❌

Normal view

Xcode 27

15 September 2026 at 21:55

Apple (xip, downloads):

Xcode 27 includes Swift 6.4 and SDKs for iOS 27, iPadOS 27, tvOS 27, watchOS 27, macOS 27, and visionOS 27. Xcode 27 supports on-device debugging in iOS 17 and later, tvOS 17 and later, watchOS 10 and later, and visionOS. Xcode 27 requires a Mac running macOS Tahoe 26.6 or later.

Peter Witham:

Is this new in Xcode 27? Pretty sure it as and I approve whole heartedly! I really hate setting up Xcode settings more than once.

Christian Beer:

Building with Xcode 27 doesn’t work because of some intransparent XCStrings error… and I even can’t check with Xcode 26 anymore because Apple decided to not let me run it on macOS 27…

Steven Woolgar:

After all these years Apple has finally broken cmd-e in Xcode 27.

Previously:

macOS 26.7 and macOS 15.8

15 September 2026 at 21:54

Apple (security, no enterprise, no developer, full installer):

This update provides important security fixes and is recommended for all users.

Apple (security, full installer):

This update provides important security fixes and is recommended for all users.

See also: MacRumors, Mr. Macintosh, and Howard Oakley.

Previously:

TestFlight Sort Order

8 September 2026 at 21:14

Zac Hall (July):

Apple just updated TestFlight for iPhone, iPad, Mac, and more. The new version, 4.3, introduces “a search field to quickly find apps.”

John Gruber:

But when Apple implemented this change, they also changed the sort order of the list of apps you’re registered to test. Starting with this update, the list is sorted in alphabetical order. For as long as I can remember — perhaps dating back to when TestFlight was a third-party utility — the list was ordered by recency. The most recently updated app was at the top; the oldest at the bottom. Sorting by recency is really the only sort order that makes sense when you’re registered for dozens (or more) of apps. For me, trying to see if there is an update to a new app whose name starts with U now requires scrolling through over 100 items.

[…]

Also, if I consider the broader view, this really speaks to how much we’ve lost in terms of UI vocabulary. For decades, any list of items with names and dates could be sorted by name or date, ascending or descending, through the standard use of clickable headers at the top of every list. This was true for almost any such list in any app, on any platform — Mac, Windows, Unix, Amiga, whatever. This was just basic GUI stuff.

[…]

iOS in 2007 introduced a simplified UI vocabulary that omitted many of these baseline GUI features. That seemed like a reasonable trade-off for a device with a 3.5-inch display and fat fingers as the only input device. But then iOS became popular and Apple stopped bringing the richer UI vocabulary of the Mac to iOS[…]

And it starting bringing iOS limitations to the Mac.

It certainly shouldn’t have taken until July 2026 to be able to search in TestFlight, either. And being able to search, and see the results sorted alphabetically, shouldn’t mean you can no longer view the full list sorted by recency.

John Gruber:

Whatever is going on with this sort order, it isn’t affecting everyone. John Siracusa, amongst many others, has the same problem I do — his list is now alphabetical, and it’s driving him nuts too. Ryan Booker, amongst many others, still has his list sorted by recency.

John Gruber (September):

For both of us, yesterday’s v4.3.1 update fixes the bug.

But there should still be more sort options.

Previously:

Update (2026-09-16): John Voorhees:

Returning to reverse chronological order may seem like a small thing, but it’s made a world of difference in keeping up with the apps I test.

Search was near the top of my list of TestFlight wishes for years, and its addition made a meaningful difference to the app’s usability. But I’ve had a lot of TestFlight wishes over the years that are scattered across multiple articles, so I thought I’d share what else I’d like Apple to tackle with TestFlight[…]

McKinley 1.0

7 September 2026 at 19:18

Amy Worrall (Mastodon):

McKinley is an all-in-one studio for drawing and annotating SF Symbols. It bundles vector tools with knowledge of the SF Symbols structure, so you can edit one set of objects across multiple weights, sizes and colours. Import SVG or start from scratch, live preview your work using Apple’s own renderer, and export directly to Xcode, so you never need touch the SF Symbols app again!

[…]

Gone are the days of converting your strokes and shapes to outlined paths before export. Keep everything how you drew it, and let McKinley handle the output.

[…]

Link your project’s asset catalog to your McKinley document. Then when you make a change, hit the Sync keyboard shortcut and it’s immediately populated with your latest version.

[…]

McKinley is a Mac-assed Mac app: a native AppKit UI, Quick Look previews and thumbnails for your documents, a full AppleScript dictionary for batch work, and the whole user guide offline in Help.

$60, no subscription. It’s been a while since I had to deal with custom SF Symbols, but I remember it being a major pain. I haven’t had the chance to try McKinley with a real project yet, but it looks very well done. I love seeing a new app ship with documentation and extensive AppleScript support, including sample scripts that you can install right from its script menu.

Mario Guzmán:

The icon isn’t just a symbol but a whole artistic creation on a canvas.

Look at how your tools are on panels that could be individually opened on their own auxiliary window. I can’t stand the single-window, everything buried into a single-sidebar design we get these days.

Amy Worrall:

SF Symbols rendering does a surprising amount behind your back: it interpolates nine weights from three masters, applies optical size adjustments, resolves hierarchical opacity ladders, and changes some of this between OS releases. Any preview I rendered myself might diverge from the real thing in ways nobody would notice until the symbol was in an app looking subtly wrong. (Obviously I aim to get my canvas rendering with the exact same nuance as Apple’s renderer, but programmers are fallible and the fewer ways things can diverge, the better.)

Apple provides no API for “here’s my SVG, render it as a symbol”. For a normal app using a custom SF Symbol, the symbol is compiled from an Asset Catalog in Xcode into a .car file (a compiled asset catalog) at build time. But there’s no ‘build time’ when I want to update a preview in McKinley.

My workaround involves compiling your symbol into a .car file at runtime, on every edit, by patching bytes into a template, then loading that temporary .car file into McKinley via NSBundle.

Previously:

Update (2026-09-08): John Gruber:

I mean just look at McKinley. It’s both beautiful and quite obviously a serious professional tool.

Update (2026-09-11): Amy Worrall:

Anyone used any great implementations of dockable palettes? (Adobe’s don’t count, I don’t think they’re great!)

I’m not going to go back to sidebars, but some kind of options/flexibility might work, if it doesn’t get in the way!

Ternus and the App Store

7 September 2026 at 19:17

Mark Gurman (tweet, John Gruber, Mastodon, 9To5Mac):

The Schiller exit is a bit more notable. Unlike Maestri, he still had a real job: The veteran executive ran the App Store and Apple Events. The App Store portion alone is no joke. It generates an estimated $30 billion a year and can be very challenging to manage. Apple’s app marketplace is loved by many consumers, but often criticized by developers and subjected to increasingly onerous regulations. It was a busy, all-encompassing gig and nowhere near a semiretirement.

[…]

But there’s a bit more to the story, I’m told. Ternus and services chief Eddy Cue want to make even more money from the App Store and figure out ways to raise margins and squeeze additional recurring revenue from the platform. Schiller, on the other hand, seems to believe that such moves will only further irk developers and governments. While there was no internal blowup or anything like that, it’s something he wanted no part of.

“Product guy” dreams about margins, forgets that people buy Apple hardware because of the software.

Tim Hardwick:

Apple admitted during its July earnings call that regulatory changes have started to weigh on its Services growth. Apple reported services revenue of $30.7 billion for the June quarter, a record for the period but short of the $31.4 billion that analysts expected.

Patrick Smith:

The hardware guys treating third-party developers like they do their suppliers has stifled Apple’s software platforms

M.G. Siegler:

I thought that perhaps with the move to John Ternus as CEO, it could also be an obvious time to revisit such policies. But I hadn’t considered that Apple could actually be in favor of making them more onerous.

See also: Mario Guzmán and Indie Simulator.

Previously:

Banktivity Document Model and Rewrite

7 September 2026 at 19:16

Ian Gillespie (2025):

Banktivity has traditionally been what’s known as a document-based app. It lets you create and open independent files (or documents), each with its own data. In contrast, many modern apps—Music, Calendar, Photos—are library-based. These apps typically have a single window and a unified data set.

We’ve long appreciated the flexibility our document model provides. But in practice, most of our customers use only a single file. And more critically, this architecture makes it much harder to integrate Banktivity with the broader Apple ecosystem.

[…]

The shift from a document-based model to the new Organizer framework marks a major step forward for Banktivity. It simplifies how users interact with their data while laying the foundation for deeper system integration, background syncing, and a more seamless multi-device experience.

This follows MoneyWell also getting rid of the document model. From my perspective, it’s a shame. I prefer the flexibility of being able to have different accounts in different documents, choosing where to store the documents, and even splitting the same account across multiple documents for performance reasons.

Ian Gillespie (2025):

Ledgers contain an entire, independent set of accounts, categories, investments, goals, budget and so on. Many customers will only have one Ledger for the finances they manage. But we also know there is a good number of customers out there that manage finances across family members, non-profits and small businesses – for these customers, support for multiple Ledgers is crucial.

[…]

While UI is what you see, most of the hard work has been in the architecture. The Library framework — the backbone that replaces our old document system — is in place. That means we can now reliably connect your Banktivity User Account with all of your Ledgers, whether local or synced to the cloud.

Ian Gillespie:

Refactoring Banktivity from a document-based app into a library-style app was a significant undertaking. It changed some very fundamental assumptions in the code. Ledgers can now be opened and closed in the background, multiple windows and scenes can be active at once, and the Organizer has to coordinate local files, cloud sync, user accounts and application state in ways the old document architecture never had to.

Banktivity 10.0 laid the foundation for that transition. With Banktivity 10.1, a major focus has been strengthening that foundation. We’ve spent a lot of time simplifying the underlying architecture, eliminating race conditions and threading issues, and improving how ledgers are opened, closed and managed.

Previously:

SoundSource Support Follow-Up

4 September 2026 at 20:19

Chris Barajas:

To spread the word, we announced SoundSource 6 on our blog and sent a mass mailing to our customer list. We also took a more targeted approach, contacting both existing and potential customers who’d previously reached out to us with specific requests. We went back to those folks to let them know about the changes that would interest them most.

[…]

A real live person writes every email response our support team sends, and that human touch takes time. The process is helped along by text snippets, replies that we write once and then reuse and adapt to answer common questions.

[…]

To decide if an email should be sent to a customer, we checked Help Scout’s conversation history, as well as our own custom app for their order history. For example, if someone requested several features across different emails, we’d pick the one that was most impactful, then delete other drafts to avoid inundating them with multiple messages.

Previously:

SuperDuper’s “Follow-Up”

31 August 2026 at 20:44

Dave Nanian:

Recent versions of xOS (that is, macOS, iOS, iPadOS, etc) have Data Protection Classes from A to D that get assigned to files and folders.

[…]

The thing is, though, is that these files and folders are inaccessible unless the user is logged in, and the screen is unlocked. A few seconds after the screen locks (or you log out), the keys are purged, and they cannot be read.

[…]

That means the files any application considers to be worth protection cannot be accessed when a backup usually happens.

[…]

You may have noticed that if you had an overnight backup, when you unlock your screen, a copy starts to run. It’s typically quite brief, thanks to ⚡️Turbo Smart Update, but it might surprise you anyway. […] During your overnight copy, SuperDuper kept track of the files that it couldn’t access due to their protection class. And now that it can access them, it’s making sure they get backed up.

This seems like the right thing to do. Time Machine also does it. A backup app should try to make as faithful a backup as possible. I kind of find it annoying, though. Sometimes it can’t do a Turbo Smart Update, and so the backup that should already be done may end up taking another 30 minutes or more. The best thing to do is schedule backups while you’re using your Mac to avoid SuperDuper needing to do such “follow-ups.”

I wrote some code to try to figure out which files I have that are using data protection. Interestingly, the URLFileProtection API seems to not work on macOS. I used the lower level getattrlist() instead. Nanian recommends fcntl(). I didn’t find any protected files that I actually care about, just caches and derived data from Apple’s own apps. But, in theory, Apple or a third-party app could be saving actual user data using data protection.

Previously:

Aren’t Snapshots Purgeable?

28 August 2026 at 19:47

Howard Oakley:

Since High Sierra and APFS snapshots, accounting for purgeable space has been inconsistent and often misleading. I first reported this over eight years ago in Sierra 10.12.6 and High Sierra 10.13.3, and most recently three years ago in Ventura 13.3.1. This article looks at how this is handled now in Tahoe 26.6.2.

[…]

There is disappointingly little documentation on space management in macOS, and the closest Apple comes to defining purgeable space is in Disk Utility’s Help pages, where it’s stated to be “space that macOS can free up when needed by removing files from your computer (you can’t manually remove the files that are designated purgeable, but macOS removes them as space is required)”.

On the face of it, that includes cache files but not snapshots, as they can be manually removed in Disk Utility, as I’ve discussed in detail here. This is contradicted when using tmutil localsnapshot to make Time Machine snapshots, which reports that “local snapshots are considered purgeable and may be removed at any time by deleted(8)”, as deleted is the purgeable space and cache management service in macOS.

APFS snapshots can also be created by third-party apps that have the appropriate restricted entitlement. Apple doesn’t explain whether those too can be purged by macOS when additional free space is required.

Howard Oakley:

Before macOS will start copying a file to a volume, it checks whether there’s sufficient free space available. I believe this is normally performed by the FileCoordinator API in Foundation, and appears in the log with the subsystem com.apple.foundation.filecoordination.

If there isn’t sufficient free space to accommodate the file to be copied, deleted in the subsystem com.apple.cache_delete checks whether enough space can be freed by purging items known to be purgeable in the destination volume. deleted has a fixed set of services that can be called on to purge items, listed in /System/Library/CacheDelete.

[…]

Space-based purging of Time Machine local snapshots is unreliable. The reason for this is that Time Machine CacheDelete fails to report purgeable space when it’s available. Even when it does work, it can take nearly half an hour for Time Machine CacheDelete to recognise the appearance of purgeable space.

Sometimes you need to do it yourself with Disk Utility.

Previously:

Update (2026-09-03): Howard Oakley:

  • When purgeable space is required, deleted (subsystem com.apple.cache_delete) first discovers purgeable space for each caching service, to determine whether it’s sufficient.
  • If it is, and the decision is taken to purge caches, caching services are called on to free up space by purging their caches as required.
  • Purging may then take place in phases until sufficient space has been freed.
  • Purging is frequent during installation of macOS updates, even when there’s ample free space available.

Update (2026-09-08): Howard Oakley:

In the event that you’re caught out by circumstances, such as the combination of recent large snapshots and exceptionally large caches, macOS does try to manage as well as possible even when there’s just a few GB free. But once free space falls to around 1 GB you should see a warning notification.

[…]

From then on, most file operations, even creating a new folder, will fail. That applies to all apps, regardless of whether they handle those failures gracefully and warn you of the error. Actions like taking a screenshot start normally, but after their image has floated across the display, they just vanish and can’t be saved.

[…]

The worst combination of problems occurs when a Mac runs out of free disk space and physical memory at the same time. macOS memory management then wants to allocate space in the VM volume as its backing store for virtual memory, but in the absence of free space to do so, that fails and should propagate as a memory allocation error.

Update (2026-09-09): See also: Accidental Tech Podcast.

Mac Studio 2026

25 August 2026 at 21:12

Apple (Hacker News, MacRumors):

Mac Studio with M5 Max features an 18-core CPU, an up-to-40-core GPU with Neural Accelerators built into each core, and up to 128GB of unified memory, accelerating complex pro and AI workloads. With the powerful M5 Ultra, Mac Studio scales up to a 36-core CPU, up to an 80-core GPU, and a staggering 512GB of unified memory, enabling users to run enormous LLMs entirely on device. Wi-Fi 7 and Bluetooth 6 come to Mac Studio for the first time, while Thunderbolt 5 rounds out its extensive connectivity, so users can take advantage of blazing-fast external storage, PCIe expansion chassis, and powerful hub solutions for the most intense workloads. Thunderbolt 5 also enables multiple Mac Studio systems to be clustered, bringing up to 3x faster performance for distributed AI inference when compared to a single system.

[…]

Mac Studio with M5 Max starts at $2,499 (U.S.) and $2,299 (U.S.) for education.

[…]

Mac Studio with M5 Ultra starts at $5,499 (U.S.) and $5,099 (U.S.) for education.

It’s not shipping until September 22, with the 512 GB configuration in late October.

John Gruber:

Here’s my attempt to put all of the RAM/SSD configurations into condensed tables, so you can see which storage and memory options are available for each chip, and how much they cost.

[…]

It kind of stinks that there are no RAM options for the Studio between the 96 GB base and the $4,000 256 GB upgrade.

Jason Snell:

The Mac Studio is effectively the replacement for the Mac Pro, and it’s alone in offering the Ultra-class chip. Apple has positioned the Mac Studio as ideal for local AI workflows, and the new models will still be able to cluster via Thunderbolt 5 to create even larger collections of memory and performance. Apple representatives pointed out that a four-Mac Studio AI cluster, like the one I saw on display at WWDC earlier this summer, is so efficient that it can be powered from a single standard wall outlet. (They even showed us a picture of four Mac Studios plugged into a power strip that was plugged into the wall.) In an era of data center excesses, Apple is clearly leaning into the possibility of small, efficient Macs being used to do local AI work rather than relying on huge, power-hungry cloud models.

Federico Viticci:

If these numbers hold up and scale linearly, a local Mixture-of-Experts model such as Qwen 3.5-35B-A3B, which would run at ~17 tokens/sec on average on a base M4 Mac mini with 16 GB of RAM, could realistically generate output at over 60 tokens/second with the base model M6 Mac mini.

Based on what we’ve seen so far, the one downside of the M6 Mac mini is that it does not have Thunderbolt 5 ports; those are exclusive to the M5 Pro model, also announced today.

[…]

Speaking from personal experience, I know that my M3 Ultra Mac Studio using oMLX can run DeepSeek-V4-Flash locally with generation averaging 35 tokens/second. Assuming a linear 4x increase, that would put the same model at over 120 tokens/second on an M5 Ultra Mac Studio. To put things in perspective, that kind of performance would be faster than any AI chatbot website, it’d be faster than many providers who offer a “fast” mode for their models, and it’d only be second to either dedicated NVIDIA PC clusters at home or specialized inference providers such as Cerebras or Groq…which are running in full-blown data centers. Sure, you would need a computer that is likely going to cost more than $20,000 to make it happen, but it’d still be possible on a single machine that is small, quiet, and that – in theory – any consumer can buy off the shelf.

Previously:

Update (2026-08-26): John Gruber:

That upgrade is labeled “+ $300”, which makes it look as though the starting price for the 18/40-core model is $2,800. That’s the price I put in the original version of my chart.

But if you select that option, you’ll notice that the actual starting price jumps from $2,500 to $3,100 — a $600 difference, not $300. The reason is that the $2500 18/32-core version only comes with one option for RAM: 32 GB. The 18/40-core chip has three tiers for RAM: 48, 64, and 128 GB.

Update (2026-09-02): Joe Rossignol:

Apple’s press release for the new Mac Studio with M5 Max and M5 Ultra chips last week initially stated that the computer had “next-generation SSD architecture built on PCIe Gen 6.” However, as spotted by the French blog MacGeneration, Apple removed the PCIe 6.0 mention from the announcement shortly after it was published.

Mac mini 2026

25 August 2026 at 21:12

Apple (Hacker News, MacRumors, Slashdot):

With M6, Mac mini now delivers up to 4x faster AI performance, 2x faster storage and graphics, and 40 percent faster CPU performance. Everything on Mac mini with M6 feels incredibly fast, from everyday productivity tasks to agentic AI workflows. Mac mini with M5 Pro delivers even more pro-level performance to breeze through demanding projects, from video production to game development. And this new level of performance takes on business workflows with ease whether Mac mini is being used as a primary desktop or for always-on, deskside agentic computing. Both Mac mini models include Wi-Fi 7 and Bluetooth 6, as well as upgraded 2.5Gb Ethernet, with a 10Gb option available.

[…]

Mac mini with M6 starts at $899 (U.S.) and $799 (U.S.) for education.

[…]

Mac mini with M5 Pro starts at $1,699 (U.S.) and $1,599 (U.S.) for education.

Rui Carmo:

The M6 tops out at 170GB/s and 32GB of unified memory, whereas the M5 Pro offers 307GB/s and up to 64GB–nearly twice the bandwidth, as well as twice the memory ceiling. That is the number to watch for AI inference, not just CPU and GPU benchmark deltas.

John Gruber:

Here’s my attempt to put all of the RAM/SSD configurations into condensed tables, so you can see which storage and memory options are available for each chip, and how much they cost.

[…]

If you configure an M6 Mac Mini with 2 TB of storage, the SSD upgrade ($1,000) costs more than the entire base model computer ($900). So too with the 4 TB SSD upgrade for the M5 Pro Mini ($1,800 upgrade for a $1,700 computer).

Nick:

Almost double (in Canadian dollars) what I paid for my M4 mini 18 months ago.

Previously:

Update (2026-08-26): Jason Anthony Guy:

Why announce (and take pre-orders) today, but not ship for a month? Perhaps Apple is using pre-orders to gauge interest and adjust its product mix. With huge prices for memory and storage, Apple does not want to build high-cost configurations that end up sitting around. Or, perhaps the “Fall iPhone” event will be a “new products” event, and Apple is clearing the decks of interesting-but-hardly-important hardware it doesn’t want distracting us from more exciting Macs (like the expected MacBook Pro “Ultra”).

Juli Clover:

The Mac mini now starts at $899, $300 over the original starting price of the M4 Mac mini when it launched in October 2024.

[…]

The Mac mini and Mac Studio support genlock over USB-C, so there’s no need for a separate sync box. Genlock is used in multi-camera shoots and virtual production to lock timing to a shared reference signal.

Tim Hardwick:

Apple’s newly announced M6 and M5 Pro Mac mini models still support up to three external displays, but there’s now support for higher refresh rates, according to Apple’s published technical specifications.

Chance Miller:

Another interesting tidbit is that even though Apple raised Mac mini prices today, it’s still excluded from Apple Upgrade leasing.

Previously:

Update (2026-08-31): Imthaz Ahamed:

Now after the price hikes, the Neo starts at £699 and the Mini at £899. So to answer the question, is the best feature of the M6 Mini the price?

I don’t think so, and that’s not because of the increased price to £899 but because of the Macbook Neo. The Mac Mini used to be the computer that everyone bought to get a taste of macOS. A lot of my friends have purchased Mac Minis just because it was the cheapest way to get into a Mac. But now I think the Neo fills that role.

The Mac Mini hasn’t become a bad deal. It’s become a different kind of deal. If you already have a monitor and a keyboard, if you want real desktop performance without paying for an Macbook Pro or a Mac Studio, the M6 Mac Mini is still probably the best price-per-performance computer Apple sells.

Unforgetful 1.0

24 August 2026 at 21:41

Marco Arment:

Unforgetful isn’t a new productivity system to learn.

[…]

This is designed for a small number of short-term tasks. What do you need to do today, tomorrow, this week, or this month?

[…]

If you want tagging, folders, archives, or other ways to organize or file away tasks, this isn’t the app you’re looking for.

Unforgetful is for people who know that if they file away a task, it never gets done.

I’m an OmniFocus person. I love tagging, folders, and archives; I never want to see a notification for a to-do item. I prefer pull to push. So this is absolutely not the right tool for me. But I like the fresh thinking behind this app and how the various design choices interact to make it an opinionated tool for the right type of person.

Marco Arment:

Calendar alarms changed my life. Events without alarms don’t happen.

[…]

Most of my Reminders interaction has always been via Siri and notifications. And that fits me very well, with three major exceptions:

  1. If I say “Remind me to buy milk,” but I forget to specify a time (or Siri misses it), Reminders will never notify me, and I’ll never check the app, so it’ll be lost.
  2. If I inadvertently dismiss a Reminders notification without snoozing it, Reminders will never notify me about it again, so it’ll be lost.
  3. When I do snooze a Reminders notification, which I do a lot, the snooze options suck.

He has good solutions to these and other problems. I’m tempted to try out Unforgetful just for the purported quick capture of dictated reminders, however there’s no watch app.

Listen to Accidental Tech Podcast to hear about unfortunate limitations of EventKit. Reminders itself is interesting to me in that the (private) data model is now so rich, but I’m put off by the UI, the lack of export, and the limited support for driving it from the keyboard.

Previously:

The Best Worst E-mail Client

21 August 2026 at 19:19

Rui Carmo:

Apple Mail is the first app open every day and the one I find hardest to defend, and I’ve been defending it for twenty years (longer if you remember the original NeXT mail client).

The broader story is one of abandonment.

[…]

Apple deprecated that API, replaced it with a (much more restrictive) MailKit surface in 2021, and proceeded to lock MailKit down so hard that barely anyone shipped an extension.

[…]

In particular, in this age of desktop AI agents, I come time and again across the fact that AppleScript support in Mail has been left to rot.

[…]

And searching for messages is such a mockery of a user experience that I’m not even sure how to describe it[…]

Watts Martin:

The last email program I truly loved was Bare Bones’ Mailsmith.

[…]

Now, I’ve tried a lot, like, a lot, of “modern” email clients. The built-in Apple email client is extremely straightforward, but underpowered. Thunderbird is too lumbering and heavyweight for what I want. Hipster ones like Spark are pretty, but focus on things I don’t care about. Mimestream is solid, but it’s Gmail-only. Microsoft Outlook is, unfortunately, Microsoft Outlook. MailMate is nerdy and, in some ways, the most obvious spiritual descendant of Mailsmith, but I find some of its UX inscrutable. Yes, I am aware of the irony of saying this just before describing an Emacs-based client.

And increasingly, commercial email clients are expensive and/or subscription-only.

Nick Heer:

I almost never use Mail on iOS 26. I just tried to insert an image from my photo library, and I could not figure out how to get back to seeing a keyboard. What a bizarre workflow. Still shocked some of this stuff shipped.

Rosyna Keller:

I haven’t been able to use Mail on macOS since macOS 15.4. It hangs on launch if any accounts are enabled. It feels like it’s been so many years since I filed feedback with sample logs and still Apple hasn’t fixed the hang.

Helge Heß:

I wonder whether I will ever see a time where Mail clients report accurate unread counts (spoiler: clicking on Inbox shows no new mall)

Well, I guess most other mail clients, Thunderbird or Outlook, get this right. But it never worked in any of the Apple mail clients. Like for decades now 🙃

Rishi Ó summarizes the promises for Mail later this year:

  • Improved Top Results

  • More reliable search indexing

  • Improved unread badge accuracy

  • Improved list formatting

Juli Clover:

iOS 27 has an overhauled search system that extends to the Mail app. Instead of surfacing results based on keywords and recency, Mail app search ranks results by relevance and intent.

I never found the problem to be relevance ranking but rather that it simply didn’t find certain messages at all.

Long press on any email and you can ask Siri to summarize, find an item in the email, track a package, get a flight number, save a photo, and more.

I guess that’s fine, but as Carmo notes there’s just a whole list of basics that need attention in iOS Mail.

Messages in Mail load faster, search indexing is more reliable, and unread badges between platforms like iOS and macOS sync more reliably.

Rayn Jones:

Mail search is still garbage in iOS 27. 😞 It’s just not better like they claim.

Previously:

macOS 26.6.2

18 August 2026 at 21:39

Joe Rossignol (release notes, security, no enterprise, no developer, full installer, IPSW):

macOS 26.6.2 delivers security fixes that were first made available in the macOS Golden Gate 27 beta.

Howard Oakley:

There don’t appear to any matching security updates to Sequoia or Sonoma, though.

See also: Mr. Macintosh.

Previously:

Zoom Screen Sharing Attack

17 August 2026 at 18:41

Lily Hay Newman (via Ben Lovejoy):

As AI models gain advanced capabilities to find vulnerabilities in software, develop ways to exploit them, and even carry out autonomous hacking sprees, researchers offered a sobering new example on Tuesday, disclosing vulnerabilities in the video conferencing platform Zoom that could have been exploited to take over targets’ devices. Anyone on a call that involved screen sharing, whether participants or the host, would have been vulnerable to a silent attack that could be carried out with no indication and no interaction from the victim.

Researchers from the digital defense firm A Security say the bug was discovered in early June using publicly available AI models, and that it took fewer than 20 prompts to uncover the vulnerabilities and create a working attack. Zoom issued a security advisory on Tuesday, including details about fixes the company has already begun rolling out to address the flaws, which affected devices running all operating systems that Zoom supports—Windows, macOS, Linux, iOS, and Android.

[…]

The vulnerabilities were specifically in the protocol used to facilitate real-time annotation during screen sharing.

I don’t understand how it could take over an iOS device when Zoom’s iOS screen sharing feature only allows observation, not control.

Previously:

TabControl Scam and the App Review Queue

14 August 2026 at 19:59

Jeff Johnson:

Despite my history of uncovering App Store frauds, I rarely go looking for these things intentionally! They’re just so pervasive and obvious, they jump out at me. In this case, I was looking at the list of top paid Safari extensions in the Mac App Store, because two of my own extensions are currently on the list, when I noticed the TabControl Extension.

[…]

The Mac App Store “screenshot” for the app is not actually a screenshot at all. If you look closely, that’s not the real Safari: the toolbar elements are wrong. I suspect that the image was AI-generated.

[…]

Another thing you should note in the fake screenshot is the “4.9 out of 5” stars, giving the impression that this is the App Store user rating of the app.

[…]

These purported reviews, all but one of which is 5 stars, are all in English. Yet none of them is in the US App Store. […] If you’ve ever looked through App Store user reviews, it’s unusual to find this naming format. […] the dates on the reviews, such as “Mar 12,” predate the release of TabControl Extension in the App Store!

John Gruber:

God only knows what this obvious AI slop scam is doing with the data from users’ Safari tabs. It’s currently the 12th or 13th most popular Safari extension in the App Store.

Jeff Johnson:

Coincidentally, on the same day well-known developer Marco Arment complained on social media that his new, unreleased Mac App Store app had been waiting 12 days for review by Apple.

Arment ended up waiting on hold—listening to an odd choice of music—to talk to App Review, which I didn’t realize was an option. His Unforgetful app is now approved.

Johnson continued browsing Safari extensions in the store:

The apps’s privacy policy is again on Google Drive, but the developer website link goes to https://aee5e5015.app-ads-txt.com, a suspicious URL. This website is barren and simply redirects back to the App Store[…] Did App Store review ever bother to click the developer website link?

[…]

In addition to the 41 apps, each of which required at least one submission to App Store review, I count across those 41 apps at least 327 updates, almost all of which have the same generic description for what’s new in the update: "Bug fixes and performance improvements." So that’s at least 368 submissions to App Store review, most within the past 12 months, from a single developer. In other words, the developer is averaging almost one submission per day. We can count only approved submissions; we have no idea how many submissions by the developer were privately rejected by App Store review.

I get the impression that Apple is asleep at the wheel. Is anyone at Apple counting submissions per developer? How many is too many? How many resources is one developer allowed to consume?

[…]

You may view it as a noble, democratic ideal to treat every app developer the same, but in reality this is the path to the crApp Store, full of scams and slop.

John Voorhees:

There’s no doubt that there is spam on the App Store, but the way to remove it is to target the spammers, not new developers, students, and hobbyists looking to build their ideas. I know that being an indie developer isn’t an easy way to make a living, but erecting barriers to submitting apps is the surest way to starve Apple platforms of fresh, innovative ideas.

John Voorhees:

I’d like to see App Store spam cleaned up as much as anyone, but the way to do it isn’t preferring well-known developers and those who can afford to pay more for special treatment.

Marc Palmer:

I don’t agree with paid tiers either. However it feels like there should be a natural brake applied to new developers and new apps. It’s no big deal if your first app takes a week or two to review (often did 10y ago), and as it matures & receives meaningful updates in the store, turnaround increases as trust and “value” (active users?) builds up. Like “tarpitting” new accounts. I think limiting the # of new apps you can add per month to say 1 or 2 would also help…

Jeff Johnson:

I was a new App Store developer myself ten years ago. My previous article didn’t propose any new barriers for those groups. To be clear, I did imply that no developer, whether new or not, should have more than 40 apps and average a new App Store submission every day of the year. I’m not aware of any prominent developer who has that many. Apparently, checking just now, Microsoft by my count has 38 App Store apps between iOS and Mac, which is a lot but still less than the 41 apps of the developer I discussed in my previous article who is definitely not one of the largest software developers in the world along with Microsoft. I do think it’s reasonable for Microsoft to pay a significantly higher developer fee to have those 38 apps reviewed than a smaller developer pays to have one app reviewed by Apple.

[…]

My contention is that Apple is actually wasting its own resources treating every developer like a potential spammer or scammer, even the developers who are known to be trustworthy, and this wasting of resources makes it harder on everyone, including new developers, students, and hobbyists. App review is grossly inefficient, and it’s clearly failing to scale to the increase in App Store submissions. What I propose is not raising the gates but rather lowering the gates for developers who have already proven trustworthy, so that Apple can focus its review efforts where they’re most needed.

I’m not sure that paying more would help anything. If scams are profitable, surely it would be worth them paying more, and then we’re back to square one. And I don’t want to create another situation like App Store Search Ads where providing poor service makes the revenue numbers go up. But I like the general idea of considering the account’s history, e.g. the way the Discourse forum gradually increases trust over time. It should count for something if you have a long history of following the rules and submitting updates to a small number of apps on a reasonable schedule vs. frequent spamming of submissions that don’t even have real release notes. It would not be fair for Microsoft to be able to cut in line, but giving spammers equal access to the review queue means they’ll use more than their share of Apple’s resources. That also seems unfair. The current system encourages frequent submissions, which also increases the overall load on the reviewers. I think the incentives need to be changed somehow. Maybe each account should get a certain number of “fast” submissions per month or year, after which you can still submit but it goes into a lower priority queue.

William Gallagher:

Even among more legitimate-seeming apps, though, Apple is ignoring clear problems. In AppleInsider research, for instance, we found that many price tiers listed for the “Simply Piano” app bore no relation to what the developer actually charges.

[…]

You shouldn’t have to be the one to investigate apps you want to try. That is the future of third-party App Stores, and that is a future to be fought.

But that future is here with the first-party App Store we already have. And this inability to trust an App Store is here, right now, because Apple will not do what it keeps saying it is doing and what it is charging developers to do.

Previously:

Update (2026-08-20): Eric deRuiter:

I wonder if there is already a separate queue, not for Marco or other established indies, but for the huge companies: Facebook, Spotify, Google, etc.

Jeff Johnson:

Apparently the App Store developer in question saw my article in the news, because the fake App Store reviews posted on the developer’s website were quickly removed, as reported by AppleInsider and confirmed by me. Until yesterday, the misleading “4.9 out of 5 stars” claim remained in the App Store. However, the developer released an update only hours ago with new screenshots that no longer include the misleading claim, thereby erasing all evidence of the previous fraud. Apple approved the developer’s update and, needless to say, did not remove the app from the App Store.

[…]

There are 59 reviews [of Authenticator ℠], 54 of which are 1 star, and 3 of which are 2 stars. Two of the reviews are 5 stars; of those, one is titled “space jam” and goes on to say, “i believe i can fly and touch the sky.” Anyway, the question is, how did the app manage ratings of 4.1 out of 5 when the reviews average 1.2 out of 5? (That’s a rhetorical question. I think we all know the answer.)

SQLite WAL-Reset Bug

14 August 2026 at 19:59

Alex Chan (Hacker News):

Many of these outages were caused by a single bug, deep in SQLite. It took months of intense forensics to track it down.

[…]

This lack of reliable trigger conditions meant we couldn’t reproduce the bug synthetically. Instead, we had to rely on deploying passive, forensic telemetry in our live environment to catch the corruption red-handed. Gathering live diagnostics for a database issue is the last thing we wanted to do, but we had no choice.

[…]

As an additional complication, the corruption didn’t occur on a regular schedule. Sometimes incidents would be hours apart, other times weeks. This made it difficult to predict progress or plan further work, because we were never sure when we’d get our next diagnostic dump. We had a six-week period between October and December when there were no corruption incidents, before they returned as an unwelcome Christmas present.

[…]

In two incidents, our transaction logs failed to replay cleanly. Upon closer inspection, we discovered that data written and committed by one transaction was inexplicably invisible to later transactions. A write had vanished into thin air without raising an error.

SQLite:

The bug is likely present in all version of SQLite from 3.7.0 (2010-07-21) through 3.51.2 (2026-01-09). It is fixed in version 3.51.3 (2026-03-13) and later. Backports of the fix are available for some earlier releases: 3.44.6 and 3.50.7.

The bug only affects databases in WAL mode when there are two or more database connections open on the same file, in separate threads or processes, and when those two connections attempt to write or checkpoint at the same instant.

Alex Chan:

This investigation is a useful reminder: running boring technology in a non-standard way is a risk. The common paths and standard configurations are incredibly well-tested and reliable. Most people use SQLite in a standard configuration and never face this sort of issue. Everything we were doing was a public, documented, supported configuration—but by taking manual control of the checkpointing process and running at our own aggressive pace, we stepped off the well-trodden operational path.

Scott Perry:

I spent the last two years of my time working on SQLite trying to chase this bug down. It was so rare that I never got an internal report; my assessment of the number of customers affected was “about a county’s worth”, some of whom were generous enough to allow their local Genius Bar to send me backups of the affected databases. I spent so many hours in a hex editor staring at the wreckage.

Top three data corruption bug of my career for sure, and the other two weren’t bugs in SQLite.

A former Tailscale employee got in touch and shared that they were checkpointing these databases every 250ms. Multiplied across a fleet of servers that is a fantastic way to surface a super rare bug—they basically built our test rack as a product, but two orders of magnitude more effective (partially due to scale, but mostly because our rack also panics devices at random in order to test the filesystem, NAND controller, etc. and rebooting takes a while)

[…]

13/10 fantastic bug. proof that 100% test coverage is a good start, and that formal methods are needed for critical applications.

Carl Sverre (Hacker News):

I whipped out my phone, and asked Claude to get to work. I had it get SQL 3.51.2 – still buggy – set up in Antithesis, and then instrument the code with a bunch of Antithesis assertions. You can see the instrumented version here.

Then I asked it to write a simple workload which exercised the WAL insert and checkpoint code. Notably, this is a completely generic workload. It just runs writes and checkpoints concurrently – things you’d expect to actually happen in production, all the time. The assertions are also generic to the bug, they’re all standard assertions you’d add to any database, things like “no lost committed writes” and “database is not corrupt” (called integrity check in sqlite).

On my first run, Antithesis caught the bug in 15 mins. Here’s the report.

Of course, it helps that he knew to look in the checkpoint code, but you could imagine using tools like this to quickly investigate hypotheses when you don’t already know the answer.

SuperDuper 4

13 August 2026 at 20:10

Dave Nanian:

The new version of SuperDuper is a ground-up rewrite, a tip-to-tail reinvention of what SuperDuper looks like, how it works, what it can do, and where I can take it in the future.

[…]

Documents have been retired and replaced with Copy Jobs, which are stored internally and organized by source. If you want to copy Macintosh HD, that’s where you start. Click, and you’re presented with one or more template copy operations, or you can start from scratch.

Configuration is done right inline by clicking bold, underlined link elements and selecting options from pop-ups. The effect of your choices is immediately reflected in What’s going to happen?, ensuring you know what to expect when you click Copy Now.

SuperDuper has been around for 22 years, and I’ve been using it since version 2 in 2006. Shirt Pocket had always been great about keeping the copy engine up-to-date with all the changes in macOS and its increasingly baroque file system structures. But the outward appearance of the app hadn’t changed much, aside from losing the brushed metal, and neither had the feature set. I know all too well how much work it can be as a solo developer just to keep an app working. Ironically, the better you are at adapting to the changing OS, hiding the complexity, and presenting a simple interface, the more it looks like you aren’t doing much. Actually, if you follow Nanian’s blog, you can see a fraction of all the stuff going on under the hood—tricky edge cases, macOS bugs, and undocumented behaviors that must be handled so that you can essentially just press a button and get a proper bootable backup.

Eventually, he found the time to rewrite the app, both the engine (which is faster and more robust) and the user interface (which is greatly expanded). My first reaction was: this is SwiftUI, isn’t it? And it is. You can just tell by the way the text reflows, all the different colored buttons and blobs, the hover effects, and how the design heavily emphasizes scrolling. (Like System Settings, it doesn’t remember scroll positions. Nor does it remember which disclosure triangles are expanded.) The keyboard navigation and focus behavior are off in places. For reasons I don’t understand, SwiftUI gets a lot of this wrong out of the box. In some cases, like the outline view for creating a copy rule, keyboard support was manually added and works as expected. But there are other places where arrow keys and type-selection don’t work. Sometimes I need extra clicks to get the proper focus. Sometimes the arrow keys scroll the window instead of changing the selection.

That said, this is one of the best SwiftUI interfaces I’ve seen. I think it successfully preserves the spirit of the app, making it really easy to configure things and see what’s going to happen, while streamlining the way documents/jobs are managed and expanding what you can do. It’s still essentially one window (plus a Settings with one checkbox), and you can still use it in the old way, but now you can also run multiple jobs at once and inspect their histories.

Click the Preview button and SuperDuper will run the copy without making changes and present you with a report that shows exactly what would have been updated, added, deleted, etc., had this been a real run.

This is great to have. If there are particular folders or files you want to check, you can browse the source tab of the preview to see what’s excluded or find them in the destination tab to see whether they would be added, updated, removed, or kept. The interface to browse this is a sort of columns view with only one column. It’s fast and easy enough to use, but keyboard navigation doesn’t work properly. I longed for it to be an outline view so that I could quickly expand an entire subtree and see at a glance which files would be changed. I also wished that it would show how much data would be copied.

SuperDuper 4 is much faster than before. And I’m not just talking 20% or 30% faster. Smart Updates are between 2x and, with the new Turbo feature, an order of magnitude faster.

It’s hard to benchmark such things, but my general impression is that this is true. The longstanding Smart Update feature copies only the files that have changed. This seems quite a bit faster than before and slightly faster than Carbon Copy Cloner. The new Turbo feature uses the FSEvents log to optimize finding such files. If macOS knows which folders might contain changes, SuperDuper can focus on those and not waste time scanning ones that are identical. When this works, it feels almost impossibly fast. SSD-to-SSD backups of my Mac’s boot drive will take 1–3 minutes instead of more like 20 minutes. This also seems to be faster than Carbon Copy Cloner’s similar Quick Update feature.

Unfortunately, for reasons seemingly out of the app’s control, sometimes Turbo isn’t possible. This can happen if you’ve modified the copy job or if there’s been a huge amount of file system activity since the last backup so that FSEvents doesn’t contain the necessary information. In such cases, SuperDuper will fall back on doing an old-school Smart Update. I found that excluding my destination drive from Spotlight made it much more likely that Turbo would work.

As much as I like Turbo, I don’t end up using it except for the daily scheduled backup of my boot drive to an always-connected SSD. For my other backups, I have multiple destination drives for each source, and I find that the user interface doesn’t scale so well to configuring a separate job for each. That leads to lots of scrolling. So, instead, I use just one job per source and select the destination I want before starting each backup. This counts as editing the job, so it won’t be able to Turbo, but I find that backups to slow spinning hard drives take a long time either way and are dominated by the copying speed rather than the scanning speed.

Successful and failed runs are shown at the bottom of the copy job, with color-coded dots that can be clicked to display details.

This is my favorite bit of interface design in the new version. It very compactly shows you the recent history for that copy job using the same format that’s used for showing the completion status of the most recent run. I can quickly see all the information I usually care about, and you can click a button to see more detailed information if necessary. The downside is that you can’t see as much information at once—or across multiple jobs—as if there were a dedicated log window, and it only shows the most recent 7 runs. But I think this tradeoff is well in keeping with the app’s spirit of making things simple and clear rather than offering every possible option.

The most baffling part of the interface is that after each backup completes or fails it shows an “Apple Intelligence Summary”. Much space is devoted to labeling this and to assuring you that none of your data went into the cloud. I just don’t see what the point of this is. 99+% of the time, my backup either succeeded or failed for a very predictable reason like running out of space. Why do we need AI for this? I trust the AI summary less than I would a hard-coded string from the developer. Perhaps in an obscure situation that the developer didn’t anticipate Apple Intelligence would be able to offer a useful interpretation, but I have yet to see that.

At a technical level, SuperDuper has been split into a “helper” or “server”, which runs the copy, and an interface, which is the part you interact with. That means that, once registered, you can quit the SuperDuper application and your backups will still run. They’ll even run if you log out!

It doesn’t much matter to me that it can back up without launching the app—I like to see its progress—but I appreciate the new architecture for scheduled copies. Schedules are now much better integrated into the app proper rather than being driven through AppleScript.

You can run any number of copies at the same time. If you have four backups you need to do, just click Copy Now for each, and they’ll all run simultaneously.

This is the most important new feature for me. I used to do all my clone backups with SuperDuper. But, over years, my backup needs grew. I now have five main source drives to back up. They are much larger than before, and APFS on spinning hard drives is really slow. Thus, the backups, even with Smart Update, can take a long time. That was a lot to manage with old versions of SuperDuper. Carbon Copy Cloner has long supported multiple simultaneous backups so that I could connect a bunch of destination drives, tell it to start, and when I came back they’d all be done. I didn’t have to be there to wait for each backup to finish and then start the next.

It was just so much easier, so I started using Carbon Copy Cloner for most of my backups. But I still liked SuperDuper and trusted its copy engine, so I continued to use it to do some of the backups of my most important drive (the internal SSD). I think it’s good backup practice to have redundancies, not just in terms of multiple physical drives and storage locations but also for the software creating the backups. Both are quality apps, but it’s possible that there’s a bug or a misconfiguration on my part that might prevent the copying of a file that I need. Why put all my eggs in one basket? Now that SuperDuper also supports multiple simultaneous backups, I’m using it for half the backups of all my drives. On one backup day I’ll do all SuperDuper backups, then the next time I’ll do all Carbon Copy Cloner backups. (I continue to use Time Machine and Arq for additional redundancy.)

If you try this, I strongly recommend writing down which app you used for each destination drive and then doing all future backups to that drive using that same app. And it works better to do the first SuperDuper backup with Erase and Copy rather than trying to Smart Update a Carbon Copy Cloner backup.

There are a variety of reasons for this, but the main one is the different ways that the apps deal with APFS snapshots. Both use snapshots on the source to ensure they’re copying from a consistent state. And both mark completed copies with snapshots on the destination. But the retention of the destination snapshots is very different.

Carbon Copy Cloner can keep them around essentially as long as you have enough free space. It can also prune them out of order, so that you have daily snapshots for the last month and weekly ones going back further. This is managed by the app, though you can also manually delete snapshots yourself using Disk Utility.

SuperDuper’s snapshots are automatically managed by the macOS. I’m personally less fond of this design because in practice the system will choose to clean up old snapshots almost right away. I can’t count on being able to restore from any backup but the most recent. To me, this is a shame because APFS supports multiple snapshots, and there’s plenty of space on the drive to store them, but I can’t use them. It’s just not a design goal of the app.

Again, this ties back to how SuperDuper values simplicity. If it made longer-lived snapshots that weren’t cleaned up automatically, you might get into a situation where you (or another app) wanted to add files to a drive and couldn’t because it seemed to be full. You’d have to understand snapshots or have an app that could delete the SuperDuper snapshots to free up space. Third-party apps aren’t supposed to delete snapshots belonging to other apps, which is why you don’t want to mix SuperDuper and Carbon Copy Cloner on the same destination. If the former needs more space to complete a backup, it won’t be able to purge snapshots created by the latter.

The status information for the backups that are in progress is shown right in the Sources section of the main window. You can see at a glance which drives are being copied and when they’re all estimated to finish. I haven’t found the estimates very accurate, so I’d prefer to see the start time and the percent complete. Flipping between multiple active jobs to check their detailed progress is kind of a chore, but if all you need is the summary information you can close the app and monitor it from the new menu bar icon.

SuperDuper 4 now supports copying to and from any file system the Mac supports. Using a “Photos” drive with both Windows and Mac that’s formatted as exFAT? No problem: you can copy it.

It can also copy individual folders rather than just entire volumes, if you drag them into the sidebar.

I’ve added Shortcuts support, so you can create a shortcut that runs before or after a copy, on success, or on error. Want to send an email on success or failure? Beep when copies are done?

[…]

Not only does SuperDuper let you call a shortcut from a copy—you can create, run, and check on a copy job from a shortcut!

There’s a lot of potential here, and the completion shortcut receives a bunch of JSON describing what happened so that it can make decisions about what to do. On the other hand, I would rather see AppleScript support, as I find Shortcuts confusing and inconvenient. I wish that common completion actions like sending e-mails were built into the app so that they were easier to set up. (You can choose to eject the drive, post a notification, or sleep the Mac without having to write a shortcut.)

In all the years SuperDuper has been on the market, we’ve never charged for updates and never even raised the price. That’s 22 years of free updates.

The Apple Silicon version was a paid upgrade, but you could run SuperDuper 3 in Rosetta with an old license and still get all the features.

Version 4 costs $43.95, with various upgrade discounts based on the purchase date. There’s no discount if you purchased before July 2020, but us old timers got so many years of free updates it was one of the best deals ever in Mac software. Regardless, it’s not a high price for peace of mind. The new version is, I think, a massive improvement, maintaining the spirit of the original while modernizing and expanding it.

I’ve already said that I use both SuperDuper and Carbon Copy Cloner. I think both are excellent—great apps with great customer support. With SuperDuper 4 they’re more similar than in the past, but they remain very different. If you must pick one, I would say that Carbon Copy Cloner is better if you want lots of options and control; if you want persistent snapshots, verification, copying of cloud-only files, or detailed logging; or if you have a very large number of backups. (It does have a Simple Mode, but it’s arguably too simple and limiting.)

SuperDuper is better if you care about bootable backups or want something simple but not too simple. There’s documentation, but you probably won’t need it because so much is explained within the app’s interface. It’s just really easy to set up a backup, see what it’s going to do, see what it’s currently doing, and see what it did before. Pretty much everything happens in a single window, without tabs or separate modes. SuperDuper is all about striking a good balance for most people, doing the right thing with a minimum of fuss.

See also: Adam Engst and Accidental Tech Podcast.

Previously:

Update (2026-08-14): The developer wrote in to say that SuperDuper does try to remember the scroll position in the main window, just not across launches. With the current version, 4.0.2, I find that this mostly works but that it gets thrown off if I’ve expanded any of the triangles to see more details about the currently running job. Then my carefully positioned view will be shifted a bit when I come back to it. It’s hard to get this exactly right.

He also had a great tip about a hidden feature that can relieve some of the scrolling issues I encountered: you can click multiple times on a drive in the list of sources to have it jump to the next active job for that drive, scrolling it to exactly the right spot. When the sidebar has keyboard focus, you can also do this by pressing the Spacebar.

See also: Dan Moren.

Update (2026-08-20): SuperDuper 4.0.3:

For those with a lot of volumes, there’s now a sort control for the source list: you can alphabetically by type, or purely alphabetically.

There’s now an option in the sort pop-up that adds a few sections to the source list.

I like being able to separate the source drives from the destination drives. The update also improves VoiceOver support.

Update (2026-09-09): See also: John Gruber.

Previously:

Update (2026-09-16): SuperDuper 4.0.6:

Click the n copies running pill to filter to just those jobs. If you have a lot of copy jobs for a given source, you can filter the list with a click.

[…]

SuperDuper now picks a band size that suits the image’s size, balancing the number of bands with their size.

[…]

There’s now a third-party application, Open Backup, that can notify mobile devices (iPhone and Android) when backups run.

WebKit IP and DNS Leaks Affecting Proxies and Private Relay

10 August 2026 at 20:44

Talal Haj Bakry and Tommy Mysk (Mastodon, Hacker News, MacRumors, Mac Power Users):

WebKit-based browsers on iOS and macOS can be configured to route all web traffic through proxy servers, which is how Tor browsers on iOS and our own Psylo work. We found three WebKit features — DNS prefetching, WebAuthn Related Origin Requests, and WebTransport — that bypass the configured proxy and send traffic directly from the device, which exposes the user’s real network. The same leaks also affect Apple’s iCloud Private Relay.

[…]

It must be noted that VPNs are not affected, since they tunnel the device’s entire network traffic at the system level.

[…]

We’ve addressed all three leaks in Psylo 1.3.1[…] Passkeys and WebTransport have legitimate uses, so both can be re-enabled at any time through per-silo toggles. This keeps Psylo leak-free out of the box, while users who need one of these features on a given site can opt in explicitly, with a clear understanding of the trade-off.

Psylo:

In an ideal world, we’d report the issues to Apple, they acknowledge the issue, and ship a fix in a timely manner. Unfortunately, our past experience with Apple tells us that reporting this issue would involve months of delays, inconsistent communication, and in some cases, denying the issue’s impact entirely.

We weren’t willing to wait months, or upwards of a year, sitting on bugs that undermine the core privacy guarantees of Psylo and iOS Tor browsers while saying or doing nothing.

[…]

Should we knowingly leave our users exposed while waiting for a system-level fix? We didn’t think that was acceptable or fair to our users. Or should we quietly ship our own mitigations without telling anyone? We didn’t think that was acceptable either. Security fixes deserve transparency, especially when they involve tradeoffs.

Psylo:

Soon after we published the blog, we sent a link to the blog and demo website to Apple in a security report to make them aware of it. Now the report is already in the status “We’re planning to address the issue you reported.” and a fix is planned for Fall 2026 🤯🤯🤯

Mysk:

It used to take months and months to reach this status. We got there in less than 24h

Running to the press always helps…

Previously:

Update (2026-08-11): Ben Lovejoy (MacRumors):

A class action lawsuit accusing Apple of false advertising, misrepresentation, and fraud has now been filed by Clarkson Law Firm – the same lawyers who previously obtained a $250M settlement over the delayed launch of Siri AI.

macOS 26.6.1

7 August 2026 at 22:25

Juli Clover (release notes, security, no enterprise, no developer, full installer, IPSW):

macOS Tahoe 26.6.1 fixes a vulnerability that could allow an attacker to authenticate to Screen Sharing without valid credentials.

See also: Adam Engst and Mr. Macintosh.

Previously:

Update (2026-08-14): Bill Toulas:

In an update to the initial advisory, the Dutch agency said it received a report indicating that the vulnerability is being exploited in the wild in attacks where port 5900 is exposed to the internet.

According to the NCSC, the attacker obtained root access to the system and deployed a Monero cryptocurrency miner.

Update (2026-08-20): Edovia (tweet, MacRumors):

The vulnerability, identified as CVE-2026-65400, could allow an attacker on the network to authenticate to Screen Sharing without valid credentials. Reports now indicate that the vulnerability has been actively exploited on Macs where Screen Sharing was accessible from the Internet.

[…]

[We] strongly recommend that all Screens users install the latest macOS updates as soon as possible.

[…]

For users who want to further restrict access to Screen Sharing, Screens can connect to a Mac through an SSH tunnel instead of exposing the Screen Sharing service directly.

❌