Month: April 2020

Joanna Stern of the Wall Street Journal compared the webcam in the 2020 MacBook Air with the one in her ten year old MacBook Pro, a Dell model, and a Microsoft Surface. They’re pretty much universally bad — especially when compared against a smartphone’s front-facing camera.

Dan Moren, Six Colors:

But here’s the thing: it’s not just the MacBook Air. The 13-inch and newly released 16-inch MacBook Pro both have a 720p camera, which is probably the exact same part. The tech specs for the 5K iMac say it has a “FaceTime HD camera” and don’t specify the resolution, but it says the same about the 2017 5K iMac I’m using, which definitely has a 720p camera. In fact, only one Mac has a webcam better than 720p—the 2017 iMac Pro, which has a 1080p camera.

It’s a bit embarrassing when compared with the 4K camera in an iPhone 11, but I would be completely fine with a 720p webcam if it were a good webcam in every other regard. But it isn’t even close to acceptable.

My desk is positioned right underneath a north-facing window, giving the camera on the front of my iMac the best possible chance with bright but indirect light. Yet my face is nearly always overexposed, the focus is iffy, the image is grainy, and the colours are not right. It isn’t a problem with the camera in this iMac, specifically, because I have the same kinds of issues with my 2012 MacBook Air — and it isn’t a problem with the room because I’ve used that MacBook Air in lots of places and it has never looked great.

The lid of a modern Mac laptop is surely too thin to support the same kind of optics and sensor that are used in the iPhone, but surely the camera could be better than it is. To be fair, the camera in my iMac does look better than the one in my partner’s 2018 MacBook Air. But all of these cameras are simply checking a box right now: yes, the new Mac you are buying has a built-in webcam, and be thankful it’s not the one Dell uses.

This is a fun piece by Jack Ivers about the development of the early iPhone app GuitarToolkit and its successor, TabToolkit, including a bunch of developer relations behind-the-scenes stuff. It brings me right back to a time when there was optimism but perhaps less certainty about the App Store. Now, the App Store just is.

Mike Masnick, Techdirt:

Given that, it’s a bit difficult to take him seriously when he claims that all along he always said to listen to your public officials, when just a few weeks ago he was mocking them. Indeed, as multiple people have pointed out, the issue here isn’t so much that Pinsky was wrong — in the early days, when there wasn’t as much info, lots of people got things wrong about COVID-19 (though Pinsky kept it up way way after most others recognized how serious it was), but that he acted so totally sure about his opinions that this was nothing to worry about. It was the certainty with which he said what he said that was so much of the problem, including deep into it already being a pandemic with local officials warning people to stay home.

But, even worse, just as he was doing the right thing and mostly apologizing… he was trying to hide those earlier clips that made him look so, so, so bad. His organization began sending out DMCA notices.

Only the most fragile jackass tries to suppress criticism by abusing copyright law.

Jen Fitzpatrick and Karen DeSalvo of Google:

Starting today we’re publishing an early release of our COVID-19 Community Mobility Reports to provide insights into what has changed in response to work from home, shelter in place, and other policies aimed at flattening the curve of this pandemic. These reports have been developed to be helpful while adhering to our stringent privacy protocols and policies

The reports use aggregated, anonymized data to chart movement trends over time by geography, across different high-level categories of places such as retail and recreation, groceries and pharmacies, parks, transit stations, workplaces, and residential. We’ll show trends over several weeks, with the most recent information representing 48-to-72 hours prior. While we display a percentage point increase or decrease in visits, we do not share the absolute number of visits. To protect people’s privacy, no personally identifiable information, like an individual’s location, contacts or movement, is made available at any point.

Kate Cox, Ars Technica:

To make the reports, Google used location data from any account that has opted into allowing Google to store location history. The company’s services have billions of active daily users, so even if only a minority of users allowed location use, it would still create an enormous data set. Google broke down locations into six broad categories: Retail and recreation, such as malls, restaurants, and museums; grocery and pharmacy, which includes farmer’s markets and food warehouses along with supermarkets and drugstores; parks, including local, national, and state parks; transit stations; workplaces; and residential.

It’s unsurprising that Google has such a vast data trove to put together these reports, but we’re also seeing ad tech companies, anonymous outside of very specific industries, come out of the woodwork to offer their own assessments.

Much as I continue to be concerned about the privacy implications of this, I think it’s worth using our existing mass surveillance infrastructure to figure out how to resolve this pandemic. After that, let’s fix the catastrophic policies that have allowed so many shady companies to track us to such an extent without our permission.

Dieter Bohn, the Verge:

Anyway, you can suss out the outlines of the deal that was struck. Amazon gets buy buttons inside its app for current Prime Video subscribers, Apple gets Amazon’s complete and total participation in the Apple TV features it cares about the most. Instead of just being yet another icon in the home screen grid, Amazon’s services are now deeply integrated into the user experiences Apple wants to move everybody towards.

[…]

All of the above is why I’m comfortable saying that Amazon had leverage on Apple: Apple has clear incentives in the form of getting more participation in the Apple TV app and in getting a cut on the new subscribers it drives to Amazon. Amazon has the incentive of not paying more money to Apple.

Most of all, you can tell it’s about leverage simply because the Amazon Kindle app hasn’t changed. You can’t buy a Kindle book directly in the Kindle app, nor is Amazon even allowed to link to or even hint at the possibility that it has a whole damn Kindle store on its website where you can make one-click purchases.

The shrewdest quality of this deal is that it allows Amazon to exclude some of its in-app purchases from Apple’s usual cut while incentivizing people to more fully embrace Apple’s ecosystem.

The more I think about this, the more I think Apple comes out on top: in exchange for foregoing a cut of some of the occasional purchases made by Prime Video users, Apple gets a piece of subscriptions started through the Prime Video app, and users more fully embrace the Apple TV app. It’s great for users, too, as it results in a better experience.

But it is an unfair deal when compared to the typical App Store requirements. It is still undocumented and not available to everyone — even other providers of “premium subscription video entertainment”.

Arundhati Roy, writing in the Financial Times:

But unlike the flow of capital, this virus seeks proliferation, not profit, and has, therefore, inadvertently, to some extent, reversed the direction of the flow. It has mocked immigration controls, biometrics, digital surveillance and every other kind of data analytics, and struck hardest — thus far — in the richest, most powerful nations of the world, bringing the engine of capitalism to a juddering halt. Temporarily perhaps, but at least long enough for us to examine its parts, make an assessment and decide whether we want to help fix it, or look for a better engine.

[…]

Whatever it is, coronavirus has made the mighty kneel and brought the world to a halt like nothing else could. Our minds are still racing back and forth, longing for a return to “normality”, trying to stitch our future to our past and refusing to acknowledge the rupture. But the rupture exists. And in the midst of this terrible despair, it offers us a chance to rethink the doomsday machine we have built for ourselves. Nothing could be worse than a return to normality.

Historically, pandemics have forced humans to break with the past and imagine their world anew. This one is no different. It is a portal, a gateway between one world and the next.

There are two clear lessons I hope we draw from this situation that, months ago, I would find unfathomable. The first is that we desperately need competent, transparent, and humble leadership at all levels. I feel somewhat lucky in that respect, but not entirely so; I understand that not everyone is so fortunate.

The second lesson that we should learn is that we need to care for the wellbeing of one another long before we are forced to do so. It should be abundantly clear that even small vulnerabilities are exacerbated when they are tested.

The “normal” that I hope we return to is one in which we are once again free to travel, gather as friends, go to shows, eat and drink at new restaurants and bars, and spend more time together. But that should not mean going back to underpaying people in positions that have always been vital; we should not underestimate the strengthening qualities of good governance, public research, and civil service.

Contrast this list compiled by Glenn Fleishman at TidBits against the statement by Zoom’s CEO posted earlier this week:

Let me put it bluntly: Zoom is sloppy. Evidence of this began to accumulate last year with a screw-up discovered in mid-2019 that exposed macOS users to significant privacy exposure: your video camera could have been activated by visiting a page that loaded a malicious link. The problematic disclosures have accelerated since January 2020 with a series of errors in judgment and programming flaws. Zoom may have a top-notch technical solution and user experience, but the company deserves to take its knocks for sloppy and negligent programming.

Zoom also has made poor privacy decisions, some of which have already been remediated, by positioning itself more like a marketing firm than one that provides personal, academic, and business services over which we conduct private, confidential, or secret conversations.

Zoom founder and CEO Eric Yuan:

First, some background: our platform was built primarily for enterprise customers – large institutions with full IT support. These range from the world’s largest financial services companies to leading telecommunications providers, government agencies, universities, healthcare organizations, and telemedicine practices. Thousands of enterprises around the world have done exhaustive security reviews of our user, network, and data center layers and confidently selected Zoom for complete deployment.

However, we did not design the product with the foresight that, in a matter of weeks, every person in the world would suddenly be working, studying, and socializing from home. We now have a much broader set of users who are utilizing our product in a myriad of unexpected ways, presenting us with challenges we did not anticipate when the platform was conceived.

Did those “exhaustive security reviews” turn up any of the engrained problems with Zoom’s infrastructure? If so, is there a reason Zoom was picked over its competitors? In light of recent disclosures, do you think any big enterprises, government agencies, and financial companies are reconsidering their choice of Zoom?

It’s right to more heavily scrutinize Zoom as it plays a pivotal role in our self-isolated current state of affairs. But what are the alternatives? Fleishman compiled those, too, but even he acknowledged at the time that it “has emerged as the clear winner for large groups”. Competing options can be pricey — particularly for underfunded organizations like charities and schools. Most of these tools are also designed for businesses; they may not work as well as Zoom in a classroom context. It is critically important that Zoom gets this right, or security professionals are going to increasingly recommend that it be avoided entirely.

Leah Finnegan, the now-former executive editor at the Outline:

farewell @outline. we have all been laid off.

Rachel Hawley:

I cannot possibly stress how much The Outline changed the trajectory of my life. They were the first place to publish my writing. They were one of the last bastions of the off-the-wall mix of content that the Internet was made for. This is a huge loss.

Paul Blest, writing at Discourse:

This year, the coronavirus is going to join forces with longstanding, structural problems in the journalism business to wreck so many of the best websites and papers we read. Alt-weeklies, already dying, are going to be on life support by the end of this. Even the websites and papers that survive are going to be hit hard.

The Outline should be remembered as more than just an early casualty of the reckoning we’re about to face. I’m going to miss The Outline for selfish reasons; it gave my friends money, and it gave me money, and it gave writers I’d never heard of and now regularly read money, and now there’s one fewer website in the world that’s willing to give us money.

But I’m also going to miss it because, as Darren Rovell would say, the content was tremendous. The Outline was more than a survivor; it was a good website.

The Outline is one of those websites that I loved to the extent that it frustrated me on a nearly daily basis. It was a sort of extant limb of Gawker — another website that irritated as much as it delighted. But it was always for a good reason: these websites explored topics you might not expect from angles you would not see anywhere else. Sometimes, those angles were brilliant; other times, they made me roll my eyes. But the web is less good when it lacks venues for trying new, weird, earnest, and honest things. That, alone, is commendable. The Outline will be missed.

Eric Yuan, CEO of Zoom:

For the past several weeks, supporting this influx of users has been a tremendous undertaking and our sole focus. We have strived to provide you with uninterrupted service and the same user-friendly experience that has made Zoom the video-conferencing platform of choice for enterprises around the world, while also ensuring platform safety, privacy, and security. However, we recognize that we have fallen short of the community’s – and our own – privacy and security expectations. For that, I am deeply sorry, and I want to share what we are doing about it.

[…]

Over the next 90 days, we are committed to dedicating the resources needed to better identify, address, and fix issues proactively. We are also committed to being transparent throughout this process. We want to do what it takes to maintain your trust. This includes:

  • Enacting a feature freeze, effectively immediately, and shifting all our engineering resources to focus on our biggest trust, safety, and privacy issues.

I think this is a generally well-written, meaningful apology. The CEO of Zoom clearly feels awful about a week of previously undisclosed security and privacy vulnerabilities coming to the fore, and has a plan to address them. That’s promising.

But there’s still an air of defensiveness about this post. For example:

First, some background: our platform was built primarily for enterprise customers – large institutions with full IT support. These range from the world’s largest financial services companies to leading telecommunications providers, government agencies, universities, healthcare organizations, and telemedicine practices. Thousands of enterprises around the world have done exhaustive security reviews of our user, network, and data center layers and confidently selected Zoom for complete deployment.

However, we did not design the product with the foresight that, in a matter of weeks, every person in the world would suddenly be working, studying, and socializing from home. We now have a much broader set of users who are utilizing our product in a myriad of unexpected ways, presenting us with challenges we did not anticipate when the platform was conceived.

According to Yuan, Zoom’s call volume grew by twenty times in just a couple of months. It is understandable that some features, like its LinkedIn integration, do not translate well to non-enterprise contexts. But Zoom’s bigger problems — its false claims of end-to-end encryption, its malware-like installer, the webcam security problem exposed last year, and its vulnerability to malicious links — have nothing to do with Zoom’s scale. They are technical debts incurred by years of sloppy work.

Thomas Brewster, Forbes:

Towards the end of March, three of the American government’s key coronavirus response organizations spent a collective $1.3 million on videoconferencing tech from Zoom, a Forbes review of government contracts has found. That was despite widespread criticism of the app’s privacy and security.

The orders – from Centers for Disease Control and Prevention (CDC), the Federal Emergency Management Agency (FEMA) and the National Institutes of Health (NIH) – were all made in just a few days from March 23 to 26. They ranged in cost, the highest being $750,000, which the CDC ordered for hosting webinars on COVID-19. FEMA spent $320,000 on 1,500 Zoom software licenses, whilst CDC spent another $160,000 on Zoom webinar tech. An NIH contract at $90,000 also specified some Zoom licenses. They weren’t delivered directly by Zoom, but by partner government contractors CDW Government and Carahsoft Technology.

I am glad that Zoom is serious about addressing these flaws anyhow, but particularly so after learning that it is being used by these government agencies.

John Gruber dug into yesterday’s confusing Amazon Prime Video situation and, predictably, has created the most comprehensive explanation I’ve seen yet:

Why would Apple agree to this? Financially, Apple now gets a cut of some Prime Video rentals and purchases, and a recurring cut of new Prime Video subscriptions made in-app. And Apple TV users get all the benefits from the Prime Video app supporting AirPlay 2, universal search, and integration with the TV app that Apple is trying to make the default interface for watching shows and movies. Prior to this deal, Apple made nothing from Prime Video — it was a free app with no in-app purchases, and there was no way to subscribe to Prime Video through iTunes.

[…]

It’s a win for Apple, a win for Amazon, and a win for users in the Apple TV ecosystem.

It does seem like an all-around win. However, the question remains why this policy is something that is seemingly only available through channels not generally available to providers of comparable services, and why it so far seems to apply to just three service providers.

Nick Statt, the Verge:

Amazon’s Prime Video iOS and Apple TV apps now let customers make in-app purchases, including renting and buying films and TV shows. The change marks a huge shift in Amazon’s approach to the App Store, which mandates a 30 percent cut on all in-app purchases. Prior to the change, Amazon would not allow you to rent or buy content on the Prime Video app, instead, directing users to a web browser to avoid the App Store fee.

Now, when users log in to the Prime Video app, there should be a message reading, “Browse, rent, or buy new release movies, popular TV shows, and more — now within the app.” (Big thanks to George Watson, who tipped us off to this change.)

Ryan Jones:

Amazon Prime Video now avoids Apple’s payment system and ostensibly the 30% fee. You pay directly to Amazon.

Change was made server-side without an app update. This is huge news either way.

Guilherme Rambo:

The Prime Video app has a special “com.apple.storekit.request-data” entitlement. This reminds me of the “requestData” property on SKPayment, which has been “Reserved for future use” for a long time. Hmmmm…

Rambo isn’t kidding — that property has been around since iOS 3.

Apple’s statement, as posted by Benjamin Mayo:

Apple has an established program for premium subscription video entertainment providers to offer a variety of customer benefits — including integration with the Apple TV app, AirPlay 2 support, tvOS apps, universal search, Siri support and, where applicable, single or zero sign-on. On qualifying premium video entertainment apps such as Prime Video, Altice One and Canal+, customers have the option to buy or rent movies and TV shows using the payment method tied to their existing video subscription.

This is bizarre, undocumented, and, as far as I can figure out, has never previously been acknowledged.

Apple’s statement does not seem to fully reflect exactly what is going on here. The features described as being part of an “established program for premium subscription video entertainment providers” — a phrase that, I think, needs more words — do not appear to be unique to apps that are allowed to bypass Apple’s in-app purchase mechanism. The Netflix app on tvOS, for instance, is part of universal search; CBC’s Gem app integrates with the Apple TV app but uses standard iOS in-app purchases, not its own. So those “benefits” are not unique to the listed apps: Prime Video, Altice One, and Canal+.

What does appear to be entirely unique to those apps is that they are allowed to bypass Apple’s in-app purchase regime, contrary to the App Store rules:

If you want to unlock features or functionality within your app, (by way of example: subscriptions, in-game currencies, game levels, access to premium content, or unlocking a full version), you must use in-app purchase. Apps may not use their own mechanisms to unlock content or functionality, such as license keys, augmented reality markers, QR codes, etc. Apps and their metadata may not include buttons, external links, or other calls to action that direct customers to purchasing mechanisms other than in-app purchase.

Why is Amazon Prime Video allowed to use a non-Apple payment method for its movie purchases and rentals, but not for subscriptions? Why is this entirely undocumented? Why did it take until today to enable this for Amazon Prime Video, and not something that has been available all along for the app?

Most of all, why has this notoriously immutable App Store rule turned out to be something that can be bypassed, if only by an invitation offered to a few apps?

Update: Apple provided a slightly different statement to the Verge stating that this new policy only applies to individual purchases, not subscriptions. No clarification was provided on how a developer would go about joining this program, though it seems like the “benefits” that Apple described in its statement — AirPlay support, universal search, and the like — are something a developer has to agree to integrate in order to get this special entitlement.