Archive for June 12, 2026

Friday, June 12, 2026

App Store Personalized Recommendations and Keylogging

Sarah Perez:

This week, Apple announced a series of discovery features that will personalize app recommendations based on users’ interests and behavior, providing a new way for developers to have their app discovered.

At Apple’s Worldwide Developers Conference (WWDC), the iPhone maker introduced Personalized Collections in the App Store, which will showcase recommendations tailored to the individual. These will also include new “App Notes” that explain why the specific apps were recommended to you. Starting this week, you’ll find these new personalized suggestions in various places in the App Store, including the Apps or Games tab or on the Search tab.

Mysk:

Now Apple is putting the extensive identifiable analytics they collect in the App Store in action. They record every tap and there’s no way to turn it off.

They can even calculate your typing speed.

[…]

If you don’t like Apple Music privacy options, you can stream music from Spotify. But where else can you download apps on the iPhone?

The data is associated with your account and unencrypted.

Previously:

Update (2026-06-17): Mysk:

The screenshot in the sub-post was taken from a CSV file you get when requesting your data from Apple. It’s called “App Store Click Activity.” Every event contains 110 attributes 🤯

In this PDF, Apple describes the data points collected in this category.

I requested my own data yesterday but am still waiting for Apple to prepare it.

Mysk:

There’s an ongoing class action lawsuit against Apple related to this. In iOS 26, Apple added an option to “reset” the identifier associated with “usage statistics,” but we haven’t seen any effect for this option. The analytics are still identifiable and linked to the user.

See also: John Gruber, Thom Holwerda, MacRumors.

Update (2026-06-19): Mysk:

It is not only about recording your typing skills in the search field, the App Store app even reports how much time you spend on every part of an app description as you scroll, hence recording your reading skills 🙃.

Apple also forces iOS to open any App Store link in the App Store app, and that will immediately log a detailed event that user XYZ has viewed that particular app as well as the referrer.

[…]

This data collection is not new. Apple has been doing it at least since iOS 14 when we discovered it. All data collected is NOT anonymous. The data is associated with your Apple ID. This means that given a court order, Apple has to hand this data to law enforcement.

Mysk:

Just for fun, I generated a 1000-character text and pasted it in the search field in the App Store. Well, the analytics captured the entire text, linked it to my ID and sent it to Apple, before even pushing “enter”. Now imagine you accidentally paste something private in there🙃

Update (2026-06-23): I received my own personal data from Apple and can confirm that it does include my timestamped App Store search queries.

Rewriting Apple’s TrueType Hinting Interpreter in Swift

Scott Perry:

My team rewrote Apple’s TrueType hinting interpreter in Swift, ask me anything.

[…]

I feel like naming just one would be a disservices to all of the features that made this effort possible (C interop, generics, noncopyable/nonescapable types) but at the end of the day I think the star of the show was the optimizer; despite being faster than the code it replaced, the new code is super readable and that was only possible because the optimizer was able to completely eliminate all of our abstractions.

The new version is faster, but the main motivation was security concerns.

Dmitrii Kalianov:

Is hinting useful/being used in the days of hi-dpi displays? I was under impression that Apple switched to grayscale anti-aliasing and ditched hinting.

Scott Perry:

For the most part hinting isn’t really necessary anymore, but thanks to being Turing-complete it has been Hyrum’s law-ed by at least one CJK font that uses hinting to lay out strokes in its characters.

Alex Rosenberg:

There were three major TrueType implementations at Apple IIRC:

  • The original 68K one
  • A rewrite for Copland that lived with ATS/ATSUI after Copland was cancelled
  • iPhone shipped one derived from heavily-modified FreeType that was current until today

Scott Perry:

One of the axioms for this project was that I wanted my team to write the most boring code possible—nearly identical structurally to the code it was replacing, because to do otherwise would introduce binary compatibility risk. The other axiom was 100% test coverage for all new code as it landed, with the same units testing both interpreters.

Rosyna Keller:

Is the font parsing code itself still C++?

Scott Perry:

There is also a “Safe Font Parser” for WebKit in Lockdown Mode, but it supports a subset of all the myriad features provided by font formats.

Previously:

Update (2026-06-16): Scott Perry (Hacker News):

Font parsers process data from untrusted sources, making the TrueType hinting interpreter a security-critical attack surface. To make the format more resilient on Apple platforms, we rewrote its hinting interpreter from C to memory-safe Swift for the Fall 2025 releases. In addition to memory safety, we also improved performance: on average, our Swift interpreter runs 13% faster than the C interpreter it replaced.

[…]

Binary compatibility was crucial for this project to succeed: existing programs had to continue to function the same as they did before, effectively unaware that a new implementation was in place. This means not just interface compatibility but pixel-identical glyph rendering as well, relative to the C implementation.

[…]

To ensure correctness, we developed two test suites. The first was a unit test suite that can target both implementations, providing exhaustive (99.7%) code coverage for both. This suite is included with the open source release of the Swift interpreter.

Then, to represent real-world workloads, we used a fuzzer to minimize a corpus of 10 million PDF files down to 4,200 without any loss of code coverage.

[…]

Following WebKit’s Safer Swift Guidelines, the example below demonstrates how to wrap a bridged structure from C in a projection type that uses Ref for lifetime safety, brokers bounds-safe access to the underlying data, and returns idiomatic Swift types to its callers.

The interpreter source is on GitHub.

Marcin Krzyzanowski:

@_lifetime(copy code, copy twilightZone, copy glyphZone)

See also: Phillip Tennen’s Writing a TrueType font renderer (Hacker News).

Previously:

Rewriting Notion in SwiftUI

Hartley Charlton:

Apple this week confirmed that Notion is migrating its user interface to SwiftUI, citing the app’s desire for greater performance and UI consistency than its existing web-based stack can deliver.

[…]

The callout was clearly deliberate; Notion is one of the most widely used productivity apps on the Mac, and has long been criticized for the sluggishness that comes with its Electron-based architecture.

Previously:

Safari 27 Announced

Tim Hardwick:

Apple’s new version of Safari browser in macOS 27 and iOS 27 can be tasked to monitor a webpage and notify you of any changes, thanks to a new built-in feature.

[…]

In other upcoming feature additions, using the power of AI, Safari tabs that you have open can automatically be organized into topics.

Saron Yitbarek et al.:

Don’t miss our WWDC26 sessions on web technology, including What’s new in WebKit for Safari 27, to go deeper on our work in this release. Now, let’s dig into this beta, packed with 58 new features, 525 fixes and 4 deprecations that will hopefully make your work as a web developer a little easier.

Saron Yitbarek:

This year, the WebKit team is here with six sessions covering new CSS layouts, customizable form controls, 3D models, immersive spatial experiences, and browser extensions.

See also: Safari 27 Beta Release Notes.

Previously:

Update (2026-06-17): Jeremy Keith:

But credit where credit is due. The upcoming version 27 of Safari is looking very good.

That’s not because it’s at the cutting edge of the latest web standards. Quite the opposite. Most of the changes listed for this release are bug fixes. That’s what I want to acknowledge and applaud.

Previously:

Copyright © 2000–2026 Michael Tsai.