Linked List: March 10, 2015

Tuesday, 10 March 2015

Nilay Patel on the Apple Watch Interface 

Nilay Patel, on using Apple Watch:

After months of anticipation, we’ve finally gotten to play with a working Apple Watch…what matters today is the software, what it can do, and how it works. And it turns out it’s actually pretty complicated. […]

That feeling of not knowing exactly where you are or what’s going to happen is pretty disorienting for an Apple product — the steady iterative updates of iOS and OS X mean that it’s traditionally been quite easy to pick up a new iPhone or MacBook and understand how to use it. But the Watch is really different, in ways big and small.

This passage from Patel made me feel worse about not having been able to attend yesterday’s event than anything else, because without hands-on experience, I can’t judge this for myself. I find Patel’s reaction worrisome. The iPhone did so much more than typical 2007 cell phones. But no one was confused by it. The iPhone’s intuitiveness, obviousness, and sense of place weren’t just nice-to-have. Those aspects of the iPhone were fundamentally essential to its success.

Update: Ben Thompson, in his subscription-only (and worth every penny) Stratechery Daily Update today:

Interestingly, Patel and I struggled with different things; he complained about confusing the external buttons, while I kept having trouble with understanding what “mode” I was in, for lack of a better term. Specifically, it was weird that “glances” could only be accessed from the watch face; the watch face, though, isn’t necessarily the “home” screen — the array of apps is. But on that screen you can’t bring up glances. It’s a bit confusing.

Again: worrisome. Compare this description of the “slide up from bottom of display” Glances to Control Center on iOS. Control Center is available and works the same way (again: slide up from bottom of display) everywhere: the lock screen, the home screen, and within any app.

Why Xcode’s Integrity Matters 

Craig Hockenberry, on reports that the CIA is actively working to compromise the integrity of Xcode:

The article refers to “Xcode” generically, but as we all know, there are a lot of pieces to this puzzle: I’m going to examine a few of them below. It’s your job to think about how these things might affect your own products.

The bottom line: You can never fully trust code you aren’t compiling from source. And even when you do have the source, you’re fucked if your compiler has been compromised.

Ken Thompson: ‘Reflections on Trusting Trust’ 

A classic essay from computer science titan Ken Thompson, back in 1984, explaining how to create a compromised C compiler that would be undetectable by an examination of its own source code:

The moral is obvious. You can’t trust code that you did not totally create yourself. (Especially code from companies that employ people like me.) No amount of source-level verification or scrutiny will protect you from using untrusted code. In demonstrating the possibility of this kind of attack, I picked on the C compiler. I could have picked on any program-handling program such as an assembler, a loader, or even hardware microcode. As the level of program gets lower, these bugs will be harder and harder to detect. A well installed microcode bug will be almost impossible to detect.

The Intercept: CIA Campaign to Compromise Apple’s Developer Tools 

Jeremy Scahill and Josh Begley, reporting for The Intercept:

Researchers working with the Central Intelligence Agency have conducted a multi-year, sustained effort to break the security of Apple’s iPhones and iPads, according to top-secret documents obtained by The Intercept. […]

The security researchers also claimed they had created a modified version of Apple’s proprietary software development tool, Xcode, which could sneak surveillance backdoors into any apps or programs created using the tool. Xcode, which is distributed by Apple to hundreds of thousands of developers, is used to create apps that are sold through Apple’s App Store.

The modified version of Xcode, the researchers claimed, could enable spies to steal passwords and grab messages on infected devices. Researchers also claimed the modified Xcode could “force all iOS applications to send embedded data to a listening post.” It remains unclear how intelligence agencies would get developers to use the poisoned version of Xcode.

Researchers also claimed they had successfully modified the OS X updater, a program used to deliver updates to laptop and desktop computers, to install a “keylogger.”

To be clear, there is no indication in this report that this hacked version of Xcode has been used in the wild. To be useful, they’d somehow have to get developers to use their modified Xcode toolset instead of Apple’s, or, to somehow infect Apple’s Xcode code base with their modifications. (Imagine a CIA or NSA agent, a trained computer scientist, who joins Apple’s Xcode compiler team under false pretenses.)

But it strikes me as outrageous that a U.S. spy agency is actively working against U.S. companies like Apple and Microsoft. You expect something like this from China or Russia. Not from our own government.

MoMA Recognizes Susan Kare 

John Brownlee, writing for Fast Company:

Susan Kare — the pioneering graphic designer whose pixel art icons for the original Macintosh helped define the language of graphical user interfaces (GUIs) — is being recognized by the New York Museum of Modern Art. Her archive of graph paper drawings sketching out her ideas for the original Macintosh interface have been acquired by the MoMA as part of the new exhibition, This is for Everyone: Design Experiments For The Common Good.

Well-deserved. Kare’s work for the original Macintosh has truly stood the test of time.

Firewatch Demo Day at GDC 

Jaw-dropping attention to detail from Panic, to set up a themed public demo for their upcoming game Firewatch at last week’s GDC. It looks like the queue for a ride at Disney World.