By John Gruber
npx workos: An AI agent that writes auth directly into your codebase.
Claude:
In Claude Cowork and Claude Code, you can now enable Claude to use your computer to complete tasks. When Claude doesn’t have access to the tools it needs, it will point, click, and navigate what’s on your screen to perform the task itself. It can open files, use the browser, and run dev tools automatically — with no setup required.
This feature is now available in research preview for Claude Pro and Max subscribers. It works especially well with Dispatch, which lets you assign Claude tasks from your phone.
I think you’re nuts if you try this on your actual Mac, with all your actual data and files. But I thought people were nuts for using a lot of bleeding edge AI features before I tried them myself. It’s certainly notable that Anthropic has shipped agentic AI on the Mac before Apple has, after Apple originally promised it to arrive a year ago.
The Claude Mac client itself remains a lazy Electron clunker. If Claude Code is so good I don’t get why they don’t prove it by using it to make an even halfway decent native Mac app.
See also: Techmeme.
Berber Jin, reporting last week for The Wall Street Journal (gift link):
OpenAI is planning to unify its ChatGPT app, coding platform Codex and browser into a desktop “superapp,” a step to simplify the user experience and continue with efforts to focus on engineering and business customers.
Chief of Applications Fidji Simo will oversee the change and focus on helping the company’s sales team market the new product. OpenAI President Greg Brockman, who currently leads the company’s computing efforts, will help Simo oversee the product revamp and related organization changes, an OpenAI spokeswoman said.
The strategy change marks a major shift from last year, when OpenAI launched a series of stand-alone products that didn’t always resonate with users and sometimes created a lack of focus within the company. OpenAI executives are hoping that unifying its products under one app will allow it to streamline resources as it seeks to beat back the success of its rival Anthropic.
This sounds like an utter disaster in the making. Would it make any sense for Apple to merge Safari, Messages, and Xcode into one “superapp”? No, it would not. It makes no more sense for OpenAI to merge ChatGPT, Codex, and especially Atlas together. I use and very much enjoy ChatGPT because its Mac client is such a good Mac app.
Simo came to OpenAI by way of Shopify and Instacart, so it doesn’t surprise me that she sees OpenAI’s existing product-first culture of creating well-crafted native apps as a problem, not a strength to build on. If this “superapp” plan is true, it’s going to tank everything that heretofore has been good about ChatGPT and Codex.
Sora, on Twitter/X:
We’re saying goodbye to the Sora app. To everyone who created with Sora, shared it, and built community around it: thank you. What you made with Sora mattered, and we know this news is disappointing.
We’ll share more soon, including timelines for the app and API and details on preserving your work.
Sora was kind of fun for a week or two. But, contrary to the above, nothing anyone made with Sora mattered. It was just a very (very) expensive lark.
Good rundown of everything new and changed, as usual, from Juli Clover at MacRumors. This has been a noticeable change for me:
The App Store merges apps and purchase history, and has a dedicated section for app updates. It now takes two taps to get to app updates rather than having them available at the bottom of the profile page.
At first the extra tap irked me, but it really does make more sense for Updates to have its own section. I update apps manually, because I like reading release notes from developers who take the time to document changes, and I also like reading “Bug fixes and performance improvements” over and over and over again from developers who do not.
Samsung:
Samsung is introducing AirDrop support to the Galaxy S26 series, making it easier for users to share content between devices using Quick Share.
The feature will begin rolling out from March 23, starting in Korea and expanding to more regions including Europe, Hong Kong, Japan, Latin America, North America, Southeast Asia, and Taiwan. AirDrop support will initially be available on the Galaxy S26 series, with expansion to additional devices to be announced at a later date.
I presume, but don’t know for certain, that Samsung is using the same reverse-engineered implementation of AirDrop that Google announced for its Pixel 10 phones back in November, and for which Google offered a wee bit of technical details to vouch for the security of the implementation. A month ago, Google expanded support to the Pixel 9 generation.
Apple has, to date, not commented on any of this. I get the feeling there’s nothing they can do about this without breaking AirDrop compatibility between existing Apple devices. It would be kind of funny if AirDrop — never intended as a public protocol — becomes a de facto standard, but FaceTime — which Steve Jobs impulsively announced would become an official standard at its introduction in 2010 (to the complete surprise of both Apple’s legal and engineering teams) — never does.
Steven Troughton-Smith, over the weekend:
Here’s one for the icons-in-menus haters on macOS Tahoe:
defaults write -g NSMenuEnableActionImages -bool NOIt even preserves the couple of instances you do want icons, like for window zoom/resize.
You do not need to restart or log out after applying this setting, but you will need to quit and relaunch any apps that are currently running for it to take effect.
If this worked to hide all of these cursed little turds smeared across the menu bar items of Apple’s system apps in Tahoe, this hidden preference would be a proverbial pitcher of ice water in hell. As it stands, alas, it’s more like half a glass of tepid water. Still quite welcome when you’re thirsty in hell, though.
The problem is that while some of Apple’s system apps obey this setting across the board, others obey it only scattershot, and others still ignore it completely. Apple’s AppKit apps — real Mac apps — are the most likely to obey it. In the Finder, Notes, Photos, Preview, and TextEdit, it pretty much kills all menu item icons, leaving behind only a few mostly useful ones. (Among the random inconsistencies: Preview still shows an icon for the File → Print command — a stupid printer icon, natch — but none of the other apps listed above show an icon for the Print command.)
Mail and Calendar are more scattershot. Calendar hides most menu item icons, but keeps a few in the File menu. Mail is more like half-and-half, with no apparent rhyme or reason to which menu items still show icons. In the Mailbox menu, nearly all items have their icons removed; in the Messages menu, most keep their icons even with this setting set to hide them.
Safari is a heartbreak. It’s one of my favorite, most-used apps, and generally, one of Apple’s best exemplars of what makes a great Mac app a great Mac app. But with this setting enabled, only a handful of seemingly random menu items have their icons hidden. For example, here is the File menu in Safari v26.3.1, before and after applying this setting:
So, after applying a setting that should hide almost all menu item icons, 15 out of 18 menu items still have icons in Safari’s File menu — with no rhyme or reason to the 3 that are omitted. Safari’s other menus are similarly noncompliant. Like I said, heartbreaking.
(All is not lost in Safari, however — the setting does remove the icons from Safari’s contextual menu.)
Apple’s non-AppKit (Catalyst/UIKit/SwiftUI) Mac apps are mostly lost causes on this front. Messages, Maps, and Journal keep all their icons, except for the Window menu. The iPhone Mirroring app hides the icons from its Edit and Window menus, but keeps all of them in the View menu.
So it’s a mixed bag. But even a mixed bag is better than seeing all of these insipid ugly distracting icons. Apple should fix these apps so they all fully support this global preference (that’s what the -g switch in Troughton-Smith’s command-line incantation means), and should expose this setting as a proper, visible toggle in the System Settings app. And of course, in MacOS 27, Apple should remove most of these icons from these apps, leaving behind only the handful that add actual clarity to their menu items. There’s an outcome just waiting to be had where the MacOS menu bar is better than it used to be, not worse, by carefully adding icons only next to commands where the icons add clarity.
My favorite example: commands to rotate images, like the Tools → Rotate Left and Rotate Right commands in Preview, and Image → Rotate Clockwise and Rotate Counterclockwise in Photos.1 The rule of thumb should be that menu items should have icons if the icon alone could provide enough of a clue to replace the command name. That’s very much true for these Rotate commands, and the icons help reduce the cognitive load of thinking about which way is clockwise.
And but so what about third-party Mac apps? I think the best solution is for third-party apps to ignore Apple’s lead, and omit menu item icons on apps that have been updated for the new appearance on MacOS 26 Tahoe. That’s what Brent Simmons has done with NetNewsWire 7, using code he published as open source. Rogue Amoeba Software has adopted the same technique to improve their suite of apps when running on Tahoe, and published this blog post, illustrated with before and after screenshots, to explain their thinking.
No one is arguing that icons never improve the clarity of menu items. But for the most part, menu commands should be read. If a few special menu items are improved by including icons, include just those. They’ll stand out, further improving clarity. Part of the problem with Apple’s “almost every menu item has an icon” approach with their own apps on Mac OS 26 Tahoe is that — as copiously documented by Nikita Prokopov and Jim Nielsen — the overall effect is to add visual clutter, reducing clarity. But a side effect of that clutter is that it reduces the effectiveness of the menu items for which icons are actually useful (again, like Rotate commands, or the items in the Window → Move & Resize submenu). If every menu item has an icon, the presence of an icon is never special. If only special menu items have icons, the presence of an icon is always special.2 ★
It should go without saying that these commands in Preview and Photos should use the same terms. Either both should use Rotate Left/Right, or both should use Rotate Clockwise/Counterclockwise. I personally prefer Clockwise/Counterclockwise, but the inconsistency is what grates. In the heyday of consistency in Apple’s first-party Mac software, Apple’s apps were, effectively, a living HIG. If you were adding a Rotate command to your own application, and you were unsure whether to call it “Rotate Right” or “Rotate Clockwise”, you could just check what Apple did, in its own apps, and feel certain that you were doing the right thing, using the correct terms. ↩︎
BBEdit offers a great example. BBEdit can be used, free of charge, in perpetuity with a limited (but robust!) subset of its full feature set. Its full feature set is unlocked with a one-time purchase for each major release version. But the full feature set is available as a 30-day trial — which trial period is reset each time a major new version is released. During that trial period, menu commands that are paid features are available to use, but marked with a “★” icon. (A very fine choice of icon, if you ask me.) Here, for example, are screenshots of BBEdit’s Text and Go menus while in trial mode. When the trial period ends, those commands are disabled, but remain visible in the menus, still marked with those star icons. Thus, during the free trial period, users can see which commands they’re using that they’ll need to pay for when the trial ends, and after the trial ends, they can see which features are locked. (After you purchase a license, those star icons just go away.) ↩︎︎
I love a single-purpose website like this. (I had no idea gas was so expensive in Hong Kong.)
Apple Newsroom:
WWDC kicks off with the Keynote and Platforms State of the Union on Monday, June 8. The conference continues online all week with over 100 video sessions and interactive group labs and appointments, where developers can connect directly with Apple engineers and designers to explore the latest announcements. The conference will take place on the Apple Developer app, website, and YouTube channel; and on the Apple Developer bilibili channel in China.
I’ve never before heard of Bilibili, which seems to be a Chinese equivalent to YouTube.
As usual, there’s a lottery of sorts to attend the keynote in person.
Here’s a post from 2015, linking to Rene Ritchie, then still at iMore, explaining how iMore found itself serving ever worse (and more reader hostile) ads. Not much has changed regarding the state of web advertising in a decade, and iMore — once a truly great site — is defunct.
What a lovely thing to drop amidst my recent consternation over the state of web design.
To paraphrase Richard III: A horse, a horse! My kingdom for native app developers with the conviction of the artist-developers in The HTML Review.
My thanks to Mux for sponsoring last week at DF. Video isn’t just something to watch; it’s a boatload of context and data. Mux makes it easy to ship and scale video into anything from websites to platforms to AI workflows. Unlock what’s inside: transcripts, clips, and storyboards to build summarization, translation, content moderation, tagging, and more.
Mux stewards Video.js, the web’s most popular open source video player. Video.js v10 is a complete architectural rebuild, with the beta now available at videojs.org.
Mux is video infrastructure trusted by Patreon, Substack, and Synthesia. Get started free, no credit card required. Use code FIREBALL for an extra $50 credit.
The sitting president of the United States, on his blog:
Robert Mueller just died. Good, I’m glad he’s dead. He can no longer hurt innocent people! President DONALD J. TRUMP
As the elderly descend further into dementia, they lose their sense of propriety and simply speak their mind. (They also get confused and think they need to “sign” their text messages and social media posts.) Say what you want about Trump’s truthfulness generally, but here, he’s just being brutally honest. Let’s keep his “Good, I’m glad he’s dead” post bookmarked for when Trump himself finally keels over — after he chokes on a hamburger or whatever it’ll be that finally does him in — and the good people of the world rejoice and celebrate.
Stuart Breckenridge, examining a web page at PC Gamer:
Third, this is a whopping 37MB webpage on initial load. But that’s not the worst part. In the five minutes since I started writing this post the website has downloaded almost half a gigabyte of new ads.
This is so irresponsible and unprofessional it beggars belief. Web browsers ought to defend against this. Why not cap page loads by default at, I don’t know, 5 MB? And require explicit consent to download any additional content?
Greg Bensinger, reporting for Reuters:
The latest effort, known internally as “Transformer,” is being developed within its devices and services unit, according to four people familiar with the matter. The phone is seen as a potential mobile personalization device that can sync with home voice assistant Alexa and serve as a conduit to Amazon customers throughout the day, the people said. [...]
As envisioned, the new phone’s personalization features would make buying from Amazon.com, watching Prime Video, listening to Prime Music or ordering food from partners like Grubhub easier than ever, the people said. They asked for anonymity because they were not authorized to discuss internal matters.
The problem with this pitch is that it’s not hard at all to buy from Amazon.com, watch Prime Video, listen to Prime Music, or order food from Grubhub using the phones we already have. All of those things are ridiculously easy. I mean, I get it. On an Amazon phone, your Amazon ID would be your primary ID for the system. So those Amazon services would all just work right out of the box. But you can’t get people to switch from the thing they’re used to (and, in the case of phones, especially iPhones, already enjoy) unless you’re pitching them on solving problems. No one has a problem buying stuff or using Amazon services on the phone they already own.
A key focus of the Transformer project has been integrating artificial intelligence capabilities into the device, the people said. That could eliminate the need for traditional app stores, which require downloading and registering for applications before they can be used.
This is just nonsense. No matter how good Amazon’s AI integration might be, it isn’t going to replace the apps people already use. If you use WhatsApp, you need the WhatsApp app. If you want to watch video on Netflix, you need the Netflix app. If you surf Instagram and TikTok, you need those apps. If Amazon tries shipping a phone without any of those apps — let alone without all of them — this new “Transformer” phone will be a bigger laughingstock than the Fire phone was a decade ago. And we’re all still laughing at the dumb Fire phone. Which means they can’t eliminate “traditional app stores”.
People aren’t clamoring for the elimination of app stores. People like app stores. If Amazon, or anyone else, is going to introduce a new type of “AI-first” phone to disrupt the iPhone/Android duopoly, it has to offer something amazingly appealing. Nothing in Reuters’s description of Transformer fits that description. Also, it’s not like Amazon has market-leading AI. At the moment that feels like a three-way game between OpenAI, Anthropic, and Google.
Sean Hollister, The Verge (gift link):
After doing something similar in its Google Discover news feed, it’s starting to mess with headlines in the traditional “10 blue links,” too. We’ve found multiple examples where Google replaced headlines we wrote with ones we did not, sometimes changing their meaning in the process.
For example, Google reduced our headline “I used the ‘cheat on everything’ AI tool and it didn’t help me cheat on anything” to just five words: “‘Cheat on everything’ AI tool.” It almost sounds like we’re endorsing a product we do not recommend at all.
What we are seeing is a “small” and “narrow” experiment, one that’s not yet approved for a fuller launch, Google spokespeople Jennifer Kutz, Mallory De Leon, and Ned Adriance tell The Verge. They would not say how “small” that experiment actually is. Over the past few months, multiple Verge staffers have seen examples of headlines that we never wrote appear in Google Search results — headlines that do not follow our editorial style, and without any indication that Google replaced the words we chose. And Google says it’s tweaking how other websites show up in search, too, not just news.
This is way past “jumping the shark” territory. This is Jaws 3-D totally-lost-the-plot territory. Jesus H. Christ.
Regarding my earlier post expressing confusion/discomfort with Bluesky announcing a $100 million funding round almost an entire year after it closed, I had an interesting back-and-forth with Adam Vartanian on Bluesky (natch), where he wrote:
If you see press reports that says a company “has raised” some money but no date on when the round closed, it probably happened some time in the past. Bluesky is actually unusual in disclosing a date that’s so far in the past.
I kept thinking that I must be missing something in this story, and this feels like it must be exactly that something. If true, it’s not unusual these days for a company to announce a seeding round long after it actually closed. What’s unusual in this case with Bluesky is that when they finally did announce it, they revealed the long-ago date it closed, too. That it was, in fact, an act of transparency, at least in comparison to many other venture-backed companies today.
Bluesky:
In April 2025, Bluesky raised $100 million in Series B funding led by Bain Capital Crypto, with participation from Alumni Ventures, Anthos Capital, Bloomberg Beta, Knight Foundation and True Ventures. In the months since, we’ve focused on scaling our team to meet the rapid growth of both the AT Protocol (atproto) and Bluesky app. We’re excited to share more as we move into a new era of leadership and further growth.
This raise was led by Bluesky founder Jay Graber, who recently transitioned to Chief Innovation Officer to focus on building the future of open social infrastructure.
I didn’t post about Graber’s stepping aside as CEO earlier this month because I didn’t make much of it. I’ve been bullish on Bluesky since its inception, but I haven’t been thrilled by it of late. I don’t think it’s gotten any worse, but its growth has stalled, leaving it in the limbo between ghost town and boom town. For many products/services/businesses/publications, a sustained popularity that’s less than booming is fine. Niches can work, or thrive even. Daring Fireball is clearly a niche publication. But for social networks, two decades of evidence suggests that anything less than booming is a problem.
But what the hell are we to make of a $100 million funding round that wasn’t announced for 11 months? Is this commonplace, and I just somehow never before took note of a company keeping a large funding round secret for a year? Or is this as weird as I’m thinking it is? I always thought big funding rounds were things companies wanted to immediately promote, not hide. This roundup of links at Techmeme suggests I’m not alone.
Update, 2 hours later: The explanation I’ve now heard, from a source in a good position to have an informed take, is that it is unusual. But basically it’s a unique series of events, at a unique time (post–2024 election, when Bluesky experienced a nice surge), for a unique company. So: weird, yes. Cause for alarm, probably not.
See also: This follow-up post.
Quiche Browser is a rather astonishing app from the one-man indie developer Greg de J./Quiche Industries. (What a killer domain name that is.) Quiche Browser is a very robust, exquisitely designed, stunningly handsome web browser exclusively for iPhone. Just iPhone — although an iPad version is currently in beta. I switched to it as my default iPhone web browser last summer, thinking I’d only stick with it for a day or two before going back to Safari, and I wound up sticking with it for a few weeks. I did go back to Safari, but it was a remarkably close call. So close that, today, I’m going to give it another try. (And I was so enamored during my month-long affair with Quiche that I gladly subscribed to Quiche Plus for $27/year to support such a remarkable app.)
Out of the box, every single aspect of Quiche Browser’s UI and feature set is designed with obvious thought and care. But it also supports a rich array of settings to tweak the design. You can customize the appearance style of the toolbar, the location of the toolbar, the buttons on the toolbar. Quiche brings to iOS something very much akin to AppKit’s Customize Toolbar from the Mac, but if anything, what Quiche implements is more customizable. The typography throughout the app is exquisite. It doesn’t support Safari extensions but it has its own built-in content blocker. And, of course, it has built-in support for Kagi, the world’s best search engine.
What got me thinking about Quiche Browser again today was this tweet on Mastodon from the developer:
One of the many reasons I made Quiche Browser was to get a per-website JavaScript kill switch in my toolbar.
But these days I’m even tempted to disable JavaScript everywhere and enable it only where needed.
A simple one-tap “JS” button you can toggle on any website. I missed this button when I was test-driving Quiche a few months ago. Every browser should have this button. It’s almost unbelievable how much it improves so many websites.
That “JS” button alone isn’t why you should check out Quiche. It’s the whole thing. It’s just so thoughtful. So utterly modern in its appearance and features, but old-school in its hyperfocus on serving you, the user, through craftsmanship.
Jeff Johnson, linking to my “Your Frustration Is the Product” piece:
My browser extension StopTheMadness Pro stops autoplaying videos and hides Sign in with Google on all sites. It also hides sticky videos and notification requests on many sites.
For more extreme measures, try my Safari extension StopTheScript. It kills JavaScript dead on websites you select. For example, from the blog post, it makes The Guardian readable.
These are both great extensions, and I have both installed for use in Safari on all my devices. StopTheScript is a bit peculiar, by nature of how it does what it does, but Johnson has a great illustrated tutorial for it and a good blog post explaining which sites he uses it on and why.
Over on the Chrome/Chromium side, there’s a very slick extension called Quick JavaScript Switcher. It’s free, but the developer (Maxime Le Breton) asks for a 5€ donation. QJS adds a simple JS on/off switch to the toolbar.
A lot of stuff doesn’t load when you just completely disable JavaScript for a site. You might be surprised just how much of that stuff is shit you don’t want or won’t miss.
Or, you can go the other way, give in, stop fighting the man, and install OnlyAds — an extension that hides everything on a website except the ads.
Javier C. Hernández, reporting for The New York Times:
He was responding to a question about why Japan and other allies had received no advance notice of the U.S.-Israeli assault on Iran.
“We didn’t tell anybody about it because we wanted surprise,” he said. “Who knows better about surprise than Japan, OK? Why didn’t you tell me about Pearl Harbor, OK? Right?”
There was some laughter from the officials and journalists gathered in the room. “You believe in surprise, I think, much more so than us,” he added.
As Trump sinks further into dementia and his presidency slides further into disarray, his administration, in a sick way, gets funnier and funnier.
Anne Applebaum, writing for The Atlantic (gift link):
Specifically, they remember that for 14 months, the American president has tariffed them, mocked their security concerns, and repeatedly insulted them. As long ago as January 2020, Trump told several European officials that “if Europe is under attack, we will never come to help you and to support you.” In February 2025, he told Ukrainian President Volodymyr Zelensky that he had no right to expect support either, because “you don’t have any cards.” Trump ridiculed Canada as the “51st state” and referred to both the present and previous Canadian prime ministers as “governor.” He claimed, incorrectly, that allied troops in Afghanistan “stayed a little back, a little off the front lines,” causing huge offense to the families of soldiers who died fighting after NATO invoked Article 5 of the organization’s treaty, on behalf of the United States, the only time it has done so. He called the British “our once-great ally,” after they refused to participate in the initial assault on Iran; when they discussed sending some aircraft carriers to the Persian Gulf conflict earlier this month, he ridiculed the idea on social media: “We don’t need people that join Wars after we’ve already won!”
Meanwhile, Irina Slav at Oilprice.com writes that oil — which was trading around $60 per barrel before the war — might soon be headed to $150–200 per barrel. $200! Energy Common Sense reports “This is now a multi-month, likely rest-of-year story of elevated prices and elevated risk.” Axios reports that most Americans will soon be paying over $4/gallon for gasoline, but I walked by Center City Philly’s lone gas station at lunch, and regular gas remains under $4 and premium under $5 — both with an entire one-tenth of one cent to spare.
Although President Donald Trump says he has “destroyed 100% of Iran’s Military Capability”, the 0% that remains is playing havoc with the global economy by choking off 10-15% of its oil supply.
This whole dumb fiasco might go down as the canonical example for the phrase “hoist with his own petard”. You just hate to see it.
Mark Simonson:
Just by coincidence, I discovered a copy of U&lc magazine in the graphics classroom. U&lc was published by ITC, the International Typeface Corporation, a typeface publisher, and the designer and editor was the legendary Herb Lubalin. I’d never seen such beautiful typography and design. It was a motherlode for an aspiring typophile like me. [...]
I decided right then that someday, somehow, I wanted to design typefaces.
Adamya Sharma, reporting for Android Authority:
When Google execs previously said sideloading would become a high-friction process on Android, they really weren’t kidding. The company is finally sharing what Android’s new sideloading flow will look like in practice, and if you’re someone who installs apps outside the Play Store, you’re going to feel it immediately, and you’re going to feel it deeply. [...]
When Android’s new sideloading rules come into force, installing apps from developers without Google verification (more on that later) will become extremely tedious by design and require a 24-hour lock before users can install them.
Here’s Google’s own explanation of the new restrictions. “Open always wins”, baby.
Would be interesting to hear Tim Sweeney’s thoughts on this, but he took a sack of cash in exchange for agreeing that whatever Google does with Android hence is “procompetitive” until 2032.
One of the most controversial opinions I’ve long espoused, and believe today more than ever, is that it was a terrible mistake for web browsers to support JavaScript. Not that they should have picked a different language, but that they supported scripting at all. That decision turned web pages — which were originally intended as documents — into embedded computer programs.
There would be no 49 MB web pages without scripting. There would be no surveillance tracking industrial complex. The text on a page is visible. The images and video embedded on a page are visible. You see them. JavaScript is invisible. That makes it seem OK to do things that are not OK at all.
In my piece riffing on Bose’s “The 49MB Web Page” yesterday, I reiterated my also-longstanding argument that publications with print editions do things with their websites that they’d never in a million years do with their print editions. The way The New York Times uses JavaScript to present popovers that obstruct reading the actual article text would be the equivalent of them gluing pages together in the print edition, using tape labeled with an advertisement. They wouldn’t do that. But they do the equivalent, using JavaScript, on every page of their website.
Here’s a simple AppleScript I wrote this week — one that solves a minor itch I’ve had for, jeez, 20 years. Almost every item I post to Daring Fireball goes through MarsEdit, the excellent Mac blogging client from Red Sweater Software (my friend Daniel Jalkut). MarsEdit has a built-in “local drafts” feature, where you can save unpublished drafts within a library in MarsEdit itself. It doesn’t happen often but I occasionally wind up with partially written posts that I don’t publish, but don’t want to throw away. But I don’t really want to keep them in MarsEdit. I want them saved as text files. For me, those text files go in a folder in Dropbox. For someone else, maybe they go in iCloud Drive.
I write my longer posts in BBEdit, and then copy them into a MarsEdit document when they’re ready to publish. My shorter posts — which is most of them — are usually entirely composed in MarsEdit. Any abandoned drafts that I might return to, I probably want to compose in BBEdit, because the reason they’re abandoned is that they need to be longer. Or they need to be shorter. But either way they need more thought, and BBEdit is where I go to do my most concentrated thinking.
MarsEdit doesn’t have a built-in way to save a document window as a text file. Just its built-in “Save as Local Draft” feature. I didn’t merely suspect but knew that it’d be relatively easy to write an AppleScript to add a “Save as Text File…” feature to MarsEdit, which I could invoke within MarsEdit from FastScripts, the system-wide scripts menu utility that is also from Red Sweater/Jalkut, and, using FastScripts, I could even give the script the standard keyboard shortcut Option-Command-S. (Or is it Command-Option-S?)
It’ll take a window like this:
and then prompt you with a system Save dialog to enter a filename (defaulting to the Title field contents, if any, in the MarsEdit document) and location to save the text file. AppleScript even conveniently remembers the last place you saved a file, so it defaults to the same folder the next time you invoke it, without the script doing any work to remember that. The text file looks like this:
Title: AppleScript: 'Save MarsEdit Document to Text File'
Blog: ★ Daring Fireball
Edited: Thursday 19 March 2026 at 12:16:29 pm
Tags: AppleScript, MarsEdit
Slug: AppleScript: 'Save MarsEdit Document to Text File'
Excerpt:
---
[Here's a simple AppleScript I wrote this week][s] -- one that
solves a minor itch I've had for, jeez, 20 years. Almost every
item I post to Daring Fireball goes through [MarsEdit], the
excellent Mac blogging client from Red Sweater Software (my
friend [Daniel Jalkut]). ...
That’s it. If you use MarsEdit, maybe it’ll help you. I picked the document fields in MarsEdit that I use (Title, Tags, Excerpt, etc.). One potential point of confusion is that while MarsEdit has an optional document field named “Slug”, I don’t use it. For historical reasons, I use Movable Type’s “Keyword” field for the words I want to use for the URL slug for each post. So in my text files, where it says “Slug:”, the text after that label comes from MarsEdit’s Keywords field. And I keep MarsEdit’s actual Slug field hidden, because I don’t use a field with that name in Movable Type. Your mileage, as ever, may vary. But this makes total sense to me.
Anyway, this script helped me clean up 29 drafts, some of them years old, that had been sitting around in MarsEdit, bugging me. Now my “Local Drafts” library in MarsEdit is empty, and those drafts are safe and sound in text files in Dropbox. When something in your workflow is bugging you, you should figure out a way to address it. Why I didn’t write (and share) this script years ago is a mystery for the ages. ★
Special guest David Pogue discusses his excellent and amazingly comprehensive new book, Apple: The First 50 Years.
Sponsored by:
Shubham Bose, “The 49MB Web Page”:
I went to the New York Times to glimpse at four headlines and was greeted with 422 network requests and 49 megabytes of data. It took two minutes before the page settled. And then you wonder why every sane tech person has an adblocker installed on systems of all their loved ones.
It is the same story across top publishers today.
This is an absolutely devastating deconstruction of the current web landscape. I implore you to pause here, and read Bose’s entire amply illustrated essay. I’ll wait.
Even websites from publishers who care about quality are doing things on the web that they would never do with their print editions. Bose starts with The New York Times, but also mentions The Guardian, whose web pages are so laden with ads and modals that their default layout, on a mobile device, sometimes leaves just 11 percent of the screen for article content. That’s four lines of article text.
Bose writes:
Viewability and time-on-page are very important metrics these days. Every hostile UX decision originates from this single fact. The longer you’re trapped on the page, the higher the CPM the publisher can charge. Your frustration is the product. No wonder engineers and designers make every UX decision that optimizes for that. And you, the reader, are forced to interact, wait, click, scroll multiple times because of this optimization. Not only is it a step in the wrong direction, it is adversarial by design.
The reader is not respected enough by the software. The publisher is held hostage by incentives from an auction system that not only encourages but also rewards dark patterns.
I disagree only insofar as the reader isn’t respected at all. Part of my ongoing testing of the MacBook Neo is that I’ve been using it in as default a state as possible, only changing default settings, and only adding third-party software, as necessary. So I’ve been browsing the web without content-blocking extensions on the Neo. It’s been a while since I’ve done that for an extended period of time. Most of the advertising-bearing websites I read have gotten so bad that it’s almost beyond parody.
And even with content blockers installed (of late, I’ve been using and enjoying uBlock Origin Lite in Safari), many of these news websites intersperse bullshit like requests to subscribe to their newsletters, or links to other articles on their site — often totally unrelated to the one you’re trying to read — every few paragraphs. And the fucking autoplay videos, jesus. You read two paragraphs and there’s a box that interrupts you. You read another two paragraphs and there’s another interruption. All the way until the end of the article. We’re visiting their website to read a fucking article. If we wanted to watch videos, we’d be on YouTube. It’s like going to a restaurant, ordering a cheeseburger, and they send a marching band to your table to play trumpets right in your ear and squirt you with a water pistol while trying to sell you towels.
No print publication on the planet does this. The print editions of the very same publications — The New York Times, The Guardian, The Wall Street Journal, The Atlantic, The New Yorker — don’t do anything like this. The print edition of The New Yorker could not possibly be more respectful of both the reader’s attention and the sanctity of the prose they publish. But read an article on their website and you get autoplaying videos interspersed between random paragraphs. And the videos have nothing to do with the article you’re reading. I mean, we should be so lucky if every website were as respectfully designed as The New Yorker’s, but even their website — comparatively speaking, one of the “good ones” — shows only a fraction of the respect for the reader that their print edition does.
Without an ad-blocking content blocker running, one of the most crazy-making design patterns today is repeating the exact same ad within the same article, every few paragraphs. It’s hard to find a single article on Apple News — a sort of ersatz pidgin version of the web — that does not do this. The exact same ad — 6, 7, 8 times within the same article. How many 30-something blonde white women need hearing aids? It’s insane.
People are spending less and less time on the web because websites are becoming worse and worse experiences, but the publishers of websites are almost literally trying to dig their way out of that hole by adding more and more of the reader-hostile shit that is driving people away. The Guardian screenshot Bose captured, where only 11 percent of the entire screen shows text from the article, is the equivalent of a broadcast TV channel that only showed 7 minutes of actual TV content per hour, devoting the other 53 minutes to paid commercials and promotions for other shows on the same channel. Almost no one would watch such a channel. But somehow this strategy is deemed sustainable for websites.
The web is the only medium the world has ever seen where its highest-profile decision makers are people who despise the medium and are trying to drive people away from it. As Bose notes, “A lot of websites actively interfere the reader from accessing them by pestering them with their ‘apps’ these days. I don’t know where this fascination with getting everyone to download your app comes from.” It comes from people who literally do not understand, and do not enjoy, the web, but yet find themselves running large websites.
The people making these decisions for these websites are like ocean liner captains who are trying to hit icebergs. ★
This support page is a fascinating footnote regarding the recent changes Apple has made to their U.S. key cap labels.
Who do you turn to when you’re Christie’s and you want to commission the finest rostrum the world has ever seen? Who else but Jony Ive and LoveFrom. I mean, I’d love to snark about this, but goddamnit, that’s a lovely piece of furniture.
David Heaney, writing for UploadVR:
Meta Horizon Worlds is dropping VR support in June, meaning it will only be available as a flatscreen experience for the web and smartphones.
By March 31, Meta says the Horizon Worlds app will be delisted from Quest’s store, and key first-party worlds such as Horizon Central, Events Arena, Kaiju, and Bobber Bay will no longer be accessible in VR. Then, from June 15, the Horizon Worlds app will be removed from Quest headsets, and all worlds will no longer be accessible in VR.
Yours truly, three months ago: “Meta Says Fuck That Metaverse Shit”.
Jake Conley, reporting for Yahoo Finance:
If the deal closes, Zaslav will receive $517.2 million in equity that would trigger if and when the sale goes through, along with roughly $34.2 million in cash and $44.2 million in benefits tied to the value of health coverage reimbursement. The Warner Bros. CEO will also get roughly $335.4 million in tax reimbursements. **
Just before the end of February, Warner Bros. agreed to a full acquisition by Paramount Skydance at $31 per share in a deal valued at about $110 billion.
The cash and equity are outrageous enough, but what in the everlasting fuck is “$44.2 million in benefits tied to the value of health coverage reimbursement”? They might as well pay Zaslav an extra $40 million for reticulating splines while they’re at it.
[Update: Variety reports that Zaslav is getting $44,195 in “continued health coverage reimbursement benefits”, which suggests that Conley at Yahoo incorrectly assumed a couple of extra zeroes on the health coverage number. Which would be a reasonable mistake to make — who but a total asshole would give a shit about $44,000 in insurance benefits as part of a $550 million heist? Assuming that was a mistake, Conley’s error wasn’t assuming the extra zeroes, it was forgetting that Zaslav is, quite obviously, a total asshole.]
The man redesigned the HBO logo five times, the company lost 50% of its value, and he made $887 million. We might be looking at the greatest businessman to ever exist.
The greatest something, for sure. I wouldn’t use the word “businessman”.
MacKenzie Sigalos, writing for CNBC, under the misleading headline “Tim Cook Squashes Retirement Rumors, Says He ‘Can’t Imagine Life Without Apple’”:
Asked about reports that he was preparing to step aside, Cook told ABC, “No, I didn’t say that. I haven’t said that. I love what I do deeply. Twenty-eight years ago, I walked into Apple, and I’ve loved every day of it since.”
He added that he “can’t imagine life without Apple.”
The Good Morning America interview was with Michael Strahan, in a five-minute segment for the show. Strahan actually did a decent job. He asked Cook if Apple expects to be reimbursed for the $3+ billion dollars they spent on Trump’s tariffs last year, now that the Supreme Court has ruled them invalid. (Cook says they’re waiting to see what the courts say about getting that money back.) Strahan then asked a pretty pointed question about Cook’s high-profile appearances alongside Trump — attending the inauguration (Strahan didn’t mention that Cook paid Trump $1 million for the honor to attend), the 24-karat-gold Apple-logo trophy, attending the White House premiere of Melania. Cook answered by saying he’s not political and only cares about policy, which makes sense only if you believe government policy decisions aren’t political — which is to say it makes no sense. But Strahan asked, and Cook’s answer speaks for itself.
But to the point of Sigalos’s report on the interview for CNBC, Cook didn’t “squash” anything related to his tenure at Apple in that interview. Watch for yourself. Cook correctly points out that he himself has never said anything (in public, at least) about being tired or wanting to “step back a little bit”, as Strahan claimed he had read. But Cook does not refute that he might soon step aside as CEO, nor does he say he intends to remain CEO for the foreseeable future. It’s an incredibly deft non-answer that would remain true if Cook steps down as CEO in two weeks, on April 1 (Apple’s anniversary), and would remain true if he’s still CEO five years from now. (The “can’t imagine life without Apple” comment would fit like a glove if, say, he steps aside as CEO but becomes executive chairman of the board.)
This headline is journalistic malpractice from CNBC.
The rest of Sigalos’s report is even worse:
The comments come after a turbulent stretch for Apple’s C-suite. In December, the company lost AI chief John Giannandrea, its top lawyer and a key design executive in a single week — while chip guru Johny Srouji reportedly signaled he might leave, too.
The departures raised pointed questions about whether Cook’s operational leadership style is the right fit for the artificial intelligence era.
Where to even start with this? Jiminy.
Giannandrea was shown the door after he blew it with Apple Intelligence. Cook took Giannandrea’s responsibilities away almost a year ago, weeks after the company’s embarrassing admission that next-generation Siri would be delayed by at least a full year. The December news was that Giannandrea was officially “retiring”, but that was just Cook allowing him as graceful and dignified an exit as possible. He was effectively fired back in April or May.
Kate Adams, Apple’s general counsel, just plain old retired in December after a successful nine-year stint in the role. Lisa Jackson announced her retirement as VP of environment, policy, and social initiatives, alongside Adams. Zero drama around either of their departures — just, for Apple, coincidentally bad timing.
The Alan Dye leaving for Meta thing, that was unexpected, and, to some degree, turbulent. But I have yet to speak to a single person within Apple, nor a single UI designer outside Apple, who thinks it’s anything but good news for Apple that Dye jumped ship for Meta. Not just that Dye is a fraud of a UI designer. Not just that he and his inner circle have vandalized MacOS, the crown jewel of human-computer interaction. Not just that he and his team are given — or have taken — credit for innovative, high-quality work on VisionOS that really belongs to the interaction team Mike Rockwell put together for VisionOS. Not just that Dye left Apple for a rival company, period — something unheard of amongst Apple’s bleed-in-six-colors executive ranks. But that he left for Meta, of all fucking companies? That’s the proof that Dye (and his urban cowboy magazine-designer cohort) never belonged at Apple in the first place.
And then there’s the Srouji thing, which was reported only once, by Mark Gurman at Bloomberg, and then effectively retracted two days later after Srouji shot it down with a meant-to-leak memo to his staff. My own reporting, talking to several sources close to and in some cases within Apple’s executive ranks, is that there is no truth to Gurman’s Bloomberg report that Srouji threatened Tim Cook that he was considering leaving Apple for a competitor.
To believe that report, you need to believe not only that Srouji is unhappy while seeing his life’s work flourish, leading what is inarguably one of the most successful silicon design divisions in the history of computing, and but also that at age 62, he would consider leaving Apple not to retire but to head up chip design at another company — any of which possible destinations being a company that is years behind Apple in chip design. And you have to believe that it’s a successful tactic for senior executives at Apple to get what they want from Tim Cook by threatening him with poaching offers from competing companies. And that Johny Srouji would either personally leak this to Mark Gurman, or loose-lippedly blab about it to someone who would leak it to Mark Gurman. And that Gurman reporting the already-very-difficult-to-believe story at Bloomberg, making private negotiations public and embarrassing both Cook personally and Apple as a company, would lead Tim Cook to cave in and do whatever it took to make Srouji happy enough to stay at Apple and write that memo refuting the report.
That does not sound like Tim Cook.
Is that report, and all that it implies, possible? Sure. It’s also possible that monkeys might fly out of my butt. It’s also possible that the Srouji story was bogus, seeded by a company that had just poached an Apple executive, and had successfully spun that story in their favor to such an extent that Bloomberg called it a “major coup” in its headline, and their intention with the bogus Srouji story was to put the narrative out there to seed doubt about Apple as a company and Cook’s leadership, personally.
Mission accomplished, at least with the gullible reporters and editors at CNBC. ★
Fox Sports, on Twitter/X:
Tonight, watch the WBC Final in a full immersive experience on the Fox Sports XR app for the Galaxy XR headset powered by Android XR!
The Fox Sports app in the App Store is native only on iOS (iPhone and iPad), Apple TV, and Apple Watch. So, unless I’m missing something, not only are they not streaming it immersively on VisionOS, they don’t even have a native VisionOS app.
Jess Weatherbed, The Verge:
Samsung is preparing to axe its first three-panel foldable phone less than three months after launching the device in the US. Sales of the $2,899 Galaxy Z TriFold will first be wound down in Korea and then discontinued in the US once remaining inventory has been cleared, an unnamed Samsung spokesperson told Bloomberg.
Maybe five blades on a razor is too many?
Stephen Hackett:
I was just going about my day then James Thomson of PCalc and other fine applications dropped these images on me and said I could share them.
Also, something fun for those of you with 3D printers.
Another crackerjack essay on design and attention from Terry Godier. (Note that the Casio in the essay not only shows the actual time, but has functional buttons.)
Apple Newsroom today:
Apple today announced AirPods Max 2, bringing even better Active Noise Cancellation (ANC), elevated sound quality, and intelligent features to the iconic over-ear design. Powered by H2, features like Adaptive Audio, Conversation Awareness, Voice Isolation, and Live Translation come to AirPods Max for the first time. The new AirPods Max also unlock creative possibilities for podcasters, musicians, and content creators, with useful features like studio-quality audio recording and camera remote.
AirPods Max 2 will be available to order starting March 25 in midnight, starlight, orange, purple, and blue, with availability beginning early next month.
Seemingly no change to the Smart Case for the Max, which I know some people were hoping for. (I only use AirPods Pro, not Max, but when I tested the original AirPods Max I thought the case was fine.) Here’s a link to Apple’s Compare page showing all the differences between the Max 2 and original Max, with AirPods Pro 3 in the third slot. (Archived for posterity here.) One neat new feature: the Max 2 will support using the Digital Crown button as a remote camera shutter button for a paired iPhone or iPad.
Some camera-equipped Apple devices have dedicated camera indicator lights. E.g. recent MacBook Pros and MacBook Airs have them in the notch, next to the camera itself. The Studio Display has one in the bezel, next to its camera. Other devices — like iPhones and, now, the MacBook Neo — render a green indicator dot on the device’s display. One might presume that the dedicated indicator lights are significantly more secure than the rendered-on-display indicators. I myself made this presumption in the initial version of my MacBook Neo review last week. This presumption is, I believe, wrong.
Later last week Apple published, and I linked to, a small update in their Platform Security Guide, which states:
MacBook Neo combines system software and dedicated silicon elements within A18 Pro to provide additional security for the camera feed. The architecture is designed to prevent any untrusted software — even with root or kernel privileges in macOS — from engaging the camera without also visibly lighting the on-screen camera indicator light.
The reason it’s tempting to think that a dedicated camera indicator light is more secure than an on-display indicator is the fact that hardware is generally more secure than software, because it’s harder to tamper with. With hardware, a dedicated hardware indicator light can be connected to the camera hardware such that if the camera is accessed, the light must turn on, with no way for software running on the device, no matter its privileges, to change that. With an indicator light that is rendered on the display, it’s not foolish to worry that malicious software, with sufficient privileges, could draw over the pixels on the display where the camera indicator is rendered, disguising that the camera is in use.
If this were implemented simplistically, that concern would be completely valid. But Apple’s implementation of this is far from simplistic. Friend of the site and renowned developer and low-level-OS spelunker Guilherme Rambo texted me a note, which, with his permission, I’ll quote:
Tidbit: the software-based camera indicator light in the MacBook Neo runs in the secure exclave¹ part of the chip, so it is almost as secure as the hardware indicator light. What that means in practice is that even a kernel-level exploit would not be able to turn on the camera without the light appearing on screen. It runs in a privileged environment separate from the kernel and blits the light directly onto the screen hardware. All of that applies to the mic indicator as well, which is a bonus compared to the camera-only hardware indicator.
¹ Exclaves run on a completely isolated realtime operating system that communicates with the kernel and userspace using a very limited API surface. Not to be confused with Secure Enclave, that’s a different thing.
(That’s right, his text message had a footnote. Like I said, he’s a friend of the site. Also: blitting.)
Exclave was the word I needed. Once I read that, it came back to me, and I recalled Random Augustine’s “On Apple Exclaves”, which I linked to almost exactly one year ago and described as “a splendidly nerdy but very approachable overview of the evolution of Apple’s XNU kernel over the last decade”. As Augustine documents, secure exclaves are something Apple had been building toward for a decade, but which only became enabled with the M4 and A18 generations of Apple Silicon.
If you’re curious, I encourage you to read (or re-read) Augustine’s “On Apple Exclaves”, which should disabuse you of any concerns that these on-display camera indicators on the MacBook Neo and recent iPhone models are anything less than very secure designs. ★
David Pogue absolutely killed it hosting this live event last week. Glad I saved it to watch on my TV. Special guests include Chris Espinosa, John Sculley, and Avie Tevanian. A legit treat.
My thanks to Finalist for sponsoring last week at Daring Fireball. Finalist is a remarkable, ambitious, and novel app for iPhone, iPad, and the Mac from indie developer Slaven Radic. It’s a planner — a digital take on traditional paper planners — that (with permission) pulls in your calendars, reminders, and health data. Its motto: “Most productivity apps help you organize tasks. Finalist helps you finish them.”
Finalist first sponsored DF back in December, and I wrote quite a bit about it then. You should read that post. I’ve continued using Finalist, day in, day out, since then. It’s open on my Mac and on my first iPhone home screen. I’m even on the TestFlight beta list, using new builds as Radic releases them. Finalist was good enough back in December that I started relying on it, and it’s gotten even better in the three months since. It’s a great app, period, but it’s really fun to use an app that is getting better so quickly. Radic is cooking with gas. It’s just so obvious, just using it, that Finalist is his own dream app for daily productivity. Here’s a fun one-minute video showing what’s new in version 3.6.
Recent features include subtasks, calendar bookmarks, HealthKit data in Finalist’s journal, and a spoken daily briefing you can trigger from your Lock Screen. You can (and I do) run Finalist alongside the apps you already use. E.g., Finalist hasn’t replaced Fantastical for me — they just work great together because they both show me the same calendar events. Same goes for Apple Reminders. If you took a look back in December, you should check out what’s new. If you haven’t tried Finalist yet, you definitely should. Free trial from the App Store, with both subscription pricing and a one-time lifetime purchase.
Sam Henri Gold:
Nobody starts in the right place. You don’t begin with the correct tool and work sensibly within its constraints until you organically graduate to a more capable one. That is not how obsession works. Obsession works by taking whatever is available and pressing on it until it either breaks or reveals something. The machine’s limits become a map of the territory. You learn what computing actually costs by paying too much of it on hardware that can barely afford it.
I know this because I was running Final Cut Pro X on a 2006 Core 2 Duo iMac with 3GB RAM and 120GB of spinning rust. I was nine. I had no business doing this. I did it every day after school until my parents made me go to bed.
What a lovely essay. The best piece anyone has written about the MacBook Neo — because it’s not really about the MacBook Neo.
Resume.org, summarizing their survey of 1,000 U.S. hiring managers:
59% admit they emphasize AI when explaining hiring freezes or layoffs because it plays better with stakeholders than citing financial constraints.
Reminds me of the “Not Me” ghost in Bil Keane’s The Family Circus comic strip.
Horace Dediu, under the headline “The Most Brilliant Move in Corporate History?”:
Apple used to be the biggest capex spender, mainly because it paid for most of the property plant and equipment in the factories that made its phones and computers. [...]
But that all changed with AI. Amazon is spending $200 billion this year on AI data centers. Google, $185 billion. Microsoft, $114 billion. Meta, $135 billion. Combined: $650 billion. (Not including OpenAI, Anthropic and SpaceX/XAI.) That is like buying the US Navy every year. And yet Apple’s capital budget is still a modest $14 billion, oscillating with new hardware tooling cycles.
Apple is refusing to transfer its cash flow to Nvidia. Curiously, it believes that its cash flow belongs to its shareholders, not to Nvidia’s.
The hyperscalers are now spending 94% of their operating cash flows on AI infrastructure. Amazon is projected to go negative free cash flow this year with as much as $28 billion in the red. Alphabet’s free cash flow is expected to collapse 90% from $73 billion to $8 billion. These companies used to be the greatest cash machines ever built. Now they’re borrowing money to keep the data center lights on.
It has served Apple very well to guard its free cash flow preciously ever since the company sprung back to growth under Steve Jobs. Are they stuck in the past by sitting this out, or wisely passing on a mania?
If they can make Apple Intelligence a first-class agentic AI by relying on Gemini, paying only $1 billion per year, it sure looks like genius. But given their track record with Apple Intelligence to date, that is an enormous “if”.
Katie Paul, Jeff Horwitz and Deepa Seetharaman, reporting for Reuters:
Meta is planning sweeping layoffs that could affect 20% or more of the company, three sources familiar with the matter told Reuters, as Meta seeks to offset costly artificial intelligence infrastructure bets and prepare for greater efficiency brought about by AI-assisted workers.
No date has been set for the cuts and the magnitude has not been finalized, the people said. Top executives have recently signaled the plans to other senior leaders at Meta and told them to begin planning how to pare back, two of the people said. The sources spoke anonymously because they were not authorized to disclose the cuts.
“This is speculative reporting about theoretical approaches,” Meta spokesperson Andy Stone said in response to questions about the plan.
This, hot on the heels of a New York Times report that Meta’s in-house AI models are lagging and they’re considering licensing Gemini from Google.
Matt Mullenweg:
One evening last month, my Apple Watch, iPhone, and Mac all lit up with a message prompting me to reset my password. This came out of nowhere; I hadn’t done anything to elicit it. I even had Lockdown Mode running on all my devices. It didn’t matter. Someone was spamming Apple’s legitimate password reset flow against my account — a technique Krebs documented back in 2024. I dismissed the prompts, but the stage was set.
What made the attack impressive was the next move: The scammers actually contacted Apple Support themselves, pretending to be me, and opened a real case claiming I’d lost my phone and needed to update my number. That generated a real case ID, and triggered real Apple emails to my inbox, properly signed, from Apple’s actual servers. These were legitimate; no filter on earth could have caught them.
Then “Alexander from Apple Support” called. He was calm, knowledgeable, and careful. His first moves were solid security advice: check your account, verify nothing’s changed, consider updating your password. He was so good that I actually thanked him for being excellent at his job.
That, of course, was when he moved into the next phase of the attack.
What makes this attack so dastardly is that parts of it are actual emails from Apple. And because the attackers are the ones who opened the support incident, when they called Mullenweg, they knew the case ID from the legitimate emails sent by Apple.
One of the tells that alerted Mullenweg that this was a scam was that he knew he hadn’t initiated any of it, so his guard was up from the start. Another is that the scammer texted him a link pointing to the domain “audit-apple.com” (which domain is now defunct). That domain name looks obviously fake to me. But to most people? Most people have no idea that whatever-apple.com is totally different than whatever.apple.com.
If you write about Mac keyboard shortcuts, as I did yesterday, you should know how to do it right. Just as there’s a proper order for adjectives in English, there’s a proper order for listing the modifier keys in a shortcut.
I haven’t found any documentation for this, but Apple’s preferred order is clear in how they show the modifiers in menus and how they’re displayed in the Keyboard Shortcuts Setting.
The order is similar to how you see them down at the bottom left of your keyboard. Control (⌃), Option (⌥), and Command (⌘) always go in that order. The oddball is the Shift (⇧) key, which sneaks in just in front of Command.
Perhaps this wasn’t documented in 2017, but at least since 2022 (per the Internet Archive), Apple has documented the correct order for modifier keys in a keyboard shortcut in their excellent Apple Style Guide, under the entry for “key, keys”:
If there’s more than one modifier key, use this order: Fn (function), Control, Option, Shift, Command. When a keyboard shortcut includes a mouse or trackpad action, use lowercase for the mouse or trackpad action.
- Option-click
- Option-swipe with three fingers
There’s all sorts of good stuff in this Style Guide entry, including an explanation for why the shortcut for Zoom Out is ⌘- (using the lower of the two symbols on the “-/_” key) but the shortcut for Zoom In is ⌘+ (using the upper of the two symbols on the “=/+” key):
If one of the characters on the key provides a mnemonic for the action of the command, you can identify the key by that character.
While I’m at it, here’s a pet peeve of mine. When you write out a keyboard shortcut using modifier key names, you connect them with hyphens: Command-R. But when using the modifier glyphs, you should definitely not include the hyphens. ⌘C is correct, ⌘-C is wrong. For one thing, just look at the shortcuts in the menu bar — the shortcut for Copy has been shown as ⌘C since 1984. For another, consider the aforementioned shortcuts that most apps use for Zoom In and Zoom Out: ⌘+ and ⌘-. Both of those would look weird if connected by a hyphen, but Zoom Out in particular would look confusing: Command-Hyphen-Hyphen?.
(How do you write those out using words, though? Apple uses “Command-Plus Sign (+)” and “Command-Minus Sign (-)”. Me, I’d just go with “Command-Plus” and “Command-Minus”.)
Pay no attention to Drang’s follow-up post, or this one from Jason Snell. The correct order is Fn, Control, Option, Shift, Command — regardless if you’re using the words or the glyphs. ★