Hello Weather 

My thanks to Hello Weather for sponsoring last week at DF. Regular readers know that I am an inveterate aficionado of weather apps. I’m not really much of a meteorology nerd, but I’m a pedestrian in a city with widely varying seasons. But even more so, I find weather apps to be a true playground for UI design and the presentation of quantitative information. Different weather apps take very different approaches, and I find the differences fascinating.

I first recommended Hello Weather back in 2021, and it’s been in my regular rotation of weather apps ever since. Back at the beginning of summer when they booked the sponsorship for this week, I started using the new version 4.0 (now up to 4.1.4) as my daily driver. I love it. It even has one of my favorite features for hot humid summers — a preference to set “feels like” as the primary temperature display (including in places like widgets). Hello Weather remains, as ever, attractive and useful in its design. And it offers everything you want in an iOS weather app: widgets for the home screen and Lock Screen, a Watch app, notification options (precipitation, severe storms, morning/evening forecast reports), and, wow, a veritable slew of forecast data providers to choose from.

Hello Weather’s privacy story is perfect: they collect zero user data, have no tracking or ads, and their privacy policy is written by humans for humans.

I highly recommend you download Hello Weather and start a 7-day free trial.

Substack Raised Another $100 Million, Which, I Bet, Is Already Being Flushed Down the Same Toilet as Their First $100 Million

Sunday, 3 August 2025

One last post on my recent Substack kick. Yesterday I linked to Ana Marie Cox’s scathing analysis of Substack’s financials. She published that on June 23, and wrote about Substack’s $100 million funding round, with a $1 billion valuation, in the future tense. Substack indeed closed that round in mid July, raising $100 million, with a valuation of $1.1 billion. After which their triumvirate of cofounders sat for an apparently brief “interview” with Benjamin Mullin and Jessica Testa of The New York Times:

Substack’s business model is simple: Users subscribe to follow creators on the platform, and the company takes a 10 percent cut of the revenue when those creators charge for a newsletter subscription or access to a podcast. That approach initially made Substack a writer’s haven, resulting in more than five million paid subscriptions and a stable of publishers, including the short story master George Saunders, the historian Heather Cox Richardson and an exodus of journalists from traditional newsrooms.

But the latest investors are betting on an emerging product that could amplify its business. Substack’s app, introduced in 2022, allows users to chat with their favorite creators, watch live video conversations and write and share posts on their own feeds through Notes, a feature similar to X or Bluesky.

If their business model were actually as simple as described, they’d already be profitable and wouldn’t have needed to raise another $100 million. They’ve already got a lot of subscribers. They’ve already got a stable of high-profile writers. They already keep 10 percent of what subscribers pay. And pointing to Twitter/X as the future model doesn’t exactly say “Well that’s the path to enormous profits.”

The sharp increase in Substack’s valuation — nearly 70 percent higher than its 2021 valuation of $650 million — is a validation of that strategy from Substack’s investors.

Or, this could be like when a guy who just lost every dollar in his pocket playing blackjack withdraws a few more grand from the ATM in the casino. That doesn’t “validate the strategy”. What would validate Substack’s strategy is showing proof of actual profits and profitable growth. And if they had actual profits and profitable growth they wouldn’t have needed to raise another $100 million.

“The network is growing,” Mr. McKenzie said. “We’re in this new phase where people can come to Substack and not just publish, but also find new audiences and find new opportunity.” The company today is more interested in taking on YouTube than MailChimp.

This, to me, is the nut graf of the whole NYT piece. Substack since its debut has presented itself as a platform for writers to build publications for readers. That’s how everyone I know who would endorse Substack would describe it. Hamish McKenzie, the cofounder quoted here, proudly claims the job title “Chief Writing Officer”. Does a company “more interested in taking on YouTube than MailChimp [sic]” sound like a company focused on writers as talent and readers as users to you? (And it’s a little thing, but Mailchimp doesn’t style their name camel-case. You’ll be unsurprised to be reminded that The New York Times dismantled its previously crackerjack copy desk in 2017.)

Now let’s do some rough back-of-the-envelope math. The New York Times Company has a market cap of $8.5 billion. Just gut-feeling-wise, I do not think Substack is worth one-eighth of the Times, nor do I think they’re on a path to get there. The Times has around 11 million digital subscribers who all pay around $25–35/month, and a strong advertising business. Individual Substack publications tend to charge around $5–7/month, and Substack only gets 10 percent of that. So Substack only pockets like 50–70 cents per month from subscribers, per publication. (Substack’s 10 percent commission, again, is pretty high compared to competing platforms.) Substack currently has no advertising business at all, and many of their writers publish with them specifically because Substack, as we know it, has no ads.

I firmly believe one could build a very nice business taking 10 percent of subscription revenue for a blogging/newsletter platform, if you could get as nice a roster of popular writers to build on the platform as Substack has. I do not think that’s a $1 billion business, though. And if it were, they should, at this point, be able to get there on their own, without additional funding. They should have achieved profitability lift-off long ago.

But what do I know, other than running a profitable independent website for the last 20 or so years? 

Sunday, 3 August 2025

How to Leave Substack 

Simple single-page website with (a) reasons to leave Substack; (b) links to comprehensive step-by-step instructions for how to move to other platforms, such as Ghost, Buttondown, and Beehiiv; and (c) links to several popular publications that moved and are glad they did.

Google Reverses Course, Will Keep goo.gl Links Redirecting 

Google:

While we previously announced discontinuing support for all goo.gl URLs after August 25, 2025, we’ve adjusted our approach in order to preserve actively used links. We understand these links are embedded in countless documents, videos, posts and more, and we appreciate the input received.

Nine months ago, we redirected URLs that showed no activity in late 2024 to a message specifying that the link would be deactivated in August, and these are the only links targeted to be deactivated. If you get a message that states, “This link will no longer work in the near future”, the link won’t work after August 25 and we recommend transitioning to another URL shortener if you haven’t already.

All other goo.gl links will be preserved and will continue to function as normal. To check if your link will be retained, visit the link today. If your link redirects you without a message, it will continue to work.

Nice!

The Substack Branding and Faux Prestige Trap

Saturday, 2 August 2025

Among the handful of oft-discussed problems with Substack:

  • Their 90/10 subscription revenue split isn’t usurious, but it’s high compared to competing platforms — especially once you reach an even mid-tier level of popularity.
  • The only way this independent publishing game works, by any credible definition of “the long run”, is to build your own audience. Substack has indies convinced that they build an audience for you through some sort of secret-sauce network effects, but I’ve seen no evidence that’s true. Writers with established reputations and readerships joining Substack are helping build Substack’s brand, not their own.
  • The whole, you know, Nazi thing.

Less commented upon but just as bad is the branding trap. Substack is a damn good name. It looks good, it sounds good. It’s short and crisp and unique. But now they’ve gotten people to call publications on Substack not “blogs” or “newsletters” but “substacks”. Don’t call them that. And as I griped back in December, even the way almost all Substack publications look is deliberately, if subtly, Substack-branded, not per-publication or per-writer branded.

Consider Paul Krugman. Krugman was an op-ed columnist for The New York Times from 2000–2024. But last year the Times wanted to cut him back from writing two columns a week plus his Times-hosted blog/newsletter to writing just one column per week and killing the blog. In an interview with Columbia Journalism Review early this year, Krugman also revealed that after over two decades, he’d started butting heads with his editors over style, tone, and even subject matter:

“I’ve always been very, very lightly edited on the column,” he said. “And that stopped being the case. The editing became extremely intrusive. It was very much toning down of my voice, toning down of the feel, and a lot of pressure for what I considered false equivalence.” And, increasingly, attempts “to dictate the subject.”

So Krugman rightfully and righteously told the Times, politely, to fuck off and struck out on his own. Reading Krugman this year, on his own site, has been like rediscovering cane sugar Coca-Cola after drinking the cheaper-to-produce corn syrup variant for a few years. This is The Real Thing — the unadulterated tart-tongued and sharp-elbowed Krugman I remember devouring during both the Bush and Obama administrations. The only hitch: Krugman hung out his independent shingle at Substack — which makes it a shingle under a shingle.

My suspicion is that for a certain class of writers and media commentators who, heretofore, have spent their careers at big-name publications — newspapers and magazines dating back to the print era, TV networks from the cable-is-king era — they actually find comfort writing under the auspices of Substack. See also: Terry Moran, who bounced to Substack after ABC News declined to renew his contract — despite 28 years at the network, including this recent classic — because of a tweet decrying Donald Trump and White House ghoul Stephen Miller. I suspect Moran, and perhaps even Krugman, perceive Substack as conveying a sort of badge of legitimacy. Self-published books, for example, used to be the refuge of kooks and no-talent hacks. I think some who spent their careers working at prestige outlets — especially those like Krugman and Moran, who are a bit older (than me) — feel a bit naked without one. But there’s no real prestige at Substack and never will be. I, for one, am fine with Substack’s liberal philosophy of letting anyone write there, but that means, well, anyone can write there.

Here’s a recent example of the Substack branding trap that irks me — grating like fingernails on a chalkboard — and which I think proves my point. Krugman last month was interviewed by Steve Inskeep at NPR, regarding Trump’s “grotesquely illegal” tariffs levied on Brazil. Introducing Krugman, Inskeep describes Krugman’s current work thus:

The people watching the tariff debate include Paul Krugman. He is a writer and economist, formerly for The New York Times, now writing independently on Substack, which is where I often find him. And since he’s in the United States, I pay no tariff. Mr. Krugman, welcome to the program.

So far, so good. That’s a fair description. But, concluding the five-minute interview, Inskeep goes with this:

Paul Krugman writes for Substack, formerly with The New York Times. Thanks so much.

Paul Krugman does not “write for Substack”. No one would say that Jason Snell “writes for WordPress”, or that Jason Kottke or yours truly “writes for Movable Type”. No one says Molly White, Casey Newton, or Craig Calcaterra “writes for Ghost”, or that Oliver Darcy “writes for Beehiiv”. Only with Substack does anyone perceive creator branding as being subservient to the platform — something that ought to be seen merely as an interchangeable CMS — like that.

That is not by happenstance. It’s a trap and it is by design. It’s exactly what Substack wants, and exactly what independent writers and content producers should not. 

Saturday, 2 August 2025

Ana Marie Cox on the Shaky Foundation of Substack as a Business 

Ana Marie Cox, who knows a thing or two about indie publishing and journalism, on her AMC All the Time blog about a month ago:

My take is more dire, because I’m not sure about “savvy and stamina” as the distinguishing characteristics of those who might be able to migrate elsewhere. I think plenty of smart folks might find themselves stuck.

Substack is rickety. It’s as unstable as a SpaceX launch, as overpromised as a Stephen Miller marriage.

Substack does not have a clear future as a newsletter business, I’m not the first to notice that. But it doesn’t have to fail outright to be a disaster. It just has to keep trying to become a life-sized map of the internet: maximum content, maximum churn. The center cannot hold — especially not for newsletters, a format that depends on intimacy and long-standing trust.

The Substack bust will not just take out a few hot-take merchants and media dilettantes. It’s going to take down a lot of working journalists who’ve built modest, sustainable incomes as well as the fragile public sphere we’ve been piecing together in the ashes of Twitter and the twilight of traditional journalism.

Taylor Lorenz’s scoop today on Substack’s Nazi notification oopsie reminded me that I’ve been meaning to link to this post from Cox casting a serious stink eye at Substack’s business. As she says up front, “Let’s set Substack’s ‘Nazi problem’ aside for a moment. What if the bigger issue is being stranded on a collapsing platform ... with a bunch of Nazis?”

Substack pitches itself to would-be independent writers as a thriving platform that’s fundamentally about independent blog publishing and email newsletter distribution. That could be a great business. But it would be a relatively small business compared to Substack’s fund raising (over $100 million so far, and currently looking to raise more) and the implied valuation that fund raising implies (at one point, they were pitching investors that they were worth $1 billion, which is about as realistic as El Gringo Loco Anaranjado’s promises that Mexico will pay for a US border wall).

Ghost is a platform and business that’s actually built for independent writers. So is Buttondown (which Cox uses for her site). Beehiiv too. There’s a whole cottage industry of creator-oriented blog-cum-newsletter platforms. Substack, on the other hand, is a trap. It breaks my heart to see great writers as disparate as Paul Krugman and Michael Chabon set up their ostensibly independent presences on Substack. Writers check in, but — if Substack gets their way — they won’t check out.

Looking at the numbers Cox lays out, Substack’s future looks even worse than I thought. Before they go under, though, their investors will put the screws to them, and Substack will take its heel turn.

Substack Sends Notification Promoting Nazi Blog 

Ashley Belanger, writing for Ars Technica:

After Substack shocked an unknown number of users by sending a push notification on Monday to check out a Nazi blog featuring a swastika icon, the company quickly apologized for the “error,” tech columnist Taylor Lorenz reported. [...]

Substack has long faced backlash for allowing users to share their “extreme views” on the platform, previously claiming that “censorship (including through demonetizing publications)” doesn’t make “the problem go away — in fact, it makes it worse,” Lorenz noted. But critics who have slammed Substack’s rationale revived their concerns this week, with some accusing Substack of promoting extreme content through features like their push alerts and “rising” lists, which flag popular newsletters and currently also include Nazi blogs.

Gizmodo reports:

The publication in question, NatSocToday, describes itself as a “National Socialist weekly newsletter featuring opinions and news important to the National Socialist and White Nationalist Community.” The newsletter’s image header is a Nazi flag, and its latest post, as of Wednesday, was an article that includes the sentence: “We demand the return of all territory currently occupied by jews and non-Whites in historically White homelands.” It does not appear to be a particularly popular blog, and currently has fewer than a thousand subscribers.

A mantra of “we host all views, but don’t promote or endorse all views” doesn’t hold much water when you promote a blog whose logo is a straight-up Nazi swastika.

Friday, 1 August 2025

The Talk Show: ‘Michigan-Starred Fine Dining’ 

Special guest Louie Mantia joins the show to talk about Liquid Glass, the various OS 26 updates, and the worrisome state of Apple’s UI design overall. Also: sandwiches.

Sponsored by:

  • Quip: A supercharged clipboard manager and text expander for Mac, iPhone, and iPad.
  • Notion: The best AI tool for work, with your notes, docs, and projects in one space.
  • Squarespace: Save 10% off your first purchase of a website or domain using code talkshow.

Thursday, 31 July 2025

Apple Files Vigorous Response to DOJ Lawsuit: ’Threatens the Very Principles That Set iPhone Apart’ 

Chance Miller, 9to5Mac:

Apple has voiced its opposition to the case many times over the last year. Now, it has officially filed its answer to the DOJ’s antitrust complaint, pushing back forcefully against the allegations.

As a refresher, the DOJ’s antitrust lawsuit focuses on five major aspects of the iPhone experience: super apps, cloud streaming games, third-party messaging apps, third-party smartwatches, and third-party digital wallets. In today’s filing, Apple says the DOJ “fundamentally misunderstands” those five things.

Apple outlines:

  • DOJ says Apple stifles the success of “super apps,” despite the fact that Apple’s rules allow and support such apps, and indeed a multitude of “super apps” exist on the App Store today.
  • DOJ says Apple blocks cloud streaming games, even though Apple allows streaming games both over the web and in the App Store where they can stream games directly to users.
  • DOJ says Apple degrades third-party messaging apps, even though they are widely available and enormously popular on iPhone already.
  • DOJ says Apple limits the functionality of third-party smartwatches, even though they can effectively pair with iPhone, share data to and from the iPhone via a companion app, and take advantage of certain functionalities Apple has developed, which are expanding over time.
  • DOJ says Apple withholds access to iPhone hardware necessary for third-party digital wallets to use tap-to-pay technology; however, Apple developed and provides a mechanism that protects user security.

One part of Apple’s defense that seems mostly proven already is that this industry moves fast and the competitive landscape is always changing. I’d say three of the DOJ’s five main arguments are already stale: Apple has since opened up cloud gaming; third-party messaging apps can now be set as default; and tap-to-pay has been opened up. And I think the other two points, on “super apps” and third-party connected devices like watches, are nonsense. Especially the “super apps” thing.

Miller, of course, embeds Apple’s full response at the bottom of his post. The argument is worth a read — it’s very cogently and plainly written.

Zuckerberg on ‘Personal Superintelligence’ 

Mark Zuckerberg, concluding a 600-word essay ostentatiously typeset in the style of web pages circa 1994*:

Meta believes strongly in building personal superintelligence that empowers everyone. We have the resources and the expertise to build the massive infrastructure required, and the capability and will to deliver new technology to billions of people across our products. I’m excited to focus Meta’s efforts towards building this future.

What about the metaverse? Wasn’t that the thing? What Zuckerberg, and thus Meta, actually believe strongly in is jumping on whatever trend becomes a hype bubble. The company’s soul is empty.

* Actual web pages from 1994 didn’t include nearly a megabyte of JavaScript to display 3 kilobytes of text.

Tea, the Women’s Dating Gossip App Riddled With Security Vulnerabilities, Remains #3 on the US iPhone App Store

Wednesday, 30 July 2025

Tea remains #3 overall in the US iPhone App Store. Here’s a screenshot of the top free iPhone apps today, and a list of the current top 10, using the full names the apps choose to display:

  1. ChatGPT
  2. Wingstop
  3. Tea Dating Advice
  4. Threads
  5. Google
  6. Google Maps
  7. WhatsApp Messenger
  8. ParentSquare
  9. CapCut - Video Editor
  10. TikTok - Videos, Shop & LIVE

I might be forgetting or unaware of previous similar situations, but I can’t recall anything like this before, where an app riddled with outrageous security/privacy vulnerabilities remains virally popular. A Hacker News thread from earlier today debates why the app is even still available on the App Store.

So is it Apple’s place to yank the app? It feels wrong to me that Apple should completely remove Tea from the App Store, but it’s also true that one of Apple’s fundamental pitches for the App Store — and the App Store’s exclusivity for app distribution in most of the world — is that iOS users can trust any and all apps in the App Store because they’re vetted by Apple. But here’s Tea, sitting at #3, providing a service that many women want, and the entire thing is shockingly untrustworthy. (I fully expect more vulnerabilities to be found and exploited.)

Tea, unsurprisingly, has almost nothing on their website about the security violations their users have suffered, nor any mention in their App Store listing. Their only public acknowledgement of the fiasco is a series of three Instagram posts on July 26, 27, and 29 (the most recent of which acknowledges that they’ve completely disabled the DM feature “temporarily”), and this FAQ on their website, that, as far as I can tell, is only discoverable through the “links in bio” on their Instagram profile. Their FAQ only addresses the initial discovery from last week, not the more significant one that 404 Media publicized Monday that included the exposure of DMs.

Also fascinating to me is that Tea, though available on both iOS and Android, is seemingly not popular at all on Android. It’s not even listed in the Play Store’s top free apps. (The Play Store website lists only the top 45, but I scrolled through the entire top 200 on my Pixel.) The current Play Store top 10:

  1. ChatGPT
  2. TikTok - Videos, Shop & LIVE
  3. Threads
  4. WhatsApp Messenger
  5. Temu: Shop Like a Billionaire
  6. Instagram
  7. TikTok Lite - Faster TikTok
  8. DramaBox - Stream Drama Shorts
  9. Cash App
  10. Snapchat

More tellingly, Tea doesn’t even crack the Play Store top 200 list for the “Dating” category. (On iOS, it’s in the “Lifestyle” category, but on the Play Store it’s in the “Dating” and “Casual” categories. Perhaps Apple requires apps in the “Dating” category to be full-fledged dating app services, not dating-app-adjacent like Tea.)

I’m not sure what explains the disparity in Tea’s popularity by platform. One assumption is that dating is more of a young person’s game, and young people skew slightly more toward iPhone than the US population overall. But from what I can tell, that skew is only about 10 percent. Also, surveys suggest women are more likely to be iPhone users. But I can’t believe that age or gender demographics alone explain why Tea is #3 in the App Store but doesn’t even crack the top 200 on Android.

I strongly suspect that, although Google hasn’t removed Tea from the Play Store, they’ve delisted it from discovery other than by searching for it by name or following a direct link to its listing. That both jibes with what I’m seeing on the Play Store top lists, and strikes me as a thoughtful balance between the responsibilities of an app store provider. As egregious as Tea’s security exploits have been, removing the app entirely doesn’t seem called for. But delisting it from popularity lists seems like a measured way to discourage new users from trying it unless they’re specifically looking for it. If this is what Google is doing, Apple should follow their lead. (I’ve put in a question to Google’s PR inquiring about this; if/when I get an answer, I’ll update this article.) 

Wednesday, 30 July 2025

YouTube Is Rolling Out an Age-Estimation Algorithm to Identify US Teens 

Sarah Perez, TechCrunch:

YouTube on Tuesday announced it’s beginning to roll out age-estimation technology in the U.S. to identify teen users in order to provide a more age-appropriate experience. The company says it will use a variety of signals to determine the users’ possible age, regardless of what the user entered as their birthday when they signed up for an account.

Well-intentioned though I think this is, it still feels more than a little dystopian.

Tuesday, 29 July 2025

Sony Sues Tencent for Allegedly Ripping Off ‘Horizon’ Video Games 

Reuters:

Sony released the first game in the Horizon series, Horizon: Zero Dawn, on its PlayStation 4 in 2017. The games follow a red-headed woman named Aloy as she navigates a post-apocalyptic world populated by human tribes and robotic animals.

Sony said in its complaint that it declined an offer from Tencent to collaborate on a new Horizon game last year. Tencent later announced Light of Motiram, which Sony said features identical gameplay, story themes and artistic elements to Horizon as well as many other similarities.

Sony said that video game journalists have characterized Light of Motiram as a “knock-off” of Horizon, including one who called the game Horizon Zero Originality.

Tencent is the Chinese software giant behind, amongst many other things, WeChat, China’s “everything app”.

The E-Book Editions of Timothy Snyder’s ‘On Tyranny’ Are Just $2 

Back in March I linked to and recommended Timothy Snyder’s On Tyranny, a cogent collection of 20 short essays. I was never a big e-book reader, both because I love printed books so much and because I welcome any respite from reading on screens of any sort. But if e-books are your thing, note that Apple Books currently has it for just $2. Amazon’s Kindle edition is also $2 — and the paperback edition, which is the lovely little thing I own, is an oddly but low-priced $7.31.

Amazon Is Selling M4 MacBook Airs for $200 Off 

These prices — which I presume are a back-to-school season promotion — are even lower than those during the weeklong “Prime Day” earlier this month, and you don’t need to be a Prime subscriber to get them:

These are make-me-rich affiliate links, as is this link for AirPods Pro 2 for just $200, $50 off.

Microsoft Introduces ‘Copilot Mode’ in Edge 

Sean Lyndersay, general manager of Edge at Microsoft:

For decades, the way we’ve used browsers has remained linear: open a tab (or 20), search for something, read a page, repeat. It’s a model that’s worked well, but it hasn’t fundamentally changed. Until now. As AI begins to reshape nearly every facet of digital life, we’re witnessing a turning point in how we interact with the web. Now, it’s worth asking: is your browser working for you as much as it should?

Color me skeptical about the idea that my web browser should be “working for me”, rather than serving as a tool for me to work with. The AI hype cycle is pointing to a future where automated agentic web browsers surf automated AI-generated websites. Robots consuming robot-generated content — an infinite loop of AI onanism.

This is why today we’re excited to launch Copilot Mode, a new experimental mode in Microsoft Edge, and our next step towards building a more powerful way to pilot the web.

With Copilot Mode on, you enable innovative AI features in Edge that enhance your browser. It doesn’t just wait idly for you to click but anticipates what you might want to do next. It doesn’t just give you endless tabs to sift through but works with you as a collaborator that makes sense of it all. It keeps you browsing, cuts through clutter and removes friction to unlock your flow — all built to the highest Microsoft standards of security, privacy and performance trusted by billions of people and businesses worldwide — with you as the user always in control.

Microsoft is famously known for presenting interfaces that “cut through clutter” and “remove friction”. I’m sure this will be great.

I am reminded of the decade-ago Netflix strategy espoused by Ted Sarandos: “The goal is to become HBO faster than HBO can become us.” I think something similar is behind Microsoft trying to make Copilot front-and-center in Edge, and Google’s concurrent move to junk up Chrome with AI-generated suggestions. Their goal is to make their web browsers chatbots faster than OpenAI can make ChatGPT a web browser.

HBO is still around. It even just got its name back. But Netflix won that race.

Google Chrome Adds AI-Generated Store Summaries 

Sarah Perez, writing for TechCrunch:

Google on Monday announced an update to its Chrome web browser that will introduce AI-generated store reviews to U.S. shoppers with the aim of helping to determine the best places to make a purchase. The feature, which will be available by clicking an icon just to the left of the web address in the browser, will display a pop-up that informs consumers about the store’s reputation for things like product quality, shopping, pricing, customer service, and returns.

The feature, which is currently available only in English, will generate the summaries based on reviews from partners, including Bazaarvoice, Bizrate Insights, Reputation.com, Reseller Ratings, ScamAdviser, Trustpilot, TurnTo, Yotpo, Verified Reviews, and others.

I have never heard of a single one of these “partners”. It’s bad enough that so many web pages themselves are increasingly covered with distracting junk, much of it AI-generated slop. But now browsers themselves will be adding their own layers of distracting cruft atop the websites. The entire premise of Chrome — the reason for its name — is that it was originally designed to simplify the UI of the browser app itself, the “chrome”, at a time when Internet Explorer and even Firefox were increasingly cluttered and confusing. I feel like this is a sign that Chrome is completely losing its way — AI-generated slop from the browser layered atop AI-generated slop in the underlying web pages.

Dare Obasanjo, on Bluesky, takes this news credulously:

Google Chrome is now going to provide AI generated summaries of online stores covering topics like customer service, product quality, shipping, pricing and return policy.

This is on the heels of Microsoft Edge announcing Copilot mode earlier today. Apple’s Safari is being left behind in the AI wars.

I would argue that Safari is looking ever more like a proverbial glass of ice water in hell. These Chrome AI overviews (Chrome is also, for example, going to start presenting its own AI-generated menu summaries for restaurants) don’t seem like user-centric features to me. They seem like features designed to turn the dial up on Google’s slice of commissions from web transactions.

Monday, 28 July 2025

Security Breach at Tea Worsens, Revealing Users’ DMs About Abortions and Cheating 

Emanuel Maiberg and Joseph Cox, reporting again for 404 Media:

Despite Tea’s initial statement that “the incident involved a legacy data storage system containing information from over two years ago,” the second issue impacting a separate database is much more recent, affecting messages up until last week, according to the researcher’s findings that 404 Media verified. The researcher said they also found the ability to send a push notification to all of Tea’s users.

It’s hard to overstate how sensitive this data is and how it could put Tea’s users at risk if it fell into the wrong hands. When signing up, Tea encourages users to choose an anonymous screenname, but it was trivial for 404 Media to find the real world identities of some users given the nature of their messages, which Tea has led them to believe were private. Users could be easily found via their social media handles, phone numbers, and real names that they shared in these chats. These conversations also frequently make damning accusations against people who are also named in the private messages and in some cases are easy to identify. [...]

Some of the private messages viewed by 404 Media include:

  • One user tells another they just discovered their husband on the app being discussed. “I am his wife,” many of the messages say.
  • Another appears to show a woman contacting others about a man she is engaged to.
  • Multiple messages which appear to show women discussing their abortions.
  • Chat logs between women discovering they are dating the same man, exchanging information such as what car he drives for verification.

When I linked to 404 Media’s coverage of the initial breach at Tea the other day, I wrote, “I’m not accusing Tea in particular of being vibe-coded”. Well, I still don’t know if Tea’s service architecture was vibe-coded, but it’s now clear that whoever made it was shamefully incompetent. They shouldn’t have made any sort of services backend, let alone one like Tea’s that’s intended to carry incredibly sensitive personal information and messages.

This is an outright privacy — and quite possibly, personal security — disaster. With the abortion discussions and the current bifurcation of women’s rights here in the US, it could be a legal disaster, too. 4chan clowns have taken the images and data and created maps of Tea users’ addresses, and a Mark-Zuckerberg-“Facemash”-style site for ranking users’ appearance.

For women who’ve already signed up and started using Tea, I doubt there’s anything that can be done to remove them from exposure. Even if Tea offers a “delete your account” feature, I wouldn’t trust that it actually deletes anything from their database, let alone everything. And the cat’s already out of the bag for any bad actors who figured out this second exploit before Tea was alerted.

Yet another data point for the argument that any “private messaging” feature that doesn’t use E2EE isn’t actually private at all.

Republican Election Group Is Attempting to Organize Against Text Message Filtering in iOS 26 

From this paywalled report at Punchbowl News, as quoted by Taegan Goddard at Political Wire:

“The Senate GOP campaign arm is warning that Apple’s new iOS update could cost them $25 million in fundraising revenue, as well as priceless GOTV opportunities,” Punchbowl News reports.

Here’s a copy of the original memo from the NRSC (National Republican Senatorial Committee). What they’re freaking out about is the new iOS 26 Messages feature (which will be available in Messages on iPadOS and MacOS 26 too — but because these messages are sent as SMS and because the iPhone is so many people’s primary or sole messaging device, it’s the platform they’re focusing on) that will automatically sort messages from unknown senders into a new “Unknown Sender” inbox.

Quoting from the NRSC letter (emphasis in original):

Apple’s iOS 26 update introduces aggressive message filtering. Political texts — even from verified and compliant senders-will be treated as spam by default, silently sent to an “Unknown” inbox with no alerts or notifications. That change has profound implications for our ability to fundraise, mobilize voters, and run digital campaigns.

It’s important to understand: Apple isn’t just targeting cold outreach or spammy actors. Every political message — shortcode, long code, doesn’t matter-gets pushed into the dark. The only workaround-getting a voter to reply — is increasingly rare and entirely at the mercy of Apple’s unclear rules. How will a voter reply if they never get the message?

Apple’s “rules” for this new feature aren’t unclear at all. If a sender is not in your saved contacts and you’ve never sent or responded to a text message from them, they’re considered “unknown”. That’s it. The feature isn’t even really new — you’ve been able to filter messages like this in Messages for years now, but what iOS 26 changes is that it now will be on by default and has a new more prominent — better, IMO — interface for switching between filter views. Update: I was wrong that this filtering will be on by default in iOS 26 — I was fooled because I had previously enabled “Filter Unknown Senders” in Settings → Apps → Messages → Unknown & Spam (which you need to scroll down quite a bit to get to). I do think, though, that many more iOS users will be using this feature starting with iOS 26 — it’s both better designed and less hidden.

Back to the NRSC letter:

Here’s the shift in practice. Today, a voter with an iPhone gets our message just like a normal text. In iOS 26, unless that person has already replied, our message is silently sent to the “Unknown” inbox. No ping, no badge, just buried in an inbox few people ever check.

We’ve spent years complying with rigorous standards — providing full documentation, opt-in proof, and message samples via Campaign Verify and The Campaign Registry — yet Apple ignores that. Carriers respect it. Apple doesn’t.

Estimated prospecting losses: NRSC alone could see a $25M+ revenue hit. Since 70% of small-dollar donations come via text, and iPhones make up 60% of US mobile devices, the macro effect could be over $500M in lost GOP revenue. [...]

Unfortunately, K St and trade groups are asleep at the wheel. Apple isn’t engaging. But we have only a few weeks left before the public release. If we’re going to push back, it has to be now. We have a very narrow window to fix this.

“Unknown Senders” isn’t spam. It’s for ... unknown senders. Which these political texts are. I don’t know anyone who enjoys getting these texts in their primary timeline of messages. What the NRSC is asserting here is that they have a right to put political solicitations in your primary Messages view, and to have them appear as notifications, which is ridiculous.

Also, there’s no reason to believe that Republican candidates and groups will be more affected by this than Democratic ones. There’s no filtering by message content. It’s just a change to stop sending notifications for texts from unknown senders, and to put those messages in a separate timeline by default. People will check the Unknown Senders timeline occasionally too — all sorts of text messages from bots will go there, including some you want or need.

Adam Aaronson Drank Every Cocktail 

Adam Aaronson:

The International Bartenders Association, or IBA, maintains a list of official cocktails, ones they deem to be “the most requested recipes” at bars all around the world. It’s the closest thing the bartending industry has to a canonical list of cocktails, akin to the American Kennel Club’s registry of dog breeds or a jazz musician’s Real Book of standards. [...]

As of 2025, there are 102 IBA official cocktails, and as of July 12, 2025, I’ve had every one of them.

The journey has taken me to some interesting places, and now that it’s done, I have a little story to tell for each cocktail. I’m not gonna tell you all 102 stories, but I do want to debrief the experience. Drinking all 102 cocktails turned out to be unexpectedly tricky, and for reasons you’ll soon understand, I might be one of the first people in the world to do it.

Fun story, copiously documented with details, locations, photos, and sidenotes. Truly a blogger’s blog post.

Saturday, 26 July 2025

SafeBase by Drata 

My thanks to Drata for sponsoring this week at DF to promote SafeBase. SafeBase eliminates the friction of inbound security reviews. It helps you automate inbound requests, use AI to answer questionnaires, and share your security posture proactively — all through a centralized Trust Center.

To Trust ICEBlock’s Anonymity, You Have to Trust Apple 

Dominic Preston, writing at The Verge, regarding Android fans’ bristling at ICEBlock developer Joshua Aaron’s claims that an Android (or web) version of ICEBlock couldn’t provide the same level of privacy as the iOS version:

Aaron told The Verge ICEBlock is built around a single database in iCloud. When a user taps on the map to report ICE sightings, the location data is added to that database, and users within five miles are automatically sent a push notification alerting them. Push notifications require developers to have some way of designating which devices receive them, and while Aaron declined to say precisely how the notifications function, he said alerts are sent through Apple’s system, not ICEBlock’s, letting him avoid keeping his own database of users or their devices. “We utilized iCloud in kind of a creative way,” Aaron said. [...]

But you might have spotted the problem: ICEBlock isn’t collecting device data on iOS, but only because similar data is stored with Apple instead.

Apple maintains a database of which devices and accounts have installed a given app, and Carlos Anso from GrapheneOS told me that it likely also tracks device registrations for push notifications. For either ICEBlock’s iOS app or a hypothetical Android app, law enforcement could demand information directly from the company, cutting ICEBlock out of the loop. Aaron told me that he has “no idea what Apple would store,” and it “has nothing to do with ICEBlock.”

Bruce Schneier linked to this story saying “the ICEBlock tool has vulnerabilities”, but I don’t think that’s a fair description. As far as we know, ICEBlock is as private as possible while still enabling push notifications, and a hypothetical Android version couldn’t be as private. But that privacy does depend on trust in Apple.

Also worth a note: Aaron’s wife, Carolyn Feinstein, was an auditor at the Department of Justice but was fired last month because of her husband’s app.

New York Times’ Style Guide Substitutions for ‘The President Violated the Constitution’ 

Carlos Greaves, writing for McSweeney’s:

“The president remained steadfast in his novel interpretation of constitutional law.”

“Faced with the choice between clinging to the letter of the law and marching to the beat of his own legal drum, the president chose the latter.”

‘Obsoless’ — Ken Pillonel’s Small-Batch Cases Bring USB-C Charging to Lightning iPhones 

Back in 2021 a young engineering student named Ken Pillonel modified his own iPhone X to replace the Lightning port with USB-C, which became a small viral sensation. He’s back at it, with a far more ambitious project: iPhone cases with USB-C ports for the last five or so years of models with Lightning ports. He’s produced three batches of cases so far, but is currently sold out.

Even if you’re not interested in buying one of these cases, Pillonel’s video documenting how he brought the concept to fruition is quite clever and fun.

Intel Needs a Big Customer for Foundry Business to Survive 

Max A. Cherney and Stephen Nellis, reporting for Reuters:

Those customers for the company’s so-called 14A manufacturing process are crucial to the success of the technology — so much so that if it fails to secure a big one, it could shut down its cutting-edge manufacturing business altogether, according to Intel’s quarterly filing on Thursday.

The possibility that Intel could drop out of the cutting-edge manufacturing business would be a historic shift for a company that has described itself as a steward of Moore’s Law — an observation by Intel co-founder Gordon Moore about the fast rate of development of the chip industry that held true for decades. Intel is the only U.S. chipmaker capable of making advanced computing chips.

Intel has struggled for years due to management missteps, missing out on the AI race and losing market share to its longtime rival AMD.

The beginning of the end for Intel was long before the AI race or the market share they’ve lost to AMD. It was missing out on mobile. From a 2013 profile of then-CEO Paul Otellini, by Alexis Madrigal for The Atlantic:

But, oh, what could have been! Even Otellini betrayed a profound sense of disappointment over a decision he made about a then-unreleased product that became the iPhone. Shortly after winning Apple’s Mac business, he decided against doing what it took to be the chip in Apple’s paradigm-shifting product.

“We ended up not winning it or passing on it, depending on how you want to view it. And the world would have been a lot different if we’d done it,” Otellini told me in a two-hour conversation during his last month at Intel. “The thing you have to remember is that this was before the iPhone was introduced and no one knew what the iPhone would do... At the end of the day, there was a chip that they were interested in that they wanted to pay a certain price for and not a nickel more and that price was below our forecasted cost. I couldn’t see it. It wasn’t one of these things you can make up on volume. And in hindsight, the forecasted cost was wrong and the volume was 100× what anyone thought.”

That was it, the beginning of the end. It’s not just that mobile computing, as defined by the iPhone, became the largest market, by far, for chips, but that the needs of mobile devices defined the future of leading edge chipmaking across all industries: performance-per-watt, not merely sheer performance. As mobile grew, so went the economies of scale, which resulted in Apple Silicon eventually beating x86 chips not just in performance-per-watt but also in single-core performance.

goo.gl, Google’s Link Shortener, Will Stop Working Next Month 

Emma Roth, The Verge:

Google will officially deprecate links generated with its URL shortening tool next month. On August 25th, 2025, all links in the https://goo.gl/* format will no longer work and return a 404 error message.

Google shut down its URL shortener in 2019, citing “changes we’ve seen in how people find content on the internet.” Links created with the tool continued to work since then, but Google announced last year that it would begin deprecating them as traffic to the shortened URLs declined. “In fact more than 99% of them had no activity in the last month,” Google said in its July 2024 blog post.

The heyday for link shorteners was the era when Twitter (a) was still Twitter, (b) had a 140-character post limit, and (c) counted characters such that each character of a URL counted toward the 140-character limit. None of those things are true anymore. But, still. Cool URLs don’t change.

I’m sure it is true that 99 percent of goo.gl links had no activity in the past month. But I’m just as sure that it would cost next to nothing for Google to keep goo.gl up and running in perpetuity. I mean, 99 percent of all URLs probably had no activity in the last month. 99 percent of all books ever written weren’t read in the last month either, I bet — but that’s no excuse for libraries to throw them in the trash.

It’s fine that Google stopped allowing for the creating of new links a while back, but there’s no reason they should ever stop redirecting existing links. The whole reason anyone might have used goo.gl instead of something like bit.ly is misplaced trust in Google. I trust Google with almost nothing long-term. Mark my words, they’re going to do this with Gmail accounts eventually.

Update: Google has come to its senses and will keep these redirections working.

4chan Clowns Find Open Database of Images From Viral Women’s Dating Safety App ‘Tea’ 

Emanuel Maiberg and Joseph Cox, reporting for 404 Media:

Users from 4chan claim to have discovered an exposed database hosted on Google’s mobile app development platform, Firebase, belonging to the newly popular women’s dating safety app Tea. Users say they are rifling through peoples’ personal data and selfies uploaded to the app, and then posting that data online, according to screenshots, 4chan posts, and code reviewed by 404 Media. In a statement to 404 Media, Tea confirmed the breach also impacted some direct messages but said that the data is from two years ago.

Tea, which claims to have more than 1.6 million users, reached the top of the App Store charts this week and has tens of thousands of reviews there. The app aims to provide a space for women to exchange information about men in order to stay safe, and verifies that new users are women by asking them to upload a selfie.

Tea jumped to the top spot in the App Store (it’s still at #4 as I type this, trailing only ChatGPT, Netflix, and Amazon Prime Video) and has been getting a lot of coverage this week. A wide open, publicly accessible database of users’ driver’s licenses and self portraits is, to say the least, pretty egregious.

I’m not accusing Tea in particular of being vibe-coded, but I do wonder if this sort of thing is going to become commonplace as more apps and services come online after being developed in slapdash AI-assisted manners.

Friday, 25 July 2025

The Talk Show: ‘The Shift-2 Crowd’ 

Jason Snell returns to the show to talk about the early PC platform rivalries of the 1980s, iOS 26 leaks (and Apple suing YouTuber Jon Prosser), the various Apple OS 26 public betas and the state of Liquid Glass, and more. (Where by “more” I mean a little baseball and keyboard nerdery.)

Sponsored by:

  • Factor: Healthy eating, made easy. Get 50% off plus free shipping on your first box.
  • Sentry: The real-time error monitoring and tracing platform that helps dev teams and tech companies build better, more reliable products. Use code talkshow for 3 months free and 150,000 errors.
  • Squarespace: Save 10% off your first purchase of a website or domain using code talkshow.

Thursday, 24 July 2025

Public Betas for Apple OSes 26 

The public betas are out for iOS/iPadOS/WatchOS/MacOS 26, and Dan Moren and Jason Snell cover them all at Six Colors. Here’s Moren on iOS 26:

Apple’s new design language, dubbed Liquid Glass, applies across all their platforms, but unsurprisingly, it feels most at home on the iPhone and iPad. That’s in part because of the touch interface; the literal hands-on nature makes the feel responsive and more like physical things that you’re interacting with. For example, dragging the new magnifying loupe across the screen, watching the way it magnifies and distorts text and images as it passes over them — this interaction has always been unique to iOS for practical reasons, but the way it feels here doesn’t have a direct analogue on other platforms.

For it now being late July, though, there remain a lot of glaring problems. I hope to be proven wrong, but I think the legibility/usability problems are going to make the 26.0 versions of Apple’s OSes unpopular. Functionally, iOS and iPadOS 26 betas 4 are solid. MacOS 26 Tahoe really adds some great productivity features. But visually, not so much for any of these OSes (especially MacOS) — and that, to me, is a serious problem.

Anyway, public beta commentary:

ICEBlock, an iOS Exclusive

Thursday, 24 July 2025

ICEBlock:

ICEBlock is an innovative, completely anonymous crowdsourced platform that allows users to report Immigration and Customs Enforcement (ICE) activity with just two taps on their phone. In recent years, ICE has faced criticism for alleged civil rights abuses and failures to adhere to constitutional principles and due process, making it crucial for communities to stay informed about its operations.

Modeled after Waze but for ICE sightings, the app ensures user privacy by storing no personal data, making it impossible to trace reports back to individual users. Available exclusively for iOS devices, ICEBlock empowers communities to stay informed about ICE presence within a 5-mile radius while maintaining their anonymity through real-time updates and automatic deletion of sightings after four hours.

The ICEBlock app is interesting in and of itself (and from my tire-kicking test drive, appears to be a well-crafted and designed app), as will be Apple’s response if (when?) the Trump administration takes offense to the app’s existence. Back in 2019, kowtowing to tacit demands from China, Apple removed from the App Store an app called HKmap.live which helped pro-democracy activists in Hong Kong know the location of police and protest activity. The app broke no Hong Kong laws, but scared the thin-skinned skittish lickspittles in the Chinese Communist Party. (Remember too that in 2019, Apple removed the Taiwan flag emoji (🇹🇼) from the iOS 13 keyboard for users in Hong Kong and Macau.)

One defense from Apple regarding HKmap.live, however, was that the iOS app was a thin wrapper around the website, which website remained fully functional and could be saved to an iPhone user’s home screen. Removing the app from the App Store thus did not prevent Hong Kongers from accessing it. (That website today seems to be defunct.)

ICEBlock is different. It is only available as a native iOS app. According to the developers, this is for technical reasons. From their web page explaining why they can’t offer an Android version:

At ICEBlock, user privacy and security are paramount. Our application is designed to provide as much anonymity as possible without storing any user data or creating accounts. While we understand the desire for an Android version of ICEBlock, achieving this level of anonymity on Android is not feasible due to the inherent requirements of push notification services.

To send push notifications on Android, it is necessary to use a mechanism that requires storing device IDs. This means that we would need to maintain a privately hosted database to store these identifiers. Storing such data, even if it’s anonymized, introduces significant privacy risks. [...]

In contrast, iOS offers us the flexibility to deliver push notifications while adhering strictly to our design philosophy. Apple’s ecosystem allows for push notifications to be sent without requiring us to store any user-identifiable information. This ensures that ICEBlock remains completely anonymous and secure.

To deliver push notifications on Android, the developers claim they would need to maintain a database of device IDs, create a user account system to manage those device IDs, and all of that server-stored data would be susceptible to law enforcement subpoenas and pro-ICE red hat hackers. (What “brown shirts” were to the Nazis, we should make “red hats” to MAGA.)

To maintain anonymity and store zero user data, there is and can be no web app version of ICEBlock. There is and can be no Android version. Only iOS supports the security and privacy features for ICEBlock to offer what it does, the way it does. Here’s to hoping that Apple will proudly defend it if push comes to shove. 

Wednesday, 23 July 2025

Yours Truly With David Barnard on the Sub Club Podcast 

David Barnard:

On the podcast I talk with John about the fascinating 40-year history of Apple’s developer relations, how almost going bankrupt in the 1990s shaped today’s control-focused approach, and why we might need an “App Store 3.0” reset.

Yet another fun appearance on a podcast. There’s a good transcript too, if you’re more of a reader than a listener.

Tuesday, 22 July 2025

The Financial Times Reports the UK Is Backing Down From Its Demand for Apple to Grant It an iCloud Encryption Backdoor 

Anna Gross, Tim Bradshaw, and Lauren Fedor, reporting for the Financial Times (syndicated without paywall at Ars Technica):

Sir Keir Starmer’s government is seeking a way out of a clash with the Trump administration over the UK’s demand that Apple provide it with access to secure customer data, two senior British officials have told the Financial Times. The officials both said the Home Office, which ordered the tech giant in January to grant access to its most secure cloud storage system, would probably have to retreat in the face of pressure from senior leaders in Washington, including Vice President JD Vance.

“This is something that the vice president is very annoyed about and which needs to be resolved,” said an official in the UK’s technology department. “The Home Office is basically going to have to back down.”

Both officials said the UK decision to force Apple to break its end-to-end encryption — which has been raised multiple times by top officials in Donald Trump’s administration — could impede technology agreements with the US.

“One of the challenges for the tech partnerships we’re working on is the encryption issue,” the first official said. “It’s a big red line in the US — they don’t want us messing with their tech companies.”

One dystopian element of the UK’s Investigatory Powers Act is that when companies are issued demands under the law — which critics in the UK call “the Snoopers’ Charter” — it’s a criminal offense subject to imprisonment to reveal to anyone that the UK government issued the demand. You will recall that after receiving this demand, in February this year Apple pulled iCloud Advanced Data Protection from users in the UK.

What I don’t like about the Financial Times’s framing of this is that they describe it only in terms of politics between the Trump administration and Starmer’s. This is not merely about a foreign government “messing with their tech companies”. It’s fundamentally about privacy and security. It is a human rights and civil liberties issue, first and foremost. The Trump administration is on the correct and just side of this issue. Whether they’re on the correct side for the right reasons, I don’t know, but that’s what’s most important here. A secret backdoor is abhorrent from all perspectives: privacy, security, civil liberties. (Not to mention impossible cryptographically with E2EE — mandating a backdoor is effectively banning E2EE, which is why Apple pulled Advanced Data Protection from the UK.)

Conversely, one reason the UK went through with this demand is that the Biden administration was, disgracefully, on the wrong side of this, choosing to look the other way and lie to Congress about what the UK was planning to do.

OS 26 Beta 4’s Are Out 

Juli Clover, MacRumors:

Apple today provided developers with the fourth betas of iOS 26 and iPadOS 26 for testing purposes, with the updates coming two weeks after Apple seeded the third betas.

MacOS, WatchOS, tvOS, and VisionOS too, all in lockstep. Also, a good first look at what’s changed in iOS 26 beta 4 from beta 3. Some of the things Apple is tweaking between betas need more than minor tweaking. Also: Apple Intelligence summaries for news notifications are back.

The Computer History Museum’s Vintage Computer Festival: August 1–2 

CHM:

Come and explore an extraordinary showcase of historical computers, from pristine originals to ingenious modern hacks. Computer enthusiasts around the world look forward to the annual Vintage Computer Festival.

Experience hands-on demos of historical systems from the 1960s through the 1990s, learn preservation tips, and try out brands like Apple, Atari, Commodore, Tandy/Radio Shack, and more.

It’s in Mountain View, so I can’t make it, but given all the recent nostalgia that’s been in the air regarding the early PC era, I wish I could.

Hackers Exploit Zero-Day Microsoft SharePoint Exploit, Attacking Governments and Businesses Around the World 

Ellen Nakashima, Yvonne Wingett Sanchez and Joseph Menn, reporting for The Washington Post:

The U.S. government and partners in Canada and Australia are investigating the compromise of SharePoint servers, which provide a platform for sharing and managing documents. Tens of thousands of such servers are at risk, experts said, and Microsoft has issued no patch for the flaw, leaving victims around the world scrambling to respond.

The “zero-day” attack, so called because it targeted a previously unknown vulnerability, is only the latest cybersecurity embarrassment for Microsoft. Last year, the company was faulted by a panel of U.S. government and industry experts for lapses that enabled a 2023 targeted Chinese hack of U.S. government emails, including those of then-Commerce Secretary Gina Raimondo.

This most recent attack compromises only those servers housed within an organization — not those in the cloud, such as Microsoft 365, officials said. After first suggesting that users make modifications to or simply unplug SharePoint server programs from the internet, the company on Sunday evening released a patch for one version of the software. Two other versions remain vulnerable and Microsoft said it is continuing to work to develop a patch.

“Just pull the plug” — classic Microsoft security.

With access to these servers, which often connect to Outlook email, Teams and other core services, a breach can lead to theft of sensitive data as well as password harvesting, Netherlands-based research company Eye Security noted. What’s also alarming, researchers said, is that the hackers have gained access to keys that may allow them to regain entry even after a system is patched. “So pushing out a patch on Monday or Tuesday doesn’t help anybody who’s been compromised in the past 72 hours,” said one researcher, who spoke on the condition of anonymity because a federal investigation is ongoing.

Sounds bad.

The nonprofit Center for Internet Security, which staffs an information-sharing group for state and local governments, notified about 100 organizations that they were vulnerable and potentially compromised, said Randy Rose, the organization’s vice president. Those warned included public schools and universities. The process took six hours Saturday night — much longer than it otherwise would have, because the threat-intelligence and incident-response teams have been cut by 65 percent as CISA slashed funding, Rose said.

Another DOGE success story.

Reuters: ‘Meta, X, and LinkedIn Appeal Unprecedented VAT Claim by Italy’ 

Reuters:

Italian tax authorities argue that free user registrations with X, LinkedIn and Meta platforms should be seen as taxable transactions as they imply the exchange of a membership account in return for a user’s personal data.

The issue is especially sensitive given wider trade tensions between the EU and the administration of U.S. President Donald Trump. Italy is claiming 887.6 million euros ($1.03 billion) from Meta, 12.5 million euros from X and around 140 million euros from LinkedIn. [...]

According to several experts consulted by Reuters, the Italian approach could affect almost all companies, from airlines to supermarkets to publishers, who link access to free services on their sites to users’ acceptance of profiling cookies.

Charging a VAT on free account signups does not strike me as a good idea.

‘Google Solves Its Pixel 10 Leaks by Just Showing Us the Phone’ 

Jay Peters, The Verge:

Google’s Pixel 10 launch event is just under a month away, but the company is already revealing the official design of the base phone. You can currently see a video of the phone on Google’s website (and below). It looks just like the official renders that leaked earlier today, which showed that the phone will have a third back camera (which is rumored to be a telephoto sensor).

That’s certainly one way to deal with leaks. It looks like a Pixel 9, which looks like an iPhone 12–16 with a different (but cool) camera mesa.

Monday, 21 July 2025

Will Wonders Never Cease? 

Brody Ford and Hannah Miller, reporting for Bloomberg:

Oracle Corp. is in discussions with Skydance Media LLC for a major software deal once the media company’s acquisition of Paramount Global is complete. The new arrangement is expected to be worth about $100 million per year, according to people familiar with the matter who asked not to be named speaking about the private discussions. The agreement would see Paramount and its subsidiaries using Oracle’s cloud software, the people said.

Skydance was founded by David Ellison, the son of Oracle Chairman Larry Ellison.

Reminiscent of SpaceX’s $2 billion “investment” in xAI. (Via Peter Kafka.)

Commanders : Goofus :: Guardians : Gallant 

Mike Florio, NBC Sports:

And while the Guardians stood up and responded to Trump, the Commanders are hiding under the bed. With the NFL right next to them.

We’ve sent multiple emails to both the team and the league seeking comment on one of the biggest stories in all of sports. No one has responded. It’s a common, low-tech, P.R. play. Ignore the request, and maybe the reporter will forget about it. Force the reporter to remember, and to ask again. And maybe again.

Here’s the statement from Guardians team president Chris Antonetti:

“I understand there are very different perspectives on the decision we made a few years ago, but it’s a decision we made and we’ve gotten the opportunity to build the brand as the Guardians over the last four years and we’re excited about the future that’s in front of us.”

I’d recommend going a little further and saying that everyone in the organization loves the new brand, but that’s quibbling. What the Commanders and the NFL are doing is cowardice.

‘CBS: The Tiffany Network’ 

Letterman: “You can’t spell CBS without BS.”

HRW Report Documents Abusive Practices at Three Florida Immigration Detention Centers Since January 2025 

John Holmes for Human Rights Watch (via The Guardian):

One woman described arriving at Krome — a facility that typically only holds men — late at night on January 28. Officers then confined her for days with dozens of other women without bedding or privacy, in a cell normally used only during incarceration intake procedures. “There was only one toilet, and it was covered in feces,” she said. “We begged the officers to let us clean it, but they just said sarcastically, ‘Housekeeping will come soon.’ No one ever came.”

A man recalled the frigid conditions in the intake cell where he was detained: “They turned up the air conditioning... You could not fall asleep because it was so cold. I thought I was going to experience hypothermia.”

This report documents serious violations of medical standards. Detention facility staff routinely denied individuals with diabetes, asthma, kidney conditions, and chronic pain their prescribed medications and access to doctors. In one case at Krome, a woman with gallstones began vomiting and lost consciousness after being denied care for several days. Officers returned her to the same cell after emergency surgery to remove her gallbladder — still without medication. [...]

Staff were dismissive or abusive even when detainees were undergoing a visibly obvious medical crisis. For example, staff ignored a detained immigrant who began coughing blood in a crowded holding cell for hours. In that case, unrest ensued, and a Disturbance Control Team stormed the cell, forcing the men in it to lie face down on the wet, dirty floor while officers zip-tied their hands behind their backs. A detainee said he heard an officer order the cell’s CCTV camera feed to be turned off. Another detainee said a team member slapped him while shouting, “Shut the fuck up.”

During another incident, officers made men eat while shackled with their hands behind their backs after forcing the group to wait hours for lunch: “We had to bend over and eat off the chairs with our mouths, like dogs,” one man said.

The Eighth Amendment of the US Constitution:

Excessive bail shall not be required, nor excessive fines imposed, nor cruel and unusual punishments inflicted.

Sunday, 20 July 2025

WorkOS: Summer Launch Week 

My thanks to WorkOS for sponsoring last week at DF to promote their summer launch week. You may recall their previous launch week back in spring, when I emphasized that their launch week announcements were worth checking out just to admire the retro-modern design of the web page. Well, they’ve done it again, with all-new retro pixel-art design. It’s so fun and well done, with a bunch of UI elements that you can play with.

Amidst the fun of the presentation, they once again have a slew of great new features, including:

Mad King Watch: Trump Threatens to Interfere With Stadium Deal Unless Washington Commanders Change Name Back to ‘Redskins’ 

Reuters, with a headline that truly could have come from The Onion, “Trump Threatens Washington Stadium Deal Unless NFL Team Readopts Redskins Name”:

U.S. President Donald Trump threatened on Sunday to interfere with a deal to build a new football stadium in Washington, D.C., unless the local NFL team, now known as the Commanders, changes its name back to Redskins. The American football team dropped the name Redskins in 2020 after decades of criticism that it was a racial slur with links to the U.S. genocide of the Indigenous population.

Trump had called for a return to the name Redskins — and for the Cleveland Guardians baseball team to once again adopt the name Indians — on other occasions, but on Sunday he added that he may take official action.

“I may put a restriction on them that if they don’t change the name back to the original ‘Washington Redskins,’ and get rid of the ridiculous moniker, ‘Washington Commanders,’ I won’t make a deal for them to build a Stadium in Washington,” Trump said in a post on his Truth Social platform.

The team moved from Washington to suburban Landover, Maryland, in 1997, but earlier this year reached an agreement with the local District of Columbia government to return to the city with a new stadium expected to open in 2030.

Trump has limited authority to intervene under the current home-rule law governing federal oversight of the District of Columbia, but he has raised the prospect of taking more control, telling reporters in February, “I think we should take over Washington, D.C.”

It should be emphasized — and shame on Reuters for not doing so — that Trump can’t just “take control” of the District of Columbia. Per Article I, Section 8 of the Constitution, it’s Congressional authority that oversees the district, not the Executive branch.

Here are the two posts from his blog that got this obvious attempt to distract from his involvement with Jeffrey Epstein. (“Look at me, I’m a crazy old angry racist, not a creepy old pedophile!”)

Don’t Forget About Atari 

Cory Ondrejka joins in on the 40-year-old retro computing reminiscing:

For being otherwise bright folks, it’s remarkable how completely wrong they all are. The Atari was the best computer to have.

This whole friendly debate reminds me of the oft-cited adage that the best camera is the one you have with you: The best computer in the 1980s was whichever one your parents bought you. I honestly don’t remember anyone I knew who had an Atari computer. Atari game consoles, sure — almost everyone I knew had a 2600, and we all coveted the 5200. But they sure were cool-looking.

Oddly enough, Jack Tramiel* — who founded and named Commodore in 1953 as a typewriter company and was running the company when it launched the PET (1977), VIC-20 (1980), and Commodore 64 (1982) — left the company after a dispute with the board in 1984 (a common industry occurrence in those days, seemingly), founded a new company briefly named Tramel Technology (not “Tramiel”, for ease of spelling), which bought the then-failing consumer business of Atari from Warner Communications and took the Atari name for its own. In 1985 Tramiel launched the Atari ST line at CES. To me the 16-bit Atari ST barely registers in my memory — I don’t think I ever encountered one anywhere, including in a store. When I think of Atari personal computers I think of the 8-bit Atari 800 (pretty cool!) and 400 (horrible — perhaps the worst keyboard ever shipped) from 1979.

(Anyway, neither of those aforecited adages are really true, though. Some cameras are much better than others. And the best computers back then were the Apple II’s.)

* Just me or was Tramiel a dead ringer for character actor Gordon Jump, of WKRP in Cincinnati fame?