The Desolation of Blog

Back in September, I blogged about a bug that I discovered: URL/NSURL double-encodes characters unnecessarily. Despite my well-known hatred of Feedback Assistant, I reluctantly used it in this case. I’ve filed a bug report in Apple Feedback Assistant: “URL/NSURL double-encodes characters unnecessarily” (FB20439045). It turns out that miracles do happen. See today’s macOS Golden Gate 27 Beta Release Notes and iOS & iPadOS 27 Beta Release Notes. Foundation Resolved Issues Fixed: +[NSURL…

The web browser vendors continually add JavaScript API that prioritize the needs of web developers over web users. The interests of the two groups can conflict, for example because web developers often want to fingerprint and track web users, and I would note that Google Search advertising revenue provides a large part of the funding for all three of the major web browser engines: Chromium, Gecko/Quantum, and WebKit. The Origin Private File System (OPFS) is such an API, that I would call…

The Mythical Man-Month is a book by Fred Brooks about software project management. The book has become famous in the industry, along with an observation from the book known as Brooks’s law: Adding manpower to a late software project makes it later. I’d like to make an analogy between software development and Apple App Store review. A common, cursory reaction to the obvious failures of app review, the continual appearance of countless scams in the App Store, is to suggest that Apple hire more…

Checking the Mac App Store charts for my own apps, I happened to notice an oddly-named app in the top ten list of Safari extensions in the United States: App for YouTube ℠. Who names their app App? That’s absurdly generic, like naming your child Child. Or Jeff Johnson. Also curious is the service mark symbol in the app name. The App Store allows developers to use a third-party trademark in an app name (see my own Homecoming for Mastodon) as long as the trademark appears at the end of the app…

I’m unaware of any explicit policy, but Apple’s long-standing practice is to release security updates for the latest three major versions of macOS. Currently, those are macOS 26 Tahoe, macOS 15 Sequoia, and macOS 14 Sonoma. On Monday, two days ago, Apple continued that practice by releasing macOS 26.5, 15.7.7, and 14.8.7. Another long-standing practice is to include Safari updates along with the latest major version of macOS but release Safari updates separately for the previous two major…

“Prevent cross-site tracking” is a Safari privacy setting, enabled by default. When “Prevent cross-site tracking” is enabled, Cloudflare challenges require an extra step, to manually click “Verify you are human.” This extra step is not required when “Prevent cross-site tracking” is disabled, nor is it required at all in Chrome or Firefox. Here is a Cloudflare challenge demo you can try: https://sergiodemo.com/security/challenge/managed-challenge In Chrome and Firefox, as well as in Safari with…