The Desolation of Blog

This is a loosely-based sequel to my May 16 blog post Mac App Store: What’s in a name? inspired by an app named App for YouTube ℠ with a symbol at the end. This blog post is inspired by an app named Chrome Browser Default. Released less than a month ago by an unknown developer, Chrome Browser Default has somehow become a top download in the United States Mac App Store, alongside well-known developers Amazon, WhatsApp/Facebook/Meta, and Microsoft: You might joke that this is possible because…

This is a follow-up to my July 10 blog post, Apple Hide My Email bug, possibly related to disclosure vulnerability. Yesterday I happened upon a Mastodon post that inspired me to continue researching my Mac Mail app bug: curl can be used to send emails with smtp I have multiple email accounts, for example with my personal domain lapcatsoftware.com here and my business domain underpassapp.com, but email clients such as Mail app do not provide me with full control over the sent email headers,…

If I think about what I like and dislike about the internet, contrasting what I find pleasant or productive with what I find unpleasant or unproductive, I can’t escape the conclusion that debating strangers stands out as the principal activity that makes me dislike, even hate the internet. A long internet debate with a stranger can drastically sour my mood, ruining a whole day. And I can’t recall a single long debate with a stranger that ever ended well, in my decades on the internet. Short…

Yesterday I published the blog post Apple again black-holed my App Store Connect bug report, which complained that Apple has twice given up on investigating my bug report without requesting additional information from me. This morning I spent some time investigating the bug myself. I believe that I’ve found the cause and a workaround. Funny, isn’t it, how a lone outside developer, in less than an hour and without the server-side source code, can do a better job at investigating an Apple bug…

I had filed a bug report with Apple Feedback Assistant: FB22952887 “App Store Connect page redirects to /login after already logged in.” This reproducible bug is still not fixed. My report previously received the resolution “Investigation complete - Unable to diagnose with current information” without requesting additional information from me. On the morning of June 15, I published the blog post Can you reproduce this App Store Connect bug? My blog post apparently caught the attention of…

For five years I’ve used the free random password generator app PSWD from the Mac App Store, and I’ve been happy with it. Since I first installed the app, the developer released a number of minor updates, the last in July 2023, three years ago. This was fine, because the app was essentially perfect for my purpose, so I didn’t need the app to change. A few days ago, however, the developer released a major update: PSWD 5.0 is a complete rewrite. Everything is new Among the changes in PSWD 5.0 was…

When you press the volume keys on macOS Sequoia and earlier, a nice big user interface appears as feedback, registering the volume change and displaying the new system volume. You can’t miss it. On macOS Tahoe, however, you can easily miss it. The user interface is much smaller and appears only at the top of the screen, near the volume control in the menu bar. The volume interface has not changed from Tahoe to Golden Gate. In fact, I first noticed it today when testing the latest developer…

As a software developer for Apple platforms, I’ve spent quite a bit of time over the years attempting to understand Apple financial statements, though I’m admittedly not an expert in corporate finances. This blog post is for other non-experts who are also interested in Apple finances. I originally became interested in Apple quarterly reports and financial statements because I wanted to see the unit sales of Apple hardware: Mac, iPhone, iPad. Unfortunately, Apple ended its longtime practice of…

Last week a disclosure vulnerability in Apple’s Hide My Email feature was publicly announced and verified by a news media outlet, though the technical details of the vulnerability were not publicized. The vulnerability is that it’s possible to unhide the real email address of a Hide My Email user. I don’t know whether I’ve accidentally stumbled upon that vulnerability, or perhaps in this case the Hide My Email user just messed up in some way, but I’ve definitely discovered a bizarre and…

Safari was inactive, in the background, with no windows open, when out of the blue I got a Little Snitch alert: Safari wanted to connect to the URL http://192.168.0.1/favicon.ico for some reason. The IP address 192.168.0.1 is private. I quickly realized that http://192.168.0.1/ was one of my bookmarks, for the web interface of my router. I had recently been looking at my bookmarks in order to answer someone’s question on Reddit about Safari bookmarks, though I hadn’t looked specifically at that…

This may sound far-fetched, but I already found that iCloud remotely triggers iMessage sign-in and sync (as well as FaceTime sign-in). I have circumstantial evidence that iCloud also remotely enabled Protect Mail Activity on my Mac, and I can’t think of any other explanation. Let me describe the circumstances in detail. Yesterday, inspired by social media, I was looking through the Mac Mail app for its one remaining NSDrawer (which turns out to be attached to the Mail Connection Doctor window.)…

WebKit, to quote its website, “is the web browser engine used by Safari, Mail, App Store, and many other apps on macOS, iOS, and Linux.” Obviously, Safari uses WebKit to display web pages, but did you know that Mail app uses WebKit to display email messages? This is true not just for HTML emails but also for plain text format emails. There are a couple of ways to reveal the presence of WebKit in Mail, both of which may be bugs. If you disable “Auto-play animated images” in the Accessibility…

Despite the fact that I never filed a report with Feedback Assistant, the bug that I discussed in my March 26 blog post App Store Connect analytics missing platform versions appears to be fixed now. The analytics are no longer missing iOS and macOS versions. Did my blog post spur the bug fix? I have no idea, since Apple is uncommunicative, but I’m going to try again with another bug. This time I made the mistake of first filing a report with Feedback Assistant: FB22952887 App Store Connect page…

For years, I’ve followed Reddit via RSS. I mentioned Reddit RSS feeds in a 2022 blog post. Among the various ways my customers can contact me, there’s a subreddit for my products. I follow a number of Apple-related subreddits such as r/apple, which is helpful to me in unearthing information relevant to my business and helpful to redditors, whose technical questions I sometimes answer. I also follow a few local, Wisconsin-area subreddits. Overall, I subscribe to around 25 Reddit RSS feeds. This…

Safari has traditionally supported the latest three major macOS versions. For example, Safari 26 supports macOS 26 Tahoe, macOS 15 Sequoia, and macOS 14 Sonoma. Currently, the Safari 27 beta is available only for the macOS 27 Golden Gate developer beta, but the release notes indicate that the Safari 27 beta will also become available for Tahoe and Sequoia soon, perhaps along with the macOS 27 public beta: “Safari 27 beta is available for iOS 27 beta, iPadOS 27 beta, visionOS 27 beta, macOS 27…

Back in September, I blogged about a bug that I discovered: URL/NSURL double-encodes characters unnecessarily. Despite my well-known hatred of Feedback Assistant, I reluctantly used it in this case. I’ve filed a bug report in Apple Feedback Assistant: “URL/NSURL double-encodes characters unnecessarily” (FB20439045). It turns out that miracles do happen. See today’s macOS Golden Gate 27 Beta Release Notes and iOS & iPadOS 27 Beta Release Notes. Foundation Resolved Issues Fixed: +[NSURL…

The web browser vendors continually add JavaScript API that prioritize the needs of web developers over web users. The interests of the two groups can conflict, for example because web developers often want to fingerprint and track web users, and I would note that Google Search advertising revenue provides a large part of the funding for all three of the major web browser engines: Chromium, Gecko/Quantum, and WebKit. The Origin Private File System (OPFS) is such an API, that I would call…

The Mythical Man-Month is a book by Fred Brooks about software project management. The book has become famous in the industry, along with an observation from the book known as Brooks’s law: Adding manpower to a late software project makes it later. I’d like to make an analogy between software development and Apple App Store review. A common, cursory reaction to the obvious failures of app review, the continual appearance of countless scams in the App Store, is to suggest that Apple hire more…

Checking the Mac App Store charts for my own apps, I happened to notice an oddly-named app in the top ten list of Safari extensions in the United States: App for YouTube ℠. Who names their app App? That’s absurdly generic, like naming your child Child. Or Jeff Johnson. Also curious is the service mark symbol in the app name. The App Store allows developers to use a third-party trademark in an app name (see my own Homecoming for Mastodon) as long as the trademark appears at the end of the app…

I’m unaware of any explicit policy, but Apple’s long-standing practice is to release security updates for the latest three major versions of macOS. Currently, those are macOS 26 Tahoe, macOS 15 Sequoia, and macOS 14 Sonoma. On Monday, two days ago, Apple continued that practice by releasing macOS 26.5, 15.7.7, and 14.8.7. Another long-standing practice is to include Safari updates along with the latest major version of macOS but release Safari updates separately for the previous two major…

“Prevent cross-site tracking” is a Safari privacy setting, enabled by default. When “Prevent cross-site tracking” is enabled, Cloudflare challenges require an extra step, to manually click “Verify you are human.” This extra step is not required when “Prevent cross-site tracking” is disabled, nor is it required at all in Chrome or Firefox. Here is a Cloudflare challenge demo you can try: https://sergiodemo.com/security/challenge/managed-challenge In Chrome and Firefox, as well as in Safari with…