Talal Haj Bakry and Tommy Mysk (Mastodon, Hacker News, MacRumors, Mac Power Users):

WebKit-based browsers on iOS and macOS can be configured to route all web traffic through proxy servers, which is how Tor browsers on iOS and our own Psylo work. We found three WebKit features — DNS prefetching, WebAuthn Related Origin Requests, and WebTransport — that bypass the configured proxy and send traffic directly from the device, which exposes the user’s real network. The same leaks also affect Apple’s iCloud Private Relay.

[…]

It must be noted that VPNs are not affected, since they tunnel the device’s entire network traffic at the system level.

[…]

We’ve addressed all three leaks in Psylo 1.3.1[…] Passkeys and WebTransport have legitimate uses, so both can be re-enabled at any time through per-silo toggles. This keeps Psylo leak-free out of the box, while users who need one of these features on a given site can opt in explicitly, with a clear understanding of the trade-off.

Psylo:

In an ideal world, we’d report the issues to Apple, they acknowledge the issue, and ship a fix in a timely manner. Unfortunately, our past experience with Apple tells us that reporting this issue would involve months of delays, inconsistent communication, and in some cases, denying the issue’s impact entirely.

We weren’t willing to wait months, or upwards of a year, sitting on bugs that undermine the core privacy guarantees of Psylo and iOS Tor browsers while saying or doing nothing.

[…]

Should we knowingly leave our users exposed while waiting for a system-level fix? We didn’t think that was acceptable or fair to our users. Or should we quietly ship our own mitigations without telling anyone? We didn’t think that was acceptable either. Security fixes deserve transparency, especially when they involve tradeoffs.

Psylo:

Soon after we published the blog, we sent a link to the blog and demo website to Apple in a security report to make them aware of it. Now the report is already in the status “We’re planning to address the issue you reported.” and a fix is planned for Fall 2026 🤯🤯🤯

Mysk:

It used to take months and months to reach this status. We got there in less than 24h

Running to the press always helps…

Previously:

• Hide My Email Vulnerability Exposes Real Address
• No Bounty for Mysk
• Psylo Web Browser 1.0
• iCloud Private Relay White Paper

Update (2026-08-11): Ben Lovejoy (MacRumors):

A class action lawsuit accusing Apple of false advertising, misrepresentation, and fraud has now been filed by Clarkson Law Firm – the same lawyers who previously obtained a $250M settlement over the delayed launch of Siri AI.

Michael Kan:

US satellite internet provider Hughesnet has filed for Chapter 11 bankruptcy after running low on cash and losing subscribers to Starlink.

Hughes Network Systems filed in a US bankruptcy court on Sunday, but the company notes it’ll continue serving its satellite internet customers during the restructuring period.

I used Hughesnet before DSL was available. The company was really annoying to deal with, and the dish was finicky, but the service was much better than using a dial-up modem.

Previously:

• Globalstar Takeover
• Starlink Mini
• US Broadband, OS, and Browser Stats

[Update: See the retraction below.]

Terry Godier:

On the web, if I build something that works within the standards, it works. Whether people use it is up to them. On iOS, there is another question entirely: whether Apple decides it should exist.

[…]

In the past couple of years I’ve built three apps that were rejected from the App Store on various grounds.

[…]

A while ago I tried to submit an iOS app for Dark Hours, my astronomy website for normal people. It was rejected on the grounds that it was astrology.

[…]

I see countless ChatGPT wrappers with nearly identical icons and eye-watering subscriptions. I see astronomy apps requesting permissions that have nothing to do with looking at the night sky. My kids download games that interrupt play every few minutes to advertise the developer’s other subscription apps, each with their own $20–50 yearly plans.

Via John Gruber (Mastodon, Hacker News):

But if you actually look at Godier’s Dark Hours, for even just a few seconds, it is instantly obvious that it pertains to the science of astronomy and has absolutely nothing — zero, zilch, nada — to do with astrology.

[…]

Godier proceeded through a series of escalations up to the App Review Board and the Review Board responded that they determined the original rejection was valid because, I shit you not, “We understand that the app includes a live tarot reading feature.” Which isn’t even about astrology. It’s straight out of Kafka.

[…]

This isn’t just contrary to the benefit of developers, like Godier. It’s obviously contrary to the benefit of Apple itself, which should not just accept an app like Dark Hours, but celebrate it as an exemplar of the platform.

Mistakes happen. But in a functioning system mistakes get corrected, and mistakes as obvious as this one get corrected almost instantly and include a quick apology for the conflation. The App Store is not a functioning system.

Previously:

• Chrome Browser Default at the Top of the Mac App Store
• Apps for YouTube℠™®•!
• Struck Rejected From the App Store

Update (2026-08-10): John Gruber:

To the best of my recollection, this is the first post I’ve retracted in the 24 years I’ve been writing Daring Fireball. I hope it’s the last. I was misled, both overtly and through omissions[…]

[…]

The truth is, the app, as originally submitted by Godier to the App Store (under the name “Asterly”, not “Dark Hours”), was entirely dedicated to astrology, not astronomy, and did in fact include a “Tarot card of the day” feature amongst other occultist horseshit.

[…]

I wrongly took Godier at his word, both in his public blog post and in private iMessage correspondence yesterday, that the rejection wasn’t just merely debatable, but completely and rather preposterously ungrounded. Whether Godier ever submitted a build of “Asterly” to the App Store that contained no occult horseshit and only the hard-science astronomy features that were present in his “Dark Hours” website that was available for the last week, I don’t know. But I have no reason to believe that he did.

[…]

In an uncomfortable exchange between Beher and Godier on Bluesky, Beher pointed out that Godier’s Dark Hours had the same bug as Beher’s that routed people to “random fields in Mexico”. Earlier today, Godier took his web app down and redirected his darkhours.io domain to Beher’s darkhours.app.

I’m really unhappy about this, both for my role in spreading a false story and because I think it will hurt the cause of reforming App Review. I know there are many crazy rejections and have experienced some first-hand. This story was believable because of that well-known history and because Godier didn’t seem like a nobody trying to get attention—he was the developer of another highly regarded app. But now people are going to point to true developer stories and accuse them of being fakes, too.

Jeff Johnson:

Terry Godier has just published a so-called “Mea Culpa” blaming Claude for cloning an open source app and denying foreknowledge.

There’s no mention of or apology for how Godier deceived Gruber and the world about the astronomy/astrology App Store submission/rejection.

The blog post essentially confirms that this person cannot be trusted.

Update (2026-08-11): Colin Cornaby:

BOTH projects were generated using Claude. So you have two people - both generating the same app from the same training data - having a public throw down over who copied who.

[…]

The “original” developer does claim to know how to code - which wasn’t clear from my research. That still doesn’t necessarily mean the original app was the source of the training data. They both may be a result of the same training data.

Nick Lockwood:

Holy shit, so the “Claude plagiarised an app” story is actually “Claude produced the same app twice when prompted to do so by two separate developers” 😅

It’s not clear to me exactly how much each developer relied on Claude or which training data was used, but I wanted to note this angle of the story.

Update (2026-08-14): Rosyna Keller:

With all this talk of an astrology app being rejected by App Store review I’m reminded there’s still a flat Earth/astrology app on the App Store that actively leaks the location of all of its users.

Juli Clover (release notes, security, no enterprise, no developer, full installer, IPSW):

macOS Tahoe 26.6.1 fixes a vulnerability that could allow an attacker to authenticate to Screen Sharing without valid credentials.

See also: Adam Engst and Mr. Macintosh.

Previously:

• macOS 26.6

Update (2026-08-14): Bill Toulas:

In an update to the initial advisory, the Dutch agency said it received a report indicating that the vulnerability is being exploited in the wild in attacks where port 5900 is exposed to the internet.

According to the NCSC, the attacker obtained root access to the system and deployed a Monero cryptocurrency miner.

Update (2026-08-20): Edovia (tweet, MacRumors):

The vulnerability, identified as CVE-2026-65400, could allow an attacker on the network to authenticate to Screen Sharing without valid credentials. Reports now indicate that the vulnerability has been actively exploited on Macs where Screen Sharing was accessible from the Internet.

[…]

[We] strongly recommend that all Screens users install the latest macOS updates as soon as possible.

[…]

For users who want to further restrict access to Screen Sharing, Screens can connect to a Mac through an SSH tunnel instead of exposing the Screen Sharing service directly.

macOS 15.7.9 (security, full installer):

This update provides important security fixes and is recommended for all users.

macOS 14.8.9 (security, full installer):

This update provides important security fixes and is recommended for all users.

These seem to fix the same screen sharing bug as the macOS 26.6.1 update.

See also: Howard Oakley.

Previously:

• macOS 15.7.8 and 14.8.8

Ruben Schade (Hacker News):

This idea is so powerful—and so longed for—that it’s escaped containment among the Apple crowd. I’ve seen everything from Linux distro to phone updates referred to as Snow Leopard releases, when their vendors cite stability and bug fixes over new features. Likewise, people plead with their vendors for a Snow Leopard release when they feel quality has slipped.

The reality was a bit different. As I wrote at the time[…]

People conflate a bunch of different ideas when talking about Snow Leopard:

• Were there really zero no features? No, but there were fewer user-facing ones.
• Was the initial release especially low in bugs? No, but it was better than Leopard’s.
• Did it feel faster? Yes.
• Was the final release especially low in bugs? Yes, it was fantastic.
• Was it just because of the longer release cycle before Lion? No, they really did focus on quality for the initial release. And they didn’t add as much stuff mid-cycle as they did with Tiger and Leopard.

LegNeato:

Snow Leopard’s stated goal internally was reducing bugs and increasing quality. That is a fact, not marketing. I am not sure why people on the internet don’t believe that, but I was there. If you wanted to ship a feature you had to get explicit approval from leadership and the bar was high. In normal feature releases it operated bottom up “here is what we are planning to ship” and in Snow Leopard it was top down “can we ship this?”.

AFAIK Snow Leopard was the first release of this kind (the first release I worked on was Jaguar or Puma), and was a direct response to taking 8 software updates to stabilize 10.5 and the severity of the bugs found during that cycle and the resulting bad press. Leopard was a HUGE feature release and with it came tons of (bad) bugs.

[…]

Testing was basically engineers, internal QA, some strategic partners like Adobe and MS, and the Apple Seed program (which was tiny). There was very little automated testing. Apple employees are not representative of the population and QA coverage is never very complete. And we sometimes held back features from seed releases when we were worried about leaks, so it wasn’t even the complete OS that was being tested.

Software updates are always needed, though the issues they fix became less severe over time due to larger seeds (aka betas), recovery partitions, and better / more modern development practices. But I can tell you FOR A FACT that Snow Leopard had fewer major bugs over its lifetime, coalesced very quickly, and was extremely solid when Lion was released.

Ken Ferry:

I agree with you that Snow Leopard was billed as no USER VISIBLE features. But people did NOT just fix niggling bugs, it was an architecturally huge release. E.g., it introduced GCD. And unless I’m confusing the year, it rewrote the Mail backend to use it and mail hasn’t had reliable search since.

My memory is that quality was so low that we pushed back the release. With the extra time we did manage to fix enough bugs that it was well received. But internally it was more destabilizing than most releases due to the amount of architectural churn.

giantrobot:

Yeah as someone else that worked on Snow Leopard I found this article and ones like it a bit silly. They’re a lot like the old “debug code” posts on Mac forums back in the day trying to explain why Puma was slow (no, you’ve got a G3 and an unaccelerated video card).

Tiger and Leopard were sprawling releases. Tiger covered 32-bit and 64-bit PowerPC, then 32-bit x86, then 64-bit x86 Macs. Tiger was also what I guess I’d say is the first “modern” OSX release, with subsystems like launchd and a more mature OpenDirectory replacing older NeXT subsystems. Leopard in my experience was a train wreck. It shipped a lot of new features, both user facing and back end frameworks, but the development was seriously impacted from teams losing engineers to iOS. Leopard had features planned assuming 100% availability of SWE’s resources but ended up with 40-50% of SWE’s resources (made up numbers based on my feels at the time). Many new frameworks in Leopard did not land or get stable until very late in the development cycle which meant everything downstream had to scramble right before GM. It was 100% the case that Leopard was not really stable until 10.5.8 and still sucked IMHO.

There was a lot of clean-up needed in MacOS and that was Snow Leopard. It was not a perfect release but 10.6.3 (the second disc pressing IIRC) and onward were very stable. Dropping PowerPC support really helped focus QA since they didn’t need the massive array of test hardware Tiger and Leopard required. You also didn’t need to wrangle builds for four architectures, including multiple compilers as a few libraries (if not whole frameworks) were compiled with ICC on x86 for performance reasons. The “Snow Leopard wasn’t that great” meme is weird. I’m sure it had its problems like every OSX release did. Unfortunately most OSX releases broke someone’s workflow. Snow Leopard ware no different. But it was always billed internally as a “no new features” release and those features that it did ship faced a very high bar to get in the release. I definitely look back on Snow Leopard as a high water mark for macOS quality in terms of a release.

Previously:

• “If You Can’t Stand By a Feature, You Shouldn’t Launch It.”
• Glow Leopard
• Snow Leopard at 15
• The Myth and Reality of Mac OS X Snow Leopard
• A Retrospective Look at Mac OS X Snow Leopard

Update (2026-08-10): Mooch:

If you weren’t there then you don’t know why I considered getting a “10.6.8” tattoo at one point. Boot Camp was no longer siloed, zero-drama Exchange support was baked in, Quicktime X hauled ass, and It was the definitive answer to the smoldering wreckage of Vista.

Mario Palomera:

Snow Leopard has always remained the best Apple OS in my memory. For me Mail search was perfect all the time, once spotlight finished indexing it was incredible, iTunes, finder, everything just worked. The consistency was felt everywhere…

macintog:

[But] there’s one other missing piece: time

everyone forgets the annual release cycle is a modern novelty. plot 10.x.0’s and 10.x.y final builds on a timeline and it becomes clear

Juli Clover:

Apple is working on a new feature that will support cross-device copy and paste between iOS devices and Windows PCs.

Microsoft asked for the feature using Apple’s EU interoperability request system for developers, which Apple implemented to comply with the Digital Markets Act. Apple began evaluating the request in March, and on June 26, proposed a project plan.

[…]

Apple proposed a solution that would let an iPhone share and import items from the pasteboard to a paired accessory, like a Windows PC. Apple plans to use a solution similar to the Accessory Notifications option it added for third-party wearables in the EU in iOS 26.5. Users would need to give a paired device one-time permission to paste content from an iPhone.

[…]

Apple says introducing cross-device copy and paste is a significant engineering effort, with work expected to be complete by fall 2027.

I wonder whether Apple will restrict this to the EU.

Previously:

• iOS 26.5 and iPadOS 26.5
• Apple Appeals EU Digital Markets Act Interoperability Rules
• DMA Compliance: Default Maps App in EU
• Meta’s iOS Interoperability Requests
• DMA Compliance: Interoperability Requests

Anurag Chawake:

Apple faces a $32.5 billion lawsuit over how its Photos app scans and stores faces. A federal judge cleared the case to proceed as a class action late last month, allowing millions of Illinois iPhone owners to join.

The case has been years in the making, and Apple has fought to shut it down at nearly every turn. Now it heads back to the court, with the company’s privacy practices on trial.

[…]

Court records have shown that the update applies to users with iCloud Photos turned on. Those accounts also need to use at least 10GB of storage and contain at least 5,000 photos and videos. Plaintiffs say all this amounts to collecting biometric data without consent, putting Apple squarely at odds with Illinois law.

Again, I find it odd that features are apparently gated based on the capacity of your iCloud account rather than the available storage.

Malcolm Owen:

The lawsuit accuses Apple of collecting biometric data without user consent in the Photos app, reports The Times. It is alleged that Photos uses facial recognition technology to scan individuals who appear in images, creating a “faceprint” for each person in the photo library.

After collecting enough samples, an algorithm is allegedly used to identify the iPhone user. That data is then stored on the iPhone within the Photos app.

I don’t see what the issue is here. My understanding is that it only uploads vectors after you’ve opted in by enabling iCloud Photos and manually assigning names. Also, the vectors don’t seem like the sort of biometric information that the law was meant to protect.

Brian Webster:

Assuming things are working properly, what should happen is that the people you have specifically named and the photos you have specifically verified sync their info via iCloud. However, the actual face detection for the rest of the photos is done on a per device basis and is not synced via iCloud, primarily for security/privacy reasons.

So, when you first set up a new device, it will pull down the names and info for the photos where you have identified a particular person, but then it still needs to go through the entire library on-device, identify the faces in each photo, and compare them to the synced information to tell which person is in which photo. So once it’s done, you should end up with mostly the same photos identified as each person, but each device still needs to do its own face detection locally.

Juli Clover:

Google Health (previously the Fitbit app) collects fitness, sleep, and wellness data from a connected wearable device. Steps, distance traveled, heart rate, sleep, and more can now be added to Apple Health. As noted on Reddit, some data such as HRV doesn't transfer over.

[…]

Syncing can be enabled after downloading the update by selecting Connections, choosing Apps and services, and then adding Apple Health.

My wife is a longtime Fitbit user. A few weeks ago, some family and friends started a friendly competition to see who could get the most steps. They’re all Fitbit users, too. Then she wanted to start comparing step counts with me, but I have an Apple Watch. I thought this would be no problem because the Health app has a sharing feature, and Fitbit and HealthKit have both been around forever. I was shocked to learn that there has never been any syncing. I don’t really understand the reason for this, as it seems like it would make the Fitbit more valuable.

It looks like the syncing part is now solved, but we still can’t automatically compare our steps. We’ve both tried inviting each other to share step counts and some other metrics multiple times over the last several weeks, and it has never worked. Either the invitation doesn’t arrive or the app just spins forever when trying to accept it.

Previously:

• Google Acquires Fitbit

Jeff Johnson (Hacker News):

Nonetheless, when I send an email in Mail app, from a non-iCloud account to an non-iCloud account, Mail immediately triggers an iCloud connection, as revealed by Little Snitch.

[…]

What could Mail be querying and saving in CloudKit when I’ve disabled Mail in iCloud?

[…]

As you can see in my screenshot at the beginning of this blog post, I have Contacts turned off in iCloud settings, so my Previous Recipients list should not be synced to iCloud. Nonetheless, I followed the commenter’s suggestion of logging in Terminal. I saw log messages that referred to com.apple.mail.recents, which might indicate Previous Recipients and would certainly explain why this happens when I send an email.

[…]

I do object to notifying Apple that I’ve just sent an email. That in itself seems like a violation of my privacy.

The settings are confusing, even more so than with System Preferences. If you go to System Settings ‣ Apple Account, it shows a round rect that says Mail and shows the Mail icon. If you click this, it lets you uncheck Sync this Mac for iCloud Mail. This mirrors the iCloud Mail checkbox that you get when you click See All to see the full list of apps. I don’t like how the top-level name and icon suggest that you’re going to a settings sheet for the Mail app, but then it actually gives you iCloud settings.

Importantly, there’s also another Mail checkbox in that list. It’s easy to miss because, first, why would you expect to see two Mail checkboxes?

And, second, it’s not obvious that there are actually three lists: a bunch of “favorite” system apps, in non-alphabetical order, for some reason including lesser ones like Freeform and Image Playground; followed by a second list of system apps in alphabetical order; and then a third list of alphabetical third-party apps.

Mail is in the second list, along with (to me) other top-tier apps like Books and Maps. Anyway, this second Mail checkbox controls the syncing of non-mail Mail data such as rules and smart mailboxes. But not, apparently, according to Apple, the previous recipients.

Previously:

• System Settings
• Yosemite Uploads Unsaved Documents and Recent Addresses to iCloud

Hartley Charlton (The Verge):

Apple briefly removed Telegram from the App Store on Monday night after a review found content that violated its guidelines against child sexual abuse material (CSAM), but restored the app a short while later, according to Reuters.

It seems like this was a symbolic gesture. Removing the app didn’t affect any of the customers who had already downloaded it. Probably none of them saw the image. And restoring the app doesn’t mean that it’s completely free from CSAM—probably none of the major platforms is. It just means that Telegram did the obvious thing after the violation was reported, which presumably they would have done, anyway.

Jeff Johnson:

They removed an entire app for ONE app user???

And before even contacting the developer? Telegram banning the account is what actually prevented users from potentially seeing the CSAM. Apple’s action seems like either a mistake or trying to send them a message.

I would note, by the way, that the Telegram app was apparently never removed from the Mac App Store. Which goes to show how little Apple cares about the Mac App Store.

Telegram:

I’m sure this stance will be applied equally to all other apps in the store, in the future right? @Apple

Pavel Durov (Telegram, MacRumors):

Because Telegram quickly removes illegal content from public groups using all kinds of moderation tools, the attacker had to resort to a technical trick. He inserted AI-modified illegal content by editing an old message in an active group chat. As a result the content was effectively hidden from the group’s members, preventing them from seeing/reporting it.

The attacker was a takedown extortionist: someone who demands ransom from group owners in exchange for not targeting their communities. These extortionists use automated accounts to plant illegal content in public groups and then report it directly to Apple, attempting to trigger the removal of legitimate communities whose owners refused to pay them.

[…]

Extortionists have found a way to manipulate Apple into overreacting. Apple removed Telegram from the App Store before contacting us. This creates a potential systemic risk for every mobile app that hosts user-generated content. If an app used by more than a billion people can be removed from the App Store without prior warning, any app can be.

Marcus Mendes:

During the time the app was unavailable, many speculated that the move was politically motivated, or perhaps in response to the recent discovery that Telegram has allegedly been using an obfuscated private UIKit API to animate its emoji picker.

It’s sad but kind of hilarious that both of these so disparate theories were considered possible. Durov really does have political enemies, and Apple really does seem to have it out for Telegram. But, also, using private API to animate emojis totally seems like something that Telegram would do and that Apple would overreact to.

Previously:

• Telegram Founder Arrested
• Telegram Stuck in App Review
• Apple Forces Telegram to Close Channels Run by Belarus Protestors
• Apple Hasn’t Blocked Telegram App, But Won’t Allow Updates

Update (2026-08-06): Matt Burgess (Hacker News):

Over the last nine months, Mark Zuckerberg’s Meta has run dozens of paid ads that include explicit AI-generated child sexual abuse material (CSAM) and images of minors alongside sexually suggestive statements, according to details of the ads shared with WIRED. The ads, which in some cases reached several thousand accounts, were targeted at people living in the United States, United Kingdom, and more than a dozen European countries.

This is much worse than what happened with Telegram, yet Apple didn’t overreact.

There’s also the Twitter/Grok case.

Previously:

• San Francisco Demands Removal of Nudify Apps

Sarah Perez (Hacker News):

Apple is now seeking a preliminary injunction in its trade secrets case against OpenAI, which aims to stop the AI model maker from moving forward with developing an AI device or other products based on Apple’s technology. […] In a new filing, Apple is requesting expedited discovery from the accused OpenAI employees, senior systems engineer Chang Liu and Chief Hardware Officer Tang Yew Tan; OpenAI, and its foundation; and io, the device startup co-founded by Apple’s former lead designer Jony Ive.

OpenAI (Hacker News, ArsTechnica, The Verge, MacRumors, 9To5Mac):

Apple had claimed that they contacted OpenAI in February and that we didn’t respond. They now admit that their outside lawyers emailed the wrong person after confusing two Asian last names—only after we brought this to their attention. Apple also claimed they had a discussion with our General Counsel, which they now concede never happened. But they again hide the fact that they never raised the specific allegations in this lawsuit at that time, and that they in fact told us that they were “resolving any issues”. We then heard nothing for five months until they sued. In their latest filing, Apple tries hard to spin this sequence of events, but you can just read the emails for yourself here.

Apple accuses Chang Liu of accessing Apple confidential information after leaving the company, but only now admits that Apple employees reached out to him and asked for his help to locate this information (you can read the messages here). Apple now tries to shift the blame to “residual access”, but they also don’t disclose that this is a common issue with Apple which is caused by them failing to properly manage system access when people leave. What that means in practice is that former employees who are trying to do the right thing when they leave still have access to Apple files—despite not wanting them or even being aware of them.

William Gallagher:

What it does not even touch is the accusation that Chang Liu retained his Apple laptop, which seems to be proven by what OpenAI posted. Apple further says that Liu entered shared network folders after leaving the company, and did so to download dozens of confidential files.

Then, too, OpenAI ignores the specific further accusation that ex-Apple employee Tang Tan both emailed documents to himself and sought trade secrets from employees he was recruiting for the ChatGPT company.

asimpletune:

What really matters is the claim that Apple never raised those issues in the lawsuit with them. OpenAI claims the emails prove this, but to me all the emails prove is Apple sent an email that said “please see the attached letters”. We don’t know what is in the attachments but I imagine those were the relevant issues they raised.

[…]

The fact that the lawyer emailed the wrong person is moot if they caught it and resolved it days later.

Previously:

• Confidential Apple Files in iCloud
• Apple Sues OpenAI Over Trade Secrets

Update (2026-08-05): John Gruber:

In OpenAI’s phrasing, it sounds like Apple’s attorney sent the entire initial letter of concern to the wrong person, and that’s why OpenAI never responded — because it wasn’t sent to the correct person (OpenAI general counsel Che Chang). That’s not what happened. The initial blockbuster “hey we think you guys are stealing our trade secrets and we want to talk to you about it” letter was sent to Che Chang. And Che Chang never did respond to Apple’s lawyers. That a mistaken email thanking Che Chang for a phone call that never happened (because that email was intended for another OpenAI employee) was also sent is irrelevant. I don’t understand why OpenAI is continuing to focus on this inconsequential mistake.

[…]

The iMessage transcripts that OpenAI provides at the bottom of their post do not contradict Apple’s claims at all. […] Apple also claims that Liu accessed confidential information, presumably in Box and definitely not in iCloud Drive, on five different occasions, up until 27 April 2026, over three months after he left Apple. These chat transcripts offer no explanation for that.

[…]

To me, the most interesting response from OpenAI wasn’t their blog post, and was in fact released by Apple, as “Exhibit F” to one of their expert declarations submitted to the court last night.

Juli Clover:

The way Apple combines work and personal iCloud accounts left some employees able to access confidential documents after departing the company, reports The Information. The site spoke to more than half a dozen former Apple employees who were unknowingly left with access to sensitive content.

[…]

Apple told The Information that the OpenAI lawsuit is unrelated to any files left available on iCloud and that it does not pursue legal claims against former employees who accidentally have Apple documents in their personal iCloud accounts.

[…]

In a now-settled legal dispute, chip company Rivos claimed Apple intentionally lets former employees retain access to files “as part of a planned effort to generate a pretextual basis to sue the employees and their new employer for ‘stealing’ Apple material.” In the Rivos case, an employee was targeted for keeping work files in his personal iCloud account.

Andrew Orr:

The documents included confidential material such as plans for product launch events. The former employees said they made no effort to retain access and unexpectedly found the files mixed with their personal iCloud data.

The problem reportedly grew from Apple’s practice of encouraging employees to connect their personal Apple IDs to company-funded iCloud storage.

[…]

Apple also relied heavily on iMessage for workplace conversations and file sharing before rolling out Slack around 2019. Former employees could retain old iMessage conversations and attachments, while Apple could terminate their Slack access when they left.

John Gruber (Mastodon):

If you use your personal Apple ID, you get a magic “Apple Work” folder in iCloud Drive. When you leave Apple, that “Apple Work” folder disappears. But any other files or folders that were shared with you that were outside that magic folder are still in your iCloud Drive, because it’s still your personal iCloud account.

[…]

You still have the same Apple ID account, even though you no longer have an employee @apple.com email account. Overall, this is a humane way of dealing with digital identity. Your Apple ID account is you, the person, not “example@icloud.com”, one specific unique email address. And you, the person, may well have multiple email addresses — all of which can be associated with your one Apple ID account. That makes Apple IDs more nuanced and complicated than a simple mapping of one email address = one account. And it obviously makes access restrictions more complicated.

Yesterday, OpenAI released messages to show that Apple employees (with permission) retained access to the departing employee’s personal iCloud account so that they could access work files that were stored there. It’s just a mess that both the software and corporate policy encourage mixing everything in one account.

Eric Schwarz:

As many things I know about Apple, this whole thing both makes perfect sense and feels absolutely bonkers.

Previously:

• OpenAI Open Letter Responds to Apple Lawsuit
• Apple Sues OpenAI Over Trade Secrets
• Privacy for Apple Employees

Ryan Merket (Hacker News, PDF):

The company said his performance was the reason, according to a lawsuit Boardman filed in San Francisco Superior Court. Boardman says that explanation was a pretext. His version of the story begins three years earlier, inside Apple’s technical relationship with the largest wireless carriers in the United States, with a category of data capable of identifying nearly every phone on the network.

[…]

Apple considered serial numbers and IMEIs personally identifiable information under its internal policies, Boardman alleges. Representatives working with carriers other than AT&T required the carrier to obtain a customer release before Apple supplied the data. The Apple representative assigned to AT&T did not enforce that requirement, according to the complaint. Boardman says the identifiers were then transmitted through “unsecured email communications.”

He reported the practice to his manager and sought guidance from Apple’s legal department. He alleges that the company never gave him a written response.

I don’t think he has much of a legal case. Apple was probably within its rights to fire him if what he refused to do was against company policy but not illegal. It doesn’t sound like Apple is disputing that, at least not yet.

However, I think this is interesting because:

• This seems to be another case, like yesterday’s story, where the interests of the customer and the carrier are at odds, and Apple leans towards the latter.

• It shows that a policy is no guarantee, because it depends on humans choosing to follow it. There are other cases where Apple has been able to engineer privacy into the system. But some data is not end-to-end encrypted, so consent is a formal but a not technical requirement.

Previously:

• Apple Upgrade
• Advertising Cognitive Dissonance
• App Store Personalized Recommendations and Keylogging
• UK Again Wants iCloud Backdoor

Anthony Reimer:

When you are shell scripting or working in Terminal, sometimes you want a quicker way to enter the path to a file or folder, particularly if you have already navigated to it in the Finder. One way that works in Terminal is to drag the file or folder from the Finder onto the Terminal window, which then types the path into the current command. However, another method was introduced in El Capitan (OS X 10.11) that allows you to copy the full path onto the clipboard.

In Finder, you can hold down Option and choose Edit ‣ Copy Pathname.

Starting in macOS Sequoia, copying the path to the clipboard using the method described generates a path that can be directly pasted into the Terminal or a script and be interpreted as that path without further manipulation.

It adds single quotes and or escapes characters, but only if necessary.

There are certainly some people who are unhappy with this change in behaviour but most Mac Admins will not be among them.

You can get the unescaped path via AppleScript.

Anthony Reimer (via Miles Wolbe):

Graham Pugh pointed out that if you have text on the clipboard, you have the option of pasting that text “escaped” in Terminal. Simply copy the text from whatever source you choose (e.g., the output of an AutoPkg run, where paths are not escaped), then in Terminal choose Edit > Pasted Escaped Text or use the shortcut Command-Control-V.

[…]

As a bonus, this concept can be applied to a tip I learned from Armin Briegel a few years ago, namely that if you select something in Terminal that you want to then paste into the current shell command, you can skip the copy-paste dance and instead just press Command-Shift-V to do it in one step (or if you prefer menus, Edit > Paste Selection). If you add the Control key to that sequence, the text pasted is escaped (Edit > Paste Escaped Selection or Command-Control-Shift-V).

Wade Tregaskis:

NSPasteboard mutates itself simultaneously from the main thread and the global concurrent Dispatch pool, w.r.t. to its internal type cache. This is surprisingly trivial to reproduce (sample code below) by just dropping, e.g. a file promise (such as by opening a PNG in Preview, revealing the thumbnails sidebar, and then dragging the thumbnail onto the sample project’s window).

[…]

Since this bug causes semi-random memory corruption, it manifests in a large number of ways – not all of which are all that helpful.

[…]

SwiftUI’s onDrop(of:isTargeted:perform:) method makes no claims or promises as to what thread / queue it executes the closure on, and in fact according to the anonymous Apple engineer it never executes the closure on the main thread.

Now, while that may be the intent, the reality of that is wrong – in my experience it always executes the closure on the main thread (which makes a lot of sense to me as drag-and-drop event handling in AppKit has always been on the main thread in practice).

Apple also told him that NSPasteboard is not safe to use outside the main thread, even though that’s not documented, it’s not @MainActor, and Apple’s own code does do that.

Apple (transcript, Hacker News):

The Company posted quarterly revenue of $109.4 billion, up 16 percent year over year.

[…]

“Today, Apple is proud to report our strongest June quarter ever, with double-digit revenue growth across iPhone, Mac and Services, and in every geographic segment,” said Tim Cook, Apple’s CEO.

Jason Snell:

iPhone revenue was up 22%, Mac revenue was up 10.4%, Services revenue was up 12%, and Wearables revenue was up 6%. iPad revenue was down 6%.

John Voorhees:

Together, iPhone and Services accounted for 77.7% of Apple’s $109.4B in net sales.

Jordan Golson:

Gross margin for the quarter was 50.1 percent, compared to 46.5 percent in the year-ago quarter.

Jason Snell:

You can’t argue with the strong iPhone and Mac sales figures, and Apple specifically called out the MacBook Pro and the MacBook Neo, which Cook said “has been especially popular” and suggested that the company is still struggling to make them fast enough.

It’s admirable (and sensible) that Cook isn’t pointing fingers at anyone but customers who want Apple products, but the key phrase in his statement is “the supply chain just has less flexibility in it than normal.” This is an acknowledgement that while in the past, Apple might have been able to boost chip production from its partners, today the chip industry is maxed out thanks to the wild building of chips for AI applications.

[…]

As an aside, Cook also alluded to reports that Apple has tried to get the U.S. government to authorize purchase of RAM from some forbidden Chinese chipmakers, which has aroused political ire.

See also: MacRumors.

Previously:

• Apple Financial Statements: Products vs. Services
• Apple Hardware Price Hikes
• Apple’s Q2 2026 Results
• MacBook Neo Sales
• Apple’s Q3 2025 Results

John Voorhees:

What sets Pastebot 3 apart is its addition of deep automation tools. Not only does the update add MCP support, making it an excellent tool to use with Claude or ChatGPT/Codex, but it includes a brand new CLI that you or an agent can use from Terminal or incorporate into scripts you build.

[…]

New filters have been added that allow you to transform clippings using text transformations and even shell scripts. Using the ability to script custom filters, I’ve begun adding a few of my own to Pastebot for things like adding and removing bullets from multiple lines of text.

I’ve long been aware of this app but hadn’t paid much attention because I’m happy using LaunchBar as my clipboard and snippet manager. LaunchBar has some transformations built-in, and I’ve built up a collection of my own scripts, but it’s appealing that Pastebot comes with so many out of the box.

From Pastebot’s main UI, you can select multiple items at once and right-click to add them to a Stack, or you can pick them one at a time in any order you’d like. As you select items, they’re numbered in the order you’ll paste them into a document using a keyboard shortcut. It’s an excellent feature for filling out forms or copying data from one spreadsheet to another.

Juli Clover:

There are also rule-based Smart Pastebins for automatic organization, like every link or image copied from Safari. Smart Pastebins can be filtered by clipping size, type, file extension, creation date, text, text length, and more. Multiple parameters can be combined for detailed filtering, and custom notes can be added to clippings to make them easy to find via search.

[…]

Tapbots says Pastebot 3 was built to work with Apple's Universal Clipboard feature, and when enabled and active, anything you copy on your iPhone is saved in Pastebot automatically.

John Gruber:

Chief among my favorite features:

• Remembers up to 1,500 clippings (up from a mere 1,000 in v2).
• Syncs via iCloud. If I copy something on one Mac, it’s in my Pastebot history on my other Macs.
• That sweet Tapbots UI.

Marcus Mendes:

Importantly, Pastebot 3 requires macOS 26 Tahoe or later and comes with a 14-day free trial. Users can buy the app directly from Tapbots for $39 or subscribe through the App Store for $2.99 per month or $24.99 per year.

[…]

The direct purchase includes one year of updates, with additional years available for $19 each. Users who stop paying for updates can continue using the latest version covered by their purchase. Pastebot 2 owners can also get a $12.99 upgrade discount by entering their existing license key at checkout.

scottybee:

They are not offering any upgrade path for MAS customers. The reason they stated was “upgrade pricing has always been our way of thanking people who bought directly from the site.”

Paul Haddad:

I generally try to avoid complaining about App Store review, since I do think they have a really hard job to do. But I’m about 2 more PB3 rejections from just giving up.

Previously:

• Apple’s Spotlight Clipboard Manager
• Boop 1.3.1
• Processing the Selected Text via Script
• iOS Background App Kludge

Marcin Wichary:

The problem is that PAMS is drunk with power and flattens everything on its way[…]

That includes:

• emphasis by italics or bolding
• links
• bulleted and numbered lists
• strike-through text
• headlines

None of these are “style.” This is actual information that should not be removed.

Sometimes, Paste and Match Style is what you want, but I like when apps also provide other options, as he discusses. For example, the Omni apps now offer Paste and Merge Styles.

Previously:

• OmniFocus 4.8.10
• OmniOutliner 6.1
• Pure Paste 1.1
• Paste Without Style

Gus Mueller (release notes):

• A new brushing engine that has been rewritten using Metal shaders. It includes an option for “velocity thinning”, where the faster you draw your brush strokes, the thinner the lines.
• A new acorn shell tool that you can use to send JavaScript to Acorn, as well as start an MCP server. So if you’ve got a favorite LLM you like to use, you can now use it to drive Acorn. The JavaScript section of the release notes are a good read if you’re interested in that. In addition:
  • The JS API has also been updated with examples for most calls.
  • The shell tool has a -jsio argument which lets you do things like:
    echo "acorn.takeLayeredScreenshot();" | acorn -jsio
• Big ML models (used for Select Subject and Super Resolution Scaling) are now downloaded on demand. If AI isn’t your thing, they won’t take up any space on your Mac.

I feel lucky that Acorn is enough for me.

Chris Person:

Very few software companies outside of Microsoft have the kind of leverage over entire industries. Premiere, Photoshop, Illustrator, InDesign, Lightroom and After Effects are all load bearing to some extent within their respective fields despite the fact that many people I know loathe using them.

Via Nick Heer:

I have said it before and I will say it again: if I had known the path Adobe’s software would eventually go down, I might very well have picked a different career.

Previously:

• Photoshop’s “Modern” Spectrum User Interface
• Acorn 8.5