m0dest

like something straight out of The East

https://www.imdb.com/title/tt1869716/

The million dollar question: Which DRM?

The fact that Apple is using third-party DRM in a web app is news. Apple TV / iTunes videos never had a web app, and presumably DRM was a big factor.

Overflow scrolling CSS is deprecated in iOS 13. All scrollable elements now get it by default.

This.

I've seen a lot of naive designs where signed data is downloaded via an unsigned control channel. At the very least, they are vulnerable to replay attacks. Beyond that, it enables more selective blocking/filtering to prevent clients from accessing specific data.

Let's not forget the lost "confidentiality" aspect of TLS either. Your request for HP_Drivers_2019_Update.exe is now broadcasting to the Internet: "Hey I'm running a vulnerable, unpatched device! Last chance to hack me!"

I took a look at Xamarin recently to see how far it had come, and the tooling is really impressive. They seem to do a great job of keeping up to date with iOS/Android SDK changes, too.

But when trying to find an example of a native-feeling Xamarin-based app for iOS, I was really underwhelmed. I tried to find one that was (a) well-known and (b) third-party (not developed by Xamarin or Microsoft). The 4 contenders were:

- UPS - 1/4 stars - All views of the app are awkward embedded web views. Every page has a full screen modal spinner.

- Outback Steakhouse - 1/4 stars - Not updated for modern iPhones, so the whole app is letterboxed. UI is completely custom, so didn't attempt to feel native. Crashed as soon as it tried to get my location.

- Alaska Airlines - 3/4 stars - Feels native-ish, nice "vanilla" design. Mix of native forms and web views. All UI related to searching flights & buying tickets is a web view. Every tap on the tab bar causes a full screen modal spinner.

- FOX Sports - 4/4 stars - Wow, impressive. Lots of native-feeling views with their own branded styling. The custom widgets feel native.

It was great to find one "hero" app for Xamarin (FOX Sports), but the fact that it's an outlier is a little concerning.

This is great. Every company should be responsible for paying market price for security vulnerabilities in their own products. If you make something that carries significant market value, you should be paying the security tax in the form of a security team or bug bounties.

> "The analog layers contain a subset of the entire collection, and include: [...] (4) The complete Vital Articles of the Wikipedia (the full English Wikipedia text is in the digital layers)."

If we somehow lose Wikipedia and every mirror of the data, we're sending Jimmy Wales to the moon to fetch the off-site backup.

This means there might have been another side to this story: Zoom's change of heart might have been forced by Apple, not the public backlash.

Apple: Hey, your app poses a threat to macOS security. We're going to remove your server app with the built-in macOS anti-virus.

Zoom: Oh crap. Okay, give us 2 sprints to release a new version that removes it.

Apple: We're killing it in 48 hours.

...

Zoom, after an all-nighter: HEyyy users, we have a patch for youu

Universal Links are better than their localhost webserver insanity, but don't really solve this. A malicious website can still redirect you to a zoom.us URL that will instantly join the meeting without confirmation.

The underlying problem is that they want a URL to join a conference call hosted by any random user and share your audio/video without confirmation. And it's simply not safe to trigger that kind of action from a URL.

The solution is in sight. It's called Feature Policy.

https://feature-policy-demos.appspot.com/

https://developers.google.com/web/updates/2018/06/feature-po...

This is for tracking lost MacBooks. Apple said this at the keynote. They may expand it beyond laptops, but that's the initial scenario. (It's a great one.)

I used to willingly enable this and enjoyed this page. But it was recently revealed that Google shares bulk location data with law enforcement, offering the list of all devices that were in a certain area. That was the line for me. Disabled.

https://www.nytimes.com/interactive/2019/04/13/us/google-loc...

> The new orders, sometimes called “geofence” warrants, specify an area and a time period, and Google gathers information from Sensorvault about the devices that were there.

For all of our sanity, please don't start producing 8-bit H.264 videos with full 0-255 range.

If you have enough control over the decoder and renderer to make that hack work, you should just be producing 10-bit HEVC/AV1 video – which does not suffer from these 8-bit banding issues – with a modern color space (Rec 2020, PQ, etc.).

And if you don't have choice or control over the decoder and renderer, then it's a good sign that this would be a fragile hack.

How exactly is the airport supposed to offer a WiFi network that is encrypted and open without breaking usability and compatibility?

This hasn't been possible until WPA3, which has barely started rolling out.

Clicking is hands-down the hardest problem with this type of device. Their hardware mouse button placement is not ergonomic; the user in their video has to use a separate hand just to click!

• If you allow tap-to-click, users are likely to trigger false positives from resting on the keys

• If you allow press-to-click, users will be unable to click in many positions (e.g. the intersection of 3 keys)

This is super clever, and I hope this takes off.

At the same time, I have to worry: SMTP is forever, but I'm not so sure that IMAP is forever.

Email is increasingly becoming a fragmented oligopoly, and the major players are promoting their own alternative protocols. IMAP is becoming a very optional legacy feature.

If the success of this project required additional integrations with EAS and Google's mail APIs, would you do the work or reject the idea on principle?

I wouldn't be surprised if COI encounters issues with automated abuse detection and spam filters in those servers. When you're in an active conversation, the client is rapidly sending 1-line emails with strange headers.

Support for S/MIME encryption is pretty ubiquitous at this point, right? There are practical issues with CAs, but nothing insurmountable.

A pragmatic view:

70% of the mobile devices in Saudi Arabia run Android.

Outcome 1- Apple bans Absher but Google does not. Absher usage continues. Android gains market share over time.

Outcome 2- Apple and Google both ban Absher. Android users install it via sideload from the government website. Carriers preload the sideloaded Absher app onto new phones. Absher usage continues. Android market share grows over time.

I don't see a victory here other than taking a moral stance.

Post: Tries very hard to avoid any use of the word roadmap

First comment: Hey is X on the roadmap?

>Don't know about Chrome, but it's likely that Chrome blocks other peoples tracking in favor of Google's.

citation needed

Because animated GIFs are already muted, autoplaying videos. If you don't give web devs an efficient way to play silent animations and videos, they resort to horrible and inefficient hacks (animated GIF, image sprites, drawing video frames to a canvas, etc.)

Safari allows you to change the autoplay blocker to include all media, not just audible. But, for the web in general, muted autoplay is the right default.

This concern about breaking only seems true for the Node.js side. The HTML/JS/CSS running in the web view should be pretty resilient to version upgrades; web devs are used to defensive, backward-compatible design that handles multiple browser versions.

The bridge itself is API stable. evaluateJavaScript:completionHandler: isn't going anywhere.

So the question is whether it's okay to use a native web view while still bundling your own V8 + Node. That seems like an improvement to me!

It's great that they've simplified their story. Totally makes sense now. Texting app and AV app for consumers, texting app and AV app for teams.

But this leaves a giant hole in their consumer texting product. Have they given up on making a private, cross-platform texting product for consumers? Messages seems like it must use an Android phone as the user's primary device – as SMS requires OS integration and presumably RCS does too.

And neither SMS or RCS are private. Carriers have full visibility to all messages. That's light-years less secure than the end-to-end encryption offered by iMessage, WhatsApp, Telegram, or Signal, and even less private than the former Hangouts. (Say what you will about Google, I'd trust them with my private messages far more than any pair of cellular carriers.)

I'd love to see this in Presto. It would make my life 1000x easier.

VMT = Vehicle Miles Traveled

The article makes extensive use of this acronym without defining it.

Synced iMessage/SMS history ("Messages in the Cloud") is also E2E encrypted - unless the user enables iCloud Backup on an iOS device, which must keep a decryption key in escrow to support restore scenarios.

Apple Notes is different. Notes stored in iCloud (default for iOS & macOS) are stored in a fairly inaccessible local database. They cannot be exported to any format other than single notes as PDFs. The service offers no public API.

7 days to make sure that this isn't part of the Import flow of a competing app :D

You could say a lot of the same things about SharePoint. (I was never a fan, personally.) This seems like the natural progression of any CMS that tries to be infinitely extensible and flexible. It becomes very difficult to evolve or simplify your product without breaking its add-on ecosystem and your most entrenched customers.