John’s Blog

My personal journal and blog. Subscribe via RSS


Arc Vulnerability

September 25, 2024

Hursh Agrawal, CEO of The Browser Company, on the company blog:

We want to let all Arc users know that a security vulnerability existed in Arc prior to 8/25/24. We were made aware of a vulnerability on 8/25, it was fixed on 8/26. This issue allowed the possibility of remote code execution on users’ computers. We’ve patched the vulnerability immediately, already rolled out the fix, and verified that no one outside of the security researcher who discovered the bug has exploited it.

The vulnerability was discovered by “xyzeva”, who has an awesome write up on their blog, including this summary of the facts:

  • arc boosts can contain arbitrary javascript
  • arc boosts are stored in firestore
  • the arc browser gets which boosts to use via the creatorID field
  • we can arbitrarily change the creatorID field to any user id

thus, if we were to find a way to easily get someone elses user id, we would have a full attack chain

This was an incredible find, and honestly, quite a sloppy bug. I’ve been using Arc for a few months now as my daily driver and I really like it. Glad this is fixed.

Also, nice to see that Arc is taking care of the hacker for disclosing this vulnerability properly with a $20k bounty.

Electrically-Released Adhesive

September 25, 2024

Donald Papp for Hackaday:

There’s a wild new feature making repair jobs easier (not to mention less messy) and iFixit covers it in their roundup of the iPhone 16’s repairability: electrically-released adhesive.

Here’s how it works. The adhesive looks like a curved strip with what appears to be a thin film of aluminum embedded into it. It’s applied much like any other adhesive strip: peel away the film, and press it between whatever two things it needs to stick. But to release it, that’s where the magic happens. One applies a voltage (a 9 V battery will do the job) between the aluminum frame of the phone and a special tab on the battery. In about a minute the battery will come away with no force, and residue-free.

This is so cool.

via Daring Fireball

Wordpress and WP Engine

September 24, 2024

Big drama in the world of Wordpress, by far the world’s most popular CMS.

Matt Mullenweg, on the Wordpress blog:

I spoke yesterday at WordCamp about how Lee Wittlinger at Silver Lake, a private equity firm with $102B assets under management, can hollow out an open source community. (To summarize, they do about half a billion in revenue on top of WordPress and contribute back 40 hours a week, Automattic is a similar size and contributes back 3,915 hours a week.) Today, I would like to offer a specific, technical example of how they break the trust and sanctity of our software’s promise to users to save themselves money so they can extract more profits from you.

The specific example has to do with WP Engine disabling revisions to posts.

What WP Engine gives you is not WordPress, it’s something that they’ve chopped up, hacked, butchered to look like WordPress, but actually they’re giving you a cheap knock-off and charging you more for it.

This is one of the many reasons they are a cancer to WordPress, and it’s important to remember that unchecked, cancer will spread. WP Engine is setting a poor standard that others may look at and think is ok to replicate. We must set a higher standard to ensure WordPress is here for the next 100 years.

Mullenweg continues later on his personal blog:

So it’s at this point that I ask everyone in the WordPress community to vote with your wallet. Who are you giving your money to? Someone who’s going to nourish the ecosystem, or someone who’s going to frack every bit of value out of it until it withers?

In response, WP Engine has sent a cease-and-desist letter to Automattic, including this interesting line:

Stunningly, Automattic’s CEO Matthew Mullenweg threatened that if WP Engine did not agree to pay Automattic – his for-profit entity – a very large sum of money before his September 20th keynote address at the WordCamp US Convention, he was going to embark on a self-described “scorched earth nuclear approach” toward WP Engine within the WordPress community and beyond. When his outrageous financial demands were not met, Mr. Mullenweg carried out his threats by making repeated false claims disparaging WP Engine to its employees, its customers, and the world.

🍿🍿

iPhone 16 Photography

September 19, 2024

Nilay Patel’s annual iPhone review for The Verge is a great read, as always. This year I really enjoyed his take on the camera system and the new “Photographic Styles” features:

The iPhone 16 and 16 Pro allow you to exclude yourself from this narrative entirely with a huge upgrade to the Photographic Styles feature that allows you to adjust how the camera processes colors, skin tones, and shadows, even after you’ve shot a photo.

It’s a subtle feature, but allowing these styles to be changed after capture is very nice.

You can pick between five “undertone” settings that are meant to adjust skin tones and nine “mood” settings that feel a lot like high-quality Instagram filters. You can shoot with a live preview of any of the styles, and then you can tweak the settings or even switch styles entirely later on.

And all of these styles offer three new fine controls: there’s “color,” which is basically saturation, and “palette,” which is the range of colors being applied. Most importantly, there’s a new control called “tone,” which lets you add shadows back to your photos. It turns out Apple is using “tone” in this context to mean “tone mapping,” and in my tests, the tone control allowed me to reliably bring the iPhone’s image processing back to reality by turning it down.

The tone control is semantically aware — it will adjust things like faces and the sky differently, so it’s still doing some intense computational photography, but the goal is for you to be able to take photos that look a lot more like what a traditional camera would produce if you bring the slider all the way down.

See also, Halide’s new “Process Zero” features.

So many great tools for photographers using phones. More of this, please.

Instagram for Teens

September 19, 2024

Julie Jargon, for The Wall Street Journal: (Apple News+ Link)

Starting this week, [Instagram] will begin automatically making youth accounts private, with the most restrictive settings. And younger teens won’t be able to get around it by changing settings or creating adult accounts with fake birth dates.

Account restrictions for teens include direct messaging only with people they follow or are already connected to, a reduction in adult-oriented content, automatic muting during nighttime hours and more.

Under the new accounts, teens won’t be able to see sensitive content, such as posts or videos that show people fighting or that promote cosmetic procedures—and Instagram’s algorithm won’t recommend sexually suggestive content or content about suicide and self-harm.

A Wall Street Journal investigation earlier this summer revealed that sexual videos were being recommended to teen accounts. Mosseri said Instagram has worked hard to ensure that the platform doesn’t show teens such content. The new teen default settings should significantly reduce the chances of that, he added.

Teen accounts will receive notifications telling them to close the app after an hour. (They can ignore it.) Sleep mode, which mutes notifications overnight, will be automatically enabled.

Good changes overall, and certainly better than nothing.

It seems pretty clear to me that kids shouldn’t be on social media at all and I’m shocked that so many parents allow it. What would be better is to prevent all kids and teens from using social media until they are mature enough to handle it, but that’s not going to come from Meta.

OpenAI o1 Model

September 17, 2024

OpenAI’s new “o1” model looks very cool and has a different approach than the company’s other model offerings:

We trained these models to spend more time thinking through problems before they respond, much like a person would. Through training, they learn to refine their thinking process, try different strategies, and recognize their mistakes. 

In our tests, the next model update performs similarly to PhD students on challenging benchmark tasks in physics, chemistry, and biology. We also found that it excels in math and coding.

Fascinating stuff. o1 is trained on how to solve problems, not just with the world knowledge base of traditional LLMs.


Ben Thompson has a high-level explanation for how the model works on Stratechery:

In summary, there are two important things happening: first, o1 is explicitly trained on how to solve problems, and second, o1 is designed to generate multiple problem-solving streams at inference time, choose the best one, and iterate through each step in the process when it realizes it made a mistake. That’s why it got the crossword puzzle right — it just took a really long time.

iOS 18 MacStories Review

September 17, 2024

Federico Viticci has dropped his amazing annual review of the new version of iOS, out this week.

Never have I been in the position to witness the company finding itself unable to ignore a major industry shift. That’s exactly what is happening with AI. As we saw back in June, Apple announced a roadmap of AI features that will be gradually doled out to users and developers over the iOS 18 cycle. Most of them won’t even be launching this year: I wouldn’t be surprised if we see them just in time before the debut of iOS 19 at WWDC 2025.

What’s even more fascinating is realizing just how much of a priority Apple Intelligence must have been for the iOS, iPadOS, and macOS teams. Let’s face it: if it weren’t for the handful of additions to iOS, which are also cross-compatible with iPadOS, I wouldn’t have much to cover today without Apple Intelligence.

Viticci’s reviews are the best. I’ve been using the betas of iOS 18 for months and I still learned a few things from this review.

Apple Needs an Editor

September 12, 2024

M.G. Siegler, writing on his Spyglass blog:

Close your eyes for a moment. Imagine the year is 2034. Apple has just held their event to unveil the iPhone 26 and the iPhone 26 Pro and the iPhone 26 Pro Max. They are powered by the A28 and A28 Pro chips. Perhaps an A28 Turbo Bionic for the iPhone 26 Pro Max Ultra. That chip is similar to the M14, but different. All of these devices run iOS 26 featuring Apple Intelligence X. Also new this year: the AirPods 14 and the AirPods Pro 11 and the AirPods Max 7. Most of these have the H8 chip, which can run Apple Intelligence 7, but some have H7 which runs Apple Intelligence 6. And we have the Apple Watch Series 20. And the Apple Watch SE (6th generation). And the Apple Watch Max 8. These all either run on the S20 or S19 or S18 chips. And they run run watchOS 21, which features Apple Intelligence 8.

This is a joke but it also feels pretty likely to be true! And it’s illustrative of my point. It’s great that Apple has hit a groove with such wonderful products. But hit that groove enough times and it wears down and out. I’m not saying Steve Jobs would have killed the iPhone 16, I’m just saying he would have figured out a better way to package it and market it and present it.

At some point, Apple needs to stop focusing on pushing out iterative updates at marquee events that people will tire of – some already are. At the very least, they need to stop focusing on too-slick video presentations and focus on the energy of live events again. There’s a reason the Steve Jobs movie was built around three separate live events, not video demos.

M.G. is killing it on Spyglass. It’s one of my favorite daily reads. What a great take.

The September Apple Event

September 11, 2024

Monday was the annual release keynote for new iPhones by Apple. The new camera button is a great idea and looks nice.

Nilay Patel and Allison Johnson, writing about the button for The Verge:

Let’s start with Camera Control, which is a physical button — it depresses into the case ever so slightly, with additional haptic feedback from Apple’s Taptic Engine to make it feel like a chunkier click. It’s not just a shutter button, although you can use it like one and click away to fire off photos from the 48MP main camera with zero shutter lag.

The reason it’s not just a shutter button is that it’s also a multifunctional capacitive control surface. The physical button itself is ultrasensitive, so pressing it ever so lightly brings up swipe-to-zoom controls, and double-pressing it lightly brings up additional controls you can swipe between, like lens selection, exposure, and the new photo styles available on the Pro. It took me a second to determine how hard to press, but it wasn’t hard to figure out. Apple says that as part of a software update later this year, the button will get a two-stage shutter function that will allow you to lock focus and exposure.

Sounds pretty cool. Unfortunately, the trend in recent keynotes continues where the most interesting feature isn’t even launching until “later this year”.


On the presentation itself, M.G. Siegler describes the event perfectly:

It was just under 1 hour and 40 minutes – just about 100 minutes. It should have been 50 minutes. Just under one hour.

I know they could have made this happen because I watched all 100 minutes. Pretty much every single segment was too long.3 But the real soul sucker was what I called the “Previously, on WWDC” segment. Essentially, Apple went over every Apple Intelligence feature already announced – and still not ready yet, by the way – at WWDC a few months ago. Apple often reiterates what was announced at an earlier event, but not like this. Again, for features that are still weeks, if not months away. It felt like it was too geared towards Wall Street. Or perhaps would-be Google Pixel or Samsung Galaxy buyers – “don’t worry, we have AI too!”

Reimagined Pixels

August 26, 2024

Earlier this month Google announced, among other things, its Pixel 9 phones lineup. One of the new AI features is the ability to “reimagine” your photos with AI. Super interesting and kind of creepy. (Sounds like a Google product launch to me.)


Chris Welch, posting on Threads, has a fascinating look at some of the output of this feature:

The “Reimagine” feature on Google’s new Pixel 9 lineup is incredible. It’s so impressive that testing it has left me feeling uneasy on multiple occasions.

With a simple prompt, you can add things to photos that were never there. And the company’s Gemini AI makes it look astonishingly realistic. This all happens right from the phone’s default photo editor app. In about five seconds.

Are we ready to go down this path? Now that the embargo has lifted, let me show you some examples. Buckle up

Playing Both Sides

August 26, 2024

Fun baseball story happening today. Lauren Merola, for The Athletic:

Danny Jansen will become the first player in MLB history to play for both teams in the same game when the Boston Red Sox and Toronto Blue Jays resume a June 26 game on Monday afternoon.

Back in June, Jansen was playing for the Blue Jays. When the rain delay was called, Jansen was at the plate with one out and one on in the top of the second. After a near two-hour delay, the Red Sox and Blue Jays said the game would resume in a doubleheader on Aug. 26.

For the last two months, the box score of that game said Jansen is still batting.

With the game scheduled to resume post-trade deadline, Jansen was traded for the first time in his career — to the team the Blue Jays were playing that June 26 night.

Apple Intelligence Prompts

August 24, 2024

The prompts used to handle Apple Intelligence features in the current betas for iOS were found by a clever redditor and transcribed by MacRumors:

You are an assistant which helps the user respond to their mails. Given a mail, a draft response is initially provided based on a short reply snippet. In order to make the draft response nicer and complete, a set of question and its answer are provided. Please write a concise and natural reply by modifying the draft response to incorporate the given questions and their answers. Please limit the reply within 50 words. Do not hallucinate. Do not make up factual information.

These are so funny and an insight into how modern AI software works. (Emphasis above is mine.) The LLMs used for Apple Intelligence don’t take inputs like normal software, instead they just want to chit chat. And they need to be told to not make stuff up.

Status

August 24, 2024

I’ve been a daily reader of the Reliable Sources newsletter, started by Brian Stelter and until recently written by Oliver Darcy, for many years now. It was a great daily overview of the happenings in media, culture, and politics.

Darcy has left CNN and is starting his own subscription service, called Status. It picks up right where Darcy left off with Reliable Sources. Well sourced, brilliantly edited, and thoughtfully designed.

Signed up. I love seeing writers and journalists owning their content and building their own platforms.

Week Notes: August 17

August 17, 2024

Happy Saturday. It’s entirely too hot here in Texas. The kids are back in school. I’ve rounded third base and I’m approaching the launch of a major new app build that’s taking all of my time and energy! More on that another time, but it’s been a busy week elsewhere. Here’s a roundup of a few links from the week…

Google’s Pixel 9 Phones

Nice updates and announcements from Google this week on its Pixel lineup. The Gemini Live AI assistant looks really cool. Will anyone buy the foldable phone? Probably not.

Neuecast

A delightful and thoughtfully designed new podcast app. I don’t mind the new Overcast update as much as some people do, so it’s still my default. But love seeing new entrants into the podcast player market. Especially with this nice of a design.

Unread for Mac

Speaking of new apps, Unread for the Mac is here and it’s lovely. I’m giving it a spin this week. I still love my NetNewsWire, but the design and typography of Unread are so well done.

Structured Outputs in OpenAI API

This is a very welcome update. We’ve been twisting ourselves into knots sometimes to format JSON output from the ChatGPT API into a specific format for consumption by our apps.

Making the case for Apple to buy WBD

M.G. Siegler, continuing to make his case that Apple should and could buy Warner Bros. Discovery. Apple TV+ has become my goto streaming service lately. Its hit-to-miss ratio is very high and is reminiscent of the great Richard Plepler era of HBO. Apple has proven themselves a worthy producer of video content, I’m all for this.

A Roundup of My Favorite Bartender Alternatives

This link is from earlier in the summer, but I missed the news that Bartender was silently acquired in a less than trustworthy way. Nice roundup by Niléane for Macstories of a bunch of worth alternatives. I’m trying out Hidden Bar and it seems like a simple and worthy replacement. And it’s completely open source.

☀️🎸

Campsite

August 8, 2024

Major new launch for the Campsite team yesterday.

Brian Lovin, CEO and co-founder, of Campsite posted some updates on Product Hunt:

We started Campsite in 2022 to help designers share work in progress, but along the way, we ended up building an entirely new (and better!) way for teams to collaborate. This year, we went heads-down to build everything we needed to simplify our entire communication stack (we no longer use Slack, Notion, and Zoom).

Campsite combines posts, calls, docs, and chat into one app so your team can move faster and stay focused. It’s a refreshingly new way to work, where all of your team communication happens in one place and is easy to share or find later.

We’ve been giving Campsite a spin on a new venture, and it’s incredibly well done. I’ve been watching this app for a while and wasn’t quite right for what I needed, but giving it a second look now. I love the idea of being able to streamline tools into one. Ambitious and very well designed. Brilliant work.

Google’s Monopoly

August 6, 2024

David McCabe, reporting for the New York Times:

Google acted illegally to maintain a monopoly in online search, a federal judge ruled on Monday, a landmark decision that strikes at the power of tech giants in the modern internet era and that may fundamentally alter the way they do business.

Judge Amit P. Mehta of U.S. District Court for the District of Columbia said in a 277-page ruling that Google had abused a monopoly over the search business. The Justice Department and states had sued Google, accusing it of illegally cementing its dominance, in part, by paying other companies, like Apple and Samsung, billions of dollars a year to have Google automatically handle search queries on their smartphones and web browsers.

“Google is a monopolist, and it has acted as one to maintain its monopoly,” Judge Mehta said in his ruling.

John Gruber writes at Daring Fireball why this is happening:

It’s worth a reminder that under U.S. antitrust law, having a monopoly is not in and of itself illegal. It’s just that monopolies must operate under different rules, and Mehta has ruled that Google broke (and continues now to break) those rules.

Back to McCabe, noting how Google’s legal team is going to appeal, but was somehow proud that the judge acknowledged that Google search is the best product on the market:

Kent Walker, Google’s president of global affairs, said the company would appeal the ruling.

“This decision recognizes that Google offers the best search engine, but concludes that we shouldn’t be allowed to make it easily available,” he said. “As this process continues, we will remain focused on making products that people find helpful and easy to use.”

What happens when a monopoly is actually the best product on the market? Surely most consumers would actively choose Google when given a choice over other competitors. There are more quality search competitors now than in decades, among them DuckDuckGo, Kagi, and of course potential offerings from OpenAI as well. But how many people in the general internet-using public are even aware of these?

It will be very interesting to see where this ends up once the remedies are outlined. If nothing else, I do hope that Apple will relax its stance on allowing for custom search engines within Safari.

Zoom Election

August 5, 2024

Kevin Roose, for the New York Times:

A month ago, if you had asked me which tech platforms would play a major role in the 2024 presidential campaign, I might have said TikTok or Facebook. I might have said YouTube. I may have even theorized that X would still play a role despite its hard-right turn under Elon Musk’s ownership.

What I wouldn’t have guessed is that this year’s breakout campaign tech would be Zoom — the unassuming videoconferencing app made famous during the pandemic and kept aloft since then by legions of remote workers dialing into meetings.

I’ve seen a number of these stories over the past week, here’s another from Bloomberg. The Zoom rally phenomenon is fascinating to me how easily it is catching on, much like Zoom-ing in the early days of Covid. I imagine there’s a large segment of the voting population that would never consider going to an in-person political rally, count me among them. But joining a quick session via Zoom, like we all do at work dozens of times as week? Not as far fetched.

The engineers at Zoom must be having fun with this one too:

Some of these rallies have been so popular that they strained Zoom’s technical limits. One meeting, “White Women: Answer the Call 2024,” ground to a halt when more than 100,000 people logged on, exceeding the cap for even the largest corporate Zoom accounts.

Great Animations

August 3, 2024

Emil Kowalski, with a lovely post on animations on the web and elsewhere in design:

Great animations are hard, as there are many aspects to consider. From easing and timing to accessibility and performance. This post is a collection of principles that, in my opinion, make animations great.

I love Emil’s work, and am excited to check out his upcoming Animations on the Web course.

Jackson Holliday’s Grand Slam HR Debut

July 31, 2024

It’s been a tough stretch for the Orioles lately, but Jackson Holliday is back in the show and making an impact this time:

MLB Pipeline’s No. 1 overall prospect announced his return to the Majors with a Statcast-projected 439-foot slam in the fifth inning of Baltimore’s 10-4 win in the series finale vs. Toronto at Camden Yards. Holliday belted an 0-2 slider from Blue Jays right-hander Yerry Rodríguez, with the ball leaving the bat at 109.2 mph.

Week Notes: July 27

July 27, 2024

Happy Saturday. It’s been an eventful few weeks in the world, and in my life. Traveling back from the Air Mail HQ in NYC this morning and catching up on some interesting links of note…

Fortnite Coming to AltStore

It is super interesting that Fortnite, one of the biggest and highest profile games in the world today, is not in the App Store, but is soon going to be in an independent app store run by a team of two indie developers. Wild.

Runway Ripped Off YouTube Creators

The source material for AI models continues to be problematic. And the ability of these AI CEOs to avoid telling the truth about what they are doing is astonishing. Big props to Samantha Cole and 404 Media for this piece.

OpenAI announces SearchGPT

In other AI news, OpenAI is coming for you Google. The rapid pace of new products and ideas coming out of OpenAI is impressive. (Alas, we don’t have full transparency on its training data either.)

Google Is the Only Search Engine That Works with Reddit

Another interesting wrinkle in the future of search: exclusive indexing deals? This is a strange one. I do not like the precedent of sites inking deals with search engines to index their content. It completely contradicts decades of history of how the web works.

Zuck: Open Source AI Is the Path Forward

Last but not least, Mark Zuckerberg argues in favor of an “open” source approach to AI models. I put “open” in quotes, because this is not an open-sourced code structure. The model weights are open, but the training set and inputs are not. (I like how Ben Thompson calls this an “open weights” model.) Still, I like this approach and find myself agreeing more and more with Zuckerberg lately.

Overcast

July 16, 2024

A very nice and snappy new update for Overcast, out today, on the 10th anniversary of the app’s launch.

Marco Arment, writing about the updates:

Most of Overcast’s core code was 10 years old, which made it cumbersome or impossible to easily move with the times, adopt new iOS functionality, or add new features, especially as one person. […]

For Overcast to have a future, it needed a modern foundation for its second decade. I’ve spent the past 18 months rebuilding most of the app with Swift, SwiftUI, Blackbird, and modern Swift concurrency.

Such a great app. Glad it’s ready for the next decade.

One Million

July 13, 2024

Earlier this year, we passed an interesting milestone at Air Mail: the one millionth member signed up. Now, this isn’t an active user count metric or any sort of important announcement from me. I just think it’s a cool round number that I’m proud of.

I’ve worked on a number of large, high-traffic applications–many with more users than this. But this one feels different. We created it from nothing. Just an idea born in a tiny ground floor apartment in the West Village.

It’s a fun accomplishment to build something that you’re proud of and that there’s a million other people out there somewhere that think it’s cool enough to sign up for too.

Graydon Carter on Joe Biden

July 6, 2024

A brilliant piece by Graydon Carter in our Air Mail issue published today:

This past June 27, the trim octogenarian took the spotlight. And against all medical odds, he moved through the evening like a teen in heat. Crisp as a hundred-dollar bill, he was nimble on his feet and never missed a beat or a word. He’s been doing this for decades, and he’s as strong and as vibrant as he’s ever been.

Alas, this wasn’t at the CNN studios in Atlanta; it was at Chicago’s Soldier Field. The man was Mick Jagger. And he will be the same age as Joe Biden at the end of this month. The thing is, there’s 81 and there’s 81. On some it can seem like the new 61—Harrison Ford, for instance. On others, as in the case of the president, it can seem like 101, as it did that night.

🇺🇸

Writebook

July 6, 2024

A new product from 37signals in the Once lineup. Jason Fried with the announcement this week:

[it’s] surprisingly challenging to publish books on the web in nice, cohesive, tight, easy-to-navigate HTML format. A collection of 20 essays can be a book. Or a company’s handbook can be a book. Or an actual book like Shape Up can be a book.

But usually you have to make a custom web site, or stretch to use a blog publishing/CMS tool to kinda-sorta squish separate posts together into a packaged whole. It’s really not ideal. We know — we’ve published a variety of books online, and we’ve had to go the custom route each time.

So we did something about it. Introducing Writebook. It’s a dead simple platform to publish web-based books. They have covers, they can have title pages, they can have picture pages, and they can have text pages. Each book gets its own URL, and navigating and keeping track of your progress is all built right in.

It’s available now to download and play with. Super cool idea, and a gift to the web from the 37s team to make this available for free.

There’s also a really cool list of classic books available as a showcase of what the platform can do.