Michael Tsai (Unofficial)

Unofficial automated RSS/Atom links to Michael Tsai's work on Apple platforms, security, and privacy. Original work is credited at the source; follow the source links. Zaps support the independent feed operator, not the author.

Public Key

npub10vavgjgeehwwlhqfxrdnksn2yku48cscd7uetxmz2y7umys5l6qqdn27dc

NIP-05 Address

michael-tsai@qwibbit.com

Profile Code

nprofile1qqs8kwkyfyvumh80msynpkemgf4ztw2nugvxlwv4nd39z0wdjg20aqqpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0ds6rhkwh

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub10vavgjgeehwwlhqfxrdnksn2yku48cscd7uetxmz2y7umys5l6qqdn27dc

Show more details

Last Notes

2026-10-31 00:39:14 UTC

iPhone Duo Crackgate
Juli Clover (forum):
Some iPhone Duos are already experiencing hinge issues that cause display cracks, based on photos shared on Reddit and the MacRumors forums. Almost all of the display faults are right along the hinge, and most result in a line of bright pixels across one side of the screen.
Juli Clover (iFixit, Hacker News):
iFixit commented on some of the display failures people have been seeing, suggesting they could be caused by pressure, a trapped particle, repeated bending, or a manufacturing defect. It may not be that the display has physically snapped, because a wiring problem can cause the same effect.
Where most of the faulty units are experiencing issues, the hinge has a different shape. The failure spot is also near where the accordion cable passes by and where several edges meet, which could be leading to a concentration of stress in that spot.
Terrence O’Brien:
Social media and the iPhone Duo subreddit are filled with reports of Apple’s foldable failing quickly and in spectacular fashion. Some users report having the phone for only a few hours before the hinge seems to catch on something, then audibly crack and break the screen. Tellingly, the cracks all seem to happen in the same place.
YouTuber CuriousHagi was able to reproduce the cracked screen during some durability testing of the iPhone Duo. Then he pulled it apart to try and find the culprit. What he found is that the Duo’s hinge is quite complex, consisting of a gear-like central hinge and two different types of linking hinges.
The piece that broke is one of the links in the middle of the phone that happens to be thinner than the links below or above it, and it snapped at a small notch where it would be weakest. He also found marks where the hinge met the support plate, indicating where it may have gotten caught.
Mark Gurman:
In these cases, customers reported hearing a crunching sound when unfolding the phone, followed by a large crack forming along the center crease. Some users also experienced a white patch or other display malfunction on the right side of the screen.
[…]
Apple acknowledged the issue in a statement, saying it was “aware of an issue impacting the inner display on a small number of iPhone Duo units.”
Juli Clover:
It is our understanding that some of the images of alleged cracking are AI-generated, which makes it harder to determine the actual scope of the problem.
Many of the iPhone Duos experiencing issues cracked in the same place on the lower half of the inner display. The crack is along the hinge, and users say there is a stuck feeling and sometimes a popping noise just before the damage appears.
Previously:
iPhone Duo Reviews
iPhone Duo
Apple Responds to Project Zero
https://mjtsai.com/blog/2026/10/30/iphone-duo-crackgate/
#iphoneduo #duocrackgate #juliclover #duoapple #duoreviews
#rss #feeds #linksharing #qwibbit

2026-10-30 23:58:59 UTC

Russia Wants User Data From Apple
Hartley Charlton (Hacker News):
Apple faces Russian data retention and disclosure requirements after being added to the country's state surveillance registry, Bloomberg reports.
[…]
Those obligations cover correspondence and messages containing audio or video. Companies must also keep information identifying users and recording the transmission of their communications within Russia for three years.
I guess this could include iMessage, iCloud mail, iCloud Photos, and perhaps iCloud backups. I have not seen whether they want an iCloud Advanced Data Protection backdoor.
William Gallagher:
That data must be stored on servers within Russia, and it must be turned over to the country’s security services as required.
Neither Apple nor Microsoft has yet commented publicly on the new requirements.
Previously:
Russia Gets Apple to Turn Off App Store Payments
Russia Blocks FaceTime, Snapchat, and Roblox
UK Again Wants iCloud Backdoor
Apple Removes VPN Apps From Russian App Store
iOS to Offer Pre-Installed Apps in Russia
Apple Storing Russian Users’ Data on Local Servers
A Hard Bargain for Apple in China
https://mjtsai.com/blog/2026/10/30/russia-wants-user-data-from-apple/
#apple #russia #appstore #icloud #appleremoves #applestoring #getsapple #backdoorapple #advanceddata #dataprotection
#rss #feeds #linksharing #qwibbit

2026-10-30 23:22:34 UTC

Australia: App Marketplaces, External Payments, No Fees/Audit
Hartley Charlton (Hacker News):
Australia’s Federal Court today ordered Apple to allow competing app stores, direct app downloads, and alternative payment services for Australian users from March 1, 2027.
[…]
Apple must let users find, download, install, and update apps through competing marketplaces and websites without charging for access or obstructing their use. Developers must receive the necessary tools on substantially the same terms as for App Store distribution, and Apple cannot penalize them for using competing stores or payment services.
Developers will also be able to offer alternative payments and link to other ways to pay, including within App Store apps. Apple cannot require them to offer its own purchasing system alongside alternatives, report those transactions, or allow Apple to audit them.
Apps will be notarized, but Apple cannot collect fees on purchases not made through the App Store. This seems like the best antitrust result yet. This will take effect on March 1, 2027 unless blocked by Apple’s appeal or request for extension.
Marcus Mendes:
Today’s order follows a ruling last year that Apple violated Australian competition law by restricting alternative app distribution and payment methods, in a lawsuit brought by Epic Games similar to its long-running legal battle with Apple in the US.
[…]
Justice Beach described the latter two actions as “a paradigm example of Apple’s enforcement of its restrictive terms, in contravention of” section 46 of Australia’s Competition and Consumer Act 2010, which prohibits corporations with substantial market power from engaging in conduct that has “the purpose, or has or is likely to have the effect, of substantially lessening competition” in that market.
[…]
When it comes to Apple’s wins in the decision, the list is much slimmer. Judge Beach rejected Epic’s request to extend the court’s injunctions worldwide and allowed Apple to maintain security scanning and notarization requirements for apps distributed outside the App Store. And while Apple must permit competing app marketplaces on iOS, it is not required to distribute them through its own App Store.
[…]
Finally, the court ordered Apple to pay 85% of Epic’s legal costs incurred through the original trial[…]
Nick Heer:
It seems unsustainable to keep dripping out rule changes one country at a time, especially as many of them slightly differ in the details even when regulators’ overarching aims are similar. The reasons for the company’s stubbornness — namely: security and privacy — become much less believable as a growing number of regions require alternative distribution channels, essentially without issue.
Apple should just rip off the bandage and do Gatekeeper for iOS.
Hartley Charlton:
Fortnite will return to Australia’s App Store today, Epic Games told Reuters, after a federal court ordered Apple to allow eligible Epic apps back onto the store.
Previously:
South Korea Fines Apple Over App Store
Taiwan: 26% App Store Fee
New EU App Store Terms to Comply With DMA
Apple Proposes 15% External Purchase Fee
UK CMA Proposals for External Payments and NFC
Fortnite Returns to the App Store Except in Australia
Brazil: App Marketplaces and External Payments
Japan: App Marketplaces, External Payments, New Fee Structure
Australian Court Finds iOS App Store Monopoly
https://mjtsai.com/blog/2026/10/30/australia-app-marketplaces-external-payments-no-fees-audit/
#appstore #apple #appmarketplaces #australia #fees #audit #epicgames #payments #court #hartleycharlton
#rss #feeds #linksharing #qwibbit

2026-10-30 22:45:30 UTC

Taiwan: 26% App Store Fee
Apple:
Apple is making changes to the Taiwan storefront of the App Store, following discussions with the Taiwan Fair Trade Commission.
As of October 31, 2026, the commission rate for standard Apple In-App Purchase and paid app transactions will be 26% on the Taiwan storefront of the App Store on iOS and iPadOS.
Juli Clover (Marcus Mendes):
Apple normally charges a lower rate for Small Business Program members, but the announcement about the Taiwan commission changes doesn't include that information.
Previously:
South Korea Fines Apple Over App Store
Australia: App Marketplaces, External Payments, No Fees/Audit
Lower App Store Fees in China
Japan: App Marketplaces, External Payments, New Fee Structure
EU App Store Tiers and Core Technology Commission
https://mjtsai.com/blog/2026/10/30/taiwan-26-app-store-fee/
#appstore #appmarketplaces #externalpayments #fee #storeaustralia #taiwanfair #newfee #feestructure #fairtrade #commission
#rss #feeds #linksharing #qwibbit

2026-10-30 22:05:32 UTC

South Korea Fines Apple Over App Store
Marcus Mendes:
South Korea’s Korea Media and Communications Commission (KMCC) announced today a series of fines and corrective orders against Apple and Google over violations of the country’s Telecommunications Business Act.
Specifically for Apple, the KMCC imposed a fine of 20.81 billion won (approximately $15.5 million) and ordered the company to revise its App Store policies regarding payment methods and app review procedures, as well as prevent what it referred to as “discriminatory commission” practices from recurring.
[…]
In essence, the decision centers around three violations: forcing specific payment methods, unfairly delaying app reviews, and imposing discriminatory commissions.
Previously:
Taiwan: 26% App Store Fee
Australia: App Marketplaces, External Payments, No Fees/Audit
South Korea Raids Apple Offices
South Korea Investigates App Store
StoreKit External Purchase Entitlement for South Korea
Apple Refuses App Store Changes for South Korea
South Korea App Store Bill
https://mjtsai.com/blog/2026/10/30/south-korea-fines-apple-over-app-store/
#southkorea #appstore #auditsouth #koreainvestigates #officessouth #storechanges #businessact #applerefuses #appmarketplaces #telecommunicationsbusiness
#rss #feeds #linksharing #qwibbit

2026-10-30 21:26:27 UTC

Xcode 27.2
Apple (xip, downloads, Xcode Releases):
Xcode 27.2 includes Swift 6.4 and SDKs for iOS 27.2, iPadOS 27.2, tvOS 27.2, watchOS 27.2, macOS 27.2, and visionOS 27.2. Xcode 27.2 supports on-device debugging in iOS 17 and later, tvOS 17 and later, watchOS 10 and later, and visionOS. Xcode 27.2 requires a Mac running macOS Tahoe 26.6 or later.
[…]
When used via Sidecar or a MacBook with Touch, Device Hub now sends touches on the iPad screen to the remote device as touches. This allows you to use multi-finger gestures such as pinch and rotate to test your applications.
[…]
Projects that use APIs specific to iOS 27.1 show compile errors when building for Mac Catalyst (“undeclared identifier”, “not found”, “has no member”, “cannot find”, and similar errors).
[…]
macOS, watchOS, tvOS, and visionOS SDKs in Xcode 27.2 incorrectly report 27.1 as a valid deployment target. Builds and other functionality might have unexpected behavior if this deployment target is used.
Ron Elemans:
Every time I open a complex Storyboard in Xcode 26 or newer, the Inspector panel decides at a certain moment to resize to full window width. The only way to continue working is to hide the whole Inspector, resizing back doesn’t work.
Feedback Assistant shows “Recent Similar Reports: Less than 10” for at least a year. This is probably Apple language for “Deal with it, otherwise stop using dinosaur tech and switch to SwiftUI” (FB23611443).
Previously:
Xcode Projects for the Command Line and Coding Agents
Xcode 27.1
Xcode’s New .xcproj Files Are JSON
https://mjtsai.com/blog/2026/10/30/xcode-27-2/
#xcode #tvos #watchos #xcodeprojects #ios #visionos #agentsxcode #maccatalyst #inspector #devicehub
#rss #feeds #linksharing #qwibbit

2026-10-30 00:52:47 UTC

eMudhra Intermediate CA Compromise
Dan Goodin:
Security personnel around the world are on high alert Tuesday following the discovery of eight TLS certificates with private keys so weak they could allow anyone to mint trusted browser and app credentials for any site on the Internet.
As of late morning Tuesday, browser makers and some major apps and programming languages had blocked all eight of the intermediate certificates.
[…]
“This will be a massive cleanup job, bigger than Heartbleed,” Filippo Valsorda, a cryptography engineer and a cryptography maintainer for the open source Go programming language, told Ars. “There will be a very, very long tail, IoT devices, Docker containers, forgotten Linux machines, unmaintained CLI tools that shipped their own copy of the roots (which is common in some ecosystems, like Python). Also, Linux distributions are still rolling out updates, some of them are not ready yet, and then system administrators will need to apply them to a lot of machines.”
[…]
The compromised eMudhra keys were defective at a level that’s challenging the imagination of many of the engineers studying the incident. A normal size for a NIST P-384 elliptic curve cryptography private key contains roughly 384 bits of entropy, a size allowing almost 2384, or a number with 116 digits, different possibilities. The private key sizes of the compromised keys ranged from 3 to 8 bits. Astonishingly, the private keys were 4, 56, 66, 115, 155, 156, 230, 237.
[…]
Ben Cartwright-Cox, director of BGP.tools, said: “My guess is that it’s example code that accidentally leaked to production, but hard to know. But it’s bonkers that no one noticed.”
Apple (Hacker News):
On 19 October 2026, Apple began blocking these 12 certificates on Apple devices. Updates to certificate configuration data are sent to devices automatically and as needed, so you don’t need to install a software update to get this change. Apple is making additional updates to this block, which will also be delivered automatically. On 23 October 2026, Apple also began blocking the emSign ECC Root CA - G3.
[…]
On Mac, some command-line tools included with macOS or the Xcode Command Line Tools (including curl, git, python3, ruby, perl, and openssl) check certificates against /etc/ssl/cert.pem. For certificates that chain to a root CA certificate in this file, these tools don’t check Apple’s block or whether the certificate has been revoked. This file will be updated in a future macOS update. If you use these tools and don’t want to wait for the update, you can remove root CA certificates from the file.
[…]
These steps affect every tool that uses /etc/ssl/cert.pem. Afterward, tools that use only this file might not be able to verify some websites whose certificates chain to these root CA certificates through intermediate CAs that weren’t affected.
emudhra.we-have-a-problem.com (Hacker News):
Apple has warned that until it ships its own fix, a macOS update may replace /etc/ssl/cert.pem. You may need to repeat these steps after each update.
See also: Filippo Valsorda, Howard Oakley, and TidBITS-Talk.
Previously:
macOS 27.2
https://mjtsai.com/blog/2026/10/29/emudhra-intermediate-ca-compromise/
#apple #compromise #intermediate #tools #emudhra #root #tuesday #filippovalsorda #linux #october
#rss #feeds #linksharing #qwibbit

2026-10-29 00:56:15 UTC

MacBook Pro (PROLED XDR Display)
Apple (technology overview, Hacker News, MacRumors, 9To5Mac, ArsTechnica, Slashdot):
Apple today introduced the all-new MacBook Pro with PROLED XDR Display, featuring breakthrough tandem OLED technology that delivers game-changing front-of-screen performance. Available in 14- and 16-inch models, MacBook Pro with PROLED XDR Display offers a visual experience unlike any other, transforming pro workflows with up to 2000 nits peak HDR and SDR brightness, an industry-leading 10,000,000:1 contrast ratio for exceptional detail, a 120Hz variable refresh rate, and a wider color gamut covering both P3 and Adobe RGB for brilliant colors. The new MacBook Pro also introduces intuitive Touch capabilities on the Mac for the first time, opening up a whole new dimension for pros to interact with their content, from manipulating 3D models to playing musical instruments onscreen. The Dynamic Island now comes to Mac, serving as the home for Spotlight, Live Activities, and Siri AI. And with up to 24 hours of battery life in thinner and much lighter 3- and 4-pound designs, MacBook Pro is more portable than ever, empowering pros to take their work wherever inspiration strikes. Featuring M5 Pro and M5 Max, Apple’s most powerful chips ever built for a pro laptop, along with up to 128GB of unified memory and now up to 16TB of blazing-fast storage, the new MacBook Pro delivers speed and capability for the most demanding workflows.
[…]
Crafted specifically for the Mac, every touch interaction feels incredibly responsive and refined. Everyday tasks are simple and intuitive, allowing users to scroll through a webpage with a natural swipe; pinch to zoom in on a photo; drag and drop slides from one presentation to another; and double-tap a window to fill the screen, or flick to tile it into place. And the touch sensor is built directly into the display panel — not layered on top of it — reducing latency so users feel like they’re touching the content itself.
Touch also introduces entirely new ways of working for pro users. Graphic designers can now use the entire display as their canvas, no longer constrained by the area of the trackpad when drawing; musicians can play software instruments right onscreen; and app developers can test how Touch performs in their iOS and iPadOS apps directly on the MacBook Pro display.
[…]
The 14-inch MacBook Pro now weighs half a pound less at 3 pounds, while the 16-inch MacBook Pro weighs just 4 pounds — 0.7 pounds lighter than before. Both models feature a slimmer design enabled by OLED’s more efficient display stack, with the 16-inch model nearly a millimeter thinner and the 14-inch model half a millimeter thinner.
Juli Clover:
Pricing on the MacBook Pro starts at $2,899 for the 14-inch model and $3,399 for the 16-inch model.
The base configurations have an M5 Pro with 24 GB of RAM and a 1 TB SSD.
This all sounds technically impressive, but these Macs don’t really interest me. I don’t need the better display; I rarely use the internal one, anyway. And I don’t want to touch my display; it seems less efficient, with horrible ergonomics, and I don’t want to get gunk on it.
I do like that the new MacBook Pros are a bit lighter, seemingly with no compromises.
The Dynamic Island does seem better than the Notch, but the problem with the Notch is mostly software, not hardware. There’s no indication that the software will be better, though at least the Dynamic Island is smaller.
What would I rather see in a new MacBook Pro? A smaller trackpad, a rounder front edge, more USB ports, Face ID, cellular.
John Gruber:
So I’m just wondering if tomorrow’s new touchscreen OLED MacBooks aren’t replacements for the current MacBook Pros, but instead are the start of a new MacBook family with another name. I don’t think they’d call them MacBook “Duos”, because they’re not two-in-one devices. MacBook “Ultras”, maybe — with the same specs as the MacBook Pros but more expensive displays? But “Ultra” seems like a wrong name for a MacBook because Apple’s M-series Ultra chips are (to date at least) desktop only. It’d be weird if the M5 Ultra is exclusive to the Mac Studio while the MacBook “Ultra” maxes out with the M5 Max. So maybe they just are the new MacBook Pros and this first OLED/touch generation uses the same chips as the ones from March?
“Ultra” never made sense, so I wondered whether Apple would add some other moniker like “Touch” or “Studio.” It turns out not, but “PROLED XDR Display” doesn’t exactly roll off the tongue, so something like “MacBook Touch” may end up being the defacto name, anyway.
Hartley Charlton:
The iconic glowing rear Apple logo is returning to the MacBook Pro with the latest model, Apple today announced.
John Voorhees:
The MacBook Pro does not, however, support the Apple Pencil.
John Ternus:
We’re glowing with excitement over the new MacBook Pro. You’ve gotta touch it to believe it.
Tim Cook:
We brought Touch to the Mac!
Steven Levy (MacRumors):
This turnaround is a big deal to Apple fans. Ternus shrugs off the drama. “The Mac is first and foremost an indirect input device, built around the trackpad and keyboard. But I think there’s times when it’s comfortable and handy to have touch.”
[…]
When I met with Apple executives Johny Srouji and Greg Joswiak this week to discuss the touchscreen MacBook Pro, you bet I invoked Schiller’s list of concerns. (Apple’s reps chose not to make Schiller, who now holds the title of “Apple Fellow,” available for an interview. In fact, they laughed when I asked.) It wasn’t only Schiller drawing a red line. In 2021, Ternus told journalist Joanna Stern, “The Mac is totally optimized for indirect input. We haven’t really felt a reason to change that.”
“Ten years is a very, very long time,” says Srouji, Apple’s chief hardware officer. “Many things have changed, whether it’s the display technology, the custom silicon, et cetera.” Eventually, he told me, the confluence of chips, display tech, and software architecture “met our bar.”
[…]
Joswiak, who holds Schiller’s old title of SVP of worldwide marketing, concedes that touch was overdue, at least for users with sophisticated needs. Its pro customers—engineers, scientists, software developers, and media creators—were impatient with Apple for its failure to let them interact directly with the screen. “Most pros own an iPad, and almost every pro owns an iPhone,” Joswiak says. “So this is something that they’re natural with. There’s a generation of young creators and young people using our MacBook Pros that expect to touch.”
Jason Snell:
Another question I had coming into this event was just how much effort Apple would make to adapt the macOS interface for touch. The answer is: A little, but not a lot. When you touch the screen, the interface makes subtle adaptations—more spacing in menus, more feedback when selecting and dragging items—but what it doesn’t do is flip into some new Touch Mode that looks and behaves totally unlike the Mac.
Federico Viticci:
Here is the same contextual menu on macOS activated via pointer (left) and touch
macOS automatically detects touch input and spaces out items a little bit more in the UI
TheRealAlex:
So I need to know what is the reason you need a Touchscreen on your […] Laptop?
What are you doing?
Paul Haddad:
The PROLED (🤮) display seems to have all the expected specs for a high end OLED. The sub pixel layout is unusual, at least I haven’t seen any others with this style. It’s an interesting choice since standard RGB is the next “big thing” with desktop OLEDs.
I wonder if Apple re-added sub-pixel rendering to the OS or just don’t bother since the PPI is high enough to maybe not matter.
See also: Mac Power Users Talk.
Previously:
Developing Mac Apps for Touch
MacBook Pro (M6, 2026)
iMac 2026
Golden Gate and the Notch
Mac Studio 2026
Mac mini 2026
macOS Touch
The Problem With the Touch Bar
An Ultralight MacBook and Other Apple Silicon Roads Not Taken
MacBook Neo
MacBook Pro 2026
MacBook Air 2026
Apple M5 Pro and M5 Max
The Dynamic Island
Big Sur Not “Preparing” for Touch Macs
New MacBook Pros and the State of the Mac
https://mjtsai.com/blog/2026/10/28/macbook-pro-proled-xdr-display/
#proledxdr #macbookpro #xdrdisplay #touch #mac #apple #adobergb #dynamicisland #oled
#rss #feeds #linksharing #qwibbit

2026-10-29 00:20:12 UTC

Developing Mac Apps for Touch
Design for touch on Mac (via Jeff Nadeau):
Discover the key design considerations for updating your app for touch on macOS. We’ll explore the touch gestures now available on Mac, how system gestures work, how to size controls and touch targets while keeping your app great with a pointer and keyboard, and how to adapt hover interactions. Finally, we’ll dive into the expansion behaviors of native controls like steppers, dials, and sliders, and what that means for your app.
Bring Touch to your Mac app:
Discover how to add touch capabilities to your Mac app. Explore how to transition from classic mouse tracking APIs to modern gesture recognizers and touch-native controls. Find out how to optimize hit targets, implement multi-touch interactions, and manage system gestures to deliver an incredible touch experience. To get the most out of this session, watch Design for Touch on Mac.
Bring Live Activities to Mac:
Discover how to drive Live Activities from your Mac app. Explore how Live Activities appear in the menu bar and Dynamic Island. Learn how to define your data model, create compact and expanded views with SwiftUI, and drive interactive updates using App Intents.
Written documentation is “coming soon.”
Previously:
MacBook Pro (PROLED XDR Display)
Golden Gate Release Candidate
macOS Touch
https://mjtsai.com/blog/2026/10/28/developing-macos-apps-for-touch/
#touch #app #jeffnadeau #activities #appintents #dynamicisland #goldengate #xdrdisplay #gaterelease #releasecandidate
#rss #feeds #linksharing #qwibbit

2026-10-28 06:55:33 UTC

visionOS 27.2
Juli Clover (release notes,
security,
no enterprise,
developer):
Apple today released visionOS 27.2, the first big update for the visionOS 27 operating system that runs on the Apple Vision Pro.
[…]
The visionOS 27.2 update provides bug fixes and security updates, per Apple’s release notes.
Previously:
visionOS 27
https://mjtsai.com/blog/2026/10/27/visionos-27-2/
#juliclover #visionos #applevision #pro #previously
#rss #feeds #linksharing #qwibbit

2026-10-28 06:22:22 UTC

audioOS 27.2
Juli Clover (release notes):
HomePod Software 27.2 brings a new Sound Glow option to the HomePod, HomePod mini, and upcoming HomePod mini 2. Sound Glow causes the top of a HomePod or HomePod mini to light up with color that pulses in sync with the music that’s playing. The feature draws colors from album artwork, and it works with songs, podcasts, and Apple’s ambient music feature.
The update also adds support for using HomePods as the default speaker for a Mac, plus it allows four HomePods or HomePod mini 2 speakers to be used as surround sound for the new Apple TV.
Previously:
HomePod mini 2
audioOS 27
https://mjtsai.com/blog/2026/10/27/audioos-27-2/
#soundglow #juliclover #audioos #homepodsoftware #apple #mac
#rss #feeds #linksharing #qwibbit

2026-10-28 05:49:20 UTC

tvOS 27.2
Juli Clover (release notes,
security,
developer):
Today’s update adds support for four-speaker surround sound, a feature that works with the HomePod, HomePod mini 2, and the upcoming Apple TV 4K.
It allows the Apple TV 4K to be used with four HomePod mini 2 speakers, four second-generation HomePods, or two HomePods and two HomePod mini 2 speakers to get surround sound.
Previously:
Apple TV 4K 2026
HomePod mini 2
tvOS 27
https://mjtsai.com/blog/2026/10/27/tvos-27-2/
#juliclover #tvos #apple
#rss #feeds #linksharing #qwibbit

2026-10-28 05:15:28 UTC

watchOS 27.2
Juli Clover (release notes,
security,
developer):
According to Apple’s release notes, watchOS 27.2 introduces new Siri AI features and extends Siri AI to new languages.
Previously:
watchOS 27
https://mjtsai.com/blog/2026/10/27/watchos-27-2/
#watchos #juliclover #siri #according #apple #previously
#rss #feeds #linksharing #qwibbit

2026-10-28 04:42:01 UTC

macOS 26.7.2 and macOS 15.8.2
macOS 26.7.2 (security,
no enterprise,
no developer,
full installer):
This update provides bug fixes and security updates for your Mac.
macOS 15.8.2 (security,
no enterprise,
no developer,
full installer):
This update provides bug fixes and security updates for your Mac.
Previously:
macOS 26.7.1 and macOS 15.8.1
https://mjtsai.com/blog/2026/10/27/macos-26-7-2-and-macos-15-8-2/
#macos #previously
#rss #feeds #linksharing #qwibbit

2026-10-28 04:08:43 UTC

iOS 27.2 and iPadOS 27.2
Juli Clover (iOS/iPadOS release notes,
security,
iOS/iPadOS enterprise,
developer):
The iOS 27.2 update expands Siri AI to new languages, including French, Japanese, Korean, Portuguese, and Spanish. It also adds profiles for the Apple TV app, a new icon and branding for Apple Music, and support for AI suggestions in the Messages app for taking quick actions in apps like Calendar and Reminders.
In the European Union, it introduces an alternative expanded prompt for App Tracking Transparency.
Ryan Christoffel:
iOS 27.2 adds a new setting for ‘Lock Controls’ inside the Home app’s HomePod accessory settings.
Previously:
iOS 27.1
iOS 27.0.1 and iPadOS 27.0.1
App Tracking Transparency Changes in Germany
Europe vs. App Tracking Transparency
https://mjtsai.com/blog/2026/10/27/ios-27-2-and-ipados-27-2/
#trackingtransparency #apptracking #juliclover #ios #ipados #applemusic #europeanunion #japanese #korean #portuguese
#rss #feeds #linksharing #qwibbit

2026-10-28 03:32:48 UTC

macOS 27.2
Juli Clover (release notes,
security,
enterprise,
developer,
full installer,
IPSW):
macOS Golden Gate 27.2 overhauls the brightness and volume sliders, plus it expands Siri AI to new languages including French, Japanese, Korean, Portuguese, and Spanish.
Mr. Macintosh (post):
Apple just broke the macOS security update record AGAIN, patching 263 CVEs in macOS Golden Gate 27.2! 🤯🔐
Jeff Johnson:
I decided to email Apple Product Security yesterday just to ask whether CVE-2026-112500 was my [e-mail privacy] issue. In the past I’ve had a number of email conversations with Apple Product Security, including a long-running thread initiated by them way back in 2024 about a WebKit security issue that I had reported, with last reply in July of this year. Sadly, as far as I can tell, I still haven’t been credit for that issue.
[…]
In other words, Apple Product Security no longer accepts reports via email, instead requiring security researchers to submit via a web form. But the web form wants you to “Report a vulnerability,” with no place for a simple question like mine, about a vulnerability already fixed. Also, the quoted paragraph implies that if you don’t use the web form, you might not get a CVE, which I suspect is what happened to me!
Gwynne Raskind:
PSA: If you use the removemacai tool and are having trouble updating to macOS 27.2, remove the RemoveMacAI profile in System Settings -> General -> Device Management. It appears to somehow block softwareupdate’s ability to download parts of the update.
Mario Guzmán:
macOS 27.2 beta brings back the solid divider line between sidebars and their details view.
Steve Troughton-Smith:
macOS 27.2 has reverted the [Mission Control] change: fullscreen apps are now once again titled by app name, not window title
David Deller:
Still broken on macOS 27.2. No response to my Feedback so far.
I’ve since added a workaround in Radiccio that simply removes the Liquid Glass effect (so the buttons can work again).
Hartley Charlton:
Upgrading to macOS 27 no longer removes an existing Rosetta installation[…]
Jeff Johnson:
I suspect what Apple really meant is that macOS 27 was not automatically reinstalling Rosetta, and now it does again in 27.2.
Previously:
Mac Installer Plug-Ins Bug
macOS 27.0.1
Hide My Email Vulnerability Exposes Real Address
Mandatory Apple Intelligence
https://mjtsai.com/blog/2026/10/27/macos-27-2/
#goldengate #appleproduct #productsecurity #juliclover #macos #jeffjohnson #email #again #appleintelligence #mandatoryapple
#rss #feeds #linksharing #qwibbit

2026-10-28 02:23:29 UTC

iMac 2026
Apple (MacRumors, Hacker News):
Apple today announced the new iMac featuring the superfast M6, delivering even more performance and powerful AI capabilities in its strikingly thin all-in-one design. […] Connectivity gets even better with Wi-Fi 7 and Bluetooth 6, along with available 2.5 Gigabit Ethernet and storage that is up to 2x faster, so apps and large projects launch in an instant. Completing the iMac experience is an expansive 24-inch 4.5K Retina display; an industry-leading camera, speakers, and mics; up to four Thunderbolt 4 ports; color-matched accessories; and the power of macOS 27. Available in a spectrum of seven colors — blue, green, pink, yellow, purple, orange, and silver — the new iMac is a tremendous upgrade for existing users and an incredible gateway into everything the Mac can do for new users.
[…]
iMac with M6 featuring a 10-core CPU and 10-core GPU starts at $1,499 and $1,449 with education savings. iMac with a 12-core CPU and 12-core GPU starts at $1,699 and $1,599 with education savings.
The base configuration has 16 GB of RAM and a 256 GB SSD, only 2 Thunderbolt ports, and no Touch ID or Ethernet, amongst other limitations. John Gruber has a price chart.
Previously:
MacBook Pro (M6, 2026)
Apple M6 and M5 Ultra
Mac Studio 2026
Mac mini 2026
MacBook Neo
MacBook Pro 2026
MacBook Air 2026
iMac 2024
https://mjtsai.com/blog/2026/10/27/imac-2026/
#imac #apple #gigabitethernet #macbookpro #gpu #macstudio #ultramac #thunderbolt #available #neomacbook
#rss #feeds #linksharing #qwibbit

2026-10-28 01:51:32 UTC

MacBook Pro (M6, 2026)
Apple (MacRumors, Hacker News):
Apple today announced the new 14-inch MacBook Pro with M6, delivering even more performance, powerful on-device AI capabilities, and faster connectivity for college students, business users, creators, and more. M6 features an advanced 12-core CPU with the world’s fastest CPU core, so everything from productivity tasks to more demanding pro workflows feels incredibly fast and responsive.
[…]
The 14-inch MacBook Pro with M6 starts at $1,999 and $1,899 with education savings.
The base configuration has 16 GB of RAM and a 1 TB SSD.
John Gruber:
This tier of MacBook Pro has only ever been offered in the smaller 14-inch size. Prices seem unchanged from the post-June-price-hike M5 models[…]
Tim Hardwick:
According to Apple’s tech specs page, the option for 16GB of unified memory remains limited to 153GB/s. That’s identical to the M5 version, while only the new 24GB and 32GB configurations receive the faster 170GB/s memory bandwidth.
Hartley Charlton:
How much has changed, and is it worth upgrading or choosing the newer model?
Previously:
iMac 2026
Mac Studio 2026
Mac mini 2026
Apple M6 and M5 Ultra
MacBook Neo
MacBook Pro 2026
MacBook Air 2026
MacBook Pro (M5, 2025)
https://mjtsai.com/blog/2026/10/27/macbook-pro-m6-2026/
#macbookpro #apple #cpu #timhardwick #mac #macstudio #ultramacbook #neomacbook #ssd #johngruber
#rss #feeds #linksharing #qwibbit

2026-10-27 02:18:27 UTC

iPod at 25
Hartley Charlton:
Apple today marks 25 years since the introduction of the original iPod, one of the company’s most significant products and a major contributor to its expansion beyond the Mac.
Tony Fadell:
A small team. An unforgiving deadline. We had months to bring the hardware, software, and music experience together. Proud of what we built and that it means so much to people still today. A device that has been woven in many ways into our lives. People have filled their iPods with road trips, breakups, workouts, special occasions with family and friends.
Joe Rossignol (Hacker News):
Apple Music has a 404 page easter egg on the web: a functional iPod that appears when you load a page that does not exist, such as music.apple.com/macrumors.
Nick Heer:
This looks enough like my own iPod library circa twenty years ago that it threw me a little. I hope this is not appearing solely for the occasion of the iPod’s anniversary. It is a nice surprise.
Previously:
Apple Music’s New Look
iPod at 20
https://mjtsai.com/blog/2026/10/26/ipod-at-25/
#applemusic #ipod #hartleycharlton #nickheer #tonyfadell #mac #newlook #joerossignol
#rss #feeds #linksharing #qwibbit

2026-10-27 01:45:41 UTC

iPad mini (8th Generation)
Apple (Hacker News):
Apple today unveiled the all-new iPad mini, featuring a stunning OLED display in an even thinner and lighter design, a huge leap in performance with A20 Pro, and water and dust resistance. The larger 8.5-inch OLED display, also available with a nano-texture option, delivers higher contrast and more than 2x higher peak brightness than the previous-generation iPad mini for a brilliant and immersive viewing experience.
[…]
The new iPad mini features an innovative Acoustic Display for an even better audio experience when gaming, watching videos, or editing content. Specially designed woofers are paired through the display to produce punchier bass and more volume. In addition, custom tweeters are now hidden between the glass and aluminum enclosure for clearer highs.
[…]
The 12MP Center Stage front camera is now on the landscape edge[…]
[…]
With iPadOS 27.2, iPad mini also supports extended display mode when connected to an external display, great for users multitasking with windowed apps.
John Voorhees:
The new iPad mini comes in Midnight and Starlight colors (fewer than before) and starts at $699, which is less than some rumors suggested, and can be configured up to $1,249 before accessories.
Before the recent price hikes it was $499. The MacBook Neo is also $699 (including keyboard).
John Gruber:
Still stuck with Touch ID — a bummer in general, and a shit sandwich given how expensive these have gotten. Unless Apple decides to make a mini-sized iPad Pro (which I definitely do not expect), there’s no way to buy a mini-sized iPad with Face ID.
[…]
This is the first iPad Mini with an XDR display. But: no ProMotion.
[…]
The new Mini is thinner (5.4mm vs. 6.3mm) and lighter (255g vs. 293g for Wi-Fi models). The display is slightly larger (8.5″ vs. 8.3″) while the footprint shrunk slightly, because the bezels have been reduced by 25 percent. The iPhone Duo weighs almost exactly the same (254g to be exact) but its inner display is only 7.6 inches diagonally.
Ryan Christoffel:
In fact, every configuration except the highest 512GB model includes a less powerful, binned A20 Pro chip.
According to Apple’s tech specs page, here’s the breakdown of the A20 Pro across different storage configurations.
Rui Carmo:
I very dearly want to go back to the Mini since the Pro is too large as a permanent companion device, but the inflated pricing is not helping. and neither is my feeling that Apple has likely nerfed the hardware in ways that matter to me.
Previously:
iPhone Duo
Apple Hardware Price Hikes
iPad Air (M4, 8th Generation)
iPad Pro (M5, 8th Generation)
In Praise of the iPad mini 7
iPad (11th Generation)
iPad mini (7th Generation)
https://mjtsai.com/blog/2026/10/26/ipad-mini-8th-generation/
#ipadmini #generation #display #pro #apple #oled #acousticdisplay #duoapple #pricehikes #centerstage
#rss #feeds #linksharing #qwibbit

2026-10-24 15:35:19 UTC

Apple Music’s New Look
Joe Rossignol:
In a YouTube video shared today, Apple said the new Apple Music visuals were “made by sound.” More specifically, Apple said it played a sound through a container of water, resulting in the liquid moving at the frequency of the notes. Apple Music brand elements were placed behind the vibrating water, resulting in a new liquid-inspired look.
Charlotte Gunn:
The approach draws on Apple’s wider design direction, particularly Liquid Glass, the translucent design language introduced across its software in 2025.
The redesign includes Apple Music’s typography. A new wordmark pairs the recognisable Apple symbol with a customised version of Apple’s own typeface, SF Pro. Bold, lowercase lettering gives the service a youthful energy, while a reworked musical note icon takes its shape from the forms captured during filming.
The project reportedly took months of experimentation with sound, materials and moving image.
Brian Webster:
“We spent a billion dollars to build a room where we splash in the water while smoking weed for a couple years, and came up with a plain black and white Apple Music icon. And oh yeah new font.”
Previously:
Liquid Glass 27 Icons
https://mjtsai.com/blog/2026/10/23/apple-musics-new-look/
#applemusic #look #liquidglass #joerossignol #charlottegunn #pro #webster
#rss #feeds #linksharing #qwibbit

2026-10-24 15:01:59 UTC

iOS 27.1
Joe Rossignol (no iOS/iPadOS release notes,
no security,
no iOS/iPadOS enterprise,
no developer):
Apple this week released the full and final version of iOS 27.1, but it is only available for the foldable iPhone Duo that launched today.
iPhone Duo already ships with iOS 27.1 preinstalled, but users need to update to a newer build of iOS 27.1 while setting up the device[…]
Previously:
iPhone Duo Reviews
iOS 27.0.1 and iPadOS 27.0.1
Jumping to 27.2
https://mjtsai.com/blog/2026/10/23/ios-27-1/
#ios #duo #duoreviews #joerossignol #ipados #previously #jumping
#rss #feeds #linksharing #qwibbit

2026-10-24 14:27:49 UTC

Building Mac App Help Books
Amy Worrall:
The documentation is available on the website for the relevant app, and also in the app as a Help Book (openable from the Help menu). These days, Help Books on MacOS open in the Tips app[…]
Apple’s documentation for making these, such as Authoring Apple Help, is pretty old. If you look at the URL for that page, you’ll see it’s part of the Carbon documentation!
There are some third party tools to help. While planning this blog article I came across Helpbook Builder. I haven’t tried it, but if I were starting afresh I would probably check it out!
In this article I’ll share my process.
Previously:
McKinley 1.0
How Apple Help Works and How It Doesn’t
Help Compiler
Why Won’t That Help Book Open?
Authoring Mac Help Books in 2020
Many Tricks Help Viewer
https://mjtsai.com/blog/2026/10/23/building-mac-app-help-books/
#books #app #authoringmac #bookopen #helpbookbuilder #amyworrall
#rss #feeds #linksharing #qwibbit

2026-10-24 13:50:06 UTC

Mastodon 5
Imani Joy:
We’re moving away from the embedded composer and adopting a pop-out composer with new controls for visibility and other post settings. Navigation is simplified and organised in a more intuitive way and create space for future new features.
[…]
In your feeds, the posts themselves have been rebuilt from the ground up, giving a fresh look to the places we all spend the most time. We’re also excited to roll out a few new colour themes, which took a truly monumental effort from our engineering team since the start of the year to tokenise our design system.
[…]
The new design includes many small affordances, such as hiding a user’s boosts directly from the post menu, following and unfollowing hashtags right from the post, and hiding your own posts and boosts in your home feed.
Via Jeff Johnson:
Incredibly, Mastodon’s own announcement shows the massive amount of wasted space in the new UI, and they’re fine with it!
Joe Fabisevich:
The Mastodon 5.0 design looks more Tumblr than Twitter, and I really dig it! Nice to see them take an approach to social media that is more differentiated than just “it’s tweeting but federated”.
To me it looks more like Twitter than before. Stars are now hearts. The layout is basically the same down to the empty right column where Twitter’s algorithmic features would be.
CM Harrington:
[The] toot button (the one that makes the toot window appear in the first place) is at the bottom of a list of everything else, including all your saved/followed hashtags.
It’s all such a mess. From what I can see (limited) they’re ‘just trying things’ that other sites have done — but without a reason or goal — so it’s all just a mash of disparate concepts.
The new composer slides up on top of the bottom post/message, so I can’t see what I’m replying to.
Matt Birchler:
There’s some interesting data here, but at a high level, you see a social network that gained over 2 million new active users in the 31 days after Musk closed on buying Twitter. A lot of those users bounced and we dropped to about 1.1 million active users by the following summer, when we saw a second spike as Twitter started to require logins to see anything and that rate limits were being applied. Since then, we’ve seen a slow but steady decline in number of people using Mastodon.
[…]
As a fan of Mastodon, these numbers are hard to look at. Not because I think a social network must have hundreds of millions of users to be valuable, but because it paints a picture where many people have tried Mastodon, but almost none of them stick around. Also, while infinite growth isn’t a requirement, constant decline isn’t what you want to see in a social network either.
Jeff Johnson:
To be honest, I’m not sure I want Mastodon to grow. I actually never wanted Twitter to grow. I originally joined Twitter in 2008 for a developer conference (C4 in Chicago) to network with other software developers. As far as I’m concerned, Twitter was ruined by the influx of celebrities and celebrity worshippers. Thankfully the celebrities have mostly ignored Mastodon. A crucial difference between the two social networks is that Twitter needed masses of people to join, because Twitter was a publicly-traded, for-profit corporation, financed by advertising. The goal of Twitter, like other such social networks—Facebook, Instagram, Threads, TikTok—was to maximize attention and thus eyeballs on ads.
[…]
This raises an important question: should you give your attention to social media? Is social media use healthy? […] In other words, Mastodon respects its users, doesn’t intend to waste their time. If Mastodon users decide to leave, I say good for them!
John Gruber:
Just after writing the preceding paragraph, I took a break to pick up some sandwiches for lunch. Get out of the house, enjoy at least a few minutes of a beautiful autumn afternoon, and stretch my legs. Waiting for the sandwiches to be prepared at the bagel joint, I took the Duo out of my pocket and checked NetNewsWire. First article up was a good one. Started reading. Screen’s too small. Do I want to open the Duo? Sandwiches aren’t going to take long. I clicked the side button to sleep the Duo and put it back into my jeans pocket (where it sank like the brick that it is). I spent the rest of the wait alone with my thoughts, pondering how to finish this review.
Apple isn’t going to start an ad campaign with a slogan like “So cumbersome you’ll keep it in your pocket”, but that’s part of my experience.
That’s kind of how I feel about Mastodon. It works OK, at least for the Mac/iOS community, without being very addictive. I wish the discovery and search were better, but that’s sort of antithetical to the federated model.
Rob Shearer:
Mastodon isn’t, and won’t ever be, a good platform for “asynchronous ephemeral notifications of any kind”. I’d also argue (more controversially) that it’s simply not good infrastructure for social networking of any kind. There are lots of interesting people using Mastodon, and I’m sure it will live on as a good-enough space for certain niche groups. But there is no question that it will never offer the fun of early Twitter, let alone the vibrancy of Twitter during its growth phase. I’ve long since dropped Mastodon from my home screen, and have switched to Bluesky for text-centric social media.
[…]
I’m not saying federation “won’t” work or “can’t” work. Merely that in 2025, nine years after deployment, federation does not work for the Mastodon use case. […] Crucially, the posts did not exist even if I visited the profile page of the account: even after weeks of daily posts, the profile page displayed by mastodon.social claimed the account had never posted, and the posts would only begin appearing after someone on mastodon.social began following the account.
[…]
When you “private mention” someone, only you and they can see the post. And they can reply with a “private mention” of their own. But if anyone in that “private” thread accidentally mentions any other Mastodon account by name, that is itself considered a “private mention”, and that person is invited into the thread. It is an absolutely insane UI design that makes it extremely easy to share private conversations with exactly the people you don’t want reading them.
[…]
The problem that did manifest is that all of this moderation is entirely opaque to users. If you explicitly follow a particular account, you may not see posts from that account because its instance doesn’t like its content, because your instance doesn’t like its content, or simply because one of the two instances doesn’t like the other.
Dave Winer:
The only way for the others to compete with Twitter is to start innovating. Get rid of the limits. The funny thing is Twitter, the dominant leader, is moving forward and getting rid of character limits, and introducing styles and links. They’re acting like the little guy while the others, Bluesky, Mastodon, Threads, aren’t doing anything to be more useful. That whole market is stuck in 2006 and the myth that 140 chars somehow was magic. It wasn’t. It killed the web as a writer’s platform.
[…]
Inbound and outbound RSS 2.0, is the way to go. And Markdown is the way you do text. This is what matters, you all are making something that’s really simple so unbearably complicated.
My first choice would be to see more people blogging on their own sites. But having longer and richer posts on Mastodon would be preferable to many of the alternatives. I still wish it supported RSS for my timeline and replies.
Previously:
Instagram Charging for Links
Why Has Mastodon Adoption Stalled?
Choosing and Switching Mastodon Instances
https://mjtsai.com/blog/2026/10/23/mastodon-5/
#twitter #mastodon #jeffjohnson #imanijoy
#rss #feeds #linksharing #qwibbit

2026-10-24 13:16:45 UTC

WindowShade Redux
Another haxie reborn, from Rosyna Keller (Mastodon):
Instead of only cramming minimized windows into a crowded dock—or hiding them altogether—WindowShade Redux reduces your windows to their title bars or small live thumbnails at all times. It supports over twenty animation styles with the following power features:
Minimize the window to the Dock, as always
WindowShade the window into a tiny strip to quickly peek below or get it out of the way
Minimize-In-Place the window so it becomes a really small thumbnail that you can freely drag the thumbnail around your screen
Make any window float on top so it will never be obscured by other windows
$10 (with $7 intro price), and there are bundle discounts with FruitMenu and Xounds.
Modern macOS no longer allows one process to change the geometry of a window owned by another process (application), so I had to redesign and rewrite the core from scratch. Now, WindowShade Redux fakes everything hard. […] WindowShade Redux takes a snapshot of visible windows, composites them into an image, and displays it either as a fake WindowShade window or as a Minimize-In-Place (MIP) thumbnail to hide the Dock’s 500-millisecond genie animation.
[…]
Floating on top was an entirely different beast, as it requires constantly recording the target window and laying a new WindowShade Redux window on top of it. This fake window is then moved in tandem with the real window below it.
Previously:
FruitMenu Redux
Sequoia Screen Recording Prompts and the Persistent Content Capture Entitlement
https://mjtsai.com/blog/2026/10/23/windowshade-redux/
#windowshaderedux #rosynakeller #dock #reduxsequoia #fruitmenuredux #captureentitlement #contentcapture #persistentcontent #recording #sequoiascreen
#rss #feeds #linksharing #qwibbit

2026-10-22 22:17:58 UTC

WebKit Blocking Identity Resolution Infrastructure
Lara O’Reilly:
Apple’s latest privacy crackdown left the online ad industry scrambling for answers. Now, the tech giant has finally offered some.
John Wilander et al.:
A “post-cookie” tracking method emerged, called identity resolution. In this scheme, third parties (i.e., not the website owner) invisibly collect your email address when you log in or sign up for a newsletter. They send the email address to their servers, create an opaque tracking ID permanently linked to your email address, and send that tracking ID back to the webpage. The tracking ID is stored on the website and can from thereon be used for arbitrary purposes linked to your email address, such as building a profile of your browsing or targeting ads at you across websites. Logging out or unsubscribing from that newsletter does not remove the tracking ID or your email address stored with the third party.
[…]
Some companies serve as third-party infrastructure to facilitate identity resolution. They are present but invisible on many webpages where you enter your email address or use your email address for login purposes. They are not themselves login providers or newsletter services, they’re just there to track you.
In our iOS, iPadOS, macOS, and visionOS 27 releases, Safari and WebKit block network access to identity resolution infrastructure to prevent cross-site tracking. This stops them from sending your email address to their servers and all the downstream effects of that. The blocking is done on the domain level, meaning they can’t just change the structure of the network request to work around the protection.
Rowena Lam:
There is an unreleased update to WebKit that makes this list dynamic, meaning Apple can remotely add new vendor domains to the blocklist at any time without requiring users to download a new OS version.
The list is not public facing, domains added to the blocklist don’t appear to be notified of their addition and there does not appear to be any formal appeal process.
Previously:
Intelligent Tracking Prevention Deleting Data
Web Fingerprinting Is Worse Than I Thought
Information Leaks via Safari’s Intelligent Tracking Prevention
The Success of Intelligent Tracking Prevention
Intelligent Tracking Prevention 2.3
WebKit Tracking Prevention Policy
https://mjtsai.com/blog/2026/10/22/webkit-blocking-identity-resolution-infrastructure/
#identityresolution #trackingprevention #intelligenttracking #resolutioninfrastructure #webkit #apple #safari #dataweb #deletingdata #informationleaks
#rss #feeds #linksharing #qwibbit

2026-10-22 21:43:43 UTC

iPhone Duo and Safari
Mike Piontek (Mastodon):
A year ago I wrote that Safari 26 and Liquid Glass have little respect for web sites and unfortunately this hasn’t changed.
[…]
It’s unclear to me why Apple is not opting to treat the iPhone Duo toolbar as a safe area. I have not come across anything discussing their reasons nor educating web developers on the best way to design for this device.
[…]
Apple has decided to examine my web page and pick out a color to use for their toolbar. The process they use to determine this color is complex and not documented.
Previously:
Developing for iPhone Duo
iPhone Duo
https://mjtsai.com/blog/2026/10/22/iphone-duo-and-safari/
#iphoneduo #safari #liquidglass #mikepiontek #apple #mastodon #previously
#rss #feeds #linksharing #qwibbit

2026-10-22 21:07:53 UTC

iPhone Duo Reviews
John Gruber (Mastodon, tweet, Bluesky):
The Duo name is perfect. It truly is like having two devices in one. The outer device is, by far, the worst iPhone Apple has ever made. It’s a miserable fat little thing. The inner device is a splendid, joyful, beautiful tablet, with a UI that out-iPads the iPad. For me, by far, it’s my favorite tablet experience ever. I prefer it to any iPad or Kindle-like reader I’ve ever used.
[…]
It does not go into or out of my jeans pocket smoothly. Sometimes, in my pocket, it rotates 90 degrees, which is uncomfortable. Folded up it never stops feeling heavy.
[…]
No, the problem with holding the Duo in your left hand alone is that the bottom left corner of its D-shaped frame digs into your palm. When you hold it in your right hand, it’s a nice round corner in the meat of your thumb’s base. In your left, it’s a crisp sharp corner, and it doesn’t feel good.
[…]
I’d love a display that looks and feels like this on my non-foldable iPhone 18 Pro. No glare, even in sunlight. It’s amazing.
[…]
Held horizontally, the iPhone Duo supports side-by-side multitasking with two apps. The user interface for this feature is brilliant. It puts every idea Apple has tried on iPadOS for multitasking to shame.
[…]
Every time you pick up the Duo to use it you face The Decision. Open it? Or be lazy and suffer with the outside display? Every time.
This is such a good review; you should just read the whole thing. Marques Brownlee has a great video review. Like Gruber, he really misses FaceID. They seem to disagree about the camera and screen aspect ratios. I also really liked Joanna Stern’s video review. She and Gruber both say it’s too hard to open the Duo with one hand.
MacRumors and MacStories have review roundups.
Austin Mann:
A week with the iPhone Duo at home, camping and in Iceland. A capable camera with new tricks, and a creative powerhouse for planning, editing and sharing.
Previously:
Developing for iPhone Duo
iPhone Duo
https://mjtsai.com/blog/2026/10/22/iphone-duo-reviews/
#iphoneduo #duoreviews #gruber #every #like #bluesky #mastodon #ipad
#rss #feeds #linksharing #qwibbit

2026-10-21 22:16:01 UTC

Apple Broke an Essential Presentation Feature of iPads
Teddy Svoronos (Hacker News):
As of iPadOS 27, if you have multiple windows open while AirPlaying (whether or not Stage Manager is on), tapping on anything other than the presenting app will snap the external display into showing your whole iPad screen. This means that my students see all my notes on who I want to call on, or poll results that should be hidden from them. They also get distracted from what we’re learning by all these jarring windows popping up and disappearing. If you’re presenting at a big conference, it’s extremely embarrassing.
[…]
As for what the behavior should be, I’m not a developer, but here’s a proposal: if you’re using an app that is in presenter mode (e.g., PowerPoint playing a presentation, or a GoodNotes document open), it should always get precedence on the external display, until that presentation gets stopped, the document is closed, or the app is quit.
Previously:
iPadOS 27
https://mjtsai.com/blog/2026/10/21/apple-broke-an-essential-presentation-feature-of-ipads/
#applebroke #essentialpresentation #presentationfeature #stagemanager #teddysvoronos #ipads #airplaying
#rss #feeds #linksharing #qwibbit

2026-10-21 21:51:06 UTC

iOS Dev Course Going Out of Business
Sean Allen (via Rebecca Sloane):
iOS dev course sales plummeted due to AI. It costs a lot of money to host my courses online and with sales at basically $0, I’ve cancelled that hosting.
This closes down the site which unfortunately removes access to the courses.
[…]
I’ve put my recent course on sale at a large discount so you can get it before it’s gone and I’ve made old courses available for free if you want to grab those too.
The school will be online until November 24th so you have a few weeks to download these videos at seanallen.teachable.com.
https://mjtsai.com/blog/2026/10/21/ios-dev-course-going-out-of-business/
#iosdev #devcourse #coursegoing #business #rebeccasloane #seanallen
#rss #feeds #linksharing #qwibbit

2026-10-21 21:26:28 UTC

Ofcom Concedes Defeat in 4chan Case
Guido Fawkes:
Ofcom boss Dame Melanie Dawes has admitted today that tech firms have paid just two of the eleven fines handed out under the Online Safety Act since March last year. Giving evidence to the Culture, Media and Sport Committee, she conceded nine remain unpaid, four of the offending sites have simply geo-blocked the UK, and three are still up and running with nothing changed.
Via Preston Byrne (Hacker News):
American courts have, by now, provided their preliminary view on the likelihood of Ofcom’s enforcement powers being successful in U.S. courts – the obiter dicta in 4chan v. Ofcom, the opinion in the case we filed against Ofcom in the federal District Court for the District of Columbia a little over a year ago.
[…]
Ofcom can’t enforce the Online Safety Act in America. Ofcom knows it, Ofcom has known it for a long time, and now, Ofcom has, finally, admitted it.
[…]
The GRANITE Act, a foreign censorship shield now before both the House and Senate (H.R. 10174 / S. 5478), is one proposed legal response America could adopt. The HOMEFRONT Act, H.R. 10309, is another. Either of GRANITE or HOMEFRONT would strip sovereign immunity from foreign censors and let Americans targeted by their orders drag those agencies into federal court, where they could be held accountable for their actions.
Previously:
UK Child Protections and Messaging Backdoor
Imgur Blocks UK Users Over Age Verification
UK Online Safety Act
UK Proposal to Weaken Messaging Security
https://mjtsai.com/blog/2026/10/21/ofcom-concedes-defeat-in-4chan-case/
#concedesdefeat #ofcomconcedes #onlinesafety #safetyact #damemelanie #melaniedawes #graniteact #homefrontact #prestonbyrne #district
#rss #feeds #linksharing #qwibbit

2026-10-21 21:00:10 UTC

PHP2Shell
Malwarebytes:
If you’ve encountered websites in maintenance mode today, it may be a security precaution. Reports of attacks targeting two critical PHP vulnerabilities have prompted warnings to install emergency updates and consider temporarily taking affected services offline until they can be patched.
[…]
Successful exploitation could let an attacker run malicious code on an affected server without logging in. That code would run with the permissions available to the PHP process, potentially allowing attackers to steal application data, alter website content, or establish a backdoor.
[…]
The PHP team scheduled its emergency security updates for October 21 at 10:00 am ET (14:00 UTC). It has now released fixes in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, and urges users to update immediately. Administrators should check with their hosting provider or operating system vendor for the appropriate updated packages.
Adam Engst:
Expect to see numerous websites go down or serve “Page not found” errors as they update PHP, the programming language that underpins 70% of websites. If you run a WordPress, Drupal, or Joomla site, this affects you directly.
Nick Heer:
Word on the street is that these exploits have leaked, and that remote code can likely be executed all the way back to PHP 5. If you have access to your website’s php.ini file, it might be worth turning off multipart uploads for now.
Vincent Schmalbach:
Two changes reduce the risk until the fixed versions are out. They were checked against PHP’s source code and the PHP manual, but they are not an official PHP mitigation. When someone suggested that turning off session upload progress might be enough, PHP core developer Gina Peter Banyard replied, “The only thing I can say is that the only mitigation is patching / upgrading PHP. I sadly know too much.” Use the stopgaps to lower the risk for a few hours, and update PHP as soon as the fixed builds exist.
Add to php.ini:
session.upload_progress.enabled = Off
Add to .htaccess:
<If "req('Content-Type') =~ /multipart/i">
Require all denied
</If>
https://mjtsai.com/blog/2026/10/21/php2shell/
#php #two #add #ginapeter #peterbanyard
#rss #feeds #linksharing #qwibbit

2026-10-21 01:51:50 UTC

Getting a File Path From a Swift URL
Seth Willits (2024, bug):
There’s a deprecation warning in Xcode for URL.path that reads:
WARNING: path will be deprecated in a future version of macOS: Use path(percentEncoded:) instead
The problem is something like this:
Bundle.main.url(forAuxiliaryExecutable: "tool")!.path
… which returns the expected file path (ex: /Applications/MyApp.app/Contents/tool)
would be quickly rewritten as suggested to:
Bundle.main.url(forAuxiliaryExecutable: "tool")!.path(percentEncoded: false)
… which simply returns tool, because the URL returned is relative to a base URL.
[…]
I’ve always found it not-completely-obvious to newcomers how to get a standard file path string from a file URL and this only makes it more confusing.
There are at least three issues here:
url.path returns an absolute path, but url.path(percentEncoded: false) returned a relative path as of his writing. I tested this on macOS 26, and now it returns an absolute path. The documentation now says, “This function will resolve against the base URL.” It seems the behavior of the method changed without it being documented when, so be careful if you’re deploying to a mix of OS versions.
percentEncoded has a default value of true, whereas path did not return an encoded string. In other words, url.path() and url.path are completely different. So this is another case where Apple updated the API but flipped the default—a good way to introduce bugs.
It’s not obvious how to get the full file system path out of a URL. With NSURL, url.path was natural and did the right thing. Now, the URL equivalent is deprecated.
The natural replacement, url.path(), is wrong. So is Xcode’s recommendation of url.(percentEncoded: false).
url.absoluteURL.path(percentEncoded: false) is correct but verbose.
url.absoluteURL.standardizedFileURL.path(percentEncoded: false) is possibly better but even more verbose.
FilePath(url)?.string uses a newer API but gives you an optional, even though for a file URL it should never fail.
This seems like such basic functionality, but there’s no API that’s the obvious right choice, concise, and ergonomic.
Previously:
The Switch From File Paths to URLs
Swift URL Improvements at WWDC 2022
Proposed Foundation URL Improvements
URL Path Retrieval Cheat Sheet
NSURL Path Handling
https://mjtsai.com/blog/2026/10/20/getting-a-file-path-from-a-swift-url/
#swifturl #path #filepath #urlsswift #urlimprovements #percentencoded #api #foundationurl #warning #nsurlpath
#rss #feeds #linksharing #qwibbit

2026-10-21 01:26:19 UTC

Xcode Projects for the Command Line and Coding Agents
Artem Novichkov (via Fatbobman):
Xcode also ships two command-line tools for the new format:
xcprojformatter came with the format in beta 2. It’s a formatter for
project files, like swift-format for code: it checks that a
project.xcproj file is valid and rewrites it with sorted keys and
consistent layout.
xcodeproj arrived in beta 3. It reads and edits projects from the
terminal: targets, build phases, groups, build settings, xcconfig files,
and Swift packages.
Neither is on your PATH, so run them with xcrun.
Previously:
Xcode’s New .xcproj Files Are JSON
https://mjtsai.com/blog/2026/10/20/xcode-projects-for-the-command-line-and-coding-agents/
#codingagents #commandline #xcodeprojects #artemnovichkov #files #fatbobman #path #json #swift
#rss #feeds #linksharing #qwibbit

2026-10-21 01:00:39 UTC

Selection and Focus in Golden Gate
Howard Oakley:
Now move the pointer to the right edge of the list of folder contents, just far enough to the left to avoid moving the window divider, but not so far as to fully select items from within that folder. Click there and the item will be selected, but in grey, the same as would appear if it had been fully selected but its window was no longer in focus. At this stage, the original folder will still be fully highlighted, as if nothing had been selected inside it, but you can drag that grey unfocussed selection to include other items inside the folder.
On my Mac, if I click on a file icon in the second column, the first column retains focus. The second column only gets focus if I click on a filename (or even farther to the right).
Now using the up and down arrow keys doesn’t move within the items inside that folder, but back with the fully highlighted folder. With a few of the items inside that folder in grey, so they’re selected but not in focus, press the spacebar for a QuickLook preview, and you’ll see the greyed items, not the folder that’s still fully selected to the left.
[…]
In other situations, this becomes infuriating.
In my log browser LogUI, separation of selection from focus can leave you clicking wildly without being able to select log entries.
Previously:
Tahoe Broke Resizing Finder Column View
Viewing Metadata in the Finder
Mojave Finder’s Preview Column Shouldn’t Prioritize Thumbnail Size
https://mjtsai.com/blog/2026/10/20/selection-and-focus-in-golden-gate/
#goldengate #focus #column #finder #click #resizingfinder #howardoakley #previewcolumn #tahoebroke #thumbnailsize
#rss #feeds #linksharing #qwibbit

2026-10-20 15:56:27 UTC

DropDMG 3.7.2
DropDMG 3.7.2 is a maintenance update of my app for disk images and archives.
It still works back to macOS 10.13, but this will probably be the last such release. There’s no reason the code can’t continue to run there, but soon I will be switching to Xcode 27, which deploys back to macOS 12.
From some reason, this build was hard to submit to the Mac App Store. altool kept retrying, or something, right at the end of the upload. There’s usually a delay before a build shows up in App Store Connect, but this time I saw it there before altool had finished running.
I also ran into trouble submitting the app for review. It kept showing a spinner or reporting errors when I tried to save the build, and also when adding it for review.
The actual review was pretty quick by modern standards—three days including a weekend. It warned me ahead of time that review “can take up to 48 hours.”
When I was approving the build for release, it asked if I was “enjoying” App Store Connect and wanted me to rate the app.
Previously:
Ending the Golden Era for Backward-Compatible Apps
Mac App Store Review Times Increasing
DropDMG 3.7.1
https://mjtsai.com/blog/2026/10/19/dropdmg-3-7-2/
#appstore #storeconnect #macapp #dropdmg #review #appsmac #increasingdropdmg #macos #goldenera #xcode
#rss #feeds #linksharing #qwibbit

2026-10-20 15:30:41 UTC

NetNewsWire 7.2
Brent Simmons:
We’ve released NetNewsWire 7.2 for Mac with a new column view layout: choose View > Use Column Layout to switch.
I really missed this feature from the old NetNewsWire, so I was happy to see its return. Now that I’m using it, I have mixed feelings. I love the columns, how I can scan the titles without the feed names and dates getting in the way. But some titles aren’t very informative, so I miss how the iOS-style view shows a little preview of the article’s body. I wish I could see that, either appended after the title itself or in a second line below it.
We’ve also added a second long-requested feature: you can now hide unread counts or replace them with a •, so you don’t have to deal with the anxiety of an ever-increasing unread count and the feeling like you have to get caught up.
Here are the other changes.
Previously:
NetNewsWire 7.1
https://mjtsai.com/blog/2026/10/19/netnewswire-7-2/
#netnewswire #usecolumn #view #brentsimmons #layout #mac
#rss #feeds #linksharing #qwibbit

2026-10-20 15:03:54 UTC

Carson Oliver and Apple’s Gaming Push
Giovanni Colantonio:
Seven years later, Apple Arcade hasn’t gone anywhere, and Apple itself hasn’t slowed its broader gaming efforts either. Between courting major publishers like Capcom to release their games on Mac to launching a proper gaming app, it’s clear that Apple still has its sights set on being a major player.
The latest example of that came this week as Apple launched an App Store event dubbed Indie Games Week. The week-long initiative saw Apple welcoming games like Vampire Crawlers to iOS and announcing an ambitious mobile version of No Man’s Sky. At the center of that push was Carson Oliver, the new head of App Store Worldwide following Phil Schiller’s sudden departure from the role this past August. The fact that one of his first acts in the role was spearheading an indie gaming showcase hints at where Oliver’s priorities might lie.
[…]
While Oliver sells the narrative with carefully worded precision, questions still linger around Apple’s wider gaming efforts. Continued investment in mixed reality gaming is uncertain given that Apple has reportedly cut down production of its Vision Pro headset due to underwhelming sales. And though Apple continues to court publishers and get games on iOS, we haven’t seen the full-throated support from major players like Capcom and Ubisoft in 2026 that was crucial to raising Apple’s gaming profile in 2023.
Previously:
Apple TV 4K 2026
App Store Moves From Phil Schiller to Eddy Cue
Apple Games App
Testimony on External Purchase Fee and Scare Screens
App Store Business Reorg
Monument Valley 3 in Netflix Games
Inside Apple Arcade
Hearing for Apple Violating Epic’s Injunction
Apple Arcade’s Uncertain Future
Apple’s Mac Gaming Push
https://mjtsai.com/blog/2026/10/19/carson-oliver-and-apples-gaming-push/
#apple #appstore #carsonoliver #gamingpush #games #philschiller #appleviolating #cueapple #injunctionapple #insideapple
#rss #feeds #linksharing #qwibbit

2026-10-17 00:12:42 UTC

Mark Stephens (Robert X. Cringely), RIP
Mary Alyce Stephens (Hacker News, Reddit, TidBITS Talk):
Mark Stephens, known to much of the world as Robert X. Cringely, passed away on October 3, 2026. He was 73.
Mark was a gifted writer, journalist, storyteller, husband, father, brother, and friend. To millions of readers and viewers, he was Robert X. Cringely, the witty and sometimes irreverent observer of the technology world. But to those of us fortunate enough to love him, he was simply Mark-and losing him leaves an emptiness that is difficult to put into words.
[…]
Writing as Robert X. Cringely, Mark became a distinctive voice in technology journalism. He had an unusual ability to understand not only technology but also the human beings behind it-the dreamers, inventors, entrepreneurs, eccentrics, and risk-takers who were changing the world. He could take a complicated subject and make it understandable, entertaining, funny, and deeply human.
Steven Sinofsky (via John Gruber):
Bob wrote “Accidental Empires” that chronicled SV and the tech industry of the PC era, 1970s-90s. It led to the highly regarded PBS series “Triumph of the Nerds” a definitive series of interviews of the era. Through that time he authored the “gossip” column” in InfoWorld on the latest goings on at OG PC companies. Everyone read it in print religiously.
See also: I, Cringely and Wikipedia.
Previously:
Revolution in the Valley
https://mjtsai.com/blog/2026/10/16/mark-stephens-robert-x-cringely-rip/
#markstephens #robert #alycestephens #cringely #rip #tidbitstalk #maryalyce #accidentalempires #johngruber #reddit
#rss #feeds #linksharing #qwibbit

2026-10-16 23:44:13 UTC

iMessage Downgrading
Glenn Fleishman:
The odds of this change in standards causing a security breach and your messages being exposed seem unlikely, at least right now. But after scrolling through conversations and seeing what’s going on, I feel Apple has omitted important signals for users when iMessage suddenly stops being used during a conversation.
[…]
The impact of that hit me while revising my book: when iMessage isn’t available, Apple tells you only inline. Despite all the information Messages displays about iMessage being encrypted, the inverse state is faint. This kind of negative knowledge, or information about something not happening, can often be as important as something that does happen. A warning about a fuel tank approaching empty is the kind of information every driver (or pilot) needs, for instance. If you think end-to-end encryption—or Apple-based encryption—is critical for you, then a pop-up message or other warning is what you would expect.
[…]
If you’d like to prevent Messages from downgrading security, you have options, although they may not be fully desirable. All of these are managed on an iPhone at Settings: Apps: Messages. You can’t control these message settings from an iPad or Mac.
This recently happened to my mother, and it was very confusing for her. For unknown reasons, while at home on Wi-Fi, she got signed out of iMessage. But it was not clear to her that this had happened or that she should try to sign back in. She was not aware that the Messages app supports multiple protocols or what the different bubble colors mean. All she noticed was that certain messages (e.g. ones sharing files) would no longer send and that she was not receiving some of the messages that people were sending to her. She saw the inline warning about encryption and interpreted it as that the sender was using a newer form of encryption that her phone didn’t support, so maybe she needed to upgrade.
I went over to take a look and quickly figured out that she was signed out of iMessage, but I couldn’t fix it. I kept getting errors that iMessage couldn’t be activated, even after rebooting the phone. Eventually, much later and again for unknown reasons, activation succeeded.
https://mjtsai.com/blog/2026/10/16/imessage-downgrading/
#imessage #downgrading #apple #glennfleishman #settings
#rss #feeds #linksharing #qwibbit

2026-10-16 23:15:43 UTC

Xcode 27.1
Apple (xip, downloads):
Xcode 27.1 includes Swift 6.4 and SDKs for iOS 27.1, iPadOS 27, tvOS 27, watchOS 27, macOS 27, and visionOS 27. Xcode 27.1 supports on-device debugging in iOS 17 and later, tvOS 17 and later, watchOS 10 and later, and visionOS. Xcode 27.1 requires a Mac running macOS Tahoe 26.6 or later.
Christian Beer:
You can’t run macOS UI tests on Xcode cloud as soon as your app uses „restricted entitlements“[…]
Previously:
Jumping to 27.2
Xcode 27
Developing for iPhone Duo
https://mjtsai.com/blog/2026/10/16/xcode-27-1/
#xcode #tvos #watchos #macos #visionos #ios #swift #christianbeer #previously #tahoe
#rss #feeds #linksharing #qwibbit

2026-10-16 13:47:07 UTC

OpenAI’s Dots
John Voorhees:
Earlier this week, I was at OpenAI’s annual DevDay conference where it launched Dots, a personal agent that lives inside the ChatGPT app.
[…]
Dots are persistent, cloud-based agents that use the plugins and other tools you’ve connected to ChatGPT, after you allow them to do so. Your Dot has its own virtual Linux computer to assist you with your work. And at first, your Dot, which is depicted by a colorful character you can customize, doesn’t have access to anything else. However, as you give your Dot tasks that need access to other tools, it will ask for your permission to access other tools.
[…]
But being a cloud-based agent has its downsides, too. Out of the box, your Dot can’t access your computer’s files and apps. That’s easily fixed by clicking or tapping on your Dot and granting it access to your Mac, so it can use the Mac alongside its own VM.
Previously:
Unspecified Full Disk Access Screw Tightening
OpenClaw 2.0
Meta AI for Mac and Muse
Grok Bot
Siri AI Ships (But Still Beta)
ChatGPT Work and ChatGPT Classic
Claude Desktop App
Gemini App for Mac
https://mjtsai.com/blog/2026/10/09/openais-dots/

2026-10-16 13:31:57 UTC

OpenAI Marks AI-Generated Content
OpenAI:
Starting today, API customers globally will be able to opt in to text watermarking for select models. Text watermarking will remain off by default in the API.
Over the coming weeks, we will add an invisible watermark to eligible ChatGPT and Codex text output in the European Union.
[…]
More details about how textGrain works can be found in our technical report (opens in a new window), which will be updated with additional details in the coming weeks. We also plan to make the technology available in open source so that others can build on it.
[…]
At a target false positive rate of 1%, our detector identified watermarks in about 80% of 200-token passages, compared with about 95% of 400-token passages, for content such as psychology.
Via John Gruber (Mastodon):
OpenAI has made this available via an API so developers should be able to actually see if this adulterates text output with real-world usage.
Third, none of these companies have yet made their watermark detectors publicly accessible. I remain highly skeptical that they will work as advertised in the real world. I think this is all somewhat of a sham to claim compliance with the EU AI Act without actually providing anything that anyone can actually use in a practical way.
Previously:
How Claude Marks AI-Generated Content
https://mjtsai.com/blog/2026/10/09/openai-marks-ai-generated-content/

2026-10-16 12:43:01 UTC

macOS 27 and External Displays
Jeff Benjamin:
A drawback of using an HDR-ready third-party monitor on macOS 26 Tahoe was the inability to activate High Dynamic Range at the common 2560 x 1440 scaled resolution. Fortunately, the newest macOS release resolves this problem.
Alexander Cohen:
Symptom: scrolling is choppy on the Studio Display XDR at 120Hz or Adaptive (47–120Hz). At 60Hz, and on the MacBook’s own screen, scrolling is smooth.
What devices are affected: M5 Pro MacBook Pros have reproduced the problem; other repots suggest the Mac mini with M5 Pro chip is also affected. Apple lists M5 Pro MacBook Pro models as supporting the Studio Display XDR at 120Hz.
Likely cause: measurements suggest the GPU stays at a low clock speed while scrolling and misses frame deadlines.
Workaround: MacRumors Forums poster Tiguanito’s M5ScrollBoost, a small menu bar app that encourages the GPU to run faster while you scroll.
Previously:
MacBook Pro 2026
Studio Display and Studio Display XDR
Update (2026-10-14): Timuçin Kabak:
Another issue I encountered is that the True Tone also applies to some external displays and applies a tint. I created a tool for it.
https://mjtsai.com/blog/2026/10/09/macos-27-and-external-displays/

2026-10-16 10:42:40 UTC

Alexa Tablets
Hartley Charlton:
The flagship Alexa Tablet 12 Pro starts at $499.99 with 8GB of RAM and 128GB of storage, aiming to rival the iPad Pro at a significantly lower price point. It features a MediaTek Dimensity 8400 chip, a 12-inch display with an adaptive refresh rate of up to 120Hz and a 3:2 aspect ratio, a 6.5mm-thick aluminum body, Wi-Fi 6E, and quad Dolby Atmos speakers. Amazon claims that the device has up to 16 hours of video playback.
A $549.99 version adds a “Nanomatte” display, using precision-etched glass developed with Corning to reduce glare. Higher configurations offer up to 16GB of RAM. Unlike Apple’s nano-texture display option, which requires a 1TB or 2TB iPad Pro, Amazon’s matte finish is available with 128GB of storage.
[…]
The Alexa Tablet 11 starts at $329.99 with 8GB of RAM and 64GB of storage, offering an 11-inch 2.5K display with a 90Hz refresh rate. A 128GB version costs $379.99. The smaller Alexa Tablet 8 starts at $229.99 with an 8.7-inch display, 4GB of RAM, and 64GB of storage.
Ryan Whitwam:
Amazon has dropped the Fire branding in favor of Alexa, and the new Alexa Tablets are now Google-certified Android devices.
Throughout the history of Fire Tablets, Amazon downplayed its use of Android. They ran Android apps from the company’s Appstore platform, but there was no Google integration with “Fire OS.” However, Amazon shut down its app store last year. The new Alexa Tablets run full-fledged Google-y versions of Android with the Play Store and all the apps you’d expect.
M.G. Siegler:
So the question is if these new Amazon Alexa Tablets can do what the previous Android tablets never could in tailoring software for the form-factor. I remain skeptical of that but perhaps stock Android plus some good Amazon + Alexa+ (as well as Prime Video) integration will be good enough?
[…]
The screen – namely the fact that it's a matte texture – sounds interesting[…]
Previously:
Kindle, Kindle Paperwhite, and Kindle Colorsoft 2026
iPad Air (M4, 8th Generation)
iPad Pro (M5, 8th Generation)
iPad (11th Generation)
Amazon Kindle Fire HDX 7-inch
https://mjtsai.com/blog/2026/10/09/alexa-tablets/

2026-10-16 10:07:18 UTC

Instagram Charging for Links
Meta:
If you subscribe to a Meta One plan, you can add links to a set number of posts and reels each month based on your plan:
Meta One Advanced plan: up to 4 posts and 4 reels with links per month
Meta One Expert plan: up to 8 posts and 8 reels with links per month
Meta One Max plan: up to 12 posts and 12 reels with links per month
Via Nick Heer:
Instagram has never supported links of any kind in individual posts, so that is a new feature with two links per month permitted for free, and more enabled by this pricey subscription — starting at $50 USD per month for four posts per month containing external links. But links in Reels have been commonplace for years. Meta is now gating that, too; and there is more.
[…]
Meta seems to have two objectives here: to take a cut from businesses that use Meta’s services as a referral source more generally, and — more specifically — to capture some of the money made by influencers.
Requiring login, removing RSS, discouraging links. Things are not looking good for the open Web.
Previously:
Reddit to Remove RSS
Twitter Now Requires Logging In
“Link in Bio” Is Apparently a Billion-Dollar Business
“Link in Bio” Is a Slow Knife
https://mjtsai.com/blog/2026/10/12/instagram-charging-for-links/

2026-10-16 09:29:00 UTC

Chrome Supports JPEG XL
Toni Sagrista Selles (Hacker News):
In a dramatic turn of events, the Chromium team has reversed its Obsolete tag, and has decided to support the format in Blink (the engine behind Chrome/Chromium/Edge). Given Chrome’s position in the browser market share, I predict the format will become a de factor standard for images in the near future.
[…]
I’ve been following JPEG XL since its experimental support in Blink. What started as a promising feature was quickly axed by the team in a bizarre and ridiculous manner. First, they asked the community for feedback on the format. Then, the community responded very positively. And I don’t only mean a couple of guys in their basement. Meta, Intel, Cloudinary, Adobe, ffmpeg, libvips, Krita, and many more. After that came the infamous comment[…]
[…]
To top it off, a couple of weeks ago, the PDF Association announced their intent to adopt JPEG XL as a preferred image format in their PDF specification.
Michael Larabel (Slashdot):
JPEG-XL image support is back in the very latest Google Chrome/Chromium codebase. Back in December they merged jxl-rs as a pure Rust-based JPEG-XL image decoder from the official libjxl organization. At the end of December they did more JPEG-XL plumbing with the enums and build flags for the support.
Luca Versari et al. (via Jarek Duda):
We’re excited to announce that Chrome is shipping decoding support for the JPEG
XL (.jxl) image format starting from Chrome 155. JPEG XL is a next-generation
image format designed to meet the needs of modern web developers and
photographers. It offers 30-50% better compression than JPEG, lossless
compression, built-in HDR support, lossless JPEG transcoding, and more.
In general, we recommend trying both AVIF and JPEG XL to get the best results.
We expect that JPEG XL is most helpful for high-fidelity or lossless
compression, especially of photographic images or in cases in which fine-grained
progressive decoding is preferred.
Previously:
Chrome Doesn’t Support JPEG XL
iPhone 16 Adds JPEG XL
https://mjtsai.com/blog/2026/10/12/chrome-supports-jpeg-xl/

2026-10-16 08:49:45 UTC

HomePod mini 2
Apple (video, MacRumors, MacStories, Six Colors):
Apple today announced HomePod mini 2, featuring Siri AI, gorgeous new colors, and enhanced audio experiences. Siri AI, coming to HomePod mini 2 in a future software update, is a profoundly more capable and conversational assistant with personal context understanding, broad world knowledge that powers tasks like richer music discovery, and the ability to tap into even more apps — bringing a whole new level of capability to HomePod mini.
[…]
With Sound Glow, the top of HomePod mini transforms into a visual canvas that glows and pulses in sync with the music, reacting in real time to bass and treble.
[…]
Sound Recognition gives HomePod mini users peace of mind by listening for a smoke or carbon monoxide alarm and, if one is detected, sending a notification immediately to the user’s iPhone, iPad, and Apple Watch.
The price has increased from $99 to $149. Our HomePod is placed high enough that the top isn’t visible, anyway. I assume it still can’t play all my purchased music.
Previously:
HomeView
Siri AI Ships (But Still Beta)
Midnight HomePod mini
HomePod (2nd Generation)
HomePod mini
Update (2026-10-14): Scott:
Annnd… apparently the HomePod mini 2 cable IS still captive.
Mr. Macintosh:
The new HomePod mini 2 is “built with the environment in mind” yet still has a non-removable power cable.
Did you move furniture onto the cable, or did your cat eat through it?
Buy a new one.
https://mjtsai.com/blog/2026/10/13/homepod-mini-2/

2026-10-16 08:10:50 UTC

Apple TV 4K 2026
Apple (video, Hacker News, MacRumors, Six Colors):
Apple today announced the next generation of Apple TV 4K, delivering its most immersive home theater experience yet. The new Apple TV 4K features Siri AI, an entirely new version of Siri powered by the next generation of Apple Intelligence, transforming how users search for, discover, and enjoy their favorite movies and TV shows through a full-screen Siri AI experience. With built-in far-field microphones, Apple TV 4K also lets users talk to Siri completely hands-free.
[…]
The A19 chip in the new Apple TV 4K delivers up to 50 percent faster CPU performance and up to 2x faster GPU performance than the previous generation, for greater responsiveness, faster navigation, and smoother animations. The A19 chip also includes a new, dedicated AV1 decoder, enabling more efficient, high-quality streaming while using less bandwidth.
The new Siri Remote keeps its familiar design while adding Find My support with Precision Finding and an option to play a sound on the remote — making it far easier to locate.
The price is now $299. Apple TV doesn’t get updated very often, so if you need one I guess now is the time to buy.
But I’ve really soured on this product. The software design is worse than when I bought it. I just want a basic interface like the iTunes column browser. Instead, we get all this extra stuff so that the text I care about is secondary, truncated, and obscured. It seems designed to hide the content I want to see, and which I am in the middle of watching, while constantly promoting what Apple wants me to watch. The search has always been bad and is still bad. The main thing it’s supposed to do is play video, and lately that’s been failing, too. It either won’t play at all or it’ll play for a while, and then after a commercial break it will switch to a different episode.
I’m considering just getting a $40 Fire TV Stick to see whether things are any better over there. Maybe the privacy is worse, but I have to weigh that against the product actually working. We watch TV to relax in the evening, and instead I keep getting agitated that either it didn’t work at all or we had to go through hassles like logging in again or rebooting. I would miss the screensaver, though.
Previously:
HomeView
HomePod mini 2
Siri AI Ships (But Still Beta)
Ads When You Start Your Fire TV
Apple TV 4K 2022
An Unsolicited Streaming App Spec
Apple TV App for Amazon Fire TV
Update (2026-10-14): Joe Rossignol:
Here are 11 changes coming with the new Apple TV[…]
Scott:
Oh, yeah, one more thing: does the $300 Apple TV have a USB C port for UVC cams, for FaceTime/vidconf apps.
If not, why not? Really fucking stupid if it doesn’t, especially at that price. The chipset and OS HAVE the capability.
It does not.
Maynard Handley:
1. There is nothing compelling here for existing owners.
2. The price is so high compared to Roku or Fire that it’s hard to justify telling friends to upgrade for the better experience.
Apple should probably, at the very least, have kept the existing 64GB box at a lower price point, and bundled in a year of Apple TV+, to work with market.
[…]
It’s about “WTF is Apple thinking? Who is this targeted at?”
We have three products released today all of which look like flailing.
[…]
I’ve been on team Apple (customer and employee) since 1990. This is the first time (even including the Wired Pray cover days) that I feel genuinely worried that Apple is fumbling the future.
Joe Rosensteel:
I don’t understand the direction the team working on the Apple TV has been given. I know people are excited by it, because they’ve been waiting to buy the best one, and cycle the old ones down to lesser TVs in their homes, but this update is going to be around next year and the year after so it’s worth thinking about it from that point of view. What will you get out of this when it isn’t just “new”? A microphone array? Chip bumps?
Asleep at the jog wheel.
https://mjtsai.com/blog/2026/10/13/apple-tv-4k-2026/

2026-10-16 07:28:42 UTC

HomeView
Apple (video, Hacker News, MacRumors Six Colors, MacStories, Slashdot):
Apple today introduced Apple HomeView, designed to be central to the home and personal to everyone in it. With a stunning 7-inch Liquid Retina display, HomeView brings entertainment, connection, and smart home management together in one place, from playing music and making FaceTime calls to home monitoring and hands-free automations with voice control — all designed with privacy and security at the core. HomeView recognizes users by their faces, adapting so they can access their personal content in Messages, FaceTime, Calendar, Reminders, and Find My.
[…]
Designed to fit in any space, HomeView can be placed on a tabletop as the center of the home or wall-mounted to fit in spaces like the entryway or hallway.
I guess the best part is the price. $299 (not including wall mount) is less than the base iPad and the same as the Apple TV. But I just can’t imagine what I would use this thing for. It does not seem more appealing than an iPhone or HomePod for any tasks. I wouldn’t want to dedicate any kitchen space for it, and the cord is a problem. Why would I not just use an old iPad or iPhone, which are wireless and support apps and standalone video? Maybe it would be interesting if it could do something extra, like act as a Time Capsule.
John Gruber:
HomeView does not have FaceID. I asked about this and Apple reps said that first, your home is (reasonably!) presumed to be a safe space. But in order for users to be recognized — by voice or face — they must have a “registered [non-watch] personal device” that supports Apple Intelligence and Siri AI, that device must be present on the home’s Wi-Fi network, and it must have been recently unlocked.
Hartley Charlton:
Apple said it is “working constructively with the EU in an attempt to find a path forward,” but provided no timeline for EU availability.
Previously:
HomePod mini 2
Siri AI Ships (But Still Beta)
No Siri AI in EU
Apple Officially Discontinues AirPort Router Line
Amazon Echo Show
Update (2026-10-14): Julian Chokkattu:
It doesn’t have an App Store. Instead, Apple has a curated selection of apps, including FaceTime, Messages, and Safari. A handful of third-party media apps like Spotify are available, and developers can bring over existing CarPlay apps. If your iPhone already has one of these CarPlay apps installed, it can automatically appear on the HomeView after setup. (There are no video streaming apps like YouTube, Netflix, or Disney+, but if those companies choose to make their apps available on the CarPlay framework, they will show up on the HomeView; for now, you’ll have to consume videos by using the Safari browser.)
Via John Voorhees:
CarPlay makes some sense as a way to push apps to the HomeView, but unless the entitlement is opened wider, it also makes no sense at all.
I suspect this is just the mechanism for audio and video apps and not a more general developer channel for making apps.
Jason Snell (MacRumors):
Beyond that, though, it seems like HomeView is at least starting life as a very limited app platform. Apple does say that if you make a Siri AI query for your personal content, it will search everything on your iPhone or iPad—and that includes apps that aren’t on the HomeView. So you should be able to query your iPhone apps, but not actually run them.
Rui Carmo:
I do think I want one, but there are a few things to settle besides price and value. For starters, having more screens in the house doesn’t seem like a winning proposition (the HomePods we’ve got work OK for alarms, reminders, etc.), and the American fascination with the kitchen island (which, by the way, needs power sockets in the middle…) doesn’t translate to European flats.
Paul Solt:
Are you going to cut a hole in your island to feature HomeView?
Mr. Macintosh:
I really like the new Apple HomeView device!
The only thing I can’t get past, (as a previous iMac G4 owner) is the screen can’t rotate vertically.
Notice the slick Apple video edit:
If someone needs to rotate HomeView, the whole base needs to rotate along with the power cord.
Mr. Macintosh:
Wait… I just noticed something else from the HomeView video🤔
When she goes to grab the HomeView, you can see her right hand reach out to grab the lower right hand corner of the screen. But then the cut shows her grab the top of the base to rotate it?
Did they not like the cut where the entire base rotates? (This would would have shown the USB-C plug rotate along with the entire unit)
Basic Apple Guy:
iOS Icon History: iPod/Music
Bob Burrough:
Folks speculating HomeView is the tail end of Tim Cook’s product “leadership,” but 1) Ternus is the CEO and can torpedo it if he thinks it’s a stinker. 2) He’s also the guy who spearheaded iPad’s “what’s a computer?” campaign and the idea that an iPad was a viable replacement.
Quinn Nelson:
The biggest issue with Apple’s Home ecosystem is the absolutely garbage Home app. Still, in 2026, there is a tab dedicated fully to buying more smart home gadgets (aka, an ad) within the iOS Home app and it can’t be removed. Yet rooms are buried up top. Pitiful.
Scott:
This is the ONE THING (“One more thing”?) I’d been hoping to get from
@Apple
in this announcement: they were redoubling efforts on HomeKit/Home.app to make the ecosystem actually work better… annnnnd did not get that impression. At all.
IMHO, as an HomeKit user with dozens of devices in 2 Homes, there is SO MUCH low-hanging fruit that
@Apple
could be working on to improve the UX, it is pathetic.
Steve Troughton-Smith:
The original HomePod didn’t come to the EU either for 5 months, and even then it was only in two countries. The original HomePod never came to Ireland at all, before it was discontinued. But if you only listened to the pundits, this is somehow now the DMA’s fault.
See also: Marques Brownlee.
https://mjtsai.com/blog/2026/10/13/homeview/

2026-10-16 05:59:33 UTC

Apple Home Collection
Apple (MacRumors, Six Colors):
Apple today announced Apple Home Collection, a new lineup of smart home accessories — including indoor and outdoor cameras, thermostats, temperature sensors, and a video doorbell and door lock — designed in collaboration with LG Electronics and Schneider Electric. These new accessories are simple to set up starting with one tap with iPhone, and everything is managed through the Apple Home app — no separate app or account required. Each accessory is encrypted end-to-end in Apple Home, so only users and the people they choose can access their home data.
[…]
LG’s Video Doorbell offers dual cameras that capture separate views of visitors and packages — allowing users to switch between the front and bottom camera views seamlessly — along with a built-in spotlight and a chime that plays through HomeView, HomePod, and HomePod mini. The front camera captures 2.5K resolution video, and the bottom camera captures full HD resolution.
LG’s Floodlight Cam delivers powerful perimeter monitoring with adaptive dual floodlights that activate automatically when motion is detected, and low-light color night vision that preserves clarity in darker conditions so users can see more of what’s happening outside.
[…]
LG’s Smart Deadbolt Lock brings a new level of convenience to home access. Using Ultra Wideband technology, the lock can tell how close a user is and when they’re approaching the door. As a user with a home key on a compatible iPhone or Apple Watch walks up, the door unlocks automatically, with no tapping required.
[…]
Two new Smart Thermostats are available — one from LG Electronics and one from Schneider Electric — so users can choose the product that best fits their home’s broader energy ecosystem.
John Gruber:
The thing that makes this partnership awkward for Apple is that these products — doorbells, cameras, deadbolt locks — are products that require the utmost of trust. What products could possibly require more trust than a camera with footage of what’s going on in or at your home, or a lock that controls who can get in? I think that’s why Apple wants to get into this market with products that they can put their stamp of approval on. But LG, of all companies, was just exposed in a scandal for shipping “smart” TVs that literally listen to the ambient audio in the room — even in standby! — and invade your privacy by tracking what content appears on screen.
Previously:
HomeView
https://mjtsai.com/blog/2026/10/13/apple-home-collection/

2026-10-16 05:16:29 UTC

Resetting Local Network Privacy
Howard Oakley:
Of all the privacy protections in macOS, those for local networking are among the most recent and the least understood.
[…]
All non-exempted apps and other processes start without any privilege. Those that try to make a local network connection result in the user being prompted to allow or deny their access. Your decision is then recorded in that app’s new entry in the Local Network section, and you can then set that to allow or deny its future access. For that to happen, the responsible app needs an additional item in its property list to explain to you why it requires that access, something that should appear in any prompt for access.
[…]
A process with a short life that immediately fails if it can’t complete a local network operation may not trigger a user prompt, and can continue to fail repeatedly as it can’t be granted the privilege. Apple recommends changing the code so that it doesn’t exit immediately after failure, to allow the prompt to be displayed and access granted.
Howard Oakley:
Another clue came in the statement in that note that “on macOS there’s no way to reset your program’s Local Network privilege to the undetermined state”. This contrasts with pretty well every other category of privacy protection, which are handled by the dreaded TCC, Transparency Consent and Control.
This has now changed in macOS 27.2.
TN3179:
During testing, you might want to reset your program’s Local Network privilege to the undetermined state. Your options for this vary by platform.
On iOS, the easiest option is to delete your app.
Alternatively, if you don’t want to delete your app for some reason, reset the entire privacy subsystem using Settings > General > Transfer or Reset > Reset > Reset Location & Privacy.
On macOS, the list in System Settings > Privacy & Security > Local Network has add (+) and remove (-) buttons. To reset your program’s Local Network privilege, select it in the list and click the remove button.
Previously:
Local Network Privacy on Sequoia
Local Network Privacy FAQ
https://mjtsai.com/blog/2026/10/14/resetting-local-network-privacy/

2026-10-16 04:32:28 UTC

Attestation News
TheLastProject (Hacker News):
In the [EU age verification] README, the following is listed:
App and device verification based on Google Play Integrity API and Apple App Attestation
I would like to strongly urge to abandon this plan. Requiring a dependency on American tech giants for age verification further deepens the EU’s dependency on America and the USA’s control over the internet.
Bobby Borisov (Hacker News):
The European Union’s open-source age-verification project has drawn criticism after a maintainer confirmed that hardware-bound attestation is a mandatory architectural requirement, raising concerns about Linux, custom Android ROMs, and independently compiled applications.
[…]
The solution lets users prove they are over a certain age without revealing their name, exact birth date, or full identity document. To prevent credentials from being copied, cloned, or reused by modified clients, the project relies on keys stored in protected hardware like Android TEE, StrongBox, or Apple’s Secure Enclave.
However, critics claim that this approach endangers the system by making it dependent on a small number of approved devices, operating systems, and attestation providers.
Positiveblue (Hacker News):
Cloudflare’s new “signed agents” pitch sounds like safety but it’s a wolf in sheep’s clothing. They’ve built an allowlist for the open web and told builders to apply for permission. That’s not how the internet works. An application form is not a standard.
GrapheneOS:
Apple and Google are gradually expanding their use of hardware-based attestation. They’re convincing a growing number of services to adopt it. Google’s Play Integrity API and Apple’s App Attest API are very similar. Apple brought it to the web via Privacy Pass, which Google intends on doing too.
Google’s Play Integrity API requires hardware attestation for the strong integrity level and is gradually phasing in requiring it for the more commonly used device integrity level. Apple already has it as a requirement. Over the long term, this will increasingly lock out hardware and OS competition.
The purpose of these systems is disallowing people from using hardware and software not approved by Apple or Google. This is wrongly presented as being a security feature. Banks and government services are the main ones adopting it but Apple and Google are encouraging every service to use it.
German National EUDI Wallet Architecture Documentation (Hacker News):
When issuing the PID, the WB confirms to the PP (via OpenID4VCI Key Attestation) that the
keys to which a PID is to be bound are controlled by an authentication means that meets certain security requirements with regard to resistance against attackers with a certain attack potential (see ISO/IEC 18045).
Simon B. Støvring:
It’s great that App Attest is coming to Mac with macOS 27. It means I can ship Canvases’ intelligence and sharing features with much more confidence, knowing I can protect the endpoints with App Attest.
Previously:
Instagram Charging for Links
The Age Verification Trap
Apple Platform Security Guide (January 2026)
EU Council Approves New “Chat Control” Mandate
Google Abandons Web Environment Integrity API
Web Environment Integrity
App Attest
https://mjtsai.com/blog/2026/10/15/attestation-news/

2026-10-16 03:34:54 UTC

Passkeys Attestation Trap
The Hack (Hacker News):
Like the Trojan Horse, passkeys are legitimately elegant on the surface, but there is something troubling inside.
What’s important to know is that unlike with any other kind of login credential, you do not have ultimate control over your passkeys. With passwords, you can choose where to write them down; with authenticator apps, you can decide for yourself which ones to use (they’re pretty interchangeable); and with physical security keys you can hand them to your colleague if you really trust them. But with passkeys come a hidden dial that lets the websites you use them on gradually remove your ability to do as you please with them.
[…]
This is the feature that means you no longer get to make the calls about your passkeys. Fortunately, attested passkeys are not yet required on most websites. But the FIDO Alliance standard makes attestation a part of the passkey ecosystem, whether you want it or not. And even if the website doesn’t require attestation now, simply by using passkeys you indicate to the website that your setup supports the FIDO Alliance’s passkey standard and that you as a user are capable of using passkeys. This means that once Twitter (formally X) is satisfied that the overwhelming majority of its users would be unaffected, they can flip the switch – perhaps not all at once, perhaps just for ten thousand users at a time so as not to cause a fuss – and start rejecting non-attested passkeys.
[…]
My expectation is that the industry will start off with very few constraints on your passkeys, and gradually add more and more, not all at the same time, but staggered on different sites, and then in a few years people will forget that they were ever offered a choice in which security measures they want to enable on their passkeys (if they even knew there were different kinds of passkeys at all).
[…]
Remote attestation can allow them to verify that your device is not capable of, say, sending and receiving encrypted messages, or running a competitor’s app, or using social media without verifying your ID.
Apple’s passkey implementation currently does not support attestation, but it sounds like this is only until they can work out how to do syncing:
Attestation was designed to attest to a specific device, exclusively at the point of creation, with a specific set of security properties. It doesn’t make sense for synced credentials for a number of reasons, including syncing to devices with different security properties, changes in security properties that happen after key creation, security properties of the sync fabric, sharing the passkey, or exporting to other passkey providers. We’re working hard with W3C and FIDO to solve these problems.
Ricky Mondello:
The post is predicated on the idea that a feature of WebAuthn called “attestation”, which is only used in high-assurance and usually corporate scenarios, and usually with physical hardware security keys, will be leveraged to hurt people, somehow.
The post posits that a website like X will bait and switch users: first, you get a passkey. Then, later, scary “attested” passkeys! This simply isn’t possible to do because attestation isn’t supported on the web for mass market, consumer authentication.
Attestation for passkeys (software-based, syncable credentials) is antithetical to their mass market goals, and would freeze out independent, non-corporate-backed credential managers. It’s an explicit non-goal of the designers of passkeys, who work together in a forum anyone can join.
And trust me, websites and apps like banks repeatedly asked for attestation at the beginning of the industry’s passkey journey. The platforms, browsers, and credential management apps have held firm that the goal of passkeys is reducing phishing and not some kind of trusted computing scheme. (And I will note: over my dead body!)
I believe this is not the goal of Mondello and some of the others working on this, but so far I’ve not been convinced that they will be able to control it. It sounds like Apple is working on it, and once the technology is out there, what’s to prevent key sites from forcing it on users? It seems like all this would take is the cooperation of a few big credential managers. This would be to their benefit in the sense that it would make their products required. Smaller credential managers who resisted would be frozen out.
varx:
The fact that websites and apps have been asking for attestation just reinforces the main point of the passkeys post! Sure, browsers aren’t supporting it yet, but that’s the sort of thing that can change, and the sort of thing that has changed in the past. See the footnote on Widevine and Firefox. (“Currently not supported” is also very subject to change.)
And we already have sites and apps allowlisting passkey vendors. That’s no theoretical, slippery slope fear -- it’s a real restriction on user freedoms that’s already happening right now.
I don’t think that a couple of bad points (e.g. the TOTP thing) invalidate the main point of the post, because the post wasn’t an argument from authority. The author makes some good points that stand on their own.
Ricky Mondello:
To be clear, the websites have stopped asking for attestation. Or at least, they’ve stopped asking me. Why? Because they know there’s no use in asking — that the OS vendors, browsers, and passkey managers are unified on this front. And now they’ve seen firsthand that passkeys without attestation are awesome and a big step forward.
iinuwa:
This is antithetical to users, as the types of authenticators that can pull this off are difficult to use (security keys). Companies with IT departments who can do account recovery for the user can handle this, an average user cannot. Synced passkeys are the answer to this for consumers and therefore attestation does not belong in the consumer space. Which is why password managers are in the spec groups pushing back against this every time it comes up.
Scott Helme (Hacker News):
If a consumer website decided tomorrow that it would only accept attested passkeys, it would lock out almost all of its own users, instantly. What website is going to do that?
[…]
If you’re worried about attestation creeping into consumer logins, then that’s worth pushing back on, loudly (if it ever happens). But it hasn’t happened, the biggest providers don’t support it, and avoiding passkeys today while you wait for it won’t protect you from anything, it just leaves you open to phishing.
It seems like rejecting passkeys is the only way the average user has to push back. The main thing protecting us is that sites don’t want to lock out their users who rely on passwords and 2FA. Once most people have adopted passkeys, if Apple and Google sell us out, I don’t think it matters much what the rest of the alliance thinks. Sites would be able to require attestation with the assurance that users could easily comply. Safari would probably opt everyone into attested passkeys, as it currently opts you into passkeys in general (unless you uncheck “Allow Automatic Passkey Upgrades”).
Previously:
Attestation News
Locked Down Passkey and Keychain Backups
Forcing Passkeys
Passkeys Credential Exchange
Web Environment Integrity
https://mjtsai.com/blog/2026/10/15/passkeys-attestation-trap/