I look forward to Austin Mann’s iPhone review every year. This is particularly true when Apple dedicates much of its product launch materials to explaining camera improvements, because nobody can test those changes quite like Mann does.
Indeed, the photos in this year’s review are stunning. There are shots in here that seem impossible to have been created with a smartphone — particularly the photo of a lantern-lit boat and a self-portrait.
There are also some fascinating technical details in this piece. On comparing Night mode to traditional long exposure photography:
But with iPhone 11 Pro the rules are different… it’s not capturing one single continuous frame but blending a whole bunch of shots with variable lengths (some shorter exposures to freeze motion and longer shots to expose the shadows.) This means the subject can actually move during your exposure but still remain sharp.
I’m sure some of you are wondering, “well this is cool for handholding but what if you want to do light trails?” The iPhone actually detects when it is on a tripod and changes exposure method so that light trails and movement can still be captured.
In a separate review in Outdoor Photographer, Mann says that the ultra wide lens can be used for panoramas, which allows for an even wider landscape shot in every direction.
One other thing I noticed thanks to the original image files included in John Gruber’s review is that noise reduction seems to preserve more detail and create less of a painterly effect when zoomed in. I hope this is true for high-detail scenes such as landscapes and architectural photos.
The apparent disconnect between most people’s stated desire for online privacy and their incautious online behavior has become known as the privacy paradox. There are competing explanations, but most experts agree it’s hard to draw conclusions about people’s values from their real-world actions. That’s because their choices are shaped by all kinds of factors: the limited available options (how many social networks have the majority of your friends and family on them?), the circumstances under which they make decisions (who has time to read a 4,000-word privacy policy before downloading each app?), the difficulty of predicting outcomes (who knew that Yahoo Mail would get hacked when they signed up for it?), and feelings of general helplessness (why spend a ton of energy protecting your data now when so much is already out there?).
It really is bizarre that we willfully sign away our right to the privacy and security of huge amounts of deeply personal information with little thought or care — and that the discussion about how to best regulate this industry and its breaches of trust, if at all, is dominated by economic rationales instead of moral and ethical ones.
Facebook announced three new products today: the 8-inch Portal Mini ($129) and 10-inch Portal ($179) — two picture frame–sized devices designed to sit on a countertop — and the Portal TV ($149), an accessory designed to sit on top of at-home televisions and let far-flung friends view Facebook Watch shows together. The devices include cameras and microphones designed specifically for video calling and have voice control via built-in Amazon Alexa software. As of today, Amazon Prime Video can also be streamed through Portal, alongside Spotify, Pandora, iHeartRadio, and other apps announced last year. Currently, Netflix and Hulu are not available through Portal or Portal TV.
Notably, the new devices have significantly lower prices than last year’s models, which ranged between $200 and $349. Facebook executives said the cuts are aimed at allowing more people to use Portal. “The most important thing for us is getting our experiences out there, and seeing how people react to them,” said Andrew Bosworth, vice president of augmented and virtual reality at Facebook, at a press event on Tuesday. “We’re not focused on the [Portal] business model right now.”
Aside from price, the other thing Facebook is emphasizing with these new products is a commitment to privacy. They ship them with camera covers and physical switches to turn off the camera and microphone. And to show you that the mic and camera are, indeed, off, a little light turns on — otherwise known as the universal sign that a device’s camera and microphone are also on.
This is something Facebook communicates on a marketing webpage with the headline “Privacy by Design”.
Facebook selling the new Portal for $129 — almost certainly less than what it costs — with @boztank casually admitting it has no business model yet is really something else.
As @ashleyrcarman has noted many times, the tech giants are so willing to lose money on hardware to lock into their services that the entire indie hardware market is being crushed. It’s why companies like Eero couldn’t stay independent.
A pattern for ad-supported tech giants is to encourage more user investment through time and data by offering services free-of-charge and selling cheap hardware, then cataloguing users’ behaviour to sell ads against. This is not a pattern that fits profitable companies that do not fund their operations through advertising and, so, have no need to exploit users, instead choosing to accept money in exchange for goods and services.
Year after year, the formula was this: I tested the most important new features of Apple’s latest smartphone and assessed whether they were useful. Assuming the newest iPhone worked well, my advice was generally the same — I recommended upgrading if you had owned your existing smartphone for two years.
But with this review of the iPhone 11, 11 Pro and 11 Pro Max — the newest models that Apple unveiled last week and which will become available this Friday — I’m encouraging a different approach. The bottom line? It’s time to reset our upgrade criteria.
I think this is a wise approach with purchasing anything: you should figure out if a newer version of the product will meaningfully advance how you use it, and whether those improvements are worth the cost to you based on their importance. Here’s where Chen lost me:
So here’s what I ultimately suggest: You should definitely upgrade if your current device is at least five years old. The iPhone 11 models are all a significant step up from those introduced in 2014. But for everyone else with smartphones from 2015 or later, there is no rush to buy. Instead, there is more mileage and value to be had out of the excellent smartphone you already own.
Chen has clarified that the improvements in the iPhone 11 and 11 Pro models are “nice to have, but [not] must have[s]” for owners of, say, an iPhone 6S. I think there are plenty of instances where one could have made a judgement like that, but this year seems like the worst possible one. To be fair, I have not used these phones. But every review I’ve read has extolled extraordinary advancements to camera quality — particularly in low-light situations &mdash and battery life in the 11 and 11 Pro. Those are two of the biggest things that people care about in a smartphone, along with having more storage.1
To be clear, I think Chen’s advice is generally sound. If you’re an iPhone user, Apple is making it completely viable to make your device last four or five years with its latest versions of iOS. But I think Chen undersells the advantages of having a battery that lasts far longer than even a brand new iPhone 6S, and far better photos in non-daylight conditions. I’m not convincing you to upgrade, especially since I haven’t used these devices, but I’m suggesting that these are massive improvements for any 6S owner that wants to take pictures in restaurants or in the evening, and doesn’t like having their phone die.
The iPhone 6S came in 16, 32, 64, and 128 GB configurations, while the iPhone 11 starts at 64 GB — so 6S owners are also likely getting a storage upgrade too. ↩︎
Our own devices distract us, others’ devices spy on us, social media companies poison public discourse, new wired objects violate our privacy, and all of this contributes to a general sense of runaway change careening beyond our control. No wonder there’s a tech backlash.
But, really, is there? There certainly has been talk of a backlash, for a couple of years now. Politicians have discussed regulating big tech companies more tightly. Fines have been issued, breakups called for. A tech press once dedicated almost exclusively to gadget lust and organizing conferences that trot out tech lords for the rest of us to worship has taken on a more critical tone; a drumbeat of exposés reveal ethically and legally dubious corporate behavior. Novels and movies paint a skeptical or even dystopian picture of where tech is taking us. We all know people who have theatrically quit this or that social media service, or announced digital sabbaticals. And, of course, everybody kvetches, all the time.
However, there is the matter of our actual behavior in the real-world marketplace. The evidence there suggests that, in fact, we love our devices as much as ever. There is no tech backlash.
Walker’s entire argument is predicated on the fact that despite numerous lawsuits, data breaches, widespread recognition of privacy violations, and antitrust investigations — all of which represent a radical shift in the way we think about technology companies from just a few years ago — consumer use has risen and, therefore, we are not reacting with our behaviour. It is a silly argument that masks misgivings held by the public at large.
An Edelman survey from earlier this year found that respondents in developed nations were weakly trusting of tech companies; it also found that respondents were generally capable of separating hardware manufacturers — which they generally trusted — from social media companies, which they did not. But we still use Facebook, Twitter, and YouTube to increasing degrees. We know they’re toxic to us and we know that they don’t give a shit about our privacy, so why do we do it?
Well, probably for similar reasons as we do lots of things that we know are terrible for us. We’ve known tobacco usage increases the likelihood of myriad diseases for decades, but the prevalence of smoking has not consistently declined. Likewise, we’ve known for years that our emissions are smothering the planet, but we keep on emitting at ever-greater rates. Our understanding that something is damaging does not necessarily mean that we will not continue our poor behaviour. After all, we still find that these risky choices are often at odds with how much value we get from these things. We emit more because we heat bigger homes, drive more fuel-thirsty cars, and want more clothes.1
Likewise, we want to send out potluck invitations without starting a gigantic “reply all” email thread, complain about the news in public, and watch goofy videos. We want to passively keep in touch with family, friends, and colleagues. We may even want to experiment with photography.
We’ve weighed all of these clearly- and immediately-tangible benefits against the more difficult question of what effects it will have for us to compromise our privacy to monopolistic tech companies, and many people hesitantly accepted those benefits often years ago. Disentangling your real social life from your electronic social life can be very difficult, especially if you’ve built up years of cruft. It’s a job unto itself.
Predictably, venture capital types have reacted to this article supportively, confident in the safety of their practice of growing the user base of bleeding-edge tech products2 and then slapping some surveillance-based ads on them. It’s easier to loudly dismiss public concerns about technology than it is to reform the business model of many of the biggest Silicon Valley firms raring for their IPO.
Meanwhile, public concern over technology is, indeed, far greater than it was not too long ago. Trust in Facebook dropped precipitously after the Cambridge Analytica scandal broke — and didn’t recover after a solid year of serious problems were reported — to the extent that Facebook is pretending to change its business model. Google also decided to become a company that ostensibly protects privacy. If these companies were confident that users didn’t see any problems with their services and business model, why would they feel the need to so aggressively tout their privacy credentials, no matter how weak?
Big tech companies with exploitative business practices are worried that their tainted reputation will overshadow our enthusiasm for the implicit progress of high technology. But you can’t quickly turn this billion-passenger ship around, especially when non-technical publications ignored the privacy and security risks of services like these for years.
We also fail to adequately regulate the biggest polluters, which are not consumers directly. ↩︎
If the product is software-based, it’s probably wedging itself into an everyday industry and stripping it of all regulation because “it’s just a platform”. If it’s hardware-based, it’s something that you own that does not presently have either WiFi or Bluetooth, and now has WiFi and Bluetooth. Fund me. ↩︎
On an earnings call in 2009, Tim Cook was asked how the company would fare when it inevitably lost Steve Jobs in the CEO post, and he responded by delivering a now-famous explanation of how he views Apple’s core values. It was, typically for Cook, an efficient and profound monologue that, among other statements, captured core truths for what sets the company apart:
[…] We believe that we need to own and control the primary technologies behind the products that we make […] We believe in deep collaboration and cross-pollination of our groups, which allow us to innovate in a way that others cannot.
I trimmed a fair bit of this, but these two statements complement each other beautifully. The tight integration of the company’s hardware and software — and the individual teams within those disciplines — have come to define the company’s key products: the Mac, iPod, iPhone, iPad, Watch, and AirPods. An arbitrary set of Bluetooth headphones cannot replicate the ease of pairing, connectivity, and device switching that Apple can achieve by building both the hardware and software sides of the AirPods.
Internet services have not been an exception to this, as they are universally better on Apple’s own platforms, but they have offered an opportunity to see what the company will offer on a cross-platform basis. iCloud — as with its MobileMe predecessor — has a Windows client; Apple Music is available for Android phones. The company is bringing the Apple TV Plus service to virtually every platform — including some television hardware. All of these services can be accessed through a web browser, too. But iMessage, Apple Arcade, and Apple News are all stubbornly constrained to products with an Apple logo on them.
And so is the Apple Card. Damon Beres of Medium’s OneZero publication sees all of these things — but particularly the card — as egregious examples of lock-in:
In fact, Apple’s most fascinating hardware release in ages arrived last month, a thin slab of titanium with accompanying software that — yes — you can use to order clothes while in the tub. The Apple Card connects to your iPhone’s Wallet app and can pop up as a default option whenever you use Apple Pay. It makes monitoring your finances kind of pleasant: A digital representation of the card is rendered on-screen and stained with colors (blue for transportation, orange for food, etc.) related to how you’re spending money. And the card, like so many other Apple products in recent years, has been developed not just to provide a good service to consumers but to increase the gravitational pull of the technology brand itself.
Others have certainly noted its major value to Apple: In being such an appealing payment option, and by only working with an iOS device, the Apple Card could be understood less as a typical credit card and more as a trojan horse. It will keep you in orbit around a Cupertino blackhole that sucks in cash for annual iPhone upgrades, new Apple TV+ shows, Apple Music, video games, MacBooks, and AirPods.
Throughout this piece, Beres seems to insist that Apple’s credit card is somehow stickier than that from any traditional financial institution, but I don’t think it is. It’s well-integrated throughout iOS, but so is any card that works with Apple Pay. You can use it with a new iPhone, of course, but it still works with any iPhone that has Apple Pay, all the way back to the iPhone 6. I guess it looks nicer than most credit cards, and the physical version is classy as hell. Is that really “lock in” in a way different from any credit card?
But Beres doesn’t stop at the Apple Card. This article points to all of Apple’s services — including TV Plus, which is, to reiterate, available on virtually all platforms independent of use or ownership of other Apple products or services — as evidence of a giant spinning lock-in machine.
Beres compares this to the approaches of other companies:
Any tech giant worth its salt is doing the same thing. Amazon may not have enough pull in the hardware game to make Prime streaming exclusive to something like the Fire TV Stick, but its Prime credit card, at least, will keep you shopping on Amazon, giving you 5% back on Amazon and Whole Foods purchases. And it has expanded its Alexa service to proprietary tablets, security cameras, and alarm clocks. If you’re into the Amazon Echo, there’s no way you’re going to switch to Facebook’s Portal, which itself hooks into a shared universe of messaging apps like WhatsApp and Messenger. Samsung is trying — and struggling — to establish a line of Galaxy products that tap into its Bixby A.I. Buying a gadget today is rarely a one-off choice; it’s an opportunity for a company to keep you on a platform.
Here’s where I have the most disagreement with Beres, and these arguments of Apple’s ostensibly severe lock-in more generally. I don’t think Apple’s products are necessarily sticky because of an ecosystem effect, but I do think the ecosystem becomes stronger as more users are retained. Apple routinely has one of the highest customer retention rates in the industry, and they regularly report some of the highest customer satisfaction rates. I wonder if there’s a correlation.
To compare this to the lock-in activities of other companies is at its most effective only at a shallow level. Apple’s stuff works better when it’s used in conjunction with other Apple things, of course, but if you want to stop using the company’s products and services, you can do that almost piecemeal or wholesale, if you wish. You cannot say the same about any other major technology company, as Kashmir Hill discovered earlier this year:
Critics of the big tech companies are often told, “If you don’t like the company, don’t use its products.” I did this experiment to find out if that is possible, and I found out that it’s not — with the exception of Apple.
These companies are unavoidable because they control internet infrastructure, online commerce, and information flows. Many of them specialize in tracking you around the web, whether you use their products or not. These companies started out selling books, offering search results, or showcasing college hotties, but they have expanded enormously and now touch almost every online interaction. These companies look a lot like modern monopolies.
No matter how powerful Apple seems to be, it is entirely possible to never use a product or service from them again. It is, I grant you, expensive and time-consuming to change your computer, phone, streaming music service, encrypted messaging platform, and anything else you use from them — your Apple News Plus subscription, I suppose — but it’s not out of the question. It is virtually impossible to stop interacting with non-Apple tech giants. You can’t escape Facebook, either, as their beacons and scripts keep track of you as you browse most popular websites. Google is trying to replace HTML with AMP, and is globally dominant in various horizontally- and vertically-integrated product categories. You can stop shopping at Amazon, but you’re not going to be able to rid yourself of the infrastructure of the modern internet. Apple’s power comes at a platform integration level; their competitors have absorbed themselves into the web and internet. If you wish to participate in the web today, you have little choice but to accept the use of — and tracking by — the services of Apple’s competitors.
That is, I think, true lock-in that makes Apple’s interconnected services, hardware, and accessories look comparatively banal.
One other thing in Beres’ piece I’d like to mention is this paragraph at the top:
Apple’s certainly something different now than it was even just a couple of years ago, when the iPhone X debuted with a notch and a dutifully frenzied press. Its keynote event on September 10, described by my colleague Will Oremus as its least interesting, cemented a new identity for a technology brand that no longer leans quite so much on surprising gadgets to make its name: improvements to the Apple Watch, iPad, and of course the iPhone were short of jaw-dropping. (The Apple Watch’s face is now always on — like, you know, a real watch — and the iPhone gained a third camera lens.)
This is a criticism that has been leveled at every Apple product launch that lacked a radically new hardware design language for the iPhone since the 3GS. In fact, even when there was new hardware, Apple was accused of playing it safe and boring. The iPad was known as “just a big iPod Touch” when it came out in 2010. For the past decade, analysts have called Apple’s products dull and uninspired, and the products have gone on to sell in unfathomably large numbers. Little has changed in that time except the ever-widening gulf in analyst expectation and customer reaction.
Uber and Lyft maintain that AB5 won’t immediately change independent contractors into employees. Tony West, Uber’s chief legal officer, said on a call with reporters that the bill builds on legal tests already established in California around how drivers should be classified. West said drivers may not necessarily fall under the new rules laid out in AB5.
“Under that three-part test, arguably the highest bar is that a company must prove that contractors are doing work ‘outside the usual course’ of its business,” West said. “Several previous rulings have found that drivers’ work is outside the usual course of Uber’s business, which is serving as a technology platform for several different types of digital marketplaces.”
That’s not the impression Uber gave in its S-1 filing (emphasis mine):
Our success in a given geographic market significantly depends on our ability to maintain or increase our network scale and liquidity in that geographic market by attracting Drivers, consumers, restaurants, shippers, and carriers to our platform. If Drivers choose not to offer their services through our platform, or elect to offer them through a competitor’s platform, we may lack a sufficient supply of Drivers to attract consumers and restaurants to our platform.
Too vague? How about the voiceover at the very beginning of their partner app tutorial?
Welcome to Uber. Drivers are our most important partners.
Background used to be a good app. You can tell from its early reviews that its users genuinely enjoyed browsing and making use of its hand-curated selection of iPhone wallpapers. In fact, its reviews are generally positive up until late June, when an update began causing some issues. From that point on it becomes clear that Background is no longer owned or updated by its original developer. It’s been flipped.
So how does an app get flipped? Read on to discover the ultimate secret to making millions on the iOS App Store.
I was one of those happy users of Background. I remember it always having an upsell component, but nothing as scummy as this. Subscription abuse is a part of the App Store I’d like to see Apple pay more attention to. For example, if an app experiences a sudden surge in subscribers compared to its history — and particularly after a change of ownership — perhaps that should set off a giant klaxon in Cupertino.
I haven’t done one of those posts for a while where I list off several notable things mentioned during and after today’s product announcements, so here goes. I feel like this announcement is perfect for that: major upgrades wrapped in modest refinements of last year’s tailoring. That’s something I can get behind: most people don’t upgrade year-over-year, and stretching a two-year upgrade cycle to three is just fine by me; but, if you were to upgrade from an iPhone XS or a Series 4 Apple Watch, you’ve still got a lot to look forward to.
Anyway, onto a list:
The rumour mill missed a lot this year. The always-on display of the Apple Watch wasn’t even rumoured. Nor was the new green colour for the Pro, or the camera combination in the iPhone 11, or the enormous battery life improvements across the board. Then there were the things that didn’t materialize: no new mute switches, Sleep Tracking on the Apple Watch, or the ability to wirelessly charge devices from the back of the new iPhones. The latter two are perhaps possible through software updates.
The Apple Watch is now being sold as an entirely customizable product from the point of purchase. Deirdre O’Brien showed off the retail store implementation what they’re calling the Apple Watch Studio, and it’s also available online.
When I bought my first Apple Watch, I thought this was how the buying experience would be. The table in the store had all of these bands laid out and you could swap whatever you wanted — with the assistance of a staff member, of course. But you couldn’t buy an arbitrary combination of watch and band. You could only buy a watch and then additional bands. I’m glad to see that’s changing, but I can’t imagine how difficult it must be at Apple’s scale.
The new U1 chip in the iPhone 11 line went unmentioned during the presentation, but it’s Apple’s implementation of ultra-wideband. Apple’s marketing webpage says that this will prioritize nearby devices for AirDrop, but it could also be used for the forthcoming item tracking beacon that also did not appear today, or the rumoured Walkie Talkie feature.
The iPhone 11 ships with a USB-A Lightning cable, while the 11 Pro includes a Lightning-to-USB-C cable and compact 18W wall adaptor. The now-perennial rumours of the iPhone’s impending switch to a USB-C connector have been greatly exaggerated.
Like last year, promotional photos that show the front of the phones feature a wallpaper that makes the notch visible on the base-model iPhone 11 and hides the notch on the iPhone 11 Pro. Most of the product photography seems to emphasize the camera bumps on each model, however, which reminds me of the iPhone 7 campaign.
These iPhones don’t have “iPhone” written on the back any more. There’s nothing on the back except the cameras and an Apple logo. It looks clean, but it’s hard to adjust to the centred logo when it’s been about a third of the way from the top for so long.
I can’t find it right now, but I remember an old piece of advice — possibly in the HIG — that said that items mathematically centred vertically tend to look like they’re lower than they are. The suggestion was that a visually vertically centred item typically needed about twice as much space below the item compared to the space above it.
Update: On page 184 of the 2003 edition of the HIG (PDF), Apple recommends visually centring application windows: “[the] distance from the bottom of the window to the top of the Dock (if it’s at the bottom of the screen) should be approximately twice the distance as that from the bottom of the menu bar to the top of the window.”
Federico Viticci says that iOS 13 will be available September 19, while 13.1 will be released just eleven days later. It sounds like iPads won’t get a x.0 release, only the iPadOS 13.1 update.
WatchOS 6 won’t be available until later this year for Series 1 and 2 models.
3D Touch has been wholly replaced by Haptic Touch. It’s likely that the requirements for the dynamic range of this display wouldn’t work with the additional screen layer required for 3D Touch. I bet it’s also easier to integrate an under-display Touch ID scanner without worrying about a 3D Touch layer.
You can get an Apple TV Plus subscription and an Apple Arcade subscription for the cost of an Apple News Plus subscription.
Ryan Broderick, Ryan Mac, and Logan McDonald, Buzzfeed News:
Photos and videos posted to private accounts on Instagram and Facebook aren’t as private as they might seem. They can be accessed, downloaded, and distributed publicly by friends and followers via a stupidly simple work-around.
The hack — which works on Instagram stories as well — requires only a rudimentary understanding of HTML and a browser. It can be done in a handful of clicks. A user simply inspects the images and videos that are being loaded on the page and then pulls out the source URL. This public URL can then be shared with people who are not logged in to Instagram or do not follow that private user.
If you have any familiarity with how the web works, you probably rolled your eyes while reading these paragraphs — I know I did. But despite my reservations about the way this is written — it reads like a parody of infosec reporting — I bet most people have no clue that it is trivial to get the address of any resource. Images need to be hosted somewhere, and protecting those addresses is often more difficult than necessary for social networks.1
The problem is not with the way that URLs work. The problem is that social networks continue to abuse the definition of the word “private”, thereby giving users a false sense of safety and secrecy with whatever they post there. Educating users is important, yes, but it is equally important for them to not be lied to by implying that flipping a single toggle switch is enough to make their pictures private to everyone except select users.2
Attempting to access an Apple Music .m4a file directly, for example, will result in an error. ↩︎
When search results were flooded with Apple apps, Apple executives said, the algorithm concluded that people were looking for a specific Apple app and decided to surface other apps by the same developer.
That wasn’t always to Apple’s benefit. For instance, they said, searching “office” returns a series of Microsoft apps because the algorithm recognizes they are looking for Microsoft Office tools.
Apple engineers said the algorithm believed people searching “music” wanted just Apple Music because users clicked on the Apple Music app so frequently. Apple Music had a distinct advantage over other apps: It comes preinstalled on iPhones. Apple said some people used the search engine to find apps that were already on their phones.
When people search “music,” the App Store reminds them that they already have Apple Music installed. Many people then click on the app, the engineers said, adding to its popularity in the eyes of the algorithm.
I think a big thing we’ll still be grappling with years from now was how we spent years uncritically absorbing content via recommendation engines and algorithms and how so many of the choices we thought were our own were really driven by this kind of stuff.
One notes that “your search algorithm favors your own products” is the core of almost every antitrust decision Google has lost.
A difference is that Google is actually very good at building search engines; Apple is not. It’s hard to give any company the benefit of the doubt when the facts of the case seem so straightforward, but it is completely plausible to me that the App Store would elevate Apple’s own apps purely because the search engine isn’t very good. That’s not an excuse — especially not when there is no other venue for iOS apps — but it’s believable.
The more I’ve thought about Apple’s statement regarding the iOS exploit chains discovered last week, the more bizarre it seems. In short, I do not understand why Apple felt it necessary to issue a news release at all, and I’ve no clue why this is the release they went with. Let’s start with the first paragraph:
Last week, Google published a blog about vulnerabilities that Apple fixed for iOS users in February. We’ve heard from customers who were concerned by some of the claims, and we want to make sure all of our customers have the facts.
Apple’s use of the word “blog” here seems pejorative — an insinuation that this multipart highly-technical explanation should be taken less seriously because of its publishing medium. Should Google have published this information in a book? Would it matter if the explanation were not hosted on Blogspot? I don’t think so, but Apple’s statement seems to imply that I should care.
The next two paragraphs need to be examined together:
First, the sophisticated attack was narrowly focused, not a broad-based exploit of iPhones “en masse” as described. The attack affected fewer than a dozen websites that focus on content related to the Uighur community. Regardless of the scale of the attack, we take the safety and security of all users extremely seriously.
Google’s post, issued six months after iOS patches were released, creates the false impression of “mass exploitation” to “monitor the private activities of entire populations in real time,” stoking fear among all iPhone users that their devices had been compromised. This was never the case.
Google’s explanation can be misread, but it is not wrong.
The iPhone is assumed to be the most secure consumer device on the planet — nothing revealed in the past week actually changes that. But because of its reputation and its widespread use by higher-value targets — celebrities, politicians, businesspersons, and the like — the market for iOS security breaches is booming. Exploits that require little to no user interaction and rely upon so-far-undisclosed vulnerabilities have long been associated with targeting specific users in a truly clandestine fashion.
The series of exploit chains Google wrote about are entirely different. They’re comprehensive — they span multiple major and minor versions of iOS. They’re targeted to surveil an entire persecuted group of people, which makes them far more exposed than specific user applications but not as indiscriminate as a computer virus. Make no mistake: this was an exploitation deployed “en masse”, exactly as Google says.
Apple’s acknowledgement that users would be exposed only if they visited one of “fewer than a dozen websites” is a little misleading as well. Those websites, Google estimates, served thousands of users per week.
Second, all evidence indicates that these website attacks were only operational for a brief period, roughly two months, not “two years” as Google implies. We fixed the vulnerabilities in question in February — working extremely quickly to resolve the issue just 10 days after we learned about it. When Google approached us, we were already in the process of fixing the exploited bugs.
Whether these websites were active for months or years seems to be confused by the context of Google’s explanation:
TAG was able to collect five separate, complete and unique iPhone exploit chains, covering almost every version from iOS 10 through to the latest version of iOS 12. This indicated a group making a sustained effort to hack the users of iPhones in certain communities over a period of at least two years.
The way this is written makes it sound like Google has extrapolated the time that these websites were operational from the version numbers of iOS. Apple doesn’t provide any source for their assertion that they were live for two months, other than “all evidence” — which, sure, but what evidence? Whatever it may be, it doesn’t seem to be available publicly.
The last paragraph is an acknowledgement that software security is a constant chase, and that neither the bugs nor the patches will stop. That’s fine; it’s probably the most straightforward paragraph in the entire release.
And that’s it — that’s the release in summary. The only new information in its five paragraphs is a slightly more accurate number of affected websites and the controversy of whether the attack was running for two months or two years. But those new details are not as relevant as the number of visitors who may have been affected, and making an estimate is still a fraught exercise. If we take the lowest possible figures that we can extrapolate from “thousands of visitors per week” (1,000), two months (or about nine weeks) of operations, mobile share of web browsing in China (about 60%) and Chinese iOS market share (about 20%), we’re left with maybe a thousand exploited iPhones.1
But, again, this is a not-particularly-useful estimate, and I won’t vouch for its accuracy. I put it out there only as a guess about how many devices may be affected by an authoritarian government’s relentless surveillance of Uyghurs worldwide. So, I return to my original question: why did Apple issue this statement?
As both Apple and Google acknowledge, these bugs were patched six months ago, so there is little ongoing customer risk from these websites. Neither company has disclosed which websites were spreading these exploit chains, however, so it’s impossible to say whether your iPhone is likely to be affected. Apple’s disputes seem to be about little more than language choices.
John Gruber points to a story by Thomas Brewster of Forbes as one possible reason. Google’s report only covered iOS vulnerabilities, but Brewster says that the same websites also distributed exploits for Windows and Android systems. The final paragraph in Apple’s statement seems to hint at this possibility:
[…] iOS security is unmatched because we take end-to-end responsibility for the security of our hardware and software. […]
I suppose that’s one possibility, but I’m not convinced.
An argument like Rhett Jones’ of Gizmodo also doesn’t seem quite right:
Cutting through the corporate-speak in that statement, it is important to acknowledge that the Project Zero crew does great work, and there’s no reason to believe that their work is motivated by malice. It’s also worth emphasizing that Apple’s reputation for making secure products has been earned by making secure products. What’s at issue here is who will have the best reputation for security in the future, and the answer is up for grabs.
I don’t see how Apple gains anything by pushing a nonsense statement on a Friday afternoon when they are preparing to unveil new iPhones, Apple Watches, and other devices on Tuesday. Their statement says nothing, but it does remind people of a reputational failure. Why not, instead, demonstrate a commitment to security during the product launch?
I am certain that Apple’s public relations people are much smarter than I am. I’m sure they have a reason for this release. I just can’t fathom what it is, nor can I understand why this is the statement they went with. If Apple did not want to engage with the troubling abuse of their platform to help surveil Uyghurs — and I think they should have, for what it’s worth, but I understand the economic risks of speaking up against the Chinese government — why not issue a succinct release solely about security? One that acknowledges Google’s findings, reminds users that these bugs are patched, reiterates the importance of software updates, and includes a commitment to maintaining device security. That explanation meaningfully helps reassure customers that apparently contacted Apple with concerns, even if the company can’t tell them the likelihood of their device being affected.
One cogent paragraph beats five mediocre ones most of the time, but demonstrating beats telling every single time.
While there are Uyghurs worldwide, the overwhelming majority live in China, so that is why I’ve used those figures for mobile browser usage and iOS market share. Again, this figure is a wildly inaccurate estimate, but it’s the closest I could come up with given public data. ↩︎
Last week, Google published a blog about vulnerabilities that Apple fixed for iOS users in February. We’ve heard from customers who were concerned by some of the claims, and we want to make sure all of our customers have the facts.
A blog is a collection of blog posts.
First, the sophisticated attack was narrowly focused, not a broad-based exploit of iPhones “en masse” as described. The attack affected fewer than a dozen websites that focus on content related to the Uighur community. Regardless of the scale of the attack, we take the safety and security of all users extremely seriously.
Google’s post, issued six months after iOS patches were released, creates the false impression of “mass exploitation” to “monitor the private activities of entire populations in real time,” stoking fear among all iPhone users that their devices had been compromised. This was never the case.
In the first couple of years of the iPhone’s availability, users simply needed to tap a link on a webpage to jailbreak their device. Even though it was an elegant solution, there was still a nagging feeling that this mechanism could be easily abused.
Apple patched the affected vulnerabilities, of course, but it is an ongoing battle — particularly with JavaScript engines that run far closer to the CPU and GPU than they used to.
As far as I know, nobody has yet published a list of the websites affected, but I imagine they’re highly targeted. That is, even though anyone could have accessed them, that doesn’t mean every iPhone user is equally vulnerable or a likely victim.
Update: Ryan Mac of Buzzfeed News reports that this attack campaign originated in China. Apple and Google have so far skirted that aspect of the story.
Update:Michael Tsai thoughtfully disputes Apple’s downplaying. Regardless of scale, I think Bruce Schneier explained very well the way in which these findings change how we think about zero-day vulnerabilities.
Today at IFA, Google is announcing a new feature for Google Assistant: Ambient Mode. On a few upcoming Android phones and tablets, this new mode will turn those devices into something like a Google Nest Hub (neé Google Home Hub) display when docked. It will show calendar info, weather, notifications, reminders, music controls, and smart home controls. Also like the Nest Hub smart display, it will automatically show a slideshow from your Google Photos account.
For its first couple of years on the market, the iPad could show a photo slideshow when it was docked. I’ve always been confused why this capability was removed in iOS 7 instead of being refined along similar lines to this Android feature.
I’m fascinated by this library of hundreds of books about and for the bartending profession. There are volumes in here dating back to the 1700s; there’s a book in the library containing the first printed martini recipe. The web viewer is pretty irritating, but all of the books can be downloaded as PDF documents. If you have a bit of a home bar, this is worth your time. (Via Metafilter.)
As first reported by TechCrunch and The Verge, Apple has launched a web-based version of its Music app as a public beta at beta.music.apple.com. The app looks and feels a lot like the Music app coming to Catalina later this fall. The two are so close in fact that it’s easy to confuse the two if they’re open at the same time, which I did almost immediately.
First impressions: Apple Music web client is a bit slow and laggy. But the UI layout is better optimised for the iPad screen size than the native Music app lol.
The Music app on the iPad should be a lot closer to iTunes or the new Music app on Catalina than it is; it’s one of my most disliked default iPad apps.
Camera sales are continuing to falling off a cliff. The latest data from the Camera & Imaging Products Association (CIPA) shows them in a swoon befitting a Bollywood roadside Romeo. All four big camera brands — Sony, Fuji, Canon, and Nikon — are reposting rapid declines. And it is not just the point and shoot cameras whose sales are collapsing. We also see sales of higher-end DSLR cameras stall. And — wait for it — even mirrorless cameras, which were supposed to be a panacea for all that ails the camera business, are heading south.
Of course, by aggressively introducing newer and newer cameras with marginal improvements, companies like Fuji and Sony are finding that they might have created a headache. There is now a substantial aftermarket for casual photographers looking to save money on the companies’ generation-old products. Even those who can afford to buy the big 60-100 megapixel cameras are pausing. After all, doing so also involves buying a beefier computer. (Hello Mac Pro, cheese grater edition!)
There’s never been a better time to get into photography by picking up a second-hand DSLR or mirrorless camera. You probably won’t find a full-frame professional-grade camera at a surprisingly good deal — the slight year-over-year improvements that Malik references mean that photographers can keep using years-old kit for much longer than they used to — but the used market is flooded with great mid-level cameras.
We’re introducing the new Galaxy Fold Premier Service to give you direct access to Samsung experts who can provide you tailored guidance and support over the phone any time, any day. This includes an optional one-on-one onboarding session to walk you through every innovation packed into the Galaxy Fold and demonstrate how best to navigate this revolutionary device.
The optimistic interpretation of this is that this is a premium product with a premium tech support experience. The more cynical read is that Samsung is still worried about the durability of the Galaxy Fold and hopes to put out any fires before they become public relations catastrophes.
What’s most striking is that a method of abusing the SMS-to-tweet system was published nearly a year ago, and Twitter appeared to do nothing at the time. It wasn’t until its CEO’s account was breached that the company made changes.
The regulator is investigating whether Google uses sensitive data, such as the race, health and political leanings of its users, to target ads. In his evidence, Johnny Ryan, chief policy officer of the niche web browser Brave, said he had discovered the secret web pages as he tried to monitor how his data were being traded on Google’s advertising exchange, the business formerly known as DoubleClick.
The exchange, now called Authorized Buyers, is the world’s largest real-time advertising auction house, selling display space on websites across the internet.
Mr Ryan found that Google had labelled him with an identifying tracker that it fed to third-party companies that logged on to a hidden web page. The page showed no content but had a unique address that linked it to Mr Ryan’s browsing activity.
Johnny Ryan of Brave explained the “hidden web pages” in more detail:
Google Push Pages are served from a Google domain (https://pagead2.googlesyndication.com) and all have the same name, “cookie_push.html”. Each Push Page is made distinctive by a code of almost two thousand characters, which Google adds at the end to uniquely identify the person that Google is sharing information about. This, combined with other cookies supplied by Google, allows companies to pseudonymously identify the person in circumstances where this would not otherwise be possible.
All companies that Google invites to access a Push Page receive the same identifier for the person being profiled. This “google_push” identifier allows them to cross-reference their profiles of the person, and they can then trade profile data with each other.
The Push Pages are not shown to the person visiting a web page, and will display no content if accessed directly.
A cursory web search turns up an article by Nic Jansma about ResourceTiming that references cookie_push.html in the context of cross-frame communication. It also references a Facebook script, another Google page, and similar blank-appearing pages from Twitter and Criteo — all of which appear to be for frame-bypassing tracking purposes. I’d love to know if any of these other companies are also passing uniquely-identifying characteristics to third parties through similar means.
As a result, Google has apparently decided to defend its business model on two fronts. First, it’s continuing to argue that third-party cookies are actually fine, and companies like Apple and Mozilla who would restrict trackers’ access to user data will end up harming user privacy. This argument is absurd. But unfortunately, as long as Chrome remains the most popular browser in the world, Google will be able to single-handedly dictate whether cookies remain a viable option for tracking most users.
At the same time, Google seems to be hedging its bets. The “Privacy Sandbox” proposals for conversion measurement, FLoC, and PIGIN are each aimed at replacing one of the existing ways that third-party cookies are used for targeted ads. Google is brainstorming ways to continue serving targeted ads in a post-third-party-cookie world. If cookies go the way of the pop-up ad, Google’s targeting business will continue as usual.
I would love a world in which the biggest privacy offenders have figured out that their business model is fundamentally objectionable and are radically transformed to become privacy leaders instead. I’m not a cynic, but I believe that hoping for that is unearned optimism. Even something as simple as building lightweight webpages is a twisted attempt at control over the web. Google is a skeevy advertising company masquerading as a purveyor of high technology.
Caroline O’Donovan and Ken Bensinger, Buzzfeed News:
The super-pressurized, chaotic atmosphere leading up to that tragedy was hardly unique to Inpax, to Chicago, or to the holiday crunch. Amazon is the biggest retailer on the planet — with customers in 180 countries — and in its relentless bid to offer ever-faster delivery at ever-lower costs, it has built a national delivery system from the ground up. In under six years, Amazon has created a sprawling, decentralized network of thousands of vans operating in and around nearly every major metropolitan area in the country, dropping nearly 5 million packages on America’s doorsteps seven days a week.
[…]
UPS and FedEx, the traditional powers of the logistics world, are deeply invested in safety. UPS, which spends $175 million a year on safety training alone, even has a policy prohibiting drivers from taking unnecessary left turns to reduce exposure to oncoming traffic, finish routes faster, and save fuel. Both firms are also heavily regulated by the government, and many of their trucks are subject to regular federal safety inspections and can be put out of service at any time by the Department of Transportation.
But Amazon’s ingenious system has allowed it to avoid that kind of scrutiny. There is no public listing of which firms are part of its delivery network, and the ubiquitous cargo vans their drivers use are not subject to DOT oversight. But by interviewing drivers as well as reviewing job boards, classified listings, online forums, lawsuits, and media reports, BuzzFeed News identified at least 250 companies that appear to work or have worked as contracted delivery providers for Amazon. The company said it has enabled the creation of at least 200 new delivery firms in the past year, a third of which are owned and run by military veterans. Inpax gets fully 70% of its business from Amazon; some companies depend on the retail giant for all of their income.
The 250 “last mile” delivery companies Buzzfeed found aren’t exactly competitors to UPS or FedEx — even though I bet plenty of people would wish for more competition in that space. Often, they’re couriers working in tandem with heavyweight logistics companies. FedEx might get the parcel across the country, for example, but will have one of these smaller companies bring the product from a warehouse to a customer’s home. And there are hundreds of these courier companies operating with little regulation, high demand, and core dependency on Amazon.
Among the characteristics that distinguish this era of enormously powerful technology companies: increasing the layers of abstraction between companies and their infrastructure; promising consumers more and relying on already-squeezed contractors, thereby exploiting their services; and celebrating their contractors’ successes as their own while deferring responsibility for any mistakes or problems.
Earlier this week, Zach Whittaker of TechCrunch reported that the complex series of exploits used to plant malware on iPhones was an attempt to infect the phones of Uyghurs — presumably by the Chinese government.
The unprecedented attack on Apple iPhones revealed by Google this week was broader than first thought. Multiple sources with knowledge of the situation said that Google’s own Android operating system and Microsoft Windows PCs were also targeted in a campaign that sought to infect the computers and smartphones of the Uighur ethnic group in China. That community has long been targeted by the Chinese government, in particular in the Xinjiang region, where surveillance is pervasive.
[…]
Google hadn’t provided comment at the time of publication. It’s unclear if Google knew or disclosed that the sites were also targeting other operating systems. One source familiar with the hacks claimed Google had only seen iOS exploits being served from the sites.
This must be one of the most expansive known surveillance campaigns in the post-Snowden era, and certainly the most brazen. It doesn’t target communications in transit; because many messaging platforms employ at least some form of encryption, the contents of messages must be captured at either the source or destination. That makes devices themselves much higher value targets and more active participants in spying.
The official Twitter account of Jack Dorsey, the co-founder of the social media platform, was hacked on Friday.
One of the first tweets sent from his “compromised” account was the N-word. Another, sent minutes later, praised Hitler.
More than a dozen racist or otherwise offensive original tweets were sent within 20 minutes from the account.
It would be pretty terrifying if there were a world leader that used their Twitter account as a primary means of broadcasting barely-literate official announcements, racist commentary, and off-the-cuff nonsense that swings markets worldwide.
The genres of TikTok become quickly apparent to anyone who spends upwards of 30 minutes scrolling on the app. In many ways, it’s just a regurgitation of what already works: prank videos, funny skits, a few lingering lip-sync efforts, still holding on to what the app used to be.
But Cinematic TikToks have arrived somewhat rapidly, tapping into the innate pop culture knowledge of teenagers everywhere. They are a generation that has spent years with access to every piece of content imaginable. That has left a mark, one they farm within themselves to create content that often even they can’t explain. It’s a feeling, it’s a vibe. It reminds them of someone else’s work, or a movie they saw. They don’t know what to call it. It just is.
It’s been said before, but TikTok is very much the spiritual successor to Vine. It’s fascinating to see the creative output encouraged by the thirty second maximum video length.
