Ryan Christoffel writes via 9to5Mac: Since the Mac doesn't have the same locked-down app distribution system of iOS and iPadOS, Apple has created other tools meant to protect users. Some of those tools include app signing and notarization. Essentially, these provide a way for Apple to perform a level of vetting for macOS apps, even ones that don't hit the Mac App Store. The intent is to ultimately prevent harmful software from being inadvertently opened by Mac users. Trying to open an app that isn't correctly signed or notarized results in some scary warnings. But until now, power users could bypass those warnings -- and Apple's overall security process -- using a Control-click shortcut. But that shortcut is going away in macOS Sequoia.

According to a new post on the Apple Developer site: "In macOS Sequoia, users will no longer be able to Control-click to override Gatekeeper when opening software that isn't signed correctly or notarized. They'll need to visit System Settings > Privacy & Security to review security information for software before allowing it to run." The post then urges developers to make sure their software is properly signed so users won't need to jump through these hoops.

Zack Whittaker reports via TechCrunch: A cyberattack on Mobile Guardian, a U.K.-based provider of educational device management software, has sparked outages at schools across the world and has left thousands of students unable to access their files. Mobile Guardian acknowledged the cyberattack in a statement on its website, saying it identified "unauthorized access to the iOS and ChromeOS devices enrolled to the Mobile Guardian platform." The company said the cyberattack "affected users globally," including in North America, Europe and Singapore, and that the incident resulted in an unspecified portion of its userbase having their devices unenrolled from the platform and "wiped remotely." "Users are not currently able to log in to the Mobile Guardian Platform and students will experience restricted access on their devices," the company said.

Mobile device management (MDM) software allows businesses and schools to remotely monitor and manage entire fleets of devices used by employees or students. Singapore's Ministry of Education, touted as a significant customer of Mobile Guardian on the company's website since 2020, said in a statement overnight that thousands of its students had devices remotely wiped during the cyberattack. "Based on preliminary checks, about 13,000 students in Singapore from 26 secondary schools had their devices wiped remotely by the perpetrator," the Singaporean education ministry said in a statement. The ministry said it was removing the Mobile Guardian software from its fleet of student devices, including affected iPads and Chromebooks.

Apple has introduced a new feature for Safari that allows users to block distracting elements on web pages, such as sign-in popups, some autoplay videos and even ads (temporarily). The feature is called "Distraction Control" and is rolling out today in iOS 18 beta 5. 9to5Mac reports: Distraction Control is accessible via the same Page Menu interface in Safari as Reader and Viewer. Here, users will find a new "Hide Distracting Items" option to enable Distraction Control. Users will then be prompted to select different elements on a webpage that they feel are distracting. Users will have to manually choose each item on a webpage that they wish to hide. Distraction Control will persist through page refreshes and reloads, assuming that the hidden item does not change. Apple says that nothing is proactively hidden with this feature; only items that a user manually selects are hidden.

Apple also emphasizes that this feature is not meant to serve as an ad blocker. While a user can technically use Distraction Control to hide an ad on a website temporarily, that ad will re-appear when the page is refreshed or otherwise reloaded. In fact, the first time a user activates Distraction Control, Safari will display a pop-up that emphasizes the feature will not permanently remove ads or other areas of a website that frequently change. If a user chooses to hide something like a GDPR banner or a cookies request pop-up, Distraction Control behaves in the same way as if the user manually clicked to dismiss that pop-up. This means Distraction Control will serve as neither an "Accept" nor "Decline" for that cookies request. Finally, if a user wishes to unhide an item, they can click back into the Page Menu interface in Safari and choose "Show Hidden Items."

Apple's elaborate new ad campaign promises that Safari is "a browser that protects your privacy." And the Washington Post says Apple "deserves credit for making many privacy protections automatic with Safari..."

"But Albert Fox Cahn, executive director of the Surveillance Technology Oversight Project, said Safari is no better than the fourth-best web browser for your privacy." "If browser privacy were a sport at the Olympics, Apple isn't getting on the medal stand," Cahn said. (Apple did not comment about this.)

Safari stops third-party cookies anywhere you go on the web. So do Mozilla's Firefox and the Brave browser... Chrome allows third-party cookies in most cases unless you turn them off... Even without cookies, a website can pull information like the resolution of your computer screen, the fonts you have installed, add-on software you use and other technical details that in aggregate can help identify your device and what you're doing on it. The measures, typically called "fingerprinting," are privacy-eroding tracking by another name. Nick Doty with the Center for Democracy & Technology said there's generally not much you can do about fingerprinting. Usually you don't know you're being tracked that way. Apple says it defends against common fingerprinting techniques but Cahn said Firefox, Brave and the Tor Browser all are better at protecting you from digital surveillance. That's why he said Safari is no better than the fourth-best browser for privacy.
Safari's does offer extra privacy protections in its "private" mode, the article points out. "When you use this option, Apple says it does more to block use of 'advanced' fingerprinting techniques. It also steps up defenses against tracking that adds bits of identifying information to the web links you click."

The article concludes that Safari users can "feel reasonably good about the privacy (and security) protections, but you can probably do better — either by tweaking your Apple settings or using a web browser that's even more private than Safari."

Microsoft is making Skype ad-free in an update that will rollout to users across all platforms soon. From a report: The update also includes improved AI image creation tools on Skype for Windows and macOS, and the ability to sign in automatically on iOS if you're already signed into another Microsoft app. "Our latest update removes all ads from Skype channels and the entire Skype platform, ensuring a smoother, decluttered and more enjoyable user experience," says Skype product manager Irene Namuganyi. The removal of ads in Skype means you'll no longer see ads in the main chat interface, or in the channels section. Microsoft says it has listened to feedback around ads in Skype, and decided to "focus on your chats without any ad distractions, making your Skype experience cleaner and more user-friendly."

Apple's upcoming AI features will arrive later than anticipated, missing the initial launch of its upcoming iPhone and iPad software overhauls but giving the company more time to fix bugs. Bloomberg: The company is planning to begin rolling out Apple Intelligence to customers as part of software updates coming by October, according to people with knowledge of the matter. That means the AI features will arrive a few weeks after the initial iOS 18 and iPadOS 18 releases planned for September, said the people, who declined to be identified discussing unannounced release details.

Still, the iPhone maker is planning to make Apple Intelligence available to software developers for the first time for early testing as soon as this week via iOS 18.1 and iPadOS 18.1 betas, they added. The strategy is atypical as the company doesn't usually release previews of follow-up updates until around the time the initial version of the new software generation is released publicly. The stakes are higher than usual. In order to ensure a smooth consumer release of its big bet on AI, Apple needs support from developers to help iron out issues and test features on a wider scale. Concerns over the stability of Apple Intelligence features, in part, led the company to split the features from the initial launch of iOS 18 and iPadOS 18.

Cellebrite, the well-known mobile forensics company, was unable to unlock a sizable chunk of modern iPhones available on the market as of April 2024, 404 Media reported Wednesday, citing leaked documents it obtained. From the report: Mobile forensics companies typically do not release details on what specific models their tools can or cannot penetrate, instead using vague terms in marketing materials. The documents obtained by 404 Media, which are given to customers but not published publicly, show how fluid and fast moving the success, or failure, of mobile forensic tools can be, and highlights the constant cat and mouse game between hardware and operating manufacturers like Apple and Google, and the hacking companies looking for vulnerabilities to exploit.

[...] For all locked iPhones able to run 17.4 or newer, the Cellebrite document says "In Research," meaning they cannot necessarily be unlocked with Cellebrite's tools. For previous iterations of iOS 17, stretching from 17.1 to 17.3.1, Cellebrite says it does support the iPhone XR and iPhone 11 series. Specifically, the document says Cellebrite recently added support to those models for its Supersonic BF [brute force] capability, which claims to gain access to phones quickly. But for the iPhone 12 and up running those operating systems, Cellebrite says support is "Coming soon."

An anonymous reader quotes a report from TechCrunch: Apple's practice of leveraging ideas from its third-party developer community to become new iOS and Mac features and apps has a hefty price tag, a new report indicates. Ahead of its fall release, you can download the public beta for iOS 18 right now to get a firsthand look at Apple's changes, which may affect apps that today have an estimated $393 million in revenue and have been downloaded roughly 58 million times over the past year, according to an analysis by app intelligence firm Appfigures. Every June at Apple's Worldwide Developers Conference, the iPhone maker teases the upcoming releases of its software and operating systems, which often include features previously only available through third-party apps. The practice is so common now it's even been given a name: "sherlocking" -- a reference to a 1990s search app for Mac that borrowed features from a third-party app known as Watson. Now when Apple launches a new feature that was before the domain of a third-party app, it's said to have "sherlocked" the app. [...]

In an analysis of third-party apps that generated more than 1,000 downloads per year, Appfigures discovered several genres that had found themselves in Apple's crosshairs in 2024. In terms of worldwide gross revenue, these categories have generated significant income over the past 12 months, with the trail app category making the most at $307 million per year, led by market leader and 2023 Apple "App of the Year" AllTrails. Grammar helper apps, like Grammarly and others, also generated $35.7 million, while math helpers and password managers earned $23.4 million and $20.3 million, respectively. Apps for making custom emoji generated $7 million, too. Of these, trail apps accounted for the vast majority of "potentially sherlocked" revenue, or 78%, noted Appfigures, as well as 40% of downloads of sherlocked apps. In May 2024, they accounted for an estimated $28.8 million in gross consumer spending and 2.5 million downloads, to give you an idea of scale.

Many of these app categories were growing quickly, with math solvers having seen revenue growth of 43% year-over-year followed by grammar helpers (+40%), password managers (+38%) and trail apps (+28%). Emoji-making apps, however, were seeing declines at -17% year-over-year. By downloads, grammar helpers had seen 9.4 million installs over the past 12 months, followed by emoji makers (10.6 million), math-solving apps (9.5 million) and password managers (457,000 installs). "Although these apps certainly have dedicated user bases that may not immediately choose to switch to a first-party offering, Apple's ability to offer similar functionality built-in could be detrimental to their potential growth," concludes TechCrunch's Sarah Perez. "Casual users may be satisfied by Apple's 'good enough' solutions and won't seek out alternatives."

At the end of June, Apple's App Store rejected the Windows/retro PC emulator "UTM SE". But in a reversal Apple approved the app Saturday, reports the Verge.

"We are happy to announce that UTM SE is available (for free) on iOS and visionOS App Store," the developer posted on X, "and coming soon to AltStore PAL."

From the Verge: After Apple rejected the app in June, the developer said it wasn't going to keep trying because the app was "a subpar experience." Today, UTM thanked the AltStore team for helping it and credited another developer "whose QEMU TCTI implementation was pivotal for this JIT-less build."

As with other emulators on the App Store, you can't do much with UTM SE out of the box. It doesn't come with any operating systems, though the app does link to UTM's site, which has guides for Windows XP through Windows 11 emulation, as well as downloads of pre-built virtual Linux machines. Mac OS 9.2.1 and DOS are listed in one screenshot from the UTM SE App Store page. Mac OS 9.2.1 and DOS are listed in one screenshot from the UTM SE App Store page.

India's antitrust watchdog has concluded that Apple abused its dominant position in the iOS app store market, according to a confidential report seen by Reuters, marking a significant development in the country's scrutiny of tech giants. The Competition Commission of India, which initiated an investigation into Apple in 2021, has determined that the company engaged in "abusive conduct and practices" by compelling developers to utilize its proprietary in-app purchase system, Reuters added.

The report asserts that Apple wields "significant influence" over the distribution of digital products to consumers through its iOS platform and App Store, characterizing the tech giant as an "unavoidable trading partner" for app developers who have little choice but to comply with Apple's terms.

The European Commission has approved Apple's commitments to open its "tap to pay" iPhone payment system to rivals, avoiding a potentially hefty fine. The Guardian reports: Regulators had accused Apple in 2022 of abusing its dominant position by limiting access to its mobile payment technology. Apple responded by proposing in January to allow third-party mobile wallet and payment service providers access to the contactless payment function in its iOS operating system. After Apple tweaked its proposals following testing and feedback, the commission said those "final commitments" would address its competition concerns.

"Today's commitments end our Apple Pay investigation," Margrethe Vestager, the commission's executive vice-president for competition policy, told a press briefing in Brussels. "The commitments bring important changes to how Apple operates in Europe to the benefit of competitors and customers." Apple said in a prepared statement that it is "providing developers in the European Economic Area with an option to enable NFC [near-field communication] contactless payments and contactless transactions" for uses like car keys, corporate badges, hotel keys and concert tickets. [...] Apple must open up its payment system in the EU's 27 countries plus Iceland, Norway and Liechtenstein by July 25.

"As of this date, developers will be able to offer a mobile wallet on the iPhone with the same 'tap-and-go' experience that so far has been reserved for Apple Pay," Vestager said. The changes will remain in force for a decade and will be monitored by a trustee. Breaches of EU competition law can draw fines worth up to 10% of a company's annual global revenue, which in Apple's case could have amounted to tens of billions of euros.

An anonymous reader quotes a report from TechCrunch: Fast-food chain Whataburger's app has gone viral in the wake of Hurricane Beryl, which left around 1.8 million utility customers in Houston, Texas without power. Hundreds of thousands of those people may remain without power for days as Houston anticipates a heat wave, with temperatures climbing into the mid-90s. Amid frustrations with the local utility company CenterPoint Energy, which doesn't offer an app, some Houstonians got creative with their attempts to track the power outages. They turned to the Whataburger app instead.

Whataburger is a San Antonio-based fast-food chain with 127 stores in the Houston area, according to Newsweek. On the Whataburger app, users can see a map of Whataburger locations, with an orange logo indicating a store is open, and a grey logo meaning it's closed. Since CenterPoint Energy doesn't have an online map of outages, an X user with the screen name BBQBryan found that the map of which Whataburger stores are open could be a useful tool for seeing where there's power. This viral moment seems to have boosted Whataburger's download numbers. In the iOS App Store, Whataburger is currently ranked 16th in the food and drink category. Just three weeks ago, it was ranked 40th. "The Whataburger app works as a power outage tracker, handy since the electric company doesn't show a map," BBQBryan wrote in a post that now has over 22,000 likes and 6.9 million impressions.

"Well there's a use for our app we didn't think of!" the Whataburger X account replied. "We hope you and everyone else are okay!"

Scharon Harding reports via Wired: In 2019, Nike got closer than ever to its dreams of popularizing self-tying sneakers by releasing the Adapt BB. Using Bluetooth, the sneakers paired to the Adapt app that let users do things like tighten or loosen the shoes' laces and control its LED lights. However, Nike has announced that it's "retiring" the app on August 6 (Warning: source may be paywalled; alternative source), when it will no longer be downloadable from Apple's App Store or the Google Play Store; nor will it be updated.

In an announcement recently spotted by The Verge, Nike's brief explanation for discontinuing the app is that Nike "is no longer creating new versions of Adapt shoes." The company started informing owners about the app's retirement about four months ago. Those who already bought the shoes can still use the app after August 6, but it's expected that iOS or Android updates will eventually make the app unusable. Also, those who get a new device won't be able to download Adapt after August 6.

Without the app, wearers are unable to change the color of the sneaker's LED lights. The lights will either maintain the last color scheme selected via the app or, per Nike, "if you didn't install the app, light will be the default color." While owners will still be able to use on-shoe buttons to turn the shoes on or off, check its battery, adjust the lace's tightness, and save fit settings, the ability to change lighting and control the shoes via mobile phone were big selling points of the $350 kicks.

After two rejections, Apple has approved the Epic Games Store for iOS in the European Union. "This paves the way for Epic CEO Tim Sweeney to realize his long-stated goal of launching an alternative game store on Apple's closed platform -- at least in Europe," reports Ars Technica. From the report: Apple announced plans to allow third-party app stores on iOS in the region earlier this year, complying with the letter of the law (though some say not the spirit) as required by the Digital Markets Act (DMA), which was enacted in hopes of making platforms more open and competitive. Apple's new policies allow for alternative app marketplaces but with some big caveats regarding the deal that app developers agree to.

The change followed years of contentious PR campaigns and court battles around the world between Epic and Apple, with Sweeney proclaiming that Apple's app approval processes are anti-competitive and that its 30 percent cut of app revenues is unfair. Even after the shift, Apple is said to have rejected the Epic Games Store app twice. The rejections were over specific rules about the copy and shape of buttons within the app, though not about its primary function. [...] Apple went ahead and approved the app despite the disagreement over the copy and button designs. However, AppleInsider reported that Apple will still require Epic to change the copy and buttons later.

Microsoft told employees in China that from September they'll only be able to use iPhones for work, effectively cutting off Android-powered devices from the workplace. Bloomberg: The US company will soon require Chinese-based employees to use only Apple devices to verify their identities when logging in to work computers or phones, according to an internal memo reviewed by Bloomberg News. The measure, part of Microsoft's global Secure Future Initiative, will affect hundreds of workers across the Chinese mainland and is intended to ensure that all staff use the Microsoft Authenticator password manager and Identity Pass app.

The move highlights the fragmented nature of Android app stores in the country and the growing differences between Chinese and foreign mobile ecosystems. Unlike Apple's iOS store, Google Play isn't available in China, so local smartphone makers like Huawei and Xiaomi operate their own platforms. Microsoft has chosen to block access from those devices to its corporate resources because they lack Google's mobile services in the country, the message said.

"Fortnite" maker Epic Games said on Friday Apple was impeding its attempts to set up a games store on iPhones and iPads in Europe, the latest escalation in a bitter feud over the technology giant's control of the iOS app ecosystem. From a report: Apple has twice rejected documents it submitted to launch the Epic Games Store because the design of certain buttons and labels was similar to those used by its App Store, the video-game publisher said. "We are using the same 'Install' and 'In-app purchases' naming conventions that are used across popular app stores on multiple platforms, and are following standard conventions for buttons in iOS apps," Epic said in a series of posts on X. "Apple's rejection is arbitrary, obstructive, and in violation of the DMA, and we've shared our concerns with the European Commission," it said. Under pressure from European regulators, Apple had in March cleared the way for Epic to put its own game store on iOS devices in Europe.

As reported by Bloomberg, Apple will get an "observer role" on OpenAI's board of directors as part of its partnership to integrate ChatGPT into iOS 18. That role will reportedly be filled by Apple Fellow, Phil Schiller. 9to5Mac reports: Apple having an "observer role" on the OpenAI board matches the role of Microsoft. Schiller will be able to observe and attend board meetings, but will not have any voting power: "The board observer role will put Apple on par with Microsoft, OpenAI's biggest backer and its main AI technology provider. The job allows someone to attend board meetings without being able to vote or exercise other director powers. Observers, however, do gain insights into how decisions are made at the company." The arrangement will take effect later this year, according to Bloomberg. Schiller "hasn't yet attended any meetings" of the OpenAI board and "details of the situation could still change."

Schiller served as Apple's long-time marketing chief before transitioning to an Apple Fellow role in 2020. In this role, Schiller continues to lead the App Store and Apple events and reports directly to Apple CEO Tim Cook. Schiller is also leading Apple's efforts to defend the App Store against antitrust allegations around the world.

storagedude shares a report from the Cyber Express: Some of the most widely used web and social media applications could be vulnerable to three newly discovered CocoaPods vulnerabilities -- including potentially millions of Apple devices, according to a report by The Cyber Express, the news service of threat intelligence vendor Cyble Inc. E.V.A Information Security researchers reported three vulnerabilities in the open source CocoaPods dependency manager that could allow malicious actors to take over thousands of unclaimed pods and insert malicious code into many of the most popular iOS and MacOS applications, potentially affecting "almost every Apple device." The researchers found vulnerable code in applications provided by Meta (Facebook, Whatsapp), Apple (Safari, AppleTV, Xcode), and Microsoft (Teams); as well as in TikTok, Snapchat, Amazon, LinkedIn, Netflix, Okta, Yahoo, Zynga, and many more.

The vulnerabilities have been patched, yet the researchers still found 685 Pods "that had an explicit dependency using an orphaned Pod; doubtless there are hundreds or thousands more in proprietary codebases." The newly discovered vulnerabilities -- one of which (CVE-2024-38366) received a 10 out of 10 criticality score -- actually date from a May 2014 CocoaPods migration to a new 'Trunk' server, which left 1,866 orphaned pods that owners never reclaimed. While the vulnerabilities have been patched, the work for developers and DevOps teams that used CocoaPods before October 2023 is just getting started. "Developers and DevOps teams that have used CocoaPods in recent years should verify the integrity of open source dependencies used in their application code," the E.V.A researchers said. "The vulnerabilities we discovered could be used to control the dependency manager itself, and any published package." [...] "Dependency managers are an often-overlooked aspect of software supply chain security," the researchers wrote. "Security leaders should explore ways to increase governance and oversight over the use these tools." "While there is no direct evidence of any of these vulnerabilities being exploited in the wild, evidence of absence is not absence of evidence." the EVA researchers wrote. "Potential code changes could affect millions of Apple devices around the world across iPhone, Mac, AppleTV, and AppleWatch devices."

While no action is required by app developers or users, the EVA researchers recommend several ways to protect against these vulnerabilities. To ensure secure and consistent use of CocoaPods, synchronize the podfile.lock file with all developers, perform CRC validation for internally developed Pods, and conduct thorough security reviews of third-party code and dependencies. Furthermore, regularly review and verify the maintenance status and ownership of CocoaPods dependencies, perform periodic security scans, and be cautious of widely used dependencies as potential attack targets.

According to Bloomberg's Mark Gurman, Apple plans to add its "Apple Intelligence" AI features to visionOS and update its approach to in-store demos of the headset. The Verge reports: The company is adding a new "Go Deeper" option to its in-store demos, Gurman writes. That reportedly includes testing office features and watching videos, as well as defaulting to the Dual Loop band that sends straps over the top and around the back of wearers' heads instead of the single-strap Solo Loop band, which some find uncomfortable. Apple will also reportedly let people view their own videos and photos, including panoramas, in the headset. Adding the sentimental touch to the demos could work out, especially once visionOS 2 comes out this fall, with its "spatialize" option to turn 2D photos into 3D ones -- a feature that's more impressive than it has the right to be (though still a little quirky with hair and glasses, like Apple's Portrait Mode feature).

An anonymous reader quotes a report from Ars Technica: Meta continues to hit walls with its heavily scrutinized plan to comply with the European Union's strict online competition law, the Digital Markets Act (DMA), by offering Facebook and Instagram subscriptions as an alternative for privacy-inclined users who want to opt out of ad targeting. Today, the European Commission (EC) announced preliminary findings that Meta's so-called "pay or consent" or "pay or OK" model -- which gives users a choice to either pay for access to its platforms or give consent to collect user data to target ads -- is not compliant with the DMA. According to the EC, Meta's advertising model violates the DMA in two ways. First, it "does not allow users to opt for a service that uses less of their personal data but is otherwise equivalent to the 'personalized ads-based service." And second, it "does not allow users to exercise their right to freely consent to the combination of their personal data," the press release said.

Now, Meta will have a chance to review the EC's evidence and defend its policy, with today's findings kicking off a process that will take months. The EC's investigation is expected to conclude next March. Thierry Breton, the commissioner for the internal market, said in the press release that the preliminary findings represent "another important step" to ensure Meta's full compliance with the DMA. "The DMA is there to give back to the users the power to decide how their data is used and ensure innovative companies can compete on equal footing with tech giants on data access," Breton said. A Meta spokesperson told Ars that Meta plans to fight the findings -- which could trigger fines up to 10 percent of the company's worldwide turnover, as well as fines up to 20 percent for repeat infringement if Meta loses. The EC agreed that more talks were needed, writing in the press release, "the Commission continues its constructive engagement with Meta to identify a satisfactory path towards effective compliance." Meta continues to claim that its "subscription for no ads" model was "endorsed" by the highest court in Europe, the Court of Justice of the European Union (CJEU), last year.

"Subscription for no ads follows the direction of the highest court in Europe and complies with the DMA," Meta's spokesperson said. "We look forward to further constructive dialogue with the European Commission to bring this investigation to a close."

Meta rolled out its ad-free subscription service option last November. "Depending on where you purchase it will cost $10.5/month on the web or $13.75/month on iOS and Android," said the company in a blog post. "Regardless of where you purchase, the subscription will apply to all linked Facebook and Instagram accounts in a user's Accounts Center. As is the case for many online subscriptions, the iOS and Android pricing take into account the fees that Apple and Google charge through respective purchasing policies."