Norbert Heger:
Apple has recently shown a noticeable tendency to collect, gather, transmit, and sometimes even store privacy-sensitive data – despite repeatedly emphasizing the importance of protecting such data and ensuring it remains solely on the user’s device.
[…]
macOS Sequoia introduces another new feature labelled Help Apple Improve Search, which sends and stores various search queries from Safari, Spotlight, and other sources to improve search results.
This feature, too, is enabled by default and is well hidden at the very bottom of System Settings > Spotlight.
[…]
Even if the data sent is not directly linked to me as a person, the data itself may contain information I might not want to share with third parties.
[…]
It’s worth noting that the new option in System Settings only governs the storage of this data, not its transmission to Apple. If Include Safari Suggestions is enabled in Safari Settings > Search, inputs into the search field are still sent to Apple for providing suggestions. To prevent this, Include Safari Suggestions must also be disabled.
As with Siri Suggestions, the UI is not exactly clear, and though both System Settings and Safari’s settings window have Privacy tabs, that’s not where these options appear.
As Fazal Majid reminds me, another recent example is that Firefox was criticized for opting users into Private Click Measurement, which Apple had also done with Safari.
I find that I’m often accidentally typing or pasting into the new Type to Siri window because I’ve accidentally triggered it by double-tapping the Command key.
Previously:
Mac macOS 15 Sequoia Privacy Safari Search Siri Spotlight
Brent Simmons reported to me that my blog’s RSS feed wasn’t updating in recent versions of NetNewsWire. They’ve added support for the Cache-Control response header, and, for reasons unknown, my site was returning an interval of 2 days:
$ curl --head https://mjtsai.com/blog/feed/
HTTP/2 200
date: Wed, 08 Jan 2025 14:28:24 GMT
server: Apache
vary: Accept-Encoding,Cookie,User-Agent
link: <https://mjtsai.com/blog/wp-json/>; rel="https://api.w.org/"
etag: "9efc6f6ed8885592fcee58bc1685dcaf"
cache-control: max-age=172800
expires: Fri, 10 Jan 2025 14:28:24 GMT
content-type: application/rss+xml; charset=UTF-8
even though plain HTML content was only cached for 10 minutes:
$ curl --head https://mjtsai.com/blog/
HTTP/2 200
date: Wed, 08 Jan 2025 14:34:20 GMT
server: Apache
vary: Accept-Encoding,Cookie,User-Agent
cache-control: max-age=3, must-revalidate
content-length: 307509
last-modified: Wed, 08 Jan 2025 14:30:02 GMT
cache-control: max-age=600
expires: Wed, 08 Jan 2025 14:44:20 GMT
content-type: text/html; charset=UTF-8
I spent a while trying to figure out why WordPress would do that, but it turns out to be a default set by my server provider, DreamHost. RSS feeds fall under the default file type even though they are more likely to change frequently.
There are various ways to override this using Apache’s .htaccess file. Simmons is using this for his feed:
<Files "rss.xml">
<IfModule mod_headers.c>
Header set Cache-Control "max-age=300"
</IfModule>
</Files>
But I don’t want to list each file separately because this blog has many feeds, e.g. one for the comments on each post. What seems to work is setting the expiration by MIME type:
<IfModule mod_expires.c>
ExpiresActive on
ExpiresByType application/rss+xml "access plus 300 seconds"
ExpiresByType application/atom+xml "access plus 300 seconds"
</IfModule>
Please let me know if you run into any problems with this.
Previously:
Apache Atom Syndication Format DreamHost NetNewsWire RSS This Blog Web
Guru Baran (via Ric Ford, PDF):
The research team from Korea University, led by Hyerean Jang, Taehun Kim, and Youngjoo Shin, presented their findings in a paper titled “SysBumps: Exploiting Speculative Execution in System Calls for Breaking KASLR in macOS for Apple Silicon.”
Their work represents the first successful KASLR break attack on macOS systems powered by Apple’s custom ARM-based chips.
[…]
By exploiting Spectre-type vulnerabilities in certain macOS system calls, the researchers demonstrated that an unprivileged attacker could cause transient memory accesses to kernel addresses, even with kernel isolation enabled.
A key component of the attack involves using the Translation Lookaside Buffer (TLB) as a side channel to infer information about the kernel’s memory layout. The research team reverse-engineered the TLB structure of various M-series processors, uncovering previously unknown details about its architecture.
Previously:
Apple M1 Apple M1 Pro Apple M2 Apple M2 Max Apple M2 Pro Exploit Kernel Mac macOS 13 Ventura macOS 14 Sonoma Processors Security
Malcolm Owen:
The LG UltraFine 6K Monitor, model 32U990A, surfaced on Monday as part of the 2025 CES Innovation Awards, as an honoree in imaging. The monitor is described as the first in the world to have a 6K resolution display that also uses Thunderbolt 5.
[…]
LG’s newest screen has a Nano IPS Black panel, delivering high color accuracy and contrast. Its color gamut coverage includes 99.5% of Adobe RGB and 98% of DCI-P3.
[…]
Add in that Dell’s monitor is available now for the relatively reasonable $2,479.99, and it seems like a good buy for the moment.
That may change if LG is particularly aggressive on the pricing of its screen and its availability. Sadly we won’t know that until LG releases more details for the display, as well as more specifications in general.
Previously:
Display Hardware LG Mac macOS 15 Sequoia Retina
