Apple’s Left and Right Hands Are Sometimes Strangers

Apple is a famously tight-knit business. Its press releases and media conferences routinely drum the integration of hardware, software, and services as something only Apple is capable of doing. So it sticks out when features feel like they were developed by people who do not know what another part of the company is doing. This happened to me twice in the past week.

Several years ago, Apple added a very nice quality-of-life improvement to the Mac operating system: software installers began offering to delete themselves after they had done their job. This was a good idea.

In the ensuing years, Apple made some other changes to MacOS in an effort to — it says — improve privacy and security. One of the new rules it imposed was requiring the user to grant apps specific permission to access certain folders; another was a requirement to allow one app to modify or delete another.

And, so, when I installed an application earlier this month, I was shown an out-of-context dialog at the end of the process asking for access to my Downloads folder. I granted it. Then I got a notification that the Installer app was blocked from modifying or deleting another file. To change it, I had to open System Settings, toggle the switch, enter my password, and then I was prompted to restart the Installer application — but it seemed to delete itself just fine without my doing so.

This is a built-in feature, triggered by where the installer has been downloaded, using an Apple-provided installation packaging system.1 But it is stymied by a different set of system rules and unexpected permissions requests.

Another oddity is in Apple’s two-factor authentication system. Because Apple controls so much about its platforms, authentication codes are delivered through a system prompt on trusted devices. Preceding the code is a notification informing the user their “Apple Account is being used to sign in”, and it includes a map of where that is.

This map is geolocated based on the device’s IP address, which can be inaccurate for many reasons — something Apple discloses in its documentation:

This location is based on the new device’s IP address and might reflect the network that it’s connected to, rather than the exact physical location. If you know that you’re the person trying to sign in but don’t recognize the location, you can still tap Allow and view the verification code.

It turns out one of the reasons the network might think you are located somewhere other than where you are is because you may be using iCloud Private Relay. Even if you have set it to “maintain general location”, it can sometimes be incredibly inaccurate. I was alarmed to see a recent attempt from Toronto when I was trying to sign into iCloud at home in Calgary — a difference of over 3,000 kilometres.

The map gives me an impression of precision and security. But if it is made less accurate in part because of a feature Apple created and markets, it is misleading and — at times — a cause of momentary anxiety.

What is more, Safari supports automatically filling authentication codes delivered by text message. Apple’s own codes, though, cannot be automatically filled.

These are small things — barely worth the bug report. They also show how features introduced one year are subverted by those added later, almost like nobody is keeping track of all of the different capabilities in Apple’s platforms. I am sure there are more examples; these are just the ones which happened in the past week, and which I have been thinking about. They expose little cracks in what is supposed to be a tight, coherent package of software.

  1. Thanks to Keir Ansell for tracking down this documentation for me. ↥︎

Internet Archive ‘Glitch’ Affects User Data ⇥ blog.gingerbeardman.com

Speaking of the Internet Archive, Matt Sephton, in August, posted about the surprise loss of his account there:

Recently at Internet Archive a “glitch” (their choice of word) deleted a great many accounts, including my account that had been at archive.org/details/@gingerbeardman since 2015.

I had meant to post this nearer to when it happened but, like others, my requests for comment went unanswered, even when sent directly to an organization representative instead of a generic media inbox. Parts of Sephton’s account were thankfully restored, but only after this post was sent to Hacker News.

I find the Internet Archive’s utility unparalleled. I find some of its recent behaviour frustrating.

Private Systems for Public Services ⇥ fosstodon.org

Brendan Jones:

The rise of Mastodon has made me so much more aware of government services requiring us to use private companies’ systems to communicate with them and access services.

Sitting on a Dutch train just now I was shown on a screen “feeling unsafe in the train? Contact us via WhatsApp”.

Jones says the railway operator’s website also contains SMS reporting instructions, but that was not shown on the train itself.

One of the side effects of the decline of née Twitter is in the splintering of its de facto customer support and alert capabilities. Plenty of organizations still use it that way. But it should only be one option. Apps like WhatsApp should not be the preferred contact method, either. Private companies’ contact methods should be available, sure — meet people where they are — but a standard method should always be as easily available.

The Internet Archive Is Under DDoS Attack ⇥ theverge.com

Jason Scott:

Someone is DDOSing the internet archive, so we’ve been down for hours. According to their twitter, they’re doing it just to do it. Just because they can. No statement, no idea, no demands.

An X account claiming responsibility says it is a politically motivated attack. If that is true, it is an awfully stupid rationale and a poor choice of target.

Wes Davis, the Verge:

Here’s what the popup said:

“Have you ever felt like the Internet Archive runs on sticks and is constantly on the verge of suffering a catastrophic security breach? It just happened. See 31 million of you on HIBP!”

HIBP refers to Have I Been Pwned?, a website where people can look up whether or not their information has been published in data leaked from cyber attacks. It’s unclear what is happening with the site, but attacks on services like TweetDeck have exploited XSS or cross-site scripting vulnerabilities with similar effects.

I have no idea if this group actually obtained any Internet Archive user data. The site has only a placeholder page directing visitors to its X account for status updates, but I see nothing there or on Brewster Kahle’s personal one.

Update: Three minutes after publishing this post, I received an alert from Have I Been Pwned that my Internet Archive account was one of over 31 million total which had been exposed. Troy Hunt, who runs HIBP, and Lawrence Abrams of Bleeping Computer both tried contacting the Internet Archive with no response.

WSJ: U.S. Wiretap Systems Targeted in China-Linked Hack ⇥ wsj.com

Sarah Krouse, Dustin Volz, Aruna Viswanatha, and Robert McMillan, Wall Street Journal (probably paywalled; sorry):

A cyberattack tied to the Chinese government penetrated the networks of a swath of U.S. broadband providers, potentially accessing information from systems the federal government uses for court-authorized network wiretapping requests.

For months or longer, the hackers might have held access to network infrastructure used to cooperate with lawful U.S. requests for communications data, according to people familiar with the matter, which amounts to a major national security risk. The attackers also had access to other tranches of more generic internet traffic, they said.

Zack Whittaker, TechCrunch:

The 30-year-old law that set the stage for recent backdoor abuse is the Communications Assistance for Law Enforcement Act, or CALEA, which became law in 1994 at a time when cell phones were a rarity and the internet was still in its infancy.

CALEA requires that any “communications provider,” such as a phone company or internet provider, must provide the government all necessary assistance to access a customer’s information when presented with a lawful order. In other words, if there is a means to access a customer’s data, the phone companies and internet providers must provide it.

Bruce Schneier:

For years, the security community has pushed back against these backdoors, pointing out that the technical capability cannot differentiate between good guys and bad guys. And here is one more example of a backdoor access mechanism being targeted by the “wrong” eavesdroppers.

Riana Pfefferkorn:

It is not the ‘90s anymore, when CALEA got enacted, the law requiring telecom wiretappability for law enforcement. China and Russia and DPRK are formidable cyber foes now. DOJ, FBI, etc. want to change CALEA so that encrypted apps like Signal or WhatsApp aren’t exempt from it anymore. But this hack shows that if anything, the law needs to change in the *other* direction. The hack needs to be a wake-up call to law enforcement that as long as they keep opposing encryption for communications, they’re enabling China to smack us in the face with our own hand while saying “stop hitting yourself!”

According to a 2016 paper from Public Safety Canada, “Australia, the U.S., the UK and many other European nations require CSPs [Communications Service Providers] to have an interception capability”; it also notes Canada does not. Such a requirement is understandable from an investigative perspective. But, as Pfefferkorn says, capabilities like these have been exploited before, and it will happen again. These are big targets and there are no safe backdoors.

That brings me — for the second time today — to the need for comprehensive privacy legislation basically everywhere but, in particular, in the United States, the hub of the world’s communications. Protecting private data would dramatically curtail this kind of access violation by removing backdoors, restrict one aspect of TikTok panic, and reduce the exploitation of our behavioural data by creepy ad tech businesses. It is not a panacea and I am sure there are worrisome side effects for law enforcement, but it would likely be more effective than tackling these problems on an individual basis.

Apple as Godzilla ⇥ youtube.com

I have to say, it is quite an odd thing to be listening to a podcast and hear one’s own name. This recently happened to me on the latest episode of “Upgrade”. It feels like I am about to be called to the principal’s office or something. But I was not.

Myke Hurley and Jason Snell discussed an article I wrote about the more granular control available to users in iOS 18 when apps request access to their contacts. (My piece is a response to a New York Times story; Snell also linked to both with some commentary.) Their chat centres Apple’s scale and influence. Even little decisions the company makes are capable of transforming entire industries.

Hurley raises an apt comparison to App Tracking Transparency, which is exactly what I was thinking about when I wrote my piece. I am similarly unsympathetic to corporate empires built on illicitly obtained data. If you cannot make money when users are given a choice to consent, your business model probably sucks. But I do think it is concerning how powerful both of the major players were in the aftermath of that announcement: Meta, for hoarding behavioural data on billions of people; and Apple, for its ability to give users options.

I see parallels to Google’s power over the web. The near-uniform layout and structure of webpages is thanks to Google’s specific suggestions for improving the likelihood of ranking higher. The main difference is Google’s suggestions are sort of optional; if a website’s owner does not care much about search traffic, they can do whatever they want. The prompts on iOS, on the other hand, are baked into the system.

As Snell says, these apps “have to make the case” for granting permission. I do not think that is such a bad thing, and I am amenable to their suggestion of Apple’s built-in apps being placed on a level playing field. I think a lot of this would be more predictable if privacy laws were stronger. A basic level of privacy protections should not be a competitive advantage, nor should users be required to navigate either unceasing permissions dialogs or terms of service agreements to understand the myriad ways their personal information is being exploited — because their personal information should not be exploited.

Low Orbit Satellite Companies Respond to Scientists’ Concerns About Light and Environmental Pollution With Even Bigger, Brighter Satellites ⇥ techdirt.com

Karl Bode, Techdirt:

Scientists say that low earth orbit (LEO) satellite constellations being built by Amazon, Starlink, and AT&T pose a dire threat to astronomy and scientific research, and that too little is being done to address the issue.

There are costs to suddenly widespread satellite connectivity. Apple’s partner in its offering, Globalstar, operates a constellation of satellites which would similarly be concerning to scientists.

It is a tricky balance. Adding redundant communications layers in our everyday devices can be useful and is, plausibly, of lifesaving consequence. Yet it also means the sky is littered with fields of objects which interfere with ground-based instruments. The needs of scientists might seem more abstract and less dire than, say, people seeking help in a natural disaster — I understand that. But I am not certain we will be proud of ourselves fifty years from now if we realize astronomical research has been severely curtailed because a bunch of private companies decided to compete in our shared sky. There is surely a balance to be struck.

Messages via Satellite in Real Life, and Real Life Catastrophes ⇥ 9to5mac.com

As smartphones began competing on satellite connectivity, I had my doubts. Sure, I could imagine a dire emergency situation where it would be lifesaving, but would I ever use it? I hike a little and I cycle a lot, often without cell connectivity, and I feel completely comfortable. I am by no means an extreme sports enthusiast or adventurer. When would I need this stuff?

Well, the Messages via Satellite capability — new for iPhone users in iOS 18 — sure was handy this weekend. I was cycling a light trail in Kananaskis with a friend when I had a low-speed fall in a rock field. It was embarrassing. It also gave me a deep, five centimetre-long cut on my knee. It was not bad enough to need medical attention — I was able to keep cycling just fine — but it was good to know I would be able to get help if I needed it in an area without any cellular reception. And, at the trailhead, I was able to let my wife know I was fine via satellite-sent text message.

Of course, it can also be used in more dire circumstances, as many are finding out.

Ryan Christoffel, 9to5Mac:

Hurricane Helene has caused massive damage and taken over 100 lives across several US states. Many thousands of people are without power and/or cell service. But in the wake of the storm, reports have surfaced about a key iOS 18 feature that has been a lifeline for survivors: Messages via satellite.

In my case, useful; in the case of many people, a truly lifesaving addition. You know those graphics of everything smartphones replaced? Satellite phones surely have not been replaced for the avid adventurer, but they can probably be added to that graphic for a lot of us. Smartphone makers seem to have gone through the list of everyday necessities, then the weekly or monthly ones, and now are at a point where they are adding features we may use only once — but we are glad when we do.

Sponsor: Magic Lasso Adblock: YouTube Ad Blocker for Safari ⇥ magiclasso.co

Do you want to block all YouTube ads in Safari on your iPhone, iPad and Mac?

Then download Magic Lasso Adblock – the ad blocker designed for you.

Magic Lasso Adblock - best in class YouTube ad blocking

As an efficient, high performance, and native Safari ad blocker, Magic Lasso blocks all intrusive ads, trackers, and annoyances – delivering a faster, cleaner, and more secure web browsing experience.

Magic Lasso Adblock is easy to setup, doubles the speed at which Safari loads, and also blocks all YouTube ads; including all:

  • video ads

  • pop up banner ads

  • search ads

  • plus many more

With over 5,000 five star reviews; it’s simply the best ad blocker for your iPhone, iPad, and Mac.

And unlike some other ad blockers, Magic Lasso Adblock respects your privacy, doesn’t accept payment from advertisers, and is 100% supported by its community of users.

So, join over 350,000 users and download Magic Lasso Adblock today.

Mark Zuckerberg’s Political Zag

The New York Times recently ran a one–two punch of stories about the ostensibly softening political involvement of Mark Zuckerberg and Meta — where by “punch”, I mean “gentle caress”.

Sheera Frenkel and Mike Isaac on Meta “distanc[ing] itself from politics”:

On Facebook, Instagram and Threads, political content is less heavily featured. App settings have been automatically set to de-emphasize the posts that users see about campaigns and candidates. And political misinformation is harder to track on the platforms after Meta removed transparency tools that journalists and researchers used to monitor the sites.

[…]

“It’s quite the pendulum swing because a decade ago, everyone at Facebook was desperate to be the face of elections,” said Katie Harbath, chief executive of Anchor Change, a tech consulting firm, who previously worked at Facebook.

Facebook used to have an entire category of “Government and Politics” advertising case studies through 2016 and 2017; it was removed by early 2018. I wonder if anything of note happened in the intervening months. Anything at all.

All of this discussion has so far centred U.S. politics; due to the nature of reporting, that will continue for the remainder of this piece. I wonder if Meta is ostensibly minimizing politics everywhere. What are the limits of that policy? Its U.S. influence is obviously very loud and notable, but its services have taken hold — with help — around the world. No matter whether it moderates those platforms aggressively or it deprioritizes what it identifies as politically sensitive posts, the power remains U.S.-based.

Theodore Schleifer and Mike Isaac, in the other Times article about Zuckerberg personally, under a headline claiming he “is done with politics”, wrote about the arc of his philanthropic work, which he does with his wife, Dr. Priscilla Chan:

Two years later, taking inspiration from Bill Gates, Mr. Zuckerberg and Dr. Chan established the Chan Zuckerberg Initiative, a philanthropic organization that poured $436 million over five years into issues such as legalizing drugs and reducing incarceration.

[…]

Mr. Zuckerberg and Dr. Chan were caught off guard by activism at their philanthropy, according to people close to them. After the protests over the police killing of George Floyd in 2020, a C.Z.I. employee asked Mr. Zuckerberg during a staff meeting to resign from Facebook or the initiative because of his unwillingness at the time to moderate comments from Mr. Trump.

The incident, and others like it, upset Mr. Zuckerberg, the people said, pushing him away from the foundation’s progressive political work. He came to view one of the three central divisions at the initiative — the Justice and Opportunity team — as a distraction from the organization’s overall work and a poor reflection of his bipartisan point-of-view, the people said.

This foundation, like similar ones backed by other billionaires, appears to be a mix of legitimate interests for Chan and Zuckerberg, and a vehicle for tax avoidance. I get that its leadership tries to limit its goals and focus on specific areas. But to be in any way alarmed by internal campaigning? Of course there are activists there! One cannot run a charitable organization claiming to be “building a better future for everyone” without activism. That Zuckerberg’s policies at Meta is an issue for foundation staff points to the murky reality of billionaire-controlled charitable initiatives.

Other incidents piled up. After the 2020 election, Mr. Zuckerberg and Dr. Chan were criticized for donating $400 million to the nonprofit Center for Tech and Civic Life to help promote safety at voting booths during pandemic lockdowns. Mr. Zuckerberg and Dr. Chan viewed their contributions as a nonpartisan effort, though advisers warned them that they would be criticized for taking sides.

The donations came to be known as “Zuckerbucks” in Republican circles. Conservatives, including Mr. Trump and Representative Jim Jordan of Ohio, a Republican who is chairman of the House Judiciary Committee, blasted Mr. Zuckerberg for what they said was an attempt to increase voter turnout in Democratic areas.

This is obviously a bad faith criticism. In what healthy democracy would lawmakers actively campaign against voter encouragement? Zuckerberg ought to have stood firm. But it is one of many recent clues as to Zuckerberg’s thinking.

My pet theory is Zuckerberg is not realigning on politics — either personally or as CEO of Meta — out of principle; I am not even sure he is changing at all. He has always been sympathetic to more conservative voices. Even so, it is important for him to show he is moving toward overt libertarianism. In the United States, politicians of both major parties have been investigating Meta for antitrust concerns. Whether the effort by Democrats is in earnest is a good question. But the Republican efforts have long been dominated by a persecution complex where they believe U.S. conservative voices are being censored — something which has been repeatedly shown to be untrue or, at least, lacking context. If Zuckerberg can convince Republican lawmakers he is listening to their concerns, maybe he can alleviate the bad faith antitrust concerns emanating from the party.

I would not be surprised if Zuckerberg’s statements encourage Republican critics to relent. Unfortunately, as in 2016, that is likely to taint any other justifiable qualms with Meta as politically motivated. Recall how even longstanding complaints about Facebook’s practices, privacy-hostile business, and moderation turned into a partisan. The giants of Silicon Valley have every reason to expect ongoing scrutiny. After Meta’s difficult 2022, it is now worth more than ever before — the larger and more influential it becomes, the more skepticism it should expect.

Hannah Murphy, Financial Times:

Some suggest Zuckerberg has been emboldened by X’s Musk.

“With Elon Musk coming and literally saying ‘fuck you’ to people who think he shouldn’t run Twitter the way he has, he is dramatically lowering the bar for what is acceptable behaviour for a social media platform,” said David Evan Harris, the Chancellor’s public scholar at California University, Berkeley and a former Meta staffer. “He gives Mark Zuckerberg a lot of permission and leeway to be defiant.”

This is super cynical. It also feels, unfortunately, plausible for both Zuckerberg and Meta as a company. There is a vast chasm of responsible corporate behaviour which opened up in the past two years and it seems like it is giving room to already unethical players to shine.

See Also: Karl Bode was a guest on “Tech Won’t Save Us” to discuss Zuckerberg’s P.R. campaign with Paris Marx.

Pavel Durov Is an Unreliable Narrator ⇥ t.me

It has been a little more than a month since Telegram CEO Pavel Durov was arrested and charged in France, and he has spent September trying to explain authorities’ interest and Telegram’s response.

Only one problem: I am not sure how much I can believe him. But I can only explain that by starting with his most recent posts.

Durov, on September 23:

To further deter criminals from abusing Telegram Search, we have updated our Terms of Service and Privacy Policy, ensuring they are consistent across the world. We’ve made it clear that the IP addresses and phone numbers of those who violate our rules can be disclosed to relevant authorities in response to valid legal requests.

And on October 2:

Since 2018, Telegram has been able to disclose IP addresses/phone numbers of criminals to authorities, according to our Privacy Policy in most countries.

Whenever we received a properly formed legal request via relevant communication lines, we would verify it and disclose the IP addresses/phone numbers of dangerous criminals. This process had been in place long before last week.

According to Durov, this is not “a major shift in how Telegram works”. It lines up with reporting in Der Spiegel, though further reporting called into question Telegram’s ongoing compliance with investigations. But earlier this year, Telegram claimed in its FAQ to reveal nothing at all about its users ever:

To this day, we have disclosed 0 bytes of user data to third parties, including governments.

Today, the same frequently asked question has a different word in it. See if you can spot it:

To this day, we have disclosed 0 bytes of user messages to third parties, including governments.

I do not know what to make of this. There is a vast difference, in my mind, between “0 bytes of user data” — which would include things like IP addresses and phone numbers — and “0 bytes of user messages”. Perhaps this was just poor wording in the earlier version — if so, it feels misleading. If I were some crime lord, I would see that as reassurance Telegram reveals nothing, especially with its reputation.

Let us now rewind to Durov on September 5:

Last month I got interviewed by police for 4 days after arriving in Paris. I was told I may be personally responsible for other people’s illegal use of Telegram, because the French authorities didn’t receive responses from Telegram.

Durov says, in effect, this is the fault of the French government because it did not use the correct channels for information requests, and French law enforcement could have just chatted with him to find out more.

I do not know whether I can believe him. From the outside, it looks like Telegram was habitually uncooperative with law enforcement on legitimate investigative grounds. It turned over some data to German authorities but realized users hated that, so it did one of two things: it deceived authorities, or it deceived users. Neither one is good. But I bet French authorities would not be charging a high-profile executive with such egregious crimes if they did not think they could prove it. I understand being skeptical of charges like these and I am not condemning Durov without proof. But I do not believe Durov either.

I Do Not Care About Impediments to a Creepy Growth Hacking Technique

Sarah Perez, TechCrunch:

iOS apps that build their own social networks on the back of users’ address books may soon become a thing of the past. In iOS 18, Apple is cracking down on the social apps that ask users’ permission to access their contacts — something social apps often do to connect users with their friends or make suggestions for who to follow. Now, Apple is adding a new two-step permissions pop-up screen that will first ask users to allow or deny access to their contacts, as before, and then, if the user allows access, will allow them to choose which contacts they want to share, if not all.

Kevin Roose, New York Times, in an article with the headline “Did Apple Just Kill Social Apps?”:

Now, some developers are worried that they may struggle to get new apps off the ground. Nikita Bier, a start-up founder and advisor who has created and sold several viral apps aimed at young people, has called the iOS 18 changes “the end of the world,” and said they could render new friend-based social apps “dead on arrival.”

That might be a little melodramatic. I recently spent some time talking to Mr. Bier and other app developers and digging into the changes. I also heard from Apple about why they believe the changes are good for users’ privacy, and from some of Apple’s rivals, who see it as an underhanded move intended to hurt competitors. And I came away with mixed feelings.

Leaving aside the obviously incendiary title, I think this article’s framing is pretty misleading. Apple’s corporate stance is the only one favourable to these limitations. Bier is the only on-the-record developer who thinks these changes are bad; while Roose interviewed others who said contact uploads had slowed since iOS 18’s release, they were not quoted “out of fear of angering the Cupertino colossus”. I suppose that is fair — Apple’s current relationship with developers seems to be pretty rocky. But this article ends up poorly litigating Bier’s desires against Apple giving more control to users.

Bier explicitly markets himself as a “growth expert”; his bio on X is “I make apps grow really fast”. He has, to quote Roose, “created and sold several viral apps” in part by getting users to share their contact list, even children. Bier’s first hit app, TBH, was marketed to teenagers and — according to several sources I could find, including a LinkedIn post by Kevin Natanzon — it “requested address book access before actually being able to use the app”. A more respectful way of offering this feature would be to ask for contacts permission only when users want to add friends. Bier’s reputation for success is built on this growth hacking technique, so I understand why he is upset.

What I do not understand is granting Bier’s objections the imprimatur of a New York Times story when one can see the full picture of Bier’s track record. On the merits, I am unsympathetic to his complaints. Users can still submit their full contact list if they so choose, but now they have the option of permitting only some access to an app I have not even decided I trust.

Roose:

Apple’s stated rationale for these changes is simple: Users shouldn’t be forced to make an all-or-nothing choice. Many users have hundreds or thousands of contacts on their iPhones, including some they’d rather not share. (A therapist, an ex, a random person they met in a bar in 2013.) iOS has allowed users to give apps selective access to their photos for years; shouldn’t the same principle apply to their contacts?

The surprise is not that Apple is allowing more granular contacts access, it is that it has taken this long for the company to do so. Developers big and small have abused this feature to a shocking degree. Facebook ingested the contact lists of a million and a half users unintentionally — and millions of users intentionally — a massive collection of data which was used to inform its People You May Know feature. LinkedIn is famously creepy and does basically the same thing. Clubhouse borrowed from the TBH playbook by slurping up contacts before you could use the app.1 This has real consequences in surfacing hidden connections many people would want to stay hidden.

Even a limited capacity of allowing users to more easily invite friends can go wrong. When Tribe offered such a feature, it spammed users’ contacts. It settled a resulting class action suit in 2018 for $200,000 without admitting wrongdoing. That may have been accidental. Circle, on the other hand, was deliberate in its 2013 campaign.

Apple’s position is, therefore, a reasonable one, but it is strange to see no voices from third-party experts favourable to this change. Well-known iOS security researchers Mysk celebrated it; why did Roose not talk to them? I am sure there are others who would happily adjudicate Apple’s claims. The cool thing about a New York Times email address is that people will probably reply, so it seems like a good idea to put that power to use. Instead, all we get is this milquetoast company-versus-growth-hacker narrative, with some antitrust questions thrown in toward the end.

Roose:

Some developers also pointed out that the iOS 18 changes don’t apply to Apple’s own services. iMessage, for example, doesn’t have to ask for permission to access users’ contacts the way WhatsApp, Signal, WeChat and other third-party messaging apps do. They see that as fundamentally anti-competitive — a clear-cut example of the kind of self-preferencing that antitrust regulators have objected to in other contexts.

I am not sure this is entirely invalid, but it seems like an overreach. The logic of requiring built-in apps to request the same permissions as third-party apps is, I think, understandable on fairness grounds, but there is a reasonable argument to be made for implied consent as well. Assessing this is a whole different article.

But Messages accesses the contacts directory on-device, while many other apps will transport the list off-device. That is a huge difference. Your contact list is almost certainly unique. The specific combination of records is a goldmine for social networks and data brokers wishing to individually identify you, and understand your social graph.

I have previously argued that permission to access contacts is conceptually being presented to the wrong person — it ought to, in theory, be required by the people in your contacts instead. Obviously that would be a terrible idea in practice. Yet each of us has only given our contact information to a person; we may not expect them to share it more widely.

As in so many other cases, the answer here is found in comprehensive privacy legislation. You should not have to worry that your phone number in a contact list or used for two-factor authentication is going to determine your place in the global social graph. You should not have to be concerned that sharing your own contact list in a third-party app will expose connections or send an unintended text to someone you have not spoken with in a decade. Data collected for a purpose should only be used for that purpose; violating that trust should come with immediate penalties, not piecemeal class action settlements and FTC cases.

Apple’s solution is imperfect. But if it stops the Biers of the world from building apps which ingest wholesale the contact lists of teenagers, I find it difficult to object.

  1. Remember when Clubhouse was the next big thing, and going to provide serious competition to incumbent giants? ↥︎

Croissant ⇥ mastodon.social

Croissant is not just a delicious pastry; it is also a new app from Ben McCarthy and Aaron Vegh:

Social media in 2024 can be a real pain. But I’m happy to d’éclair that Croissant is here to help. It makes cross-posting to Bluesky, Mastodon and Threads feel buttery smooth.

I have been testing this for a couple of weeks and it is as described: a lovely, polished way to post across platforms. Okay, it is described with a few more baked good puns in McCarthy’s thread. There is full support for platform-specific features like audience limiting, and probably the nicest alt text entry for images I have seen yet.

It is available from the App Store on the iPhone.

Also, I feel compelled to mention Croissant uses showManageSubscriptions to display your in-app purchase. This is a nice touch. Except Apple takes the opportunity to pollute the screen with an ad for Apple One in a third-party app. Gross.

iPhone Battery Limiter Anecdata ⇥ icloud.com

Juli Clover’s experiment last month created fertile ground for ample anecdata about whether capping the battery at 80% of its capacity leads to better longevity. This sort of stuff fascinates me.

So here is what I did with my evening: I looked through the first ten pages of the relevant MacRumors Forums thread, the links in Michael Tsai’s roundup, and figures I was emailed by readers. I only looked at reports from the iPhone 15 family of models for a more valid comparison, and only recorded those with capacity, cycles, and an indication of whether limiting was turned on.

Is this data? Barely! I did not factor anything else into this — not charge method, and not the specific iPhone 15 phone model. If someone said they used the 80% charging limit for most of the phone’s life apart from vacationing, I counted that as using the limit. Also, this is a survey of people who felt compelled to comment on a forum thread about battery statistics, so it is wildly skewed. It can barely be called “statistics” because these numbers are so noisy, but it is fun. Roll with it.

Here is my Numbers spreadsheet with a little over a hundred reports. As I was entering it, two things struck me:

  1. Far more of the people reporting 100% remaining battery capacity after typical use have turned on the charge limiter.

  2. People who use the charge limiter seem to also use their phones less but, critically, the 80% limiter appears to help lighter users.

The latter is maybe a little bit too obvious, and it is probably the biggest factor: if you use more of your battery more often, it will wear out faster. But this is something to consider. If you regularly find yourself with plenty of charge remaining at the end of the day, this collection of anecdotes suggests you should think about turning on the capacity limiter. If you are a light user, you may be able to stretch out the life of your battery and keep the same phone for longer.

If you are a heavier phone user, though, you might just be compelled to replacing your battery more often regardless of your settings.

Update: “jawbroken” on Bluesky made a chart. (You may need to log into Bluesky to see it.)

The Collapse of Self-Worth in the Digital Age ⇥ thewalrus.ca

I loved this essay from Thea Lim, as published in the Walrus, about our quantified digital lives subsuming our reality, but I have a quibble with this otherwise excellent paragraph:

[…] What we hardly talk about is how we’ve reorganized not just industrial activity but any activity to be capturable by computer, a radical expansion of what can be mined. Friendship is ground zero for the metrics of the inner world, the first unquantifiable shorn into data points: Friendster testimonials, the MySpace Top 8, friending. […]

To the contrary, this is something we not only talk about with frequency, but usually with anxiety approaching a moral panic. I share those worries, for what it is worth; I am not sure it is a positive thing to have constant reminders of our social and physical performance. I am sometimes upset I do not scrobble my vinyl records with Last.fm, even though I also know this is very silly. Since I stopped wearing a smartwatch or any kind of fitness tracker, I am no longer recording health metrics and I feel healthier as a result. I track webpage views here and have a vanity search for the site URL because it lets me see when cool people have noticed something I wrote. Your experience may vary.

This next paragraph in Lim’s essay, though, is noteworthy:

And those ascetics who disavow all socials? They are still caught in the network. Acts of pure leisure — photographing a sidewalk cat with a camera app or watching a video on how to make a curry — are transmuted into data to grade how well the app or the creators’ deliverables are delivering. If we’re not being tallied, we affect the tally of others. We are all data workers.

We are all helping create webpage views, ad impressions, and video plays, all of which are reported to people who are ostensibly concerned with accuracy. But all of these stats lie. If one’s livelihood depends on what they report, it is hard not to see why they are taken so seriously, even if everyone kind of knows they are not real. We are all participants in this shared delusion.

X’s First Transparency Report Since Elon Musk’s Takeover ⇥ wired.com

Until this week, the most recent data available about the moderation activities of the company formerly known as Twitter could be found in a report covering the last six months of 2021. Maybe you heard, but Elon Musk began his process for acquiring the company in April 2022, and it concluded in October the same year. I am working my way through “Character Limit”, so I have just relived the experience of that era, and it was not good! Anyway, despite being enthusiastic about transparency, Musk’s X had not released any updates. Now, though, we have data for the first half of 2024 (PDF), and it is quite interesting.

Vittoria Elliott, Wired:

While some numbers remain seemingly consistent across the reports — reports of abuse and harassment are, somewhat predictably, high — in other areas, there’s a stark difference. For instance, in the 2021 report, accounts reported for hateful content accounted for nearly half of all reports, and 1 million of the 4.3 million accounts actioned. (The reports used to be interactive on the website; the current PDF no longer allows users to flip through the data for more granular breakdowns.) In the new X report, the company says it has taken action on only 2,361 accounts for posting hateful content.

Elliott quotes Michael Abboud, a spokesperson for X, saying “[a]s an entirely new company, we took time to rethink how best to transparently share data” about moderation activity. Nonsense. X is not really an “entirely new company”, and this is not a rethought report. It is very similar to the ones which came before, though it is less comprehensive and now in a slick PDF instead of on a slick webpage.

One of the key differences between the two reports is the way total reports of violative behaviour are measured. Twitter says over 11.6 million accounts were reported between July and December 2021. The company said these are de-duplicated; these are 11.6 million accounts against which the company received at least one report. In the X report, it says it received over 224 million “user reports” for the first six months of this year. The company does not share a comparable de-duplicated figure for how many individual accounts were reported, however, nor could I find a comparable total metric reported by Twitter.

Karissa Bell, Engadget:

The report, which details content takedowns and account suspensions from the first half of 2024, shows that suspensions have more than tripled since the last time the company shared data. X suspended just under 5.3 million accounts during the period, compared with 1.6 million suspensions during the first six months of 2022.

In addition to the suspensions, X says it “removed or labeled” more than 10.6 million posts for violating its rules. Violations of the company’s hateful conduct policy accounted for nearly half of that number, with X taking action on 4.9 million such posts. Posts containing abuse and harassment (2.6 million) and violent content (2.2 million) also accounted for a significant percentage of the takedowns and labels.

Abuse and harassment suspensions are up, from 82,971 in the July–December 2021 report to over 1.1 million in the 2024 one. There were 182,536 suspensions between January–June 2021, and 86,202 in July–December 2020. Perhaps X is more responsive to abuse and harassment reports compared to Twitter. But I bet this is indicative of the more abusive and harassing environment that is X today.

Cristiano Lima-Strong, Washington Post:

The site acted on 71 percent of the legal requests it received to remove content in the first half of this year, up 20 percent from the last time it reported the figure in 2021 and more than double the rate in preceding years, according to a new transparency report X published Wednesday and a Washington Post review of past disclosure data.

So X in 2024 is happier to grant government censorship requests — particularly from more authoritarian countries — more abusive, and more lenient with hateful posts than Twitter used to be. Sounds about right.

Christiaan Hetzner, Fortune:

Ferguson based his assessment on internal second-quarter figures recently obtained by the New York Times. According to this report, X booked $114 million worth of revenue in the U.S., its largest market by far. This represented a 25% drop over the preceding three months and a 53% drop over the year-ago period.

That already sounds bad. But it gets worse. The last publicly available figures prior to Musk’s acquisition, from Q2 of 2022, had revenue at $661 million. After you account for inflation, revenue has actually collapsed by 84%, in today’s dollars.

Advertisers do not want to prop up the expensive soapbox of an unhinged billionaire as the site becomes increasingly occupied by hostile squatters? What a surprise.

One could make a quite reasonable argument that businesses should not be so beholden to the desires of advertisers. The appeal of a publication or website to advertisers is not necessarily reflective of its quality. There is plenty of room for anti-advertising, anti-corporate media. But the failure of X to attract advertisers is not so much a subversive statement as it is an understandable free market response.

Guided by Vices

Allow me to set the scene: you have been seated with a group of your friends at a restaurant, catching up in a lively discussion, when a member of the waitstaff shows up. They take everyone’s orders, then the discussion resumes — but they return a short while later to ask if you heard about the specials. You had and, anyway, you have already ordered what you want, so the waiter leaves. You chat amongst yourselves again.

But then they appear again. Might they suggest some drinks? How about a side? Every couple of minutes, they reliably return, breaking your discussion to sell you on something else.

Would you like to see the menu again? Here, try this new thing. Here, try this classic thing we brought back. Here is a different chair. How about we swap the candles on the table for a disco ball? Would you like to hear the specials again? Have you visited our other locations?

It is weird because you had been to this restaurant a few times before and the service was attentive, but not a nuisance. Now that you think of it, though, the waitstaff became increasingly desperate after your first visit. Those first interruptions were fine because they were expected — even desired. But there is a balance. You are coming to this restaurant because the food and the drinks are good, sure, but you are there with friends to catch up.

Now, pressured by management, the waiters have become a constant irritant instead of helpful, and there is nothing you can do. You can ask them to leave you alone, but they only promise a slightly longer gap. There is no way to have a moment to yourselves. Do you get up and leave? Do you come back? I would not. In actual experience, there are restaurants I avoid because the service is just too needy.

Also, apps.

When I open any of the official clients for the most popular social media platforms — Instagram, Threads, X, or YouTube — I am thrust into an environment where I am no longer encouraged to have a good time on my own terms. From home feeds containing a blend of posts from accounts I follow and those I do not, to all manner of elements encouraging me to explore other stuff — the platform is never satisfied with my engagement. I have not even factored in ads; this is solely about my time commitment. These platforms expect more of it.

These are decisions made by people who, it would seem, have little trust in users. There is rarely an off switch for any of these features — at best, there is most often only a way to temporarily hide them.

These choices illustrate the sharply divergent goals of these platforms and my own wishes. I would like to check out the latest posts from the accounts I follow, maybe browse around a bit, and then get out. That is a complete experience for me. Not so for these platforms.

Which makes it all the more interesting when platforms try new things they think will be compelling, like this announcement from Meta:

We’re expanding Meta AI’s Imagine features, so you can now imagine yourself as a superhero or anything else right in feed, Stories and your Facebook profile pictures. You can then easily share your AI-generated images so your friends can see, react to or mimic them. Meta AI can also suggest captions for your Stories on Facebook and Instagram.

[…]

And we’re testing new Meta AI-generated content in your Facebook and Instagram feeds, so you may see images from Meta AI created just for you (based on your interests or current trends). You can tap a suggested prompt to take that content in a new direction or swipe to Imagine new content in real time.

Perhaps this is appealing to you, but I find this revolting. Meta’s superficially appealing generated images have no place in my Instagram feed; they do not reflect how I actually want to use Instagram at all.

Decisions like these have infected the biggest platforms in various ways, which explains why I cannot stand to use most of them any longer. The one notable asterisk is YouTube which, as of last year, allows you to hide suggested videos on the homepage, which also turns off Shorts’ infinite scrolling. However, every video page still contains suggestions for what you should watch next. Each additional minute of your time is never enough for any of these platforms; they always want the minute after that, too.

You really notice the difference in respect when you compare these platforms against smaller, less established competitors. When I open Bluesky or my current favourite Mastodon client, it feels similar to the way social media did about ten years ago blended with an updated understanding of platform moderation. Glass is another tremendous product which lets me see exactly what I want, and discover more if I would like to — but there is no pressure.

The business models of these companies are obviously and notably very different from those of incumbent players. Bluesky and Mastodon are both built atop open protocols, so their future is kind of independent of whether the companies themselves exist. But, also, it is possible there will come a time when those protocols lack the funding to be updated, and are only used by not more than a handful of people each running their own instance. Glass, on the other hand, is just a regular boring business: users pay money for it.

Is the future of some of these smaller players going to mimic those which have come before? Must they ultimately disrespect their users? I hope that is not the roadmap for any of them. It should not be necessary to slowly increase the level of hostility between product and user. It should be possible to build a successful business by treating people with respect.

The biggest social platforms are fond of reminding us about how they facilitate connections and help us communicate around the world. They are a little bit like a digital third place. And, just as you would not hang out somewhere that was actively trying to sabotage your ability to chat with your friends in real life, it is hard to know why you would do so online, either. Happily, where Google and Meta and X exhaust me with their choices, there are a wealth of new ideas that bring back joy.

How Much Does the 80% Charging Limit Help an iPhone’s Battery After a Year? ⇥ macrumors.com

Juli Clover, MacRumors:

With the iPhone 15 models that came out last year, Apple added an opt-in battery setting that limits maximum charge to 80 percent. The idea is that never charging the iPhone above 80 percent will increase battery longevity, so I kept my iPhone at that 80 percent limit from September 2023 to now, with no cheating.

My iPhone 15 Pro Max battery level is currently at 94 percent with 299 cycles. For a lot of 2024, my battery level stayed above 97 percent, but it started dropping more rapidly over the last couple of months.

I am grateful to Clover for running such a long experiment.

John Gruber:

My year-old iPhone 15 Pro (not Max) which I simply used every day and charged to 100 percent overnight: max capacity: 89 percent, 344 charge cycles.

Glenn Fleishman:

@gruber My iPhone 15 Pro is set to optimized charging up to 100%: 411 cycles, 91%. It seems like her Pro Max actually performed…worse than yours and mine? (Every battery is a little different.)

I received my iPhone 15 Pro on the first day it was available. Its battery is reporting 95% of its maximum capacity with 273 cycles. I use it normally, have never changed battery settings from the default, and it often runs beta iOS releases.

Some caveats: all of us are our own n of 1 study; a handful of those is not data. I would imagine Apple has a reason for creating this preference, too.

The Environmental Cost of A.I. ⇥ theatlantic.com

Karen Hao, the Atlantic:

Microsoft isn’t a company that exists to fight climate change, and it doesn’t have to assume responsibility for saving our planet. Yet the company is trying to convince the public that by investing in a technology that is also being used to enrich fossil-fuel companies, society will be better equipped to resolve the environmental crisis. Some of the company’s own employees described this idea to me as ridiculous. To these workers, Microsoft’s energy contracts demonstrate only the unsavory reality of how the company’s AI investments are actually used. Driving sustainability forward? Maybe. Digging up fossil fuels? As Prapoo put it in that September conference call, it’s a “game changer.”

Josh Saul, Naureen S. Malik, and Mark Chediak, Bloomberg:

From Florida to Oregon, utilities are racing to meet a surge in demand from power-hungry AI data centers, manufacturing facilities and electric vehicles. The staying power of gas, which in 2016 overtook coal as the No. 1 US source of electricity, has surprised some experts who not so long ago had projected the era of frenzied domestic demand growth for the fuel might soon come to an end.

[…]

Still, the booming power needs are hard to ignore. Electricity usage by data centers is poised to surge as much as ten times current levels by 2030. In addition to building new plants, some power companies will retire gas plants at a slower rate than previously expected, said power market analyst Patrick Finn of energy consultancy Wood Mackenzie. “It makes clean energy goals that much more difficult to attain,” he said.

Brian Merchant:

It’s also worth noting that data centers are at the moment a relatively small slice of total worldwide energy usage — currently something like 1%, dwarfed by cars, heavy industry, commercial buildings, and so on. That could change — a report from the Electric Power Research Institute projected that the electricity required by AI companies could rise to reach up to 9% of the United States’ energy mix, which would, quite frankly, be insane. (If you think the web is overrun with AI content now, imagine a world where one tenth of all the electricity we generate is going into pumping out more of the stuff.)

BUT. There’s another element at work here, and that, as energy analysts have pointed out, is that utilities have a self-interested reason to take AI companies’ energy projections at face value, or even to inflate them: It means they can raise rates and lobby to build more gas plants!

Between these reports and the last batch I linked to, the non-A.I.-generated summary seems to be: businesses are largely entrusted with setting their own environmental targets by the accounting measures of their own design, which they are bending in order to hurriedly launch A.I. features.

I am not an A.I. doomer; I am also not a cheerleader. That umbrella of technologies covers a bunch of exciting innovations, many of which are already finding their way into many of our lives, whether we have agreed to that or not. But it is alarming to see the flexibility of even mediocre environmental targets because of this admittedly interesting technology. Yet I am not convinced it is worth accelerating the damage we are inflicting upon our world.

Actual Emissions by Tech Companies Far Exceed Claims ⇥ theguardian.com

Akshat Rathi, Bloomberg, in July:

The Alphabet Inc. unit [Google] has claimed that it’s been carbon neutral in its operations since 2007. The status was based on purchasing carbon offsets to match the volume of emissions that were generated from its buildings, data centers and business travel. But in its latest report, the company states: “Starting in 2023, we’re no longer maintaining operational carbon neutrality.”

It’s a sign of a company learning to adapt to strengthening sustainability criteria. “In line with a changing market — including a more robust carbon-removal ecosystem we helped catalyze — we’ve shifted our strategy,” a Google spokesperson said. “We aim to avoid or reduce greenhouse-gas emissions to reach our absolute emissions reduction target.”

Kenza Bryan, Camilla Hodgson, and Jana Tauschinski, Financial Times, in August:

Companies including Amazon, Meta and Google have funded and lobbied the Greenhouse Gas Protocol, the carbon accounting oversight body, and financed research that helps back up their positions, according to documents seen by the FT.

But Big Tech is itself split on how to craft the rules. A coalition that includes Amazon and Meta is pushing a plan that critics fear will allow companies to report emissions numbers that bear little relation to their real-world pollution and not fully compensate for those emissions.

One person familiar with the reform discussions describes the proposal as “a way to rig the rules so the whole ecosystem can obfuscate what they are up to”. The coalition said its approach “emphasises accurate emissions data and transparency”.

The battle reported in this Times article is over renewable energy credits — previously — which are different than carbon offsets. This article paints Google’s credit accounting approach as more honest than the proposal from Amazon and Meta.

Isabel O’Brien, the Guardian:

According to a Guardian analysis, from 2020 to 2022 the real emissions from the “in-house” or company-owned data centers of Google, Microsoft, Meta and Apple are probably about 662% — or 7.62 times — higher than officially reported.

These businesses have different emissions sources — Amazon, for example, also factors deliveries into its environmental reporting; Apple accounts for device manufacturing and transportation. But the overall impact of these companies is far greater than they admit to. It is frustrating to constantly see messages of “net zero” accomplishments and know it is, by some measure, fake — but by how much is difficult to know for most of us laypersons.