develop profiles of us so accurate that the ads they deliver are so on-point to our recent interests that millions of people falsely believe their devices are somehow surreptitiously listening to their real-world conversations. This stupid Apple Arcade prompt in Settings is the opposite: I’m being shown it because Apple knows I recently bought a new device from them, but somehow doesn’t know that I already pay them for a subscription that includes Arcade.

For the last week, CarPlay has been showing a notification circle (no number) on the Music icon, and I couldn’t figure out how to get rid of it. Nothing popped up when I tapped the icon in the car. I don’t normally use the Music app on iOS, so it’s not on my home screen, but I came across its icon today, saw the notification badge, and tapped it. What has CarPlay been trying to get my attention about all this time? It was yet another solicitation for an Apple Music. I must have opted out a dozen times in the last month or two, and, as previously discussed, even that didn’t prevent me from getting enrolled in a preview that required a phone call to cancel.

Sam Rowlands:

Advertising in OSes is crazy.

• Apple has adverts for services in the their “Settings” app. They use dark patterns to encourage iCloud subscriptions.
• Microsoft is adding adverts in the Start Menu.
• Google, who makes their money from advertising… Doesn’t AFAIK.

[…]

IMHO, auto-enabling of these settings from a migration and then asking me to pay, and removing my data if I disabled the settings, can be considered a dark pattern.

Mario Guzman:

I had no clue Apple is asking for App Store reviews on stock, first party apps?! Eww LOL.

Previously:

• HomePod Late Adopter
• iOS Announcements and Offers
• The Enshittification of All Things
• Get Rid of the Apple Pay Setup Badge
• App Store Ads in Today and App Pages
• The Apple Services Experience Is Not Good Enough
• The Paywalled Garden: iOS Is Adware

Update (2023-05-09): Darren Allan (via Slashdot):

Windows 11’s Settings panel has been seen with a number of adverts in test builds of the OS, in what’s becoming a sadly familiar theme for preview builds of late.

Update (2023-08-23): Andrew Cunningham (via Nick Heer):

This time-honored practice is colloquially called a “clean install,” and it was a cure for most things that ailed a new Windows PC. Computer manufacturers often distributed buggy, pointless, or redundant third-party software (“bloatware” or “crapware”) to help subsidize the cost of the hardware. This might pass some savings on to the user, but once they owned their computer, that software mainly existed to consume disk space and RAM, something that cheaper PCs could rarely afford to spare. Computer manufacturers also installed all kinds of additional support software, registration screens, and other things that generally extended the setup process and junked up your Start menu and desktop.

You can still do a clean install of Windows, and it’s arguably easier than ever, with official Microsoft-sanctioned install media easily accessible and Windows Update capable of grabbing most of the drivers that most computers need for basic functionality. The problem is that a “clean install” doesn’t feel as clean as it used to, and unfortunately for us, it’s an inside job—it’s Microsoft, not third parties, that is primarily responsible for the pile of unwanted software and services you need to decline or clear away every time you do a new Windows install.

Update (2023-08-24): Beebles (via ednl):

If you are setting up Windows 11, select “English (World)” as your language (English Europe also works), and you will have NONE of the third party bloatware installed.

Advertising Apple Arcade Apple Services CarPlay Dark Patterns iOS iOS 16 Music.app Strategy Tax System Preferences Windows Windows 11

Pythonista 3.4 Update Rejected

Ole Zorn:

Apple has unfortunately rejected the Pythonista 3.4 update, citing 3 separate issues. Still trying to process it all, but it’s ridiculous that even a harmless link to the top 50 female names in Iran (courtesy of the faker module) triggered their strict sanctions policy.

Not really sure what to make of the others. The part about 2.5.2 and the “itms-apps” URL scheme is exactly identical to a rejection of the first beta (which was resolved without further explanation, after I sent a long message, explaining that I don’t know what they mean).

Previously:

• The Dark Side of the Mac App Store
• Still Yanking Pythonista Around
• Pythonista in App Store Peril

Update (2023-04-28): Ole Zorn:

Pythonista 3.4 is finally out on the App Store. 🥳 It comes with Python 3.10, updated modules (openai, pandas), and many new possibilities for iOS automation with Python actions in the Shortcuts app. 🐍

App Store App Store Rejection iOS iOS 16 iOS App Iran Pythonista

Poor Security at FTX

Stacy Elliott:

[John Ray III] wrote in Sunday’s court filing that FTX “kept virtually all crypto assets in hot wallets.” To underline his point, Ray mentioned the unauthorized transactions that drained $432 million worth of funds from the company’s wallets the day after it filed for bankruptcy on November 11.

[…]

Hot wallets are connected to the internet and therefore susceptible to being compromised by a bad actor. A cold wallet is not connected to the internet and, for that reason, better protected from bad actors.

Ray said keeping the majority of funds in hot wallets and the private keys of those wallets in AWS was an especially bad way to manage risk.

Molly White (via Hacker News):

Debtors give multiple examples of irresponsible key storage. Keys to >$100M stored in unencrypted plaintext, for example, or in tools unsuitable for the job. Keys were often accessible by many employees with no auditing. Keys were poorly labeled, with names like “use this”.

[…]

“Passwords for encrypting the private keys of wallet nodes were stored in plain text, committed to the code repository (where they could be viewed by many and were vulnerable to compromise), and reused across different wallet nodes”

[…]

“Over a dozen people had direct or indirect access to the FTX​.com and FTX​.US central omnibus wallets, which held billions of dollars in crypto assets”

Amazon Web Services Bitcoin and Cryptocurrency Financial FTX Passwords Security Web

Sideloading Rumored for iOS 17

Ivan Mehta (MacRumors, 9to5Mac, Hacker News):

After vehemently fighting “sideloading” alternative app stores on the iPhone, Apple is now apparently looking to allow them with iOS 17, which will come out next year, to comply with European laws. The report from Bloomberg also noted that Apple is exploring opening up its camera and NFC (Near Field Communication) stack to developers.

[…]

Europe’s Digital Market Act (DMA) will come into effect next year, and companies will have until 2024 to comply. Under the new rules, Big Tech must allow alternative app stores on their platforms to provide users with more choice, and it’s likely that Apple is now preparing to comply.

Apple has already committed to supporting USB-C due to the EU’s push to standardize charging ports. Now, with the DMA on the horizon, this could force the Cupertino-based company to allow sideloading too.

Linda Rosencrance:

The question is what do app developers think about these new regulations? Will they actually be beneficial to EU based developers and what will be the short and long term impact on the EU’s app market? We spoke with a few to find out.

[…]

“Bug fixes can be released faster compared to when they’re released on the App Store,” he said. “Waiting up to 20 days for bug fixes is frustrating, especially when it’s out of my control and I can’t contact Apple about it,” Young said.

In addition, developers won’t have to pay the 15%-30% Apple tax any longer.

This last part is far from certain.

Macro Arment:

Apple will just use another method to collect their “commission”.

[…]

Remember: Tim Cook views our customers as THEIR customers, our sales as THEIR sales, and the 30% as what they rightfully deserve for gracing us with a platform that we provide no other value to.

Steve Troughton-Smith:

Alarm bells should be sounding at Apple over the kinds of developers who are fed-up-enough of the App Store to want to be on alternatives; Apple is at risk of the iOS App Store turning into the same kind of marketplace as the Mac App Store, bereft of many of the platform's top apps. As much as they might want to blame the EU or ‘lawmakers’, it was an entirely preventable series of toxic business decisions (and, lately, bridge burning) that lead to it.

Riley Testut:

How will Apple restrict sideloading? [poll]

Michael Love:

The bad news is that it’s seemingly only in the EU, the good news is that we’ll now have actual real-world proof that all of their FUD about sideloading is meaningless.

Or perhaps Apple will find business and technical ways to make it so unattractive that it won’t get enough traction to prove anything.

Previously:

• The Dark Side of the Mac App Store
• 2023 Six Colors Apple in the Enterprise Report Card
• Competition in the Mobile Application Ecosystem
• Apple Working on Sideloading for Europe
• EU Passes Law to Switch iPhone to USB-C
• EU Approves Digital Markets Act and Digital Services Act
• App Store External Purchase Fee: 27%
• Schneier on Sideloading
• Apple Attacks Sideloading

Antitrust App Store European Union iOS iOS 17 MindNode Near-Field Communication (NFC) Setapp Sideloading Ulysses

The Dark Side of the Mac App Store

Privacy1St:

In the last 30 days, I have been closely monitoring the Mac App Store and have made a disturbing discovery. In the midst of the OpenAI frenzy, several apps have surfaced that are copying the iconic OpenAI logo and color scheme in order to mislead unsuspecting MacOS App Store users. But that’s not all — I also found that some developers are abusing Apple’s Developer Agreements by spamming multiple accounts and flooding the store with nearly identical applications.

[…]

The scammy developers didn’t even bother to make a different paywall style for both apps. Both apps share the same paywall with slight differences and there is no close button. This behavior of not providing a close button on the paywalls is highly unethical and can be considered a scam. It puts the users in a frustrating situation where they are forced to either subscribe or forcibly quit the application to regain control of their device.

[…]

More than 175 reviews were received in the last 24 hours Worldwide with 63 total reviews received in the US Store. These reviews were possible by using a simple abusive technique: request the user to review your app immediately after the subscription to the application and every time the user asks a question to the OpenAI without allowing the user to test your application more time.

Previously:

• Sideloading Rumored for iOS 17
• Scam Authenticator App Steals QR Codes
• Swapping App Data After Review
• Sketchy ChatGPT App Soars Up App Store Charts
• The Top PDF Reader in the Mac App Store
• Most Fraudulent Apps Still on the App Store
• App Store Feature Promotes Rip-Off Apps
• Forced 5-Star Ratings

Update (2023-04-25): Nick Heer:

In fact, upon opening the App Store on my iPhone, the first thing I saw was an ad on the search page for an app which looks, at first glance, like an official OpenAI app — same colours, similar logo, and a description with a conspicuous use of the word “Open”. As of writing, it is the ninth most popular app in the Productivity category — and, yes, of course it offers paid subscriptions.

See also: Hacker News.

Previously:

• App Store Ads Gone Wild
• Gambling Ads on App Store Product Pages

App Store Scams App Store Search Ads ChatGPT Mac Mac App Mac App Store macOS 13 Ventura OpenAI

ChatGPT in SwiftKey

Tim Hardwick:

Microsoft last year said it would be ending support for SwiftKey on iPhone, then only weeks later it backtracked and asked users to "stay tuned" for the arrival of new features. The company has now lived up to its promise with a fresh update that, perhaps unsurprisingly, integrates its ubiquitous Bing AI chatbot into the predictive keyboard app.

mcc (via Hacker News):

At almost the exact same time they rolled out this update, Microsoft deleted the public support forums. The public uservoice/feedback/feature request thing. They appear to have just removed it completely from the support site and old links to it 404. What an interesting coincidence.

Previously:

• ChatGPT in Bing and Edge
• Microsoft Brings Back SwiftKey for iOS

Artificial Intelligence ChatGPT Datacide iOS iOS 16 iOS App Keyboard SwiftKey Web

Cheaper Studio Display Alternatives

Scott Yoshinaga:

Apple finally released the Studio Display in 2022. My initial reaction was to purchase one, even with the starting price of $1599. I’ve really wanted a 27-inch 5K display for a while and wasn’t willing to go with the 5K 27-inch LG UltraFine after a bad experience with the 4K 24-inch version. I was ready to pull the trigger, but I soon learned about the many drawbacks, like having only a single input source, one Thunderbolt 3 port, no external power button, and worst of all, running some version of iOS that needs firmware and software updates!

[…]

At work, we had a few late-2015 27-inch 5K iMacs that were set to be recycled, so I set out to see if there was any way to convert one into an external display. After doing some research, I found that there was indeed a way to do this, so I gave it a shot. This post documents how I did it, so maybe you can too if you’d like.

[…]

In order to convert a 27-inch 5K iMac into an external display, it needs to be disassembled and all of the internals removed. Next, a component called a display driver board needs to be purchased. The driver board will be installed inside the empty iMac chassis and connected directly to the LCD panel of the iMac. The driver board provides multiple HDMI and Display Port inputs, a power port, and a headphone jack. Using these connections on the driver board, the iMac can be converted into an external display.

ClickClack:

Kuycon G27X 5K 60HZ 27-inch IPS Monitor

Via Casey Liss:

Somebody buy this and tell me if it’s any good please. Not in the market at the moment but the idea of a < $1000 5K monitor is appealing.

Previously:

• Studio Display Firmware 16.4
• ViewFinity S9
• Upgrading to a 14-inch MacBook Pro With a Studio Display
• Mac External Displays for Designers and Developers
• Luna Display to Use an Old iMac 5K As a Display
• Studio Display
• The State of External Retina Displays
• The Best Mac External Displays

Display Hardware iMac Mac macOS 13 Ventura Retina

iPhone Thieves Locking Users Out of Their Apple Accounts

Nicole Nguyen and Joanna Stern (MacRumors, Hacker News):

Greg Frasca has been locked out of his Apple account since October, and he’ll do just about anything to get back in.

He has offered to fly from Florida to Apple’s California headquarters to prove his identity in person, or write a check for $10,000 to reclaim the account. It holds the only copies of eight years of photos of his young daughters.

This is all because the thieves who stole Mr. Frasca’s iPhone 14 Pro at a bar in Chicago wanted to drain cash from his bank account and prevent him from remotely tracking down the stolen phone. They used his passcode to change the 46-year-old’s Apple ID password. They also enabled a hard-to-find Apple security setting known as the “recovery key.” In doing so, they placed an impenetrable lock on his account.

But this is not because Apple can’t restore access. It’s just their policy not to support other forms of recovery identification: driver’s license, backup e-mail, postal mail, physically appearing at an Apple Store, etc. The article cites an example where Apple did restore an account after the customer answered some verification questions, but this option does not seem to be available to most.

The article recommends enabling Screen Time protections, which may help against an unsophisticated thief, but as discussed before this seems to not be a true solution.

It’s better to have a backup of your photos, though I’m not sure there’s an automated way to do that if you don’t have a Mac.

larsnystrom:

IMHO, the crazy part is that it is possible to create a new Recovery Key with just the iPhone passcode (and the iPhone). So basically, the iPhone passcode is mightier than the Recovery Key. The only purpose of the Recovery Key is to protect against SIM swapping attacks. I didn’t know this.

So an attacker with the iPhone passcode can lock you out of your Apple account on all devices, even if they don’t have your Apple ID password or your Recovery Key.

Previously:

• Apple Card Savings Account Launches
• Photos Data Loss With macOS 13.3 Beta
• Changing Apple ID Password Using Only a Device and Passcode
• Apple Accounts “Permanently” Blocked
• Password Reset iCloud Account Vulnerability
• Locked Out of an Apple Account

Update (2023-04-21): Adam Engst:

Although I haven’t been able to find a detailed explanation of how the recovery key works in Apple’s Platform Security Guide, my understanding is that it essentially acts as a second copy of a user-managed encryption key that takes over from Apple’s usual account recovery option.

[…]

When the Wall Street Journal article talks about how victims attempt to prove ownership of their accounts with various forms of identification, it’s missing the point—identification is not in question; the data is simply inaccessible because it’s encrypted with a key that Apple doesn’t control.

I’m not sure that’s the case. If it were, then what was the point of Advanced Data Protection? Anyway, I think Apple needs to document this better.

The best protection right now is to use Screen Time, as I discussed in my previous article.

[…]

Unfortunately, it does that by preventing you from even entering Settings > Your Name without first going to Settings > Screen Time > Content & Privacy Restrictions > Account Changes > Screen Time Passcode > Allow, and then setting it back to Don’t Allow once you’re done. If Apple tweaked iOS 17 to prompt for the Screen Time passcode when accessing the blocked options, it would be much easier to recommend.

Doug Miller:

It used to be you could do a certain set of actions that would allow you to change the password even with the screen time passcode block (I won’t list them.) But with 16.4 Apple now requires you to confirm a trusted phone number, and then requires you to use another trusted device to actually change the password.

See also: Bruce Schneier.

Previously:

• iOS 16.4 and iPadOS 16.4

Update (2023-05-01): Doug Miller:

I have both a recovery key set and a screen time passcode and I can still go through and change the Apple ID password with the procedure you listed.

[…]

Having a screen time passcode with account changes disallowed makes it harder to find the Apple ID address on the device, but not impossible.

Apple ID Datacide iCloud Photo Library iOS iOS 16 Passwords Screen Time Security

Lockdown Mode in iOS 16.4 Breaks Web Forms

Jeff Johnson:

HTML button elements don’t appear in Safari in Lockdown Mode.

Most input elements don’t appear either!

A reader writes:

Since iOS 16.4 was released, HTML input elements have vanished from all sites and web views in apps, and so have attachments in Mail.app, which no longer appear at all (not even as icons).

As you can imagine, this renders most websites, as well as the Mail app itself, pretty well unusable, especially when the last remaining text labels appear in black on black when in Dark Mode.

I realise that Lockdown Mode is one of these features that Apple supports only partially, but this has gone beyond the bounds of inconvenience and will probably lead many people who do need it to disable it just to use their devices.

Previously:

• iOS 16.4.1 and iPadOS 16.4.1
• iOS 16.4 and iPadOS 16.4
• Lockdown Mode

Bug iOS iOS 16 iPadOS iPadOS 16 Lockdown Mode MobileMail MobileSafari WebKit

CloudSyncSession

Ryan Ashcraft (tweet):

Last week, I published CloudSyncSession, a Swift library that builds on top of the CloudKit framework to make it easier to write sync-enabled, offline-capable apps.

I started CloudSyncSession over two years ago with the goal of replicating NSPersistentCloudKitContainer’s syncing behavior, without the Core Data hard dependency. Additionally, I wanted a solution that provided harder guarantees, more control, and more diagnostic information. I didn’t find an existing solution that met all of my requirements, so I (reluctantly) set out to build my own.

After years of refining this framework and fixing various bugs in my app, I’ve learned a lot about CloudKit syncing. You can glean some of my learnings by reading the code, but there’s a lot more that I felt I could share with a proper, technical blog post.

I love posts like this that are based on experience in the field:

CloudKit implements rate limiting. It has a special CKError code for this, requestRateLimited, but I’ve actually never seen an error with this code. In practice, rate limiting is indicated by serviceUnavailable (CKError 6, HTTP code 503).

[…]

Users want to know if their data is being synced properly. And from a customer support perspective, it’s invaluable to have logs and rich diagnostic information about the sync engine. Here are some diagnostics that I’ve found to be super helpful[…]

CloudSyncSession:

In an effort to make as much of the logic and behavior testable, most CloudKit-specific code is decoupled and/or mockable via protocols.

[…]

CloudSyncSession is not intended to be a drop-in solution to integrating CloudKit into your app. You need to correctly persist metadata and records to disk. In addition, you must use the appropriate hooks to convert your data models to and from CKRecords.

It does not support assets.

See also: Cirrus, CloudCore.

Previously:

• Proton announces Proton Pass, a password manager | Hacker News
• iCloud Syncing Limitations & Solutions
• NSPersistentCloudKitContainer in 2022
• Increased iCloud Errors
• iCloudCoreDataStarter and Temporary IDs Bug
• How to Set Up Core Data and CloudKit
• Syncing Core Data With CloudKit and NSPersistentCloudKitContainer
• How CloudKit Works
• CloudKit
• Core Data Ensembles

CloudKit iOS iOS 16 Mac macOS 13 Ventura Open Source Programming Swift Programming Language Syncing Testing

Canopy

Canopy:

A library that helps you isolate CloudKit dependency and write testable code using CloudKit.

[…]

In live use of your app, you initiate and inject the live Canopy object that talks to CloudKit. When independently testing your features, you instead inject a mock Canopy object that doesn’t talk to any cloud services, but instead plays back mock responses.

Jaanus Kase:

There’s still not a whole lot written about CloudKit. It continues to be this mysterious thing and I think it’s underused.

As part of Canopy, I publish a documentation site that covers not only the library, but also some broader topics around CloudKit, such as its tradeoffs, how iCloud Advanced Data Protection affects your apps, etc.

See also: Dependencies.

Previously:

• CloudSyncSession

Update (2023-06-02): Jaanus Kase:

I greatly enjoyed putting the whole package together. For better or worse, it reflects my shape as a maker of things on Apple platforms as of early 2023. In the spirit of testable code, Canopy itself is well tested, and the important parts have 100% or near-100% test coverage. I’m pretty happy to see this coverage.

[…]

One compromise I chose to make is that Canopy produces a number of warnings with Xcode 14.3. Halfway working through Canopy, Apple shipped Xcode 14.3 with Swift 5.8 that enables Sendable warnings for many Apple system types, including CloudKit types like CKRecord. Canopy does indeed ship these types across actor boundaries, which currently produces warnings like this.

CloudKit iOS iOS 16 Mac macOS 13 Ventura Open Source Programming Swift Concurrency Swift Programming Language Testing

Apple Card Savings Account Launches

Apple (Hacker News, MacRumors):

Starting today, Apple Card users can choose to grow their Daily Cash rewards with a Savings account from Goldman Sachs, which offers a high-yield APY of 4.15 percent — a rate that’s more than 10 times the national average. With no fees, no minimum deposits, and no minimum balance requirements, users can easily set up and manage their Savings account directly from Apple Card in Wallet.

[…]

Once a Savings account is set up, all future Daily Cash earned by the user will be automatically deposited into the account.

The 10x is compared with most physical banks. There are a dozen or more online banks that offer similar rates. Ally and Amex are currently at 3.75%. Goldman Sachs’s own Marcus product is at 3.9%, slightly lower than its Apple product. Synchrony offers the same 4.15%. CIT offers 4.5%, or 4.75% on a $5,000 balance. VIO is at 4.77%. So Apple’s offering is not amazing, but it’s very good. There are probably lots of people who have been getting terrible rates because they never shopped around, and now Apple is making it really easy for them to get something much better.

It’s still unclear whether this is a fully featured bank account. Can you use it to pay your Apple Card bill? There does not seem to be a Web site.

Dave Mark:

Unless you reject the arbitration provision, you automatically:

• Give up the right to litigate claims,
• Initiate or participate in a class action
• Waive the right to be heard in court or have a jury trial.

From page 13. Worth knowing.

John Gruber:

Peers makes it sound like all a thief needs to empty your bank account is your phone. What the Journal story made clear is that thieves need both your phone and your device passcode. That’s a big difference.

[…]

And the new interest-paying savings accounts are just an alternative to having your Apple Card cash-back go to your Apple Cash account — which pays no interest. So if Peers has successfully spooked any Information readers from signing up for these savings accounts, all he’s succeeded in doing is keeping them from earning interest. There’s zero difference in security.

This is literally true, if you go by Apple’s current framing that this is a way to earn interest on your existing rewards balance. But presumably Apple and Goldman are thinking bigger and would like you to transfer in additional funds. Before, there was no reason to maintain a balance; now there is. Now it becomes relevant that your iPhone passcode is probably less secure and more frequently entered in public than your current banking password. Plus, the banking login may be protected by an additional factor or stored in a separate password manager with its own password.

contrabroker:

It would have been nice if the prompt that was supposed to show up per the instructions to transfer existing Apple Cash balance actually did appear. It did not in my case.

Andrew Abernathy:

I mostly really like the Apple Card (credit card), but there are some issues. Like today when I looked at my transactions and noticed one this morning from Ace Hardware (including showing me the local store); got worried because I haven’t been there in months; had trouble figuring out how to report it; then when I did figure it out, I noticed on that screen an important bit of info: “shown on statement as” — with the name of my dentist’s office (where I actually was this morning).

Not the first time that some bit of automation on Apple’s or Goldman Sach’s side has misidentified a transaction. The other one I recall claimed (every month for a long time) that my Centurylink payment was actually from the US Navy or Marines, and showed me the location, which was an old (and closed) recruitment office.

Previously:

• Changing Apple ID Password Using Only a Device and Passcode
• Apple Card Savings Account

Update (2023-06-02): Juli Clover:

Apple Card customers who have opted to create a high-yield Apple Savings account through Goldman Sachs have been experiencing issues attempting to withdraw their money, according to a report from The Wall Street Journal.

Multiple customers who transferred thousands of dollars to the Apple Savings account have had to wait weeks for money transfers in some cases, and some customers have also had money disappear.

Update (2023-08-09): Greg Pierce:

I like the idea of ease of use, but the interest rate isn’t keeping up with what I get elsewhere. They are at 4.15% and I’m currently getting 4.75% at Betterment. 🤷‍♂️

VIO is now a full point higher at 5.15%, and the others I mentioned have increased, too. All are now the same or higher than Apple.

Apple Card Financial iOS iOS 16 Security Wallet

TidBITS Downsizing and New Direction

Adam Engst (Mastodon):

33 years. That’s how long I’ve been publishing TidBITS, starting in April 1990. Last year was the closest I’ve come to shutting TidBITS down, but with changes that came late in the year, I’m more enthused about TidBITS than I have been in quite some time.

[…]

Plus, since we couldn’t predict when most news would break, I often found myself dropping whatever I was doing to edit Josh’s articles. Much as I liked working with him, I had come to dislike all the editing interruptions, particularly because we found ourselves publishing the same kind of articles over and over again. Outside of the details, news isn’t usually new—stories fall into categories, and after 30-plus years, I have written or edited most of them many times.

[…]

Although I initially thought I’d make more extensive changes—I’m still pondering starting a podcast—I’ve found spending more time in my own head simultaneously relaxing and invigorating. […] I’m actively excited to dive into topics that I think will make a real difference in the lives of many readers.

[…]

I was amused when he said he thought I should focus on writing one article per week on whatever I was doing rather than news of any sort. […] I can’t compete with all the tech reporters at the likes of The New York Times and The Wall Street Journal, nor do I have the loose-lipped industry sources that whisper secrets to Bloomberg’s Mark Gurman. But unlike me, they won’t delve into the murky details of the File Provider extension for cloud storage services or explain how to resolve nagging problems with a Level 2 clean install.

It’s been great seeing more writing from Engst, and I like this new focus.

Previously:

• The End of Computer Magazines in America
• 1,000 Issues of TidBITS

Anniversary Business iOS Mac The Media TidBITS Web

The End of Computer Magazines in America

Harry McCracken (via Jason Snell):

I’m not writing this article because the dead-tree versions of Maximum PC and MacLife are no more. I’m writing it because they were the last two extant U.S. computer magazines that had managed to cling to life until now. With their abandonment of print, the computer magazine era has officially ended.

[…]

Then again, if you want to quibble, Maximum PC and MacLife may barely have counted as U.S. magazines at the end; their editorial operations migrated from the Bay Area to the UK at some point in recent years when I wasn’t paying attention. (Both were owned by Future, a large British publishing firm.)

[…]

But the web didn’t render printed computer magazines obsolete overnight. PCW had some of its fattest, happiest years as a business in the late 1990s. Even in 2008, when I left, the print magazine was a profit center, not an albatross.

Indeed, the entire computer magazine category spent years in Wile E. Coyote mode. We’d blithely walked off a cliff—it’s just that gravity hadn’t kicked in yet.

[…]

Pretending that the internet didn’t exist sounds like a preposterous strategy for keeping a print magazine alive, but it somehow worked. Maximum PC and MacLife survived—scrawny, but with a pulse—until 2023. Their final issues were 98-page weaklings that cost $9.99 apiece and seem to have a grand total of one page of paid advertising between them—plus an article sponsored by a mail-order computer dealer.

John Gruber:

As McCracken himself notes, it’s impossible to overstate the essential role computer magazines played before the web. I read Macworld and MacUser cover-to-cover every month.

Chris Adamson:

The hospital gift shop had a copy of the last issue of the last surviving print computer magazine in the US.

Previously:

• TidBITS Downsizing and New Direction
• DPReview.com to Close
• Amazon Shuts Down Newspaper and Magazine Subscriptions
• MacSurfer Shutting Down
• Goodbye, Mac360
• Apple Removes Apps From Their Affiliate Program
• Macworld UK Ends Print Magazine
• Macworld Layoffs

Business iOS Mac Sunset The Media Web

Price Increases for Developer Tools

Sketch:

We’re writing to let you know that we’re introducing a modest increase to the cost of license renewals from $99 to $120. The new price will come into effect the next time you renew your license, on or after 19 May 2023.

[…]

We don’t take decisions like these lightly but, like everyone else, our running costs are increasing. Doing this helps us remain sustainable and deliver more new features and improvements. Even with these increases, you’ll find our pricing is still favorable compared to our competitors.

Florian Albrecht (tweet):

Very soon, we will be announcing Kaleidoscope 4 with many exciting new features. But before we share details about the new version, we want to outline our subscription pricing and upgrade options for existing customers.

The new subscription price will be $14.99/month or $99/year ($8.25/month). All existing customers will get the first year for half the price.

[…]

We grew the company in order to work on features requests that require more engineering resources. And we have a roadmap that will make Kaleidoscope even more powerful.

Transitioning from paid upgrades to subscription will allow us to follow through on this roadmap.

Sören:

Kaleidoscope 1.0, 2010: ~$36 ($49.67 in 2023 dollars)

Kaleidoscope 2.0, 2013: $69.99 ($90.38)

Kaleidoscope 3.0, 2021: $149.99 ($166.52)

Kaleidoscope 4.0, 2023: $99/yr

Feels like a big ask. OTOH, how do you sustain a business around such a niche tool?

It feels weird because, say, BBEdit is only $49.99 for a perpetual license and about 2 years of feature updates. It does way more than Kaleidoscope, and I spend more than 100x as much time in it. Or, put another way, Kaleidoscope is an expanded version of one of BBEdit’s features, for roughly 4x the price. Plus, there are free alternatives such as FileMerge. Yet that’s not a very useful way of looking at the situation. Kaleidoscope is really good at what it does. For some people the alternatives would suffice, but for others this may be a niche, but it’s a very important one. If a niche product can’t get a lot more customers, the only option seems to be to charge more than the more mass-market products. That can work for a product that when you need it you really need it. As a fan of Kaleidoscope but a light user of it—I do most of my diffing in Tower, BBEdit, and Word—I’m not yet sure which group I’m in.

The main choice, as I see it, is how much development to do. Perhaps one could charge less with fewer new features, built by fewer developers, who are maybe dividing their time among multiple apps. How many new features does the app need, anyway? It already does what I (think I) want; I mainly want it to keep working. But they have lots of ideas and are going in the opposite direction: charging more to support more development. They presumably have reason to expect that they can win over customers who already have perpetual licenses for Kaleidoscope 3.

Another developer tool is Hopper, which has gone from $19 to $45 per major update, to $45 and then $99 per year of updates. To me, it’s similar to Sketch and Kaleidoscope in that I don’t really need a lot of new features, and sometimes I go weeks between uses, but I wouldn’t want to be without it. Hopper is a bit different, though, in that it seems to require regular updates to keep working with Apple’s OS and compiler changes. Those are probably best thought of as new features. Whereas, with Sketch I would expect less breakage due to Apple. The main reason I keep upgrading it is that my designer saves files using the latest version, and then the app scares me into thinking that they won’t work properly if I’m using an older one.

Previously:

• Sketch Layoffs
• Kaleidoscope 3
• Sketch Subscriptions
• Productivity Apps and Subscription Pricing
• New Sketch 4.0 Licensing Model

Update (2023-04-22): See also: Twitter, Hacker News, Christian Tietze.

App Subscriptions Business Developer Tool Hopper Kaleidoscope Mac Mac App macOS 13 Ventura Sketch Top Posts

Creating a Company Contact on iOS

I’ve long wanted to be able to create new business contacts in the iOS Contacts app. On macOS, there’s a checkbox to control whether the contact displays as a person or as a company. The value syncs to iOS, which respects it, but there’s no switch on iOS to mark contacts created there. However, Manfred Linzner-Scherf has a great tip for how the value can be set implicitly. You create the contact on iOS but fill in only the Company field. Then click Done. This gets iOS to remember that it’s a company contact. You can then go back and add the First name and Last name, and it will remain marked as a company.

Contacts iOS iOS 16

Parler Shuts Down

Jon Brodkin (Hacker News):

Parler, the self-described “uncancelable free speech platform,” has been sold and shut down while its new owner conducts a “strategic assessment.” The platform will be back eventually, new owner Starboard says.

Mike Masnick:

You may recall there were stories last fall of Kanye West buying the site, which we noted appeared to be the failed site (with around 50,000 daily active users) trying to take advantage of a troubled rich guy. That deal quickly fell apart.

[…]

It’s not at all clear why one would buy the site just to shut it down, but the CEO of Starboard claimed he still hoped to “retain the platform’s audience.” But… elsewhere he admitted that there’s no real market for a Trumpist social media network.

Certainly not with Trump himself on Truth Social and Instagram, and also restored on Twitter. Gab is still out there, too, for the crowd who wants even less moderation. I guess Starboard just wanted a good deal on a bunch of customer data.

Interestingly, while Parler was intially removed from the App Store for not being sufficiently moderated, Mastodon apps don’t seem to have faced that problem, even though anyone can start up an instance so there’s no guarantee that any particular moderation policy will be followed.

Previously:

• Parler Approved for App Store
• Parler Denied Re-entry to the App Store
• Parler Removed From App Stores and AWS
• Gab Will Become a Mastodon Fork

App Store Business iOS iOS 16 iOS App Mastodon Parler Sunset Web

Angry Birds Company to Be Sold to Sega

Umar Shakir (via Hacker News):

Sega is reportedly close to buying Rovio Entertainment — the company that owns the Angry Birds mobile game franchise — for a whopping $1 billion, according to The Wall Street Journal.

[…]

The original game was a smash success in 2009, but the franchise has seemingly fallen off since its 2014 peak, when Rovio reported falling profits and layoffs.

[…]

Rovio watched as competitors like Candy Crush grew more and more, eating away interest in Angry Birds.

[…]

Recently, Rovio removed its original Angry Birds game from the Google Play Store, and it renamed the iOS version to Red’s First Flight. The move was done seemingly to move players over to its lucrative freemium sequels and obscure the buy once and play forever business model of the original game.

Acquisition Angry Birds Business Game iOS iOS 16 iOS App Sega

“Duplicate” Safari Downloads Replacing Files

jmhbpc:

Not sure when the feature started in Safari wherein duplicate downloads, within close proximity in time, would be replaced by the latest download…

But I have noticed a bit of a flaw in that feature.

Example: When downloading zipped music files at Bandcamp a zip archive of the same name can replace a previous version of the same name: even though its contents are different.

For my example the following can occur: A zip file with my preferred aiff files was deleted when accidentally downloading the same album in a different file format not preferred (mp3)

I’ve been seeing this happen for years when testing downloads of my apps and sometimes when downloading photos. Coalescing identical files makes some sense, but it’s confusing and could delete important data if the files are not actually the same.

Marc Z:

This has definitely been a problem for a long time. I see it frequently. For instance, every year about this time I go to download all my past year’s bank statements to go through for my tax preparation. At least one of my banks names the downloaded file “stmt.txt” with no indication of which month it is. If I click on several months to download each statement, I will only end up with the most recent one as the others get downloaded and then overwritten. So instead of clicking 12 times (once for each month) I have to click, go to the Downloads folder, rename the file with the appropriate month number, go back to Safari, and click on the next month. It’s annoying.

[…]

That’s just one example: I’ve had the problem with downloads on other sites, too. (Like a clipart/stock photo site where I painstakingly went through to find and download thumbnails of a dozen possible graphics I might want to use, and when I went to the Finder there was only a single file saved, called preview.jpg – the site named all the thumbnails the same. 🤦‍♂️

Safari also checks for “duplicates” when asked to open links from other apps. If you click a link and there’s already a tab open for that URL, it will activate that tab instead of opening a new one.

Update (2023-04-21): This tab coalescing can lead to data loss, e.g. if you have typed into a form and then click a link that has the same URL as the form it will reload the page and discard what you entered.

Bandcamp Bug Datacide Mac macOS 13 Ventura Safari

Swift’s Versioned canImport()

Marco Eidinger:

SwiftUI.Font.width(_:) was actually introduced in iOS 16.1 and not in iOS 16.0 as the documentation suggests.

[…]

While researching a solution, I stumbled on an interesting fact that #if canImport allows specifying a version that gets checked during compile-time. The version gets compared against the -user-module-version flag in the .swiftmodule file using.

[…]

Suppose the framework and the APIs in question are cross-platform. In that case, you can (theoretically) write a single query to determine the build time availability of the API across multiple platforms because module versions tend to be aligned across the aligned platform-specific SDKs.

It allows you to gracefully handle things like APIs introduced midway through the betas even though the overall system/SDK version number hasn’t changed.

But you have to figure out the user-module-version of the framework.

iOS iOS 16 Mac OS X 10.9 Mavericks macOS 13 Ventura Programming Swift Programming Language SwiftUI

Katie Cotton, RIP

The Express Times:

She arrived in California from New Jersey in 1988 ready to make her mark on the world. And so she did.

Katie is recognized as one of the most remarkable women in Public Relations and Marketing in Technology. In her role as Vice President of Worldwide Corporate Communications for Apple Inc., she worked most of her 18-year career directly for Steve Jobs. She was a strong and unwavering proponent for the company, helping to elevate its products and brand.

John Gruber:

I always appreciated Cotton’s forthrightness, and part of that is Apple’s institutional default to “no comment” when asked about anything other than what Apple wants to talk about. Those “no comments” seem to downright offend some reporters, but to me, they’re a sign of respect. Better not to say anything at all, and waste no one’s time, than to offer up a lengthy but meaningless pile of bullshit, which in my experience is how most PR teams operate.

Walt Mossberg:

Katie was a formidable figure for 18 years at Apple and I worked closely with her for most of that time. She was a key partner to Steve Jobs, who trusted her judgement.

[…]

Katie brilliantly led the media strategy for the historic run of big products during Jobs’s second tenure running Apple.

[…]

She had a big impact on Apple and the tech media and built a great team.

Daniel Jalkut:

Kinda feels like Katie Cotton passing should be front-page Apple memorial material.

See also: Mark Gurman.

Update (2023-05-08): Richard Sandomir:

Ms. Cotton, who built a culture of mystery by saying relatively little, if anything, to reporters, joined Apple in 1996 and began working with Mr. Jobs the next year, soon after he returned to the company after 12 years away. Apple was in poor financial shape at the time, but Ms. Cotton worked with him to engineer a striking turnaround.

Together they crafted a tightly controlled public relations strategy as the company recovered from steep losses and turned out one successful product after another, including the iMac desktop computer and innovative digital devices like the iPod, the iPhone and the iPad.

[…]

“She was accessible, she was a point of contact,” said John Markoff, a former technology reporter for The New York Times, “but sometimes it was hand-to-hand combat if they wanted to convey a story to the world and it wasn’t the story I wanted to tell.”

[…]

Richard Stengel, a former managing editor of Time magazine, said in an email that Mr. Jobs “would call me five or six times in a day to tell me I should do a story or not,” and that Ms. Cotton would “frequently call right after and gently apologize or pull back something he had said.”

Apple iOS Mac Marketing Rest in Peace The Media

Make Something Wonderful

Steve Jobs Archive (MacRumors, Hacker News):

A curated collection of Steve’s speeches, interviews and correspondence, Make Something Wonderful offers an unparalleled window into how one of the world’s most creative entrepreneurs approached his life and work. In these pages, Steve shares his perspective on his childhood, on launching and being pushed out of Apple, on his time with Pixar and NeXT, and on his ultimate return to the company that started it all.

Featuring an introduction by Laurene Powell Jobs and edited by Leslie Berlin, this beautiful handbook is designed to inspire readers to make their own “wonderful somethings” that move the world forward.

It’s even available as an EPUB file.

Stephen Hackett:

The holy grail, it would seem, is the physical edition of the book, which has been given to employees at both Apple and Disney.

As of this writing, there are roughly two dozen of them for sale on eBay, with prices as high as $25,000. Many of the listings have active bidders, most of them in the $1,000 range or so.

John Gruber:

Also, for everyone enjoying the book on the website, due to a regression in the latest version of Safari/WebKit, it works best in Chromium browser. (Example: the full-screen pages lock into place as you swipe.)

Sebastiaan de With:

It’s hard to capture the delight of a real book, but this website does a fantastic job coming close. Lots delightful, thoughtful little details.

Jason Snell:

I have to admit that the existence of the Steve Jobs Archive generates mixed feelings in me. It’s dedicated to curating the work of an important historical figure, but also feels a bit like it’s designed to be a hagiographic tool for influencing how Jobs is remembered by history. (Given how history tends to flatten people’s life stories and accomplishments into caricature or outright falsehood, I entirely understand the impulse.)

[…]

The highlight of the book, however, is his Stanford commencement address from 2005. It’s a remarkable speech to begin with, one that will likely be quoted for years to come. But the book also provides Jobs’s notes to himself as he began planning what to say in the speech! (He just kept sending himself emails whenever he thought of something, and because of that quirk, we get to peek inside his thought process.)

Previously:

• The Steve Jobs Archive

Update (2023-04-21): Adam Chandler:

[You] can also show “completed” listings and those are averaging $350-$500

Book History iOS Mac Safari Steve Jobs Web WebKit

macOS 12.6.5 and macOS 11.7.6

Apple (full installer, MacRumors):

This document describes the security content of macOS Monterey 12.6.5.

Apple (full installer):

This document describes the security content of macOS Big Sur 11.7.6.

Previously:

• macOS 13.3.1
• macOS 12.6.4 and 11.7.5

Mac macOS 11.0 Big Sur macOS 12 Monterey macOS Release

New Macs All Have Model Identifier “Mac”

Oskar Groth:

Well this just broke – seems like Apple changed the model identifiers for new M2 Macs. Regardless of model, Macs are now just called Mac14,1, Mac15,2 etc. I wonder if there’s still a way to figure this out without hardcoding all identifiers…

When the Mac Studio was Mac13,1 and Mac13,2, I didn’t think much of it, since no other Mac had been using the Mac prefix. But it turns out that the M2 MacBook Air is Mac14,2, the M2 Mac mini is Mac14,3 and Mac14,12, and the M2 MacBook Pro Mac14,5, Mac14,9, Mac14,6, and Mac14,10. So you can no longer just look at the prefix to get the Mac family for statistical purposes. I have been overestimating the number of customers that have a Mac Studio.

The full list of Mac model identifiers is here.

Previously:

• MacBook Pro 2023
• Mac mini 2023
• MacBook Air 2022
• Mac Studio

Mac Mac Studio MacBook Air MacBook Pro macOS 13 Ventura

Peer Group Benchmarks

Apple:

Peer group benchmarks provide powerful new insights across the customer journey, so you can better understand what works well for your app and find opportunities for improvement. Apps are placed into groups based on their App Store category, business model, and download volume to ensure relevant comparisons. Using industry-leading differential privacy techniques, peer group benchmarks provide relevant and actionable insights — all while keeping the performance of individual apps private.

Jeff Johnson:

My proceeds per paying user are $7.48 [for a $9.99 app]. I’m in the App Store Small Business Program, so Apple’s cut is 15% rather than 30%, which leaves me with $8.49 USD. I guess that foreign currency exchange rates bring down my average by $1? Or maybe the amount includes refunds, I don’t know.

In both the iOS App Store and Mac App Store, my proceeds per paying user put me in the top quartile of all upfront paid apps with no In App Purchase, despite the fact that both of my apps cost under $10. Indeed, according to the numbers given, a mere $5 in proceeds per paying user would have put me in the top quartile. Curiously, the quartiles are divided by exactly the same dollar amounts in the iOS and Mac App Stores; I don’t know the explanation for that.

If I look at my peer group, the Utilities category, as opposed to all categories in the above screenshots, the numbers are approximately the same but actually a little “worse”: in both the iOS and Mac App Store, it’s $1.33 proceeds per paying user to qualify for the 2nd quartile, $2.47 for the 3rd quartile, and $4.36 for the top quartile.

Indeed, I have a utility in the top quartile at $4.66. And the numbers seem to have changed such that now you only need $4.28 to be in the 75th percentile in Utilities, and $6.31 in Productiivty.

Previously:

• Apple Responds to Spotify
• Apple “Frustrated” That “People Don’t Want to Pay Anything”

App Store Business iOS iOS 16 iTunes Connect Mac Mac App Store macOS 13 Ventura

Shortcat 0.11.4

Sproutcube (via Rui Carmo):

Shortcat indexes your Mac’s user interface and makes them available to you in a powerful command palette.

Click buttons, focus text fields, invoke menu commands, switch windows, and more; no mouse required.

[…]

Shortcat lets you search window titles for more precise multi-tasking. No more Command + Tab and Command + Backticks!

[…]

Navigate around your web apps and websites by just typing what you want.

Previously:

• Command Bars

Update (2023-04-26): See also: Contexts and SuperKey.

Keyboard Shortcuts Mac Mac App macOS 13 Ventura Open Source

C23 Standard Sets the World on Fire

Terence Kelly and Borer Yekai Pan (via Hacker News):

Like the previous major revision, C11, the latest standard introduces several useful features. The most important, if not the most exciting, make it easier to write safe, correct, and secure code. For example, the new <stdckdint.h> header standardizes checked integer arithmetic[…]

[…]

In addition to these new correctness and safety aids, C23 provides many new conveniences: Constants true, false, and nullptr are now language keywords; mercifully, they mean what you expect. The new typeof feature makes it easier to harmonize variable declarations. The preprocessor can now #embed arbitrary binary data in source files. Zero-initializing stack-allocated structures and variable-length arrays is a snap with the new standard ={} syntax.

[…]

Standard C hides behind a paywall: The official standard currently costs more than $200, so most coders make do with unofficial drafts. The standard routinely confuses its own authors, and crucial parts mystify even experienced and well-educated programmers; baffled silence is not consent.

[…]

C23 furthermore gives the compiler license to use an unreachable annotation on one code path to justify removing, without notice or warning, an entirely different code path that is not marked unreachable[…]

[…]

Imagine, then, my dismay when I learned that C23 declares realloc(ptr,0) to be undefined behavior, thereby pulling the rug out from under a widespread and exemplary pattern deliberately condoned by C89 through C11.

Previously:

• C23 Is Finished

C Programming Language Documentation Integer Overflow Language Design Optimization Programming Security

Casting in XCTest Methods

Paul Samuels:

The XCTest framework added the super helpful function XCTUnwrap back in Xcode 11. At the time I added a similar helper to my various projects to help smooth over the many cases where casting is required. The idea is to have a similar call site to XCTUnwrap but for use in situations where you want to verify you have the right type or fail.

His example also demonstrates using the new record(_ issue: XCTIssue) method, which lets you provide more information than just failing with a string description.

I added casting to my tests around the time I added unwrapping and find it very helpful. And you can often use type inference to avoid having to pass in the type.

Previously:

• Passing Types to Swift Functions
• Let Your Swift XCTest Methods Throw

Mac macOS 13 Ventura Programming Swift Programming Language Testing Xcode

Checking the Real Apple Account Balance

John Gordon:

His account [in the Mac App Store] shows $150 as a balance, but that’s wrong. If you click on Profile and drill down to this Accounts page (requires authentication) you will see the correct amount of $135.37. Evidently the amount displayed on the App Store screen is copied there from another system and there’s a time lag. In my testing I’ve found that the lag is at least a day and I suspect it only updates when one checks the Apple Account (requires authentication). So, in reality, the Apple Account is the only way to know this number.

Apple doesn’t mention this, but you can also get to this Accounts page (which has the accurate numbers) from iTunes/Music. You can’t get to it from the web however; appleid.apple.com doesn’t have this data.

I’ve also found the displayed balance to often be stale and inconsistent among different devices and apps.

Apple ID Bug Family Sharing Mac Mac App Store macOS 13 Ventura Payments

macOS Cursor Images

Matt Birchler (Hacker News):

Some design assets some of you may love!

macOS Cursors has SVGs of basically (actually?) every cursor from macOS.

Emoji Toolkit has 135 common emoji in vector format (Figma, Sketch, and Photoshop versions) so you ever need to use emoji at larger sizes than like 72pts.

ishvanl:

Final Cut Pro, Apple’s flagship video editing software, overrides the default MacOS cursor with a nearly identical, but slightly different cursor shape. It’s almost exactly the same as the standard retina MacOS cursor but the little “stem” at the bottom is shorter & points slightly more to the right. I’d expect this from a weird niche bit of open source software, but for one of the Mac’s flagship applications it’s a bit strange. Perhaps someone here could enlighten me to the purpose of this bizarre quirk.

ChilledTonic:

If you want to investigate the history of the macOS cursor, and other cursor schemes, I highly recommend this video.

Previously:

• SVG to SwiftUI Converter

Update (2023-04-22): Léo Natan:

It seems that SwiftUI caches the current cursor image, so even if it is changed in Settings, Settings itself displays the wrong cursor on screens that have been rendered at least once.

Bug Design Emoji Final Cut Pro X Graphic Design History Icons Mac macOS 13 Ventura SVG SwiftUI

Keyboard Shortcuts for Exporting From Photos.app

Ole Begemann:

1. The Photos app on macOS doesn’t provide a keyboard shortcut for the Export Unmodified Original command.
2. macOS allows you to add your own app-specific keyboard shortcuts via System Settings > Keyboard > Keyboard Shortcuts > App Shortcuts. You need to enter the exact spelling of the menu item you want to invoke.
3. Photos renames the command depending on what’s selected: Export Unmodified Original For 1 Photo“ turns into ”… Originals For 2 Videos“ turns into “… For 3 Items” (for mixed selections), and so on. Argh!

So he wrote a shell script to add shortcuts for all the different numbers to the user defaults. I would have probably done this with GUI scripting and FastScripts or Keyboard Maestro, but this method doesn’t require any third-party software.

There’s a bug in Photos.app on macOS 13.2 (and at least some earlier versions). Custom keyboard shortcuts don’t work until you’ve opened the menu of the respective command at least once.

Previously:

• CustomShortcuts 1.0

Esoteric Preferences Keyboard Shortcuts Mac macOS 13 Ventura Photos.app

Side Mirror 2.5

Ben Scheirman:

Side Mirror allows you to select any attached display on your Mac and run it in a window.

This can be useful for a number of reasons:

• During live presentations, to avoid looking back at a projector screen. You can see it and monitor what the audience sees right on your Mac. This keeps your eyes front toward the audience. Your main screen can have presenter notes, snippets to copy & paste, files to drag, etc.
• Using a cheap HDMI dummy adapter (like this one), you can get a virtual screen in macOS. Using Side Mirror, you can put this screen inside a window.

It’s $24.99 in the Mac App Store.

Mac Mac App macOS 13 Ventura Multiple Displays Side Mirror

Photos, Spotlight, and iCloud

Nick Heer:

So I assumed this message would disappear after my Mac figured out I had moved its library. A week later, it has not disappeared and images from Photos are, indeed, not searchable in Spotlight. Apple’s documentation implies Spotlight will work for whichever library is the system one, but the message in Photos implies that libraries stored on external drives will not be indexed.

[…]

My Mac has been dutifully downloading tens of thousands of original media files from iCloud until earlier this week when it decided to stop. The only information I have is a message in Photos, saying there are 42 originals not yet downloaded — but which ones are missing is anyone’s guess. Photos has Smart Albums but, unlike Music, it does not have a filtering criteria for whether the original file has been downloaded. There does not appear to be any logging, nor any status window. While writing this paragraph, I can see the library file slowly increasing in size; however, the number of original files remaining to be downloaded has not budged.

[…]

Happily, after repairing my library and waiting for it to reconcile with iCloud, it seems there were only 21 missing original media files which needed a local copy, and they seem to have downloaded. I still do not know what they were. I only have myself to blame for getting to this point. Even so, the lack of any way for me to figure out which items are only in iCloud and not on my local drive is a baffling omission. It is not quite a silent failure but it is in the spirit of one, where Apple seems to have assumed that its software will perform correctly and users should never need to intervene. In the real world, I just wanted to know what it was waiting on.

Like Josh Hill, he was using optimized photo storage. I think this is really common, even among people who know better, because it’s so much easier. Apple continues to use expensive and relatively low capacity SSDs, so many photo libraries just won’t fit on internal storage.

External storage is then the only way to download originals and, thus, back up your library, but it’s a pain, especially with a portable Mac. Even if you do get external storage and figure out how to use it with Photos, it doesn’t work the way you would want. Aside from the potential Spotlight limitation, having your whole photo library on the external drive is not ideal. That drive is then required to do anything with Photos, and performance is worse because you can’t keep the photo database on your fastest storage.

With Lightroom, I can keep metadata and thumbnails on the internal SSD, while offloading older originals to secondary storage. Apple’s Aperture could do stuff like this, too, but it’s not possible with Photos.

Scott Gruby:

You would think that Apple would put something in iCloud Photos that would warn you if 15K pictures were deleted. I went to look for a photo today and found out that I no longer had my full library. On disc, it was down to 85GB from 185GB. Luckily I had a separate backup from mid February and was able to import the photos.

Daily backups that overwrite your data only protects against hardware failure. Time Machine to a local drive (TM to a network sucks) or rotating external drives are key.

Previously:

• Photos Data Loss With macOS 13.3 Beta
• Your Memories, Their Cloud
• Silent Failure
• Apple Lowers SSD Prices

Adobe Lightroom Aperture Backup Datacide iCloud iCloud Photo Library Mac macOS 13 Ventura Photos.app Solid-State Drive (SSD) Spotlight Storage

Xcode Files With Source-Control Status

Jesse Squires:

I usually use Git Tower to review and commit my changes, but you can’t edit files in Git Tower, which means switching back-and-forth between Xcode if you need to make additional modifications. Xcode provides a nice commit interface that allows editing, but it isn’t always easy to use for editing — the side-by-side view forces lines to wrap and sometimes scrolling is wonky. File selection in this view is often glitchy, too.

[…]

Instead of trying to use Git Tower or Xcode’s commit UI, you can filter the files in the sidebar to show only ones that have been modified! It’s a very subtle button in the bottom right corner with a +/- icon. Click that and Xcode will hide all the files you haven’t touched. I’ve found this to be helpful for focusing specifically on the changes I’m making and removing all the clutter in large projects.

Xcode has had this feature for a while, but I only started using it recently after Apple fixed the bug where enabling this mode would mess up the outline expansion state in the regular view.

Besides reviewing commits, it’s also useful for regular coding, as it makes it easy to jump back and forth between files that I’m working on in different folders. I find that this often works better than tabs, which require more work to set up which files to Keep Open and to close the ones that are no longer relevant because there isn’t room to view many at a time.

Instead, I tend to use tabs for files that may not be modified but that I frequently want to flip back to. For example, I want quick access to the main English Localizable.strings files in my project because these are hard to access using Open Quickly… with so many for different languages.

Git Mac macOS 13 Ventura Programming Version Control Xcode

2023 Six Colors Apple in the Enterprise Report Card

Jason Snell (tweet):

In most categories, our panel’s view of Apple in the enterprise was on an upswing. The company made large gains in the categories of enterprise service and support and in macOS identity management (its 3.3 average was still fairly low overall, but up a whopping 0.4 from last year). However, Apple took a big hit in the deployment category, which dropped 0.2 to become the lowest scoring category in the survey.

We also asked a couple of questions outside the traditional set. For the second straight year, we asked about the pace of operating-system adoption. There was a big change here, with “quicker than usual” moving from 37% last year to 51% this year. (A decision by Apple to force a Ventura update as a “minor” upgrade may be at least partially responsible—see the comments in that category for the gory details.)

[…]

More than half of the people who answered said that while they allowed the App Store, they wouldn’t want to allow third-party app stores. In their detailed comments, several expressed concern that any policy ruling that forced Apple’s hand might make it harder for admins to block third-party app stores, which would make them very unhappy.

Previously:

• iOS 16.4 and iPadOS 16.4
• 2022 Six Colors Apple Report Card
• 2022 Six Colors Apple in the Enterprise Report Card

Apple ID Apple Software Quality Education iOS iOS 16 iPad iPadOS 16 Mac macOS 13 Ventura Mobile Device Management (MDM) Sideloading Software Update

SVG to SwiftUI Converter

Antoni Silvestrovic (via Dave Verwer):

Tool to convert SVG to SwiftUI’s Shape structure. This approach is much more memory efficient than introducing a SVG library for rendering.

[…]

This repository is just a front-end wrapper over our svg-to-swiftui-core (npm link) package.

[…]

To demonstrate this tool I created a thicc plus sign with rounded corners (created it in Sketch, so shapes from Sketch should work fine with this tool). It’s saved as content/demo-plus.svg file in this repository. You can see below how it looks like in the browser, and how it looks like after converting into SwiftUI Shape.

Previously:

• ChatGPT for Apple Platforms Development
• PaintCode 3 Leaves the Mac App Store
• WebCode 1.0

Code Generation iOS iOS 16 Mac macOS 13 Ventura Open Source Programming SVG Swift Programming Language SwiftUI

Recovery on Apple Silicon Macs Has Changed Again

Howard Oakley:

Recovery modes on Apple silicon Macs have also changed. In Big Sur, the primary Recovery system is stored in a hidden container on the internal SSD, and a fallback Recovery system in a volume alongside the boot volume group. Monterey swapped those over, so primary Recovery goes into the paired volume in the boot volume group, and fallback Recovery into the hidden container on the internal SSD.

[…]

Now, at least in Ventura 13.2.1, and presumably in recent releases of Monterey with their firmware updates, you can enter fallback Recovery with a restart, instead of having to start up cold, but that normally enters fallback rather than primary (paired) Recovery mode.

I used to be really good at administering Macs, but now I find tasks related to installing, booting, and recovery so confusing. I thought things would get simpler with Apple integrating more of the stack. But with more security stuff and multiple modes, and limitations on what third-party apps can do to help, it’s gotten more complicated and error prone, and it always seems to be changing.

Previously:

• “Volume contains a macOS or OS X installation which may be damaged”
• macOS 13.2.x and Recovery, a Sad Tale
• Free Space Required for Modern macOS Upgrades
• How Recovery Works on M1 Series Macs
• Booting an M1 Mac From an External Disk With Monterey
• Owner Accounts on M1 Macs
• Big Sur Really Needs Real Free Space
• Check Free Space Before Updating to Big Sur
• No More Big Sur Internet Recovery
• What to Do When a macOS Update Goes Wrong
• How to Restore BridgeOS on Your T2 Mac
• Installing Old Versions of macOS

Mac macOS 13 Ventura macOS Recovery Security

News Is Not a Normal Mac App

Jeff Johnson on the News app’s Share menu:

This doesn’t open in Safari but rather in my default web browser, which is Link Unshortener.

Any normal Mac app — including Link Unshortener — can call the API to determine which app is your default web browser.

They did restore the Open in Safari menu command, but it badly needs a keyboard shortcut. Both this command and the share menu say “Safari,” but they actually follow the Default web browser system setting. Ultimately, this is up to News, but why doesn’t the system have a built-in sharing service with the proper icon, name, and behavior?

Jeff Johnson:

The Mac News app forgets my window size on every launch.

For me, sometimes it remembers the size and sometimes it forgets.

Previously:

• The Apple Services Experience Is Not Good Enough
• Funneling Into Apple News+
• Catalyst and Cohesion
• Desktop Apps Post-Catalyst

Update (2023-04-24): Jeff Johnson:

News forgetting the window size is actually the bug I wrote about here.

The irony is that I filed the bug against Monterey, but they wanted me to test the Ventura beta.

That seems reasonable to me if Apple can’t reproduce the issue on the latest beta or if they actually think they have fixed it. The problem is that a lot of times these requests to re-test just seem to be someone trying to blindly close lots of bugs. Then it just waste’s everyone’s time to verify a bug that is not being worked on, anyway.

Apple News Bug Catalyst (Marzipan) Keyboard Shortcuts Mac macOS 12 Monterey macOS 13 Ventura Radar and Feedback Assistant

Twitter Restricts Substack Links

Timothy B. Lee (Hacker News):

Twitter users on Friday began noticing that they could not retweet or reply to tweets containing links to the Substack.com domain. This behavior seems to have started less than 48 hours after the popular newsletter platform announced a new product called Notes that will compete directly with Twitter.

[…]

In the last 24 hours, Twitter also appears to have started blocking tweet-embedding in Substack posts.

[…]

I emailed Twitter’s official press email address, press@twitter.com, for comment. Twitter automatically replies to all emails at that account with the message “💩.”

Elon Musk:

1. Substack links were never blocked.[…]
2. Substack was trying to download a massive portion of the Twitter database to bootstrap their Twitter clone, so their IP address is obviously untrusted.
3. Turns out Matt [Taibbi] is/was an employee of Substack.

As far as I can tell, (1) and (3) are false.

See also: The Verge.

GiftedHorse:

Twitter is now censoring competitors by outright lying and placing false “this is harmful/spam” warnings when clicking on competitors’ links. This caused me to (for the n-th time since 2022) Google for “Twitter alternatives”. But clear results are hard to find in today’s SEO-mess, and sifting through old/unstructured news articles isn’t ideal either. So I spent a few hours making twitter-alternatives.com (and twitalternatives.com).

It’s a simple table of all currently known Twitter Alternatives and their main traits, like Top Countries, Platforms, Security, Notable Accounts, etc.

[…]

My main learning from this is that surprisingly, nobody has literally just cloned Twitter and focused on porting everyone over.

Previously:

• Migrating From Twitter to Mastodon
• The Struggle for Twitter Alternatives

Update (2023-04-24): Decoder:

[Nilay Patel:] Just to be clear, Elon’s claim is: “Substack was trying to download a massive portion of the Twitter database to bootstrap their Twitter clone.” Were you doing that?

[Chris Best:] No. And it’s one of several claims that got bandied around during this time. It’s not true.

[…]

We’ve been trying every route that we can to calm this down and sort of find a peaceful resolution that can help writers. That hasn’t totally worked, and we haven’t had any answers to our specific questions of, “Are there things that we could do to make this better?”

[…]

Are there things that we could do to resolve this? They haven’t answered with any specifics.

Mike Masnick:

You’ve likely heard about recent leaks of Pentagon documents that were first leaked via a Discord server. On Wednesday, the Washington Post’s Shane Harris and Samuel Oakford broke quite a story about where the documents came from, discussing the small, private Discord group, and the guy who operated it, who apparently went to great lengths to leak these classified documents.

[…]

Anyhow, all that is lead up to the fact that Twitter now appears to be permanently suspending at least some accounts that have shared the Washington Post story.

Cabel Sasser:

I just want to confirm: this was 1000% a lie, right?

Amanda Silberling (via John Gruber):

Numerous Twitter users are reporting a bug in which Circle tweets — which are supposed to reach a select group, like an Instagram Close Friends story — are surfacing on the algorithmically generated For You timeline. That means that your supposedly private posts might breach containment to reach an unintended audience, which could quickly spark some uncomfortable situations.

Previously:

• Other People’s Playlists in Your Apple Music

Elon Musk Substack Twitter Web

Microsoft Teams Rewrite

Jeff Teper (via Ben Sandofsky, Slashdot):

We have been listening to your feedback which has culminated in a reimagining of Teams from the ground up. The new app is built on a foundation of speed, performance, flexibility, and intelligence—delivering up to two times faster performance while using 50 percent less memory so you can save time and collaborate more efficiently.

[…]

We are targeting the general availability of new Teams later this year in 2023. In the meantime, we encourage our commercial customers using Windows to try the public preview, which is rolling out starting today. We intend to extend the preview release to a broader set of customers, including those using Macs later this year.

Jérôme Danthinne:

[Dropping Electron] But still not going native, but Webview + React.

Microsoft Teams (via Casey Muratori, Hacker News):

This video showcases some of the key speed and performance advantages of new Teams over classic Teams.

The new version takes 9.1 seconds to launch, 3.5 seconds to switch between chats and channels, and uses almost 600 MB of RAM when idle.

Previously:

• Performance of Microsoft Teams
• Visual Studio and Teams Get More Native
• The Persistent Gravity of Cross Platform
• Rebuilding Slack on the Desktop
• Rewriting Facebook Messenger

Electron Mac Mac App macOS 13 Ventura Microsoft Teams Software Rewrite Windows Windows 11 Windows App

Substack Pricing Experiment

Gergely Orosz:

Wow. @SubstackInc experimented with pricing, reducing it by 1 cent, so e.g. instead of $10/month, do $9.99/month.

The result?

A significant decrease for the pricing ending with .99. Which goes against conventional pricing wisdom!!

Paddle:

The actual appearance of your published prices can have subconscious effects on your potential customers that increase sales. In some cases, smaller details like ending your prices in 0’s or 5’s and avoiding decimal pricing can justify a higher price by presenting an image of higher quality. This type of psychological pricing strategy is used in high end restaurants all the time, and you rarely see a price like “8.99” for a meal unless you’re in a chain or franchise establishment. Prices ending in 9 are meant to persuade consumers they’re getting a bargain, but prices consisting of round numbers (no cents, no decimals) can subliminally convince customers that your company has integrity and your product is sophisticated. In other words, it’s worth the high price they pay.

Elizabeth Lopatto:

Substack is desperate, huh? That’s what I understand from their fundraising email, anyway. They’re now hitting up retail investors for millions of dollars after they failed to raise last year.

[…]

Substack makes its money by taking a 10 percent cut of the subscription fees its newsletter writers charge. (Its payment processor takes another 4 percent, according to Wefunder.) The company says it paid out more than $300 million to writers, cumulatively.

[…]

Doubled their revenue in a year! Not too bad. I might have some other feelings if I knew anything about their cost basis, but unfortunately, I don’t. So I don’t know if the company is profitable, but I am going to take a flying leap and assume not — because in this environment, profitability is something to brag about.

Previously:

• Smaller App Store Pricing Increments

Business Marketing Substack The Media Web

Bakery 2.11

Jordi Bruin (via Paul Hudson):

Generate beautiful placeholder app icons for your Xcode projects with Bakery!

If your homescreens are filled with apps with the white placeholder icon, Bakery is for you! Quickly generate beautiful simple and distinctive app icons that make your (side) projects stand out!

This looks cool, though I’m not sure whether it’s still under development. The last update was a year ago, and the Web site is down.

Update (2023-04-21): Jordi Bruin:

I’ll release Bakery 3.0 if it beats out Rocketsim 😉

Jordi Bruin:

I need to get my company site up again. V3.0 is coming in may 🙂

Developer Tool Graphics Icons Mac Mac App macOS 13 Ventura

Mac Security Bugs Expose Location and Safari History

Guilherme Rambo:

However, when it comes to these local XPC services, the assumption that their scope is limited -- both in terms of functionality as well as which processes can even look them up to initiate a connection in the first place — means that not all local XPC services on macOS have strong authentication for clients.

[…]

Well, turns out you could just symlink another bundle’s Contents/XPCServices directory into your own app’s Contents/XPCServices, and launchd would happily follow that symlink and allow your app to lookup and connect to a local XPC service embedded in a completely unrelated bundle.

[…]

One of the things this service handles is the “Set timezone automatically using your current location” option. When enabled, the preference pane uses the bundled XPC service in order to obtain the current device location. Because the location request goes through TimeZoneService and it has the effective bundle entitlement, what the location icon in the Menu Bar shows is just “Setting Time Zone”.

[…]

Safari’s history agent was not validating client processes that connected to it, which meant that any process running on the system could access the user’s Safari browsing history.

He recommends the new setCodeSigningRequirement(_:) API.

Previously:

• macOS 13.3
• macOS 13.2
• SiriSpy Bug
• Privileged Operations on macOS
• PrivilegedHelperTools and Checking XPC Peers

Apple Security Bounty Bug Code Signing GPS Mac macOS 13 Ventura Privacy Programming Safari Security Time XPC

Carrier-Forced Wi-Fi Offloading

newZWhoDis:

Essentially, the latest iOS (16.4 at post time) allows your cellular carrier (via eSIM) to add “managed networks” to your device.

These networks cannot be removed, they cannot have “automatically join” disabled, and they have equal priority with your real, personal networks.

So guess what happens when your neighbors get a wifi/modem combo that blasts a free hotspot SSID? Not only does it pollute the already crowded 2.4ghz band, your iPhone will often prefer this connection over your real /local wifi (despite said wifi being at 1 bar).

As of post-time, there is no way to remove these networks short of completely disabling cell service/removing the eSIM and resetting all network settings.

seraphsf:

Wifi offloading is not new. AT&T helped invent these standards back in ~2009 when their network was getting crushed by massive increases in traffic as iPhone usage took off.

WiFi offload networks are configured as “Managed Networks” which are lower priority than any user-selected networks. You can disable them by turning off “auto-join”. (Also these WiFi offload networks are secure; you can’t spoof them).

However it appears that the original poster’s carrier (presumably Xfinity Mobile or Spectrum Mobile) has done something new - they’ve disabled the user’s ability to turn off “auto-join” on iOS. Some overzealous team is trying to lower their cellular costs. That’s because both Comcast and Spectrum rent capacity on Verizon Wireless towers, but their MVNO cellular service is not profitable unless their customers are using the cable company’s own WiFi fairly often.

trafficante:

I noticed this a couple days back at Home Depot, of all places. Was looking up the locations of stuff I needed to pick up via their website while sitting out in the parking lot and my iPhone kept switching off 5g to hop on some single bar wifi that I couldn’t delete or deselect auto-join.

Eventually just turned off wifi and the problem was “solved” but man this is going to be annoying if it starts happening at the grocery store or something.

Previously:

• iOS 16.4 and iPadOS 16.4

Carrier iOS iOS 16 Wi-Fi

iOS 16.4.1 and iPadOS 16.4.1

Juli Clover (release notes, security):

According to Apple’s release notes, iOS 16.4.1 add a fix for an issue that could cause Siri not to respond in some cases, and it adds skin tones variations for the pushing hands emoji.

Juli Clover:

According to Apple's security support documents for iOS and macOS, the new software includes fixes for two separate vulnerabilities, both of which were known by Apple to have been actively exploited in the wild.

Hopefully this will also fix Universal Clipboard and the Weather app.

Previously:

• macOS 13.3.1
• iOS 16.4 and iPadOS 16.4

Continuity Handoff iOS iOS 16 iOS Release iPadOS iPadOS 16 iPadOS Release Security Siri

macOS 13.3.1

Juli Clover (release notes, security, full installer, IPSW):

According to Apple’s release notes for the update, it introduces a fix for a bug that could cause Auto Unlock with Apple Watch not to work, plus it includes a fix for an issue that caused the pushing hands emoji not to show skin tone variations.

See also: Howard Oakley, Mr. Macintosh.

Previously:

• iOS 16.4.1 and iPadOS 16.4.1
• macOS 13.3

Update (2023-04-22): Maynard Handley:

If anything 13.3.1 is more of a disaster than 13.3.

(a) Unmounting then remounting all external volumes every 5 minutes! WTF???

(b) PERMANENT decal of the volume control icon sitting in the middle of the screen!!!

Joe Rosensteel:

The latest point release of macOS (13.3.1) broke my screensaver. The screensaver works as expected on the MacBook when it’s not plugged into any external displays, and it works on one of the two monitors when it’s connected to two external displays, but the right monitor is always broken. I use “Classic” set to “Colors”. When the screensaver kicks on the right monitor just shows a black screen that says “No Photos”. How did it somehow manage to decouple the screensaver between displays?

Update (2023-04-24): Gabriel Zachmann:

With the latest upgrade to macOS 13.3, I have received a few reports from users that my screensaver (a real .saver) looks funny when the Mac has two monitors, the built-in one and an external one.

kipmanley:

I read all the other comments concerning this fault after the update to Ventura 13.3, all happening with external monitors. So I don't feel alone. If I disconnect my 27 inch AOC external monitor, the problem goes away and the iMac shows my photos just fine.

Update (2023-04-25): Howard Oakley:

macOS Ventura 13.3.1 has a bug preventing the password for encrypted sparse bundles from being changed using hdiutil. As there’s no alternative method, this has a high impact on those using encrypted sparse bundles, for instance to store Time Machine backups on network shares.

[…]

Thanks to Paolo for confirming that this bug isn’t present in 13.2.1. This makes it most likely that it was introduced in 13.3, or possibly 13.3.1.

Bug Continuity Disk Image Handoff Mac macOS 13 Ventura macOS Release Multiple Displays Screensaver Storage

Jacob Ziv, RIP

Matthieu Bloch (Hacker News):

Jacob Ziv, known for his pioneering contributions to communication and information theory that inspired generations of researchers, passed away on March 25, 2023 at the age of 91. Perhaps his most celebrated achievement is the creation, together with Abraham Lempel, of efficient universal compression algorithms, known as LZ77 and LZ78. These algorithms have had a profound and far reaching impact in digital technologies including the widely used gzip package and the GIF image format.

Yuval Mann:

In 2004, the International Association of Electrical and Electronics Engineers (IEEE) declared that the Lempel-Ziv algorithm is a “milestone in the fields of electronics and computer engineering” and that it “made a significant contribution to the transformation of the internet into an effective means of global communication.”

In 2011, Prof. Ziv was awarded the 2021 IEEE Medal of Honor for his extensive work, his broad contribution to information theory and data compression, and his exceptional research pioneering.

Previously:

• Abraham Lempel, RIP
• Jacob Ziv Honored

Compression CS Theory GIF PNG Rest in Peace

Abraham Lempel, RIP

Ynet (via Hacker News):

The first major milestone of Lempel’s oeuvre came in 1977 when he and his colleague Prof. Jacob Ziv published LZ77, the first version of the Lempel-Ziv algorithm, which was followed up the very next year with LZ78.

The Limited Times (via Hacker News):

He taught electrical engineering and computer science at the Technion and in 1981-1984 served as the dean of the Taub Computer Science Faculty. In 1993 he was recruited to HP Laboratories and a year later he founded and managed HP Laboratories Israel.

See also: Wikipedia.

Previously:

• Jacob Ziv, RIP

Compression CS Theory GIF HP PNG Rest in Peace

Bitcoin PDF in macOS

Andy Baio (Hacker News, MacRumors):

While trying to fix my printer today, I discovered that a PDF copy of Satoshi Nakamoto’s Bitcoin whitepaper apparently shipped with every copy of macOS since Mojave in 2018.

[…]

If you’re on a Mac, open a Terminal and type the following command:

open /System/Library/Image\ Capture/Devices/VirtualScanner.app/Contents/Resources/simpledoc.pdf

[…]

In the Image Capture utility, the Bitcoin whitepaper is used as a sample document for a device called “Virtual Scanner II,” which is either hidden or not installed for everyone by default.

It’s unclear whether this a test file that wasn’t intended to ship or an Easter egg of some kind.

Bitcoin and Cryptocurrency Easter Eggs Image Capture Mac macOS 10.14 Mojave macOS 13 Ventura PDF

Violation of Undo in Apple Mail

Daniel Jackson:

Appropriately, Apple synchronized this action with the undo action of the general Undo concept. So if you send a message and then immediately execute an undo, it is interpreted as undo send, even without clicking the special transient button carrying that label.

But Apple went further. The undo action is synchronized with undo send for as long as the message has not been sent, even if another action has been performed in the meantime.

[…]

Initially, I thought that the effect of the undo was to pop the undo-stack all the way back to the send. In fact, it’s not that bad, and what it does instead is to keep the send action on the top of the stack even as other actions are performed. Either way, this violates the simple and intuitive operational principle of Undo that executing undo reverses the last action performed.

Apple Mail Design E-mail Mac macOS 13 Ventura Undo

Web Fingerprinting Is Worse Than I Thought

Bitestring (via Hacker News):

But companies found another way to uniquely identify you across different sessions and websites without using cookies or other persistent storage. It’s called web fingerprinting. Fingerprinting is a more sophisticated approach to identify a user among millions of others. It works by studying your web browser and hardware configuration. Many websites use a fingerprinting library to generate a unique ID. This library collects data from multiple JavaScript APIs offered by your web browser. For example, websites can see web browser version, number of CPUs on your device, screen size, number of touchpoints, video/audio codecs, operating system and many other details that you would not want a typical news website to see.

All of these values are combined to generate a unique ID. Surprisingly, each user’s device and browser specifications differ so much that they get a unique ID among millions.

I did not think web fingerprinting is serious until I came across a company which is actually selling fingerprinting as a service to other websites. I tried their demo and shocked how accurate it is. Many ecommerce websites use it because these fingerprinting companies sell it, saying it prevents credit card frauds and increases security of the websites.

Nick Heer:

My visitor ID was stable in Safari after visiting fingerprint.com only in private windows across two separate sessions. This, despite using Safari’s anti-tracking features, having iCloud Private Relay switched on, and using browser extensions which limit what kinds of scripts are able to run in my browser — and, again, accessing it only in private windows. On its homepage, FingerprintJS says the “VisitorID will remain the same for years, even as browsers are upgraded”. It can be, near as makes no difference, a permanent personal identifier.

Previously:

• Analytics in Apple Apps
• See What JavaScript Commands Get Injected Through an In-App Browser
• Safari 15 IndexedDB Information Leaks
• Firefox Total Cookie Protection
• Identifying People by Their Browsing Histories
• The Success of Intelligent Tracking Prevention

Update (2023-04-07): Kuba Suder:

There are some tools that let you check how you’re fingerprinted and exactly what data provides how many bits of information / how much uniqueness, e.g.: amiunique.org and coveryourtracks.eff.org.

Advertising Firefox Google Chrome iOS iOS 16 JavaScript Mac macOS 13 Ventura Privacy Safari Web

Zippyshare Closing

Zippyshare:

Since 2006 we have been on the market in an unchanged form, that is, as ad financed/free file hosting. However, you have been visiting in less and less over the years, as the arguably very simple formula of the services we offer is slowly running out of steam.

[…]

All sorts of adblockers, whether built into the browser, as add-ons, or in the form of DNS services. Sure, we all use them, but they take away any control the site owner has over the site. Eventually we get to the point where a vicious cycle begins, in order to pay for the server infrastructure you are forced to place more and more ads, then users fire up more and more adblockers and we get to a point like today.

[…]

Over the past year, electricity prices have gone up 2.5 times, which, with a large number of servers, gives a significant increase in costs that we have no way to balance.

Via Andy Maxwell (Hacker News):

Zippyshare’s success was built on solid yet basic foundations; straightforward free hosting of files, via a clean interface, at zero cost to the user.

[…]

Almost three years after the surprise 100mb limit was introduced, Zippyshare doubled its filesize limit to 200mb. A little later, when the internet was consumed with Megaupload being taken down, Zippyshare carried on as if nothing had happened, or it did once its email servers had been fixed.

[…]

Nominated for “notorious market” status by the RIAA in 2013, Zippyshare became a magnet for rightsholder complaints, regular referrals to the U.S. government, and millions of DMCA notices.

To date, rightsholders have requested the removal of more than 14.5 million Zippyshare URLs but for internet users in Europe, worse was on the horizon.

anenefan:

I used to send files by way of zippy, no fuss password protected obviously small stuff I wanted to send over - but it became really NSFW and I had to change to another.

Of course it also means people aren’t using it to share files to people who may have children in the same room - it really was over the top stuff[…]

Previously:

• MegaUpload

Update (2023-06-02): Nick Heer:

All of these services have been historically used by, among others, plenty of old-school music blogs. There are many reasons to object to file sharing, but I do think there is something special about that era of online publishing.

Ernesto Van der Sar (via Hacker News):

RARBG, one of the world’s largest torrent sites, has said “farewell” to millions of users.

Advertising BitTorrent Business Music Piracy Sunset Web

Bob Lee, RIP

Amy Graff (Hacker News):

Bob Lee, 43, died after being found stabbed on the 400 block of Main Street in SoMa. Lee was chief product officer of MobileCoin[…]

Romain Dillet:

Before joining MobileCoin, Bob Lee worked at Google for the first few years of Android, focusing on core library development. He then joined Square, the payment company that later became Block, to develop its Android app. He became the company’s first CTO and also created Cash App.

Bob Lee, also known as ‘Crazy Bob,’ was an investor in tech startups as well.

Scott Perry:

goddamn, I was thinking of Bob last night as I wrote a ringbuffer for something. what a terrible loss

Dylan Field:

So sad to hear of @crazybob’s untimely passing. I first met him in summer 2006 — he didn’t care that I was only 14 and we talked tech / geeked out about programming. We remained connected over the years and he was an early supporter of Figma. It’s so hard to believe he is gone.

aEJ04Izw5HYm:

I want to draw attention to Bob Lee, a well-respected technologist and prototype hacker, always curious and sharing lots of interesting technical developments. He was a great role model for how Engineers should be respected in an executive capacity as he advanced his career from 'Software' to 'Product'. His efforts contributed to technology used by millions.

[…]

Please share your stories featuring Bob Lee, who I'm sure would like to be remembered for his contributions rather than as a victim of this unfortunate awful event.

Bryan Cantrill:

Bob very much deserves to be remembered as you described him: an engineer’s engineer. I first met him at Foo Camp in 2011, and we had a deeply enthralling conversation about building the Square reader. As it turns out, credit card swipes are (were?) fiendishly complicated! (I still tell others the advice that Bob gave me: for the best read, you want constant acceleration of your card -- not a fast swipe.) He showed me the tooling that he had built at Square to debug bad swipes; it was a role model for rigor in engineering and especially for the power of tooling.

Yishan Wong:

I met him when he was CTO of Square and I was consulting there - here is a write-up of some great programming that he did for a coding challenge.

[…]

He was not a high-flying celebrity CTO, he was a great engineer who was just happy to be able to solve problems and Square was lucky to have him.

matttproud:

Bob was a nice guy. We had an overlapping tenure at Google in the 2000s. He was one of the original authors of the Guice dependency injection framework. When I was earning Java readability at Google, I was fortunate to have had him assigned as a reviewer. Having the review work so smoothly alleviated a lot of the imposter syndrome I felt at the time. I felt like a million bucks afterwards. The compassion and humility he brought to the table made a world of difference.

See also: LinkedIn.

Update (2023-04-06): Wil Shipley:

He was just such a nice dude, and also so brilliant.

I once had a meeting with him at Square where I was showing off our barcode-reading tools and he showed me his magnetic-strip reading tools and his were WAYYYY better than mine.

See also: MobileCoin:

Android Android App Programming Rest in Peace Square Testing

StopTheFonts 1.0

Jeff Johnson (Mastodon):

Today I’m introducing StopTheFonts, a Safari content blocker for web fonts on iOS and macOS, available now in the App Store.

[…]

There are a number of reasons to use StopTheFonts: to protect your privacy, because every web font is loaded over the web, exposing your IP address and possibly other information, often to third parties; to make web pages load faster, because they don’t have to wait for the fonts to load; to save bandwidth on carrier-limited connections.

[…]

StopTheFonts makes it easier to create a “blank slate” for font replacement rules in StopTheMadness.

It’s a $2.99 universal purchase.

Previously:

• StopTheMadness Font Substitution
• iOS Safari Extension: StopTheScript
• User Tracking via Custom Fonts

Update (2023-04-07): Jeff Johnson:

Apple seriously rejected version 1.1 of StopTheFonts for this complete bullshit.

The biggest problem is that App Review asked me for [documentation and a screenshot] while I was trying to rush out a version 1.1 update instead of asking me for these bullshit things while they were reviewing version 1.0.

That’s always the most frustrating part: we suddenly get rejected for things that were already accepted!

Previously:

• Wired Finds App Review Unchanged
• Allowing Bug Fixes and Challenging the Guidelines

App Review iOS iOS 16 iOS App Mac Mac App Mac App Store macOS 13 Ventura Privacy Safari Extensions StopTheFonts Web

Dark Noise 3.0

John Voorhees:

The free version of Dark Noise includes eight sounds, continuous sound looping, Shortcuts support, Siri integration, and a timer. The Pro subscription increases the number of sounds to over 50 and adds custom sound mixes, alternate app icons, themes, and Family Sharing. The Pro features are also available as a one-time purchase.

[…]

There are a lot of ambient sound apps on the App Store, but a lot aren’t very good. Dark Noise is excellent, and I expect having a free tier to show off what the app can do to new users will result in more paid users in the long run.

[…]

Version 3.0 also introduces remastered Rain, Beach, Airplane Interior, and Thunderstorm sounds that sound better when used with stereo speakers.

I have been using Rain Rain for years, and both iOS and macOS now have built-in Background Sounds, which can be triggered from Control Center or Siri.

Update (2023-04-06): Craig Grannell:

I’ve long used White Noise+, with its straightforward mixing desk layout and one-hit price.

App Subscriptions Audio Dark Noise iOS iOS 16 iOS App Mac Mac App macOS 13 Ventura Rain Rain Sleep

Google Drive Adds File Limit

ra13 (via Hacker News):

Around 14th February 2023 several Google Drive accounts started showing an error of “Upload Failed” for any creation action carried out. (Eg. creating a new empty folder).

I faced the same on my Google Drive account (2 TB). My usage is only 1.62TB of the 2TB, and my Bin is empty.

[…]

There were a few reports of Google Support reps informing people of a 5 million item limit on Google Drive. (Regardless of if you have a 2TB, 5TB or 20TB account).

That might sound high, but up until this issue, I had 7 million files in my Google Drive without any problems at all.

Now all of a sudden, since ~14th Feb, it’s unusable, unless i delete 2 million files!

Ben Schoon (via Slashdot):

Effectively, that user and anyone else in the same situation are locked out of their accounts, with the files stored now in a “read-only” mode.

[…]

In a brief Twitter thread, Google tonight confirmed that it is rolling back the limit on created files for all Google Drive users. The limit, which was imposed by surprise, was done to “preserve stability and optimize performance.” Google says that it is now looking into “alternate approaches” despite reiterating that only a small number of users were affected by the limit.

Google also addressed its shortcoming in notifying users of the limit, saying that “will communicate” any further changes to users prior to implementing them.

ajb:

Google Drive lost all our HR files, everyone’s contracts etc. Huge panic. We only got them back by using Vault (the legal discovery back door, which doesn’t return them in the same format or folder structure). And yes, no one deleted them - I checked the audit logs.

See also: Hacker News, Ron Amadeo.

Previously:

• Update on Cloud File Provider Extensions
• Google Drive Flags .DS_Store Files for Copyright Infringement
• Google Drive Incorrectly Flags File for Copyright Infringement

Cloud Datacide Google Drive Mac Mac App macOS 13 Ventura Web

Alex Hay, RIP

John Voorhees (via Federico Viticci):

Recently, Alex Hay, the developer of Toolbox Pro and other apps, passed away after a battle with cancer.

[…]

In any creative field, though, there are always some people who stand apart from the pack. You don’t notice them because they’re especially good at self-promotion. No, they stand out because their raw talent is simply impossible to ignore. That was Alex Hay.

I don’t recall how Alex first appeared on my radar, but it was undoubtedly a text from Federico along the lines of “Hey, you gotta check out the crazy stuff this guy in the UK is doing with Shortcuts. You’re going to love this.”

[…]

Instead of building apps that fulfilled a specific need, Alex’s talent was building apps that let users tap into their own creativity to make what they wanted for themselves with Shortcuts.

Federico Viticci:

In many ways, Alex invented the modern idea of a “headless app” with Shortcuts integration.

He saw the beauty and power of automation for what it ultimately stands for: pure creativity. To let users take control of their computers however they want.

John Gruber:

His apps Toolbox Pro and Logger for Shortcuts are my two favorite Shortcuts utilities. (I’ve always been a printf() debugger and that’s what Logger enables for Shortcuts hacking.)

Previously:

• Toolbox Pro

Update (2023-08-25): Snailed It Development (via John Voorhees):

We’re truly honoured to be able to announce that we have taken over development of Toolbox Pro, Logger for Shortcuts, and Nautomate.

All three apps were originally developed by indie developer Alex Hay before he tragically passed away back in March after a battle with cancer.

iOS iOS 16 iOS App Rest in Peace Shortcuts Toolbox Pro

General Motors to Phase Out CarPlay

Hartley Charlton (Hacker News):

General Motors (GM) will phase out Apple CarPlay and Android Auto in its vehicles starting this year, shifting to a built-in infotainment system co-developed with Google (via Reuters).

GM owns Buick, Cadillac, Chevrolet, and GMC in the United States. It will stop offering Apple CarPlay and Android Auto starting with the 2024 Chevrolet Blazer, which goes on sale this summer. The company plans to continue offering Apple CarPlay and Android Auto in its combustion models, which are expected to be phased out by 2035 in favor of electric vehicles.

John Gruber:

I’m wondering if this bizarre decision has something to do with tracking users in a way that CarPlay defends against.

Or perhaps Google is paying them?

Stephen Hackett:

I don’t plan on ever purchasing a car without CarPlay again. I suspect a lot of folks feel the same way.

Michael Yacavone:

I saw this news and thought GM had done an April Fools, but no, they are just fools. We got a Bolt EUV in December, and CarPlay was a requirement, didn’t look at any cars without it.

It’s not just about purchasing, though. Rental companies have lots of GM vehicles, and you can’t choose what you’re going to get. Currently, it’s pretty safe to assume that a rental will support CarPlay. In the future, you might have to bring a mount for using your phone directly.

Previously:

• Google Gives Apple a Cut of Chrome iOS Search Revenue
• Google Paid Blizzard to Stay on Play Store
• iOS 16 Announced
• Google Antitrust Lawsuit

Update (2023-04-07): Jason Snell:

I ranted about this topic for a while on this week’s Upgrade and Patrick George did an excellent job of summarizing this move at The Verge[…] I have a lot of strong feelings about this, because it’s a clear case of a corporation prioritizing its own business and technical interests over the needs of its users. While GM’s statements on the matter constantly emphasize that this is an improvement or evolution of the in-car experience, it’s all spin and lies.

[…]

Even if you happen to use a supported service or app, you have to rely on syncing between devices. Now you’ve got to hope that whatever connectivity the car offers will be able to keep your music playlists and the current playing location of your podcast or audiobooks synced and up to date. Cloud syncing is tricky—do I really trust General Motors to keep all my stuff in line?

[…]

Tangentially, two EV companies have already gone down this path: Tesla and Rivian. And yes, both of them are just as arrogant as GM in preferring their own stock software to the smartphones in everyone’s pockets. At least GM will have access to Android apps—Tesla finally added support for Apple Music earlier this year! (It took just eight years!) A guy in Poland has spent countless hours trying to hack CarPlay into the Tesla web browser.

See also: TidBITS.

Update (2023-04-22): Jamie L. LaReau and Phoebe Wall Howard (via Hacker News):

Harsh reaction to GM’s decision last month echoed across social media immediately with some people saying they will not buy a vehicle that doesn’t offer CarPlay or Android Auto, prompting some car shopping experts to predict that GM may lose customers.

[…]

Mossberg introduced the article by saying, “I think this is a huge blunder, which puts greed over consumer choice. I wouldn’t buy a car without Car Play and I bet millions of others feel the same.”

Some say GM wants to create new revenue streams by selling subscriptions to certain features on the GM-built infotainment systems, plus gather data on how consumers use their EVs.

John Gruber:

One thought I had regarding this decision by GM is that it’s a bit like selling “smart” TV sets that don’t support HDMI input. You get the TV maker’s interface for using apps, games, and streaming services, with no choice to plug in a third-party device like an Apple TV, Chromecast stick, or Roku. I don’t know of any TV sets like that, but HomePods are sort of like that as speakers. HomePods have no traditional line-in for audio — whatever sound comes out of your HomePods, it comes through Apple’s own software stack. GM is more like a traditional speaker company. It’d be really weird if, say, Bose sold a set of smart speakers that didn’t support line-in, because unlike Apple, Bose isn’t a leading software platform company.

Tesla is seemingly thriving while going its own way software-wise. Rivian is following Tesla’s lead, and can’t manufacture their vehicles fast enough to keep up with demand. But both of those companies have roots in Silicon Valley, not Detroit. Both Tesla and Rivian seem more like Apple than they do General Motors.

Update (2023-05-01): John Gruber:

It doesn’t seem to be about being able to provide a better experience than CarPlay, but instead about collecting surveillance data that Apple’s privacy rules don’t allow. Sozzi just breezes past this notion of using surveillance data to sell car insurance, but a car that reports such data to insurance companies seems like a privacy disaster.

Update (2023-05-10): General Motors (via Hacker News):

General Motors Co. announced today that Mike Abbott, former vice president of Engineering for Apple’s Cloud Services division, will join GM as executive vice president, Software, effective May 22, 2023. He will report to GM Chair and CEO Mary Barra.

Update (2023-05-18): John Gruber:

But I don’t look at this hire and think that GM is any more likely to come up with a CarPlay-quality interface for its own platform. Some back-of-the-envelope math on Barra’s services revenue goals for GM makes it sound to me like Mike Abbott is being tasked with designing an in-dash slot machine.

[…]

What services could they offer that new car buyers would pay north of $50/month for? Maps and navigation? Everyone has that on their phones already. Music and podcasts? Everyone has that on their phones already. Crash detection? By 2030 everyone will have that on their phones already (or at least they will if they have iPhones, but I bet that will soon become a standard feature on Android phones too). GM wants to sell “behavior based insurance” (translation: tracking/surveillance), but according to Reuters, their goal for insurance is just $6 billion/year by 2030. I find it hard to see where the rest of the money will come from.

[…]

One idea that occurred to me is the equivalent of Apple’s services revenue dark matter: payments from Google for default placement as Safari’s search engine.

Update (2023-12-19): Juli Clover:

According to Tim Babbitt, GM’s head of product for infotainment, GM has driver safety in mind. CarPlay and Android Auto can have issues like bad connections, slow response times, compatibility issues, and connectivity problems, leading drivers to be distracted from the road with smartphone troubleshooting.

Lawrence Hodge (via Hacker News):

Essentially, the thinking is that if a car’s in-built infotainment system is good enough, drivers will be less likely to use their phone for what they’re trying to do while they’re behind the wheel, — though Babbitt admits that GM hasn’t exactly tested this in a controlled setting to see whether or not it’s true.

John Gruber:

In his imagined scenario, people check their phones while driving when the CarPlay connection flakes out. But if the car doesn’t support CarPlay, people will use their phones for every single thing that’s on their phones but not in GM’s built-in system. “If drivers were to do everything through the vehicle’s built-in systems” is as much a fantasy as, say, “If drivers always obeyed all posted speed limits.” It’s not going to happen. There is no plausible scenario where the drivers of future GM vehicles without CarPlay support check their iPhones less frequently than they do in vehicles that support CarPlay.

Android Car CarPlay Google iOS iOS 16

Apple Passwords Deserve an App

Cabel Sasser (Mastodon, Hacker News):

Very few people know these things because Apple tucks all of their important password features away in weird little Settings panels, instead of in a Proper Real App. I think this is a mistake.

Passwords are productivity, not preferences.

[…]

Break Passwords out into a standalone app, with an actual fully resizable window (!!), and full, proper UI for most of its features[…] PS: there is one place where Apple provides a nice standalone iCloud Passwords management app, with a fully resizable window. On Windows!?! 🫠

John Gruber:

Apple should break these features out into a discrete Passwords app, and they should launch a marketing campaign to raise awareness of it. I’ve been using the built-in password management in iOS and MacOS (and iCloud for syncing) for years, and last summer I switched all of my 2FA verification codes to it too. It’s a great system, especially if you use Safari as your web browser. But the biggest reason it isn’t used more is that zillions of people don’t even know it’s there.

[…]

As a postscript, it’s also possible that you know this feature exists within Settings, but don’t know that it offers full import and export options, because those commands are tucked away in a “···” menu.

Dan Moren:

Unlike Cabel, however, I would like Apple to implement some sort of family sharing feature for Passwords. I share a bunch of logins with my wife, and while I can share them with 1Password, there’s an additional hurdle to getting someone on a third-party app that requires their own account, etc. Especially as we shift more and more to passkeys, where traditional methods of sharing will be impractical, it’s more important that Apple make it easier to share credentials.

John Gruber:

Apple Notes added robust small-scale sharing years ago and hasn’t sherlocked the market for third-party notes apps. I think the same would be true for passwords.

Glenn Fleishman:

Cabel is right on a Passwords app—which could also manage FIDO hardware security keys, passkeys (they need a management app in addition to the website-based enrollment UI), and everything else.

Damien Petrilli:

Knowing that you can be robbed from your iCloud account easily by stealing your iPhone pin code, it might [not] be a good idea to put all your eggs in the same basket.

Previously:

• Changing Apple ID Password Using Only a Device and Passcode
• Notes in Apple’s Password Manager
• There Should Be an iCloud Keychain App

Update (2023-04-07): Nick Heer:

iCloud Keychain works great for my needs, but its existing implementations leave much to be desired. As of MacOS Ventura, the preferred way to do password-related things is through the Passwords pane in System Settings. But its performance flags with the number of passwords I have.

Apple Password Manager iOS iOS 16 Mac macOS 13 Ventura Passwords

ChatGPT Plug-ins

OpenAI (Hacker News):

Users have been asking for plugins since we launched ChatGPT (and many developers are experimenting with similar ideas) because they unlock a vast range of possible use cases. We’re starting with a small set of users and are planning to gradually roll out larger-scale access as we learn more (for plugin developers, ChatGPT users, and after an alpha period, API users who would like to integrate plugins into their products). We’re excited to build a community shaping the future of the human–AI interaction paradigm.

Plugin developers who have been invited off our waitlist can use our documentation to build a plugin for ChatGPT, which then lists the enabled plugins in the prompt shown to the language model as well as documentation to instruct the model how to use each. The first plugins have been created by Expedia, FiscalNote, Instacart, KAYAK, Klarna, Milo, OpenTable, Shopify, Slack, Speak, Wolfram, and Zapier.

It’s still early days, but you can see the possibility of this being the next big platform, if the community can iterate and it doesn’t all collapse in a disaster. It seems like the wild west compared with what third parties can do with Siri.

Stephen Wolfram (Reddit, Hacker News):

Early in January I wrote about the possibility of connecting ChatGPT to Wolfram|Alpha. And today—just two and a half months later—I’m excited to announce that it’s happened! Thanks to some heroic software engineering by our team and by OpenAI, ChatGPT can now call on Wolfram|Alpha—and Wolfram Language as well—to give it what we might think of as “computational superpowers”. It’s still very early days for all of this, but it’s already very impressive—and one can begin to see how amazingly powerful (and perhaps even revolutionary) what we can call “ChatGPT + Wolfram” can be.

rez0__ (via Hacker News):

This morning I was hacking the new ChatGPT API and found something super interesting: there are over 80 secret plugins that can be revealed by removing a specific parameter from an API call.

The secret plugins include a “DAN plugin”, “Crypto Prices Plugin”, and many more.

It is possible to use these unreleased plugins by setting up match-and-replace rules through an HTTP proxy. There are only client-side checks to validate that you have permission to use the plugins and they can be bypassed.

koolba:

There’s no way I’m going to accept the intersection of “we take security very seriously” and implementing security checks purely client side. This and the recent title information leak are both canaries for how the rest of Open AI operates.

Previously:

• GPT-4
• Other People’s Playlists in Your Apple Music
• ChatGPT in Bing and Edge

Artificial Intelligence ChatGPT Privacy Web Web API Wolfram Alpha

Swift 5.8

Alexander Sandberg:

Swift 5.8 enables you to start incrementally preparing your projects for Swift 6 by using upcoming features. By default, upcoming features are disabled. To enable a feature, pass the compiler flag -enable-upcoming-feature followed by the feature’s identifier.

[…]

The result builder implementation has been reworked in Swift 5.8 to greatly improve compile-time performance, code completion results, and diagnostics. The Swift 5.8 result builder implementation enforces stricter type inference that matches the semantics in SE-0289: Result Builders, which has an impact on some existing code that relied on invalid type inference.

[…]

• SE-0274: Concise magic file names
• SE-0362: Piecemeal adoption of upcoming language improvements
• SE-0365: Allow implicit self for weak self captures, after self is unwrapped
• SE-0367: Conditional compilation for attributes
• SE-0368: StaticBigInt
• SE-0369: Add CustomDebugStringConvertible conformance to AnyKeyPath
• SE-0370: Pointer Family Initialization Improvements and Better Buffer Slices
• SE-0372: Document Sorting as Stable
• SE-0373: Lift all limitations on variables in result builders
• SE-0375: Opening existential arguments to optional parameters
• SE-0376: Function Back Deployment

SE-0365:

As of SE-0269, implicit self is permitted in closures when self is written explicitly in the capture list. We should extend this support to weak self captures, and permit implicit self as long as self has been unwrapped.

Paul Hudson:

In this article I’m going to walk you through the most important changes this time around, providing code examples and explanations so you can try it all yourself.

Previously:

• Xcode 14.3
• Swift Proposal: Function Back Deployment
• Swift 5.7
• Weak Self: Closure Rules of Thumb

Language Design Programming Swift Programming Language

Xcode 14.3

Apple:

Clang and the build system support a new mode for building module dependencies called explicit modules which improves build performance, reliability, and correctness. The new mode is opt-in, and can be enabled by setting _EXPERIMENTAL_CLANG_EXPLICIT_MODULES as a user-defined build setting in C and Objective-C projects which build with modules enabled.

[…]

Xcode now prompts a user prior to performing a clean action. This prompt can be bypassed by holding the option key while performing a clean, or by permanently hiding the prompt by enabling the “Don’t Ask Me” setting within the prompt.

[…]

Run scripts in a scheme’s pre-actions and post-actions for the Build section now cause the build to fail if any run script exits with a non-zero exit code, instead of reporting a false-positive successful build.

[…]

When a pre-build scheme action (such as compiling a package plugin) encounters an error, the status message at the top of Xcode’s workspace window sometimes doesn’t update. This leaves the previous status showing, possibly causing confusion if the previous status was “Build Succeeded.”

[…]

Xcode automatic signing now creates managed provisioning profiles for Developer ID. This resolves an issue that caused Xcode to throw an error when cloud signing with a Developer ID certificate during the app distribution workflow.

[…]

The timeout argument of XCTestCase.wait(for:timeout:enforceOrder:) and related methods is now optional—if you don’t specify it, the function waits indefinitely (until the overall test times out.) To ensure reasonable execution time, set an appropriate value for the executionTimeAllowance property of the running XCTestCase instance (self).

The extra pieces can be downloaded here, though the Additional Tools are still only at RC status.

The two main changes I noticed are that there’s now an annoying animation when I use Open Quickly… and that tests now need a deployment target of macOS 12. This created a bunch of work silencing deprecation warnings, which is kind of silly because the code being tested runs on macOS 10.13 and so can’t depend on the newer APIs, anyway.

I had to turn off the new module verifier because it warned about double-quoted includes even though I had turned off that warning. (I use such includes to be able to use the same file both in a framework and when I want to include a few individual files in a standalone binary.)

Heath Borders:

TIL Xcode 14.3 Beta isn’t supported under Rosetta. This means that if your iOS project uses x86 libraries, you won’t be able to run the project on an x86 iOS Simulator on an arm64 mac anymore.

You’ll either have to go back to an x86 mac to run your project or you’ll have to add arm64 slices to your libraries.

Jonathan Grynspan:

New in Xcode 14.3: if you’re using XCTestExpectation or XCTWaiter from an async Swift function, you’ll get warnings when using wait(for:timeout:) because that synchronous function may deadlock. Switch to fulfillment(of:) instead for maximum Swiftiness!

Christian Selig:

If Xcode 15 released and the only feature was it was cured of hallucinating ghost errors I would stand up out of my chair and clap.

With the last several releases of Xcode, I’ve seen a lot of fake errors, as well as problems with builds not working properly unless I manually clean the folder first. The Swift compiler still crashes every day.

Nick Lockwood:

PSA: If you’re an Apple dev who hasn’t updated to Ventura for whatever reason, the usual trick of editing the Minimum system version in the Xcode 14.3 Info.plist seems to get it running just fine on Monterey.

Previously:

• Swift 5.8
• Xcode 14.2

Update (2023-04-07): My experience so far is that Xcode 14.3 massively increases the number of fake compiler errors, and I’m also getting all sorts of weird crashes when running tests that go away if I clean the build folder. My guess is that there’s something wrong with the dependency tracking so that some files are not being recompiled, and the mismatch between old and new code interacting is causing crashes as well as unexpected test failures.

Kurt:

I have to build multiple times to see failures in Xcode 14.3. First build: failed, but no errors are shown. Second build: failed, errors are show for a few seconds then go away. Rinse and repeat until you can find the errors.

Update (2023-04-21): Christian Beer:

Xcode, I love you too…

Brent Simmons:

I can’t upload NetNewsWire to Apple’s notarization service using Xcode 14.3 — Xcode complains about the profile not complaining a Game Center entitlement.

Sure. For obvious reasons.

But! I had kept a copy of Xcode 14.2, as you do, and it worked perfectly.

Martin Pilkington:

Sooo… I just discovered the latest version of Xcode may have fixed a compiler issue that was kneecapping my M1 Ultra.

There was an issue where on certain projects my Mac Studio would be as fast as my Intel iMac and SLOWER than an M1 MBP. The reason? Too many cores. If I limited to 4 cores it was faster than 20 (as in 90s vs 150-200s).

Just did a clean build today and… 20-30s. My Studio FINALLY feels as fast as it should! 😭

Gus Mueller:

A change in compilers (whatever clang was in Xcode 14.0 vs. 14.3) + a more aggressive ARC memory release surfaced a stupid little bug in Acorn that nobody would have seen but me. It was caught in regression tests, and I was super confused for a long time, but … yay compilers getting smarter / faster / whatever?

Marcel Weiher:

Anyone else have Xcode 14.3 beach balling constantly?

Seems to be hanging on some XPC thing to do with text input?

This has happened to me several times. I’m also seeing hangs when I’m away from the office and it tries to check the source control status of a file but can’t reach the server on my LAN.

Previously:

• Xcode Files With Source-Control Status
• Swift Compiler Not Optimized for Lots of Cores

Update (2023-05-01): Paul Haddad:

Anyone run into problems with Xcode 14.3 not auto-creating a proper CFBundleIcons~ipad entry? 14.2 doesn’t create it for simulator builds, but does create it for Archive. 13.4.1 creates it all the time.

Driving me nuts.

Aaron Czichon:

Xcode 14.3 has many problems. Also doesn’t work correctly in any CI/CD environment. Throwing random errors which are not related to the actual error. Need to downgrade to Xcode 13.x everything to get the real error. Driving me nuts.

I’ve been much happier since downgrading to 14.2, though it still shows lots of spurious errors.

Bug Clang Code Signing Mac macOS 13 Ventura Programming Rosetta Swift Concurrency Swift Programming Language Testing Xcode

Twitter’s Recommendation Algorithm

Twitter (Hacker News, Slashdot):

At Twitter 2.0, we believe that we have a responsibility, as the town square of the internet, to make our platform transparent. So today we are taking the first step in a new era of transparency and opening much of our source code to the global community.

[…]

We also took additional steps to ensure that user safety and privacy would be protected, including our decision not to release training data or model weights associated with the Twitter algorithm at this point.

Twitter (tweet, Hacker News):

Twitter aims to deliver you the best of what’s happening in the world right now. This requires a recommendation algorithm to distill the roughly 500 million Tweets posted daily down to a handful of top Tweets that ultimately show up on your device’s For You timeline. This blog is an introduction to how the algorithm selects Tweets for your timeline.

[…]

The foundation of Twitter’s recommendations is a set of core models and features that extract latent information from Tweet, user, and engagement data. These models aim to answer important questions about the Twitter network, such as, “What is the probability you will interact with another user in the future?” or, “What are the communities on Twitter and what are trending Tweets within them?” Answering these questions accurately enables Twitter to deliver more relevant recommendations.

The recommendation pipeline is made up of three main stages that consume these features: 

1. Fetch the best Tweets from different recommendation sources in a process called candidate sourcing.
2. Rank each Tweet using a machine learning model.
3. Apply heuristics and filters, such as filtering out Tweets from users you’ve blocked, NSFW content, and Tweets you’ve already seen.

The (mostly Scala) code is here.

Dan Luu:

The new stuff in the Twitter algorithm is wild.

“author_is_elon”, “author_is_republican”, “author_is_democrat”, etc., are explicit terms that are special cased.

Aakash Gupta:

1. Likes, then retweets, then replies

   Here’s the ranking parameters:

   • Each like gets a 30x boost
   • Each retweet a 20x
   • Each reply only 1x

   It’s much more impactful to earn likes and retweets than replies.

2. Images & videos help

   Both images and videos lead to a nice 2x boost.

3. Links hurt, unless you have enough engagement

   Generally external links get you marked as spam.

Stephen Hackett:

There were some very funny things in there that have now been deleted, but as of this writing, this one remains, as does one requesting a printed version of the repository.

Mysk:

What is this WTF thing that Twitter's algorithm refers to?

Mysk:

Things no longer restricted on Twitter

Update (2023-04-04): Mysk:

Oh, the number of unfollows might result in “shadow-banning” a Twitter account. The Twitter algorithm shadow-bans an account based on these 5 negative signals:

1- Blocks
2- Mutes
3- Abuse reports
4- Spam reports
5- Unfollows

Update (2023-04-24): Arvind Narayanan (via Hacker News):

It turns out to be a standard engagement prediction algorithm of the kind most major platforms use; I explained how these algorithms work in a recent essay. The source code release makes for an interesting case study of social media transparency. Let’s talk about what the code does and doesn’t reveal, from the perspective of trying to understand information propagation and algorithmic amplification on social media.

Artificial Intelligence Open Source Programming Scala Twitter Web

New Twitter API Tiers

Twitter (tweet):

We will offer two access tiers for developers via our website:

Free

For write-only use cases with the Twitter API

• Low rate-limit access to v2 tweet posting and media upload endpoints
• 1,500 Tweets per month posting limit - at the app level
• 1 app ID
• Login with Twitter
• Cost: Free

Basic

For hobbyists & prototypes

• Low-rate limit access to suite of v2 endpoints
• 3,000 Tweets per month - posting limit at the user level
• 50,000 Tweets per month - posting limit at the app level
• 10,000 Tweets per month read-limit rate cap
• 2 app IDs
• Login with Twitter
• Cost: $100 per month

Going by the stated goal of stoppings bots, this doesn’t make a lot of sense. The write-only tier is free, but you have to pay to read. For the pricing, $100/month is a lot for a hobbyist. It’s reasonable for a paid service that helps you read tweets, but the limits are so low as to be useless. A cap of 10K tweets—not even API calls, tweets—is just too limiting. Twitter really wants you to use their clients.

Andrew Wooster:

Just for reference, back in the day when there were like 14 people at Twitter they gave my account a 50,000 req/day limit for free.

Paul Haddad:

They totally disabled access to the V1.1 API (probably because they had no one that could implement these limits on it).

[…]

The sign up link for the Enterprise API, you know the thing that costs $42k/month, is just a Google Form doc…

In the Enterprise sign up form they make it seem like the Enterprise APIs don’t change. The Enterprise API aren’t a superset of the V1.1/V2 API, they’re fairly different and limited in scope.

So what happens to the hundreds of companies who need more access than the crap-o level provides? IFTTT, ZenDesk, Buffer, Block Party, etc…

Ben Ubois:

Feedbin’s Twitter access was revoked because “this App has violated Twitter Rules and policies.” Which is the same message many Twitter clients received in January when Twitter first started turning off API access. […] This means the end of Twitter support in Feedbin.

Brent Simmons:

We’ll have till the end of April, it looks like, before we have to turn off Twitter integration in NetNewsWire.

Manton Reece:

For Micro.blog, we plan to support cross-posting for a limited number of months, to let folks wind down their use of Twitter. There’s no future on Twitter so all we can do is smooth over the shutdown for customers.

Dave Winer:

Every developer who built on Twitter has had to make a decision about what to do as their API is changing in the next few days.

Here’s my plan. I’m not going with them. If the API changes break my software, so be it. We had a good run.

Ryan Barrett (via Hacker News):

I’d just like to draw your attention to this page that shows Twitter employees’ posts here on this forum, in chronological order, descending.

Before December, a large number of employees posted here regularly on a wide range of topics. Over the last few months, only a single Twitter employee has posted here consistently, and only about the Ads API.

[…]

I conclude that the Twitter API is now effectively unmaintained. I expect the company will only touch it when they get a misguided edict from the top – for example, the upcoming free API lobotomy. When that happens, I expect it will be done by engineers from the other side of the org, who don’t know the code or systems much or at all, and will probably break more than they “fix.”

Previously:

• Twitter to Charge for API

Feedbin IFTTT Micro.blog NetNewsWire Twitter Web Web API