If you have HomeKit-compatible security cameras, you may have heard that Apple was going to ship an Apple Intelligence upgrade with the version 27 operating system releases. Apple Home would now provide an analysis in words of what was happening in a clip, making it easier to search for things that had occurred, instead of “animal” or a person’s name.

But it’ll cost you. Maybe more than you expected. Apple had said it would require an iCloud+ subscription, its name for what used to be simply extra storage. Starting at $0.99 a month (in the United States) for 50 GB of extra storage—barely enough for any purpose—options range all the way to $59.99 a month for 12 TB of storage. With an Apple One plan, you can increase that to 14 TB.

Over time, Apple added additional features: iCloud Private Relay, Hide My Email, a custom email domain name, Apple Invites, and HomeKit Secure Video. A 50 GB tier supported one camera, 200 GB ($2.99 a month) supported up to five, and the 2 TB ($9.99 a month) and higher tiers supported unlimited cameras.

In a support note updated September 9, Apple dropped the price bomb. Because video summaries require higher usage of Apple Intelligence, your iCloud+ subscription has to be at an even higher level than the basic secure video offering:

• 1 camera in the 2 TB tier
• 2 cameras in the 6 TB tier ($29.99 a month)
• 5 cameras in the 12 TB tier ($59.99 a month)

You also need an Apple TV 4K or 2nd-generation HomePod. Make sure they’re upgraded before you try to work with the new feature. To enable it, go to the Home app in iOS 27, iPadOS 27, or macOS 27 Golden Gate. Tap or click the settings icon, then choose the new Apple Intelligence menu. Enable Summarize Videos. You can select as many cameras as your iCloud+ tier supports. Once you flip the switch for that many, the rest are grayed out.

There’s definitely a pricing mismatch here. I don’t think there’s a case for video summaries for 2 to 5 cameras costing $30 to $60 a month if you don’t need the storage. I’ve stayed comfortably at the 2 TB tier for many years—now paid via an Apple One bundle—for personal and family storage, and for the number of cameras we have.

However, I also accept that video processing is computationally intense. Apple can’t throw open the doors. But having advertised a feature as something it feels is useful, this service price tag seems too high. Apple rarely lowers service prices; I can’t think of a time it did. But it also can’t underprice the server capacity required to manage this task. The company may have painted itself into a corner.

At my gym, all the signs are handwritten and friendly. In one section, a sign asks members not to drop their weights because there are downstairs neighbors.¹ In the bathrooms, reminders to flush and wash hands. But throughout the gym, signs say—more directly—no live streaming. Other signs ask people to exercise consideration when recording their routines for themselves or their coaches to ensure nobody else is in their sight lines. Privacy in the gym is paramount to ensure everyone is not self-conscious and is comfortable.

I was thinking of my gym when I heard about Live Rewind and Siri Recap in the just-announced Apple Watch Series 12 and Apple Watch Ultra 4. These are two of the four flagship Audio Intelligence features launching in beta later this year. Both of these tools record audio continuously. Live Rewind lets you double-press the Digital Crown to receive a transcription of the last 15 seconds of conversation. Siri Recap takes notes on what it hears throughout the day and provides Apple Intelligence-generated summaries.

Both features have, understandably, freaked people out, made them angry, or caused them to shrug in resignation. Surely Apple is exaggerating the privacy protections it explains on the same page it describes the features! And if Apple is all in on recording us all the time without our consent or knowledge whenever one of its devices is nearby, the privacy game is over, isn’t it!? Everything becomes fodder for the machine; private conversations are immutable; the future is surveillance!

I’m not one for extremes, and I’ve studied Apple’s privacy and security provisions and mistakes for nearly 30 years. But I have concerns about these features from social, political, safety, and legal standpoints. Let me tackle the privacy and security first.

Hush, now

When Apple announced Private Cloud Compute in 2024, it was interesting, but it felt academic because it didn’t then release a Siri worth worrying about. In 2026, the PCC expansion with Siri AI is much more important, as Siri may send huge amounts of our personal information to the cloud to provide better answers derived from our data.²

After studying Apple’s details on PCC, I felt reassured. This is partly because one of Apple’s five pillars of PCC integrity is transparency. This is unlike many previous claims by Apple that it would be transparent. Here, they’ve stated exactly what will be available to researchers, and one researcher already found a flaw and was awarded the highest Apple bounty—$150,000. The other pillars include end-to-end encryption, barring access by Apple or other parties through cryptographic design, and no way for an external (or internal!) party to determine which PCC server is processing an individual’s data.

Apple’s promises with Audio Intelligence are somewhat different, though I find them a valid approach to minimizing invasions of one’s privacy and an attempt to reduce violations of other people’s personal sphere. Here are the fundamentals for Live Rewind and Siri Recap:

• The features are opt-in and can be entirely disabled (with a big asterisk, which I discuss in the next section). Live Rewind has to be triggered before it can access a 15-second recording window. Siri Recap must be enabled. This contrasts with Apple Intelligence in the version 27 releases, where, unlike earlier iterations, you cannot disable Apple Intelligence.³

• Audio isn’t recorded, nor is it stored, nor is a transcript made. As it is captured, the audio is not accessible to you, watchOS or iOS, apps, or Apple. Apple achieves this by using the Secure Exclave to process audio; after processing, the audio is immediately discarded.⁴

• All of the audio processing happens on your Apple Watch and iPhone. That prevents leakage. If you engage Siri, however, some portion of the Live Rewind text could be sent to PCC under the same security protections. (Apple says “will.”)

• Siri Recap uses PCC. The process is complicated, exposing as little information as possible within the already secured PCC environment.

• iCloud syncing is end-to-end encrypted. You don’t need to enable Advanced Data Protection (ADP).

• Siri Recap deletes summaries after seven days; Live Rewind’s 15-second text snippets are deleted within 30 seconds after the Apple Watch display dims. You can save Siri Recaps or export them. With Live Rewind, they are retained within the Siri app if you choose to save them or ask Siri about the text.

From a design standpoint, these measures all feel well thought out to prevent all of the egregious use cases one might imagine: Unwanted recordings! Apple analyzing our conversations to sell us stuff (or sell to third parties)! Leakage that would allow friends or strangers to access summaries, snippets, or conversations, including via internet cloud storage!

And yet. I find the above fits into the meme of “My ‘An explanation of how the Apple Watch recording what you are saying is kept private and anonymous’ T-shirt has people asking a lot of questions already answered by my shirt.”

The right to be unheard

When I’m out in public in the United States, courts have found that in most situations, I have little right to privacy. But then you can shave that down. If a neighbor points a camera from their house at my unfenced front lawn, visible from the street?Generally legal, with some exceptions related to harassment or intimidation. But if a camera points into my house through a window or into a fenced area of my property, most jurisdictions find that “not cool” (a legal term).

The audio side of this is very different. My state of Washington, for instance, is an “all-party consent” state; some states are “one-party consent” or have different rules. “One party” means anyone in the conversation (on a phone, in person, via videoconferencing, etc.) can consent, so they can record audio or have a device or system do it for them. In Washington and other all-party states, every person being recorded must consent, or it is illegal and actionable. (Recording across state lines or internationally becomes complicated.)

The company says it’s not “recording” or “storing” audio. But it is capturing it. Shockingly, I’m not a lawyer, so I can’t provide a legal analysis. (Presumably many privacy-focused organizations are doing deep reads of state-level statutes.) But the gut check is what I’m really going for, anyway: do these two features have the feeling of being recorded without one’s permission, even if Apple is trying to mitigate both the technical reality and the sense of it?

On the technical side, it appears that you have to enable each feature in the Watch app on the paired iPhone. Live Rewind requires enabling Siri: Live Rewind: Double Click Digital Crown. You can schedule Siri Recap by time, trigger it or turn it off using a location, or enable or disable it manually, such as through Control Center.

So let’s do the vibe check.

Live Rewind appears to be buffering audio at all times in anticipation of needing to transcribe the last 15 seconds. Apple says Live Rewind is designed to alert those around you that you’re replaying audio: when you double-click the Digital Crown, a chime sounds (ignoring any of your settings) as the Apple Watch’s entire screen is taken over with an animation that includes a microphone indicator.

However, unless Live Rewind is also a literal Time Machine, this doesn’t feel right. People are being warned 15 seconds after their audio is captured. (If Apple doesn’t mean that, it needs to clarify.) Further, it assumes that people will be keyed in to someone’s smartwatch making sounds and flashing images they should be paying attention to.

There’s also no “stop recording” option: if you’re being recorded by Live Rewind, you as an unrelated party—a waiter, a friend, a stranger, someone nearby, a celebrity—have no way to say “no.”

Siri Recap ostensibly is capturing audio whenever it’s active in any of the circumstances above. There’s no indication to other people that it’s running at all, and no one except the user can opt out.

Apple’s mitigations here include that no speaker is attributed, though Siri Recap identifies and anonymously labels different voices.

With Siri Recap, an Apple Watch automatically discards “potentially harmful content.” Apple defines this as content that “promotes self-harm or hateful speech, and sensitive information, such as financial data, government-assigned identifiers, authentication data, and certain personal identifiers.” I’m not sure this list is a strong argument for Siri Recap.

When using a public or private space, there should be a compelling case, even with the protections enumerated. There are already many kinds of assistive technology used by people with many kinds of disabilities to let them function better in a world often hostile to people with no or low vision or hearing.

However, the assistive case isn’t what defines Live Rewind, a useful feature of convenience that has massive privacy implications despite the way data is captured and stored. And it doesn’t help with Siri Recap at all. Siri Recap is just “life recording” without the label attached, since no audio or video is retained, and only 0.01% of a day’s conversation will likely be summarized.

These features feel like they were designed in a lab and passed through to production without enough people wondering, “Will this provoke a tremendous backlash because of the gaps in privacy that are relatively obvious?”

It’s a jungle, Jim

The best way I can conclude my analysis is by quoting Apple:

Be mindful of those around you. While audio is not recorded and stored, and no speakers are attributed, consider those around you where conversations might be private or sensitive.

Given that Apple has to warn of this, it’s the surest sign the features shouldn’t be released in this form. Apple repeats the form of the warning I see regularly at my gym… but apparently it isn’t heeding it.

You might be interested in knowing how to embrace Apple Passwords with a bear hug, leaving behind your current password manager. If you tried Apple’s Passwords app in the past and were disappointed, you should probably give it another try. The improvements Apple has made in the last couple of releases have brought it to what I consider parity with the most important useful features of well-designed third-party password managers.

Despite that, Passwords is focused on—no surprise—passwords and password-like items: website logins, passkeys, and Time-based One-Time Passwords (TOTPs). Many password managers include a junk drawer of other kinds of structured material you can store that doesn’t map directly to Apple’s Passwords structure. If you’re mostly using a third-party system for password-esque stuff and use all Apple devices or Apple and a Windows PC, a migration is straightforward. Otherwise, it can be hairier and could involve rethinking how you store assorted data.

You can use iCloud Passwords with Windows (and then use Microsoft Edge, Firefox, or Google Chrome). You can also use browsers other than Safari on a Mac with an iCloud Passwords plug-in or extension. However, if you or people you currently shared information with use Android, Linux/Unix, or ChromeOS, this migration won’t work for you: those platforms aren’t supported, and there’s no web app for iCloud Passwords.

Because Joe Kissell and I have written entire books that help with different components involved in a password manager migration, I’ll include references throughout to appropriate Take Control series books. For a general grounding in passwords, for example, I recommend reading Joe Kissell’s Take Control of Your Passwords, updated earlier this year.

Map the data connections

As I noted, Passwords is best at passwords (and passkeys and TOTPs), and filling them in on webpages and in apps. If you care mostly about this, you’re in luck, as you can easily migrate data of these kinds:

• Website and app logins: Account logins move to Passwords.
• Loose passwords: Ones that have no direct connection to an app or site, like a bank card PIN, also move to Passwords.
• TOTPs: These confirmation codes can be migrated. However, there’s a technical detail with how they may be stored by third parties (or Apple) that can prevent the migration and might require using a backup code; see details below.
• Passkeys: The password “industry” finally developed and rolled out a secure copying system that Apple supports that will let you move passkeys among password managers. This requires migrating on an iPhone or iPad; you can’t move these on a Mac.

Two other categories of fill-in entries that aren’t managed in Passwords can be handled—and you may already be using—in Wallet and Safari:

• Payment cards: Payment cards need to move to Wallet & Apple Pay. You have to enter these manually as AutoFill Cards, unless you’ve already done so or added the card to Apple Pay. It’s a little complicated, as I explain.
• Identities: Apple supports filling in personal or business address information through Safari using AutoFill.

(You can see Safari’s evolution on the Mac at Safari: Settings: AutoFill: your personal contact now links to Contacts, user name and passwords to Passwords, and credit cards to Wallet & Apple Pay.)

Where you will be left hanging by Apple:

• Miscellaneous secure items and attachments: If you store Social Security numbers and other account information that is distinct from a password, but you want to have available to fill in at particular websites or by searching Passwords, you can create these as entries in Passwords. In some cases, you may want to create entries in Notes (with additional security, described later).
• Structured data: You may have bank accounts, passports, driver licenses, memberships, software licenses, or other structured information stored in a password manager. That is a trickier needle to thread, as Passwords offers no support beyond a Note field.

For both of these, you might want to migrate to… a password manager. But wait! This would be one you use solely for secure storage of these miscellaneous structured or less-classifiable items, not for field-oriented secrets and accounts you want to fill in.

There’s one more important migration issue:

• Shared vaults and items: If you use a password manager that supports secure storage areas with other people—like vaults in 1Password, Dashlane, or LastPass, for example—Passwords provides something akin, though not precisely the same: Shared Groups. Because of the above provisos, many non-password items shared via a third-party manager will need to be migrated to Notes or another secured shared item-storage-based space.

Three big things that may derail the whole migration for you:

• Tags/labels: Some people make use of metadata organizational systems, like tags. These don’t transfer to Passwords at all!
• Extra data: Much like the paper card catalogs of yore had book information plus tons of annotation, accumulated over time, you may have used password manager features to add extensive notes, additional fields, include attachments, and create richly detailed records. All that will be gone, like tears in rain. True, Passwords has a Notes field, but it lacks structure, rich text, and Markdown support. If you move to another, more focused password manager, you may be able to retain this.
• Access after you’re gone: Non-Apple password managers have recovery kits that could allow a relative or other party who has that information to gain access to stored, synced data. Apple’s Legacy Contacts system, which allows an executor or other authorized person to access your data when you’re gone, excludes iCloud Keychain: no passwords, passkeys, Wi-Fi passwords, or other data. However, Legacy Contacts must be activated; until it is, it’s possible for someone who retains access to one or more of your devices to view your passwords and other data in Passwords. (See Joe Kissell’s Take Control of Your Digital Legacy, or my Take Control of Your Apple Account.

One last bit of aggravation? Passwords does not yet support removing duplicates!

Plan your migration

As you consider migrating, I urge you to run your old manager and Passwords in parallel.¹ Particularly if you store a lot of different kinds of data in your old manager, you may want to be able to consult it and migrate some of it over time. This can be a pain if you are paying an annual fee and the renewal is coming up soon. Consult the maker’s website to see whether you retain access to your data after a subscription expires and, if that bothers you, in what form.

The place to start is pruning old entries.

First, sort by last modified date. Did I know that nearly 2,200 of my 2,600 entries haven’t been modified since 2022? Some since 2008? I did not. However, you likely don’t want to delete these wholesale, because there may be secrets you can’t recover. Online backup private keys (such as with Backblaze), Bitcoin and other cryptocurrency phrases or keys, or other secrets you set once need to be retained or you lose access forever.

My strategy:

• First, export everything. These exports are unencrypted and must be performed on your Mac. The export won’t include passkeys. (See below for that pathway.) This gives you a revert point. Because there are so many export formats across systems, I refer you to the software documentation to pick the best one. Warning: That file will be unencrypted and is like plutonium. Handle with care. The best plan is to use Disk Utility to create a disk image (APFS, 256-bit AES, Sparse Bundle Image), use a password you know or that is stored in Passwords, and then export directly to that encrypted image. The reason? If you save the file elsewhere, it might be backed up to Time Machine or become accessible in a way you didn’t intend. When unmounted, the drive is as secure as your startup volume. Just don’t forget or lose the password!

• Move all the older entries into a group. You might be able to create a group, tag all entries, or, in the worst case, move to a separate vault. In 1Password, the only strategy I found was to create a new vault called Outdated Entries and move all the older entries there. Warning: When selecting, make sure you aren’t including entries from all vaults, as that might move items you share with others or that others share with you.

• Next, sort by name or title. This lets you scan through entries and identify duplicates. I found a number of items I’d already labeled “outdated,” or that were from services I couldn’t even remember. However, there were also a huge number of passwords and account logins that hadn’t been changed in more than four years—some for more than a decade! (There’s no reason to change uniquely set passwords routinely unless your current one is weak and a site is compromised. Most password managers, including Passwords, let you know about weak and reused passwords.) This process can be mighty tedious, which is why I’d recommend tackling it over time rather than all at once.

When you’re pruned, cleaned up, and otherwise reduced, you can now use the set you’re exporting; it’s time to go to the next step.

Export your secrets

Your best and first choice should be to use your iPhone or iPad; at this time, you can only perform a secure password storage transfer in iOS.² Major password managers support this transfer method, which lets you move passkeys—it’s currently the only way to migrate a passkey.³

Here’s how it appears and works in 1Password:⁴

1. Navigate to the export section of 1Password—that’s Lock (upper-left corner): Settings: Advanced: Start Export.
2. Enter your account name; the app provides a hint. Tap “Approve export.”
3. An explanation screen appears. Tap Continue.
4. Choose the destination. In this case, tap Passwords, then tap Continue.
5. Tap Continue in “Passwords,” and you’re switched to the Passwords app, where you can watch the import in progress.

While this is the best method, you can also export from most apps in CSV (comma-separated values) format, which truncates most information and likely leads to problems. Warning: You will have to re-create your passkeys. You may need to use the desktop version of the password manager to export. In Passwords for Mac, choose File: Import Passwords from File, click Choose File, select the file, and proceed. This doesn’t overwrite entries.

Now, check important accounts:

• Does the regular login work? If not, reset the password. Take this opportunity to upgrade to TOTP or a passkey if either is available.
• Does TOTP or a passkey work for logging in? If not, find a backup code or another method to generate a new TOTP or passkey.

TOTPs have a particular idiosyncrasy. They are seeded with a secret generated by a website. The site displays that code as a QR code, so you rarely need to copy it, though Password and other managers allow you to do so. When migrating an entry with a TOTP, it might appear in its URL format, which is generically like otpauth://totp/user@user.user?secret=SEQUENCE in the Notes field instead of appearing as a TOTP within Passwords. If that’s the case, you can fix it manually:

1. Copy the text after secret=.
2. Tap or click Edit.
3. Tap or click Set Up Code.
4. Paste the secret you copied into the Setup Key field.
5. Tap or click Use Setup Key.
6. Tap or click Done.

If that fails, log into the website in question and use a backup code or other means to re-enroll with TOTP.

Enter credit cards, set up AutoFill, and move to Notes

Before getting started, I strongly recommend enabling Advanced Data Protection in iCloud. ADP improves iCloud security by encrypting nearly all application data—iCloud Drive, Messages, Photos, Notes, etc.—via keys stored only on your devices, just like iCloud Keychain. Without ADP, these kinds of data are encrypted in transit and at rest using only Apple’s encryption secrets, and could be demanded via a government subpoena or someone gaining access to your Apple Account. (Note that contacts, events, and email remain encrypted at rest, not end-to-end, because of the need for compatibility with third-party software.)

Follow the steps in the link to enable. You can also still access this information via iCloud.com through a process that enables a temporary end-to-end session. (For more about ADP, see Joe Kissell’s Take Control of iCloud or my recently updated for the 27 releases, Take Control of Securing Your Apple Devices.)

Now, work through these categories:

• Payment cards: Use Settings: Wallet & Apple Pay on an iPhone or iPad, or System Settings: Wallet & Apple Pay on a Mac. Tap or click AutoFill cards and authentication. Now you can tap or click Add Card to provide the card details. This lets you fill in the card anywhere there’s a form field or wherever you can tap or Control-click/right-click in a field and bring up AutoFill as a menu item. AutoFill cards sync across your devices when Wallet sync is active in iCloud (Settings/System Settings: Your Name: iCloud: See All). For more on working with Wallet and payment cards, see my book Take Control of Apple Wallet. This information is secured end-to-end.

• Identity filling: A different kind of AutoFill, for identity information, is found in Settings: Apps: Safari: AutoFill or Safari: Settings: AutoFill. Enable Use Contact Info on an iPhone or iPad, or check “Using information from my contacts” on a Mac. Now you can tap the entry next to My Info on an iPhone or iPad, or click Edit to the right of the checkbox label. This lets you pick an entry—you probably already did—and populate it with all the things you’d want to fill in on a form, including multiple addresses. Safari doesn’t protect identity information with ADP. However, the type of address and other information you would use are likely the least important to protect in what would be a very unlikely break-in to an Apple Account or one of your devices.

• Fill in Notes: As I noted earlier, the structured entry style of third-party password managers doesn’t mesh well with either Passwords or Notes. Passwords has a single Notes field, which may be enough for some entries, but not the more detailed ones I describe. The Notes app is structured around entries, but it’s not well designed for hundreds or thousands, and it lacks inherent field data or structure. Judge what you’re storing in your old password manager to figure out if Notes could work. With ADP enabled, it offers strong security. For migrating structured data intact, read on!

Migrate structured data

If you’re looking to move structured entries, I suggest checking out Strongbox, but not for passwords, passkeys, TOTPs, and the like. Its developer offers a free syncing version (for iPhone, iPad, Mac, and Apple Watch) with everything you need except Touch ID/Face ID unlocking. That requires the Pro flavor at $24.99 per year, which includes several other features.⁵

Strongbox, unlike some managers, allows you to sync via a file under your control or through its secure syncing service, depending on your preference. This lets you keep your, er, digital strongbox under your personal control, if that matters to you. It can import from all major password manager export formats.

In testing, it preserved my 1Password structured data extremely well. This included tags. It also arranged my vaults into what it calls groups, letting me retain a sense of what I was sharing with others.

The one complication is that if you want to use one of the migration processes above to copy your items into Passwords, you have to do one of two things after performing your migration:

• In your old manager, delete all passwords, passkeys, and TOTPs. This is dangerous in my accounting, as it reduces your ability to have a parallel working solution, and you could accidentally delete secrets you need to keep.
• Import everything into Strongbox, then select all the passwords, passkeys, and TOTPs from Strongbox, and empty the trash. This gives you two copies of everything: Passwords and old password manager for secrets; Strongbox and old password manager for structured data.

When you’re ready to abandon your old password manager, maybe weeks or months from the migration, you can retain a securely stored backup copy or perhaps retain access depending on the product, while not using it actively or paying renewal fees.

Working in groups

Sharing your passwords and other secrets with other people remains Passwords’ weakest aspect, because Apple offers only Shared Groups. Each entry can be stored only in your personal Passwords storage or in Shared Groups. Otherwise, you have to duplicate an entry, which can cause such entries to drift out of sync.

In the Passwords app, select any entry, then click or tap the Group pop-up menu. You can then choose an existing group or create a new one. When you make your choice, the password, passkey, or other item is now exclusively found in the Shared Groups section, not copied! Passwords doesn’t offer a copy or duplicate feature, so you have to re-create the entry if you want to share it with two or more groups that aren’t a complete overlap of the same people.

It may be easier to understand from a family perspective. Let’s say you have items you share only with your spouse, others with your children, and some with both. You can’t create a “spouse” group and a “children” group. You need to have one for your spouse, one for your children, and one for the whole family. This is where there’s real room for improvement by Apple.

The password rhymes with orange

I know this is a whole rigmarole, but I’m actually impressed that it’s finally doable in a reasonable manner. A couple of years ago, it was not. It was possible a year ago, but I wouldn’t have recommended it. Now, if you’re careful with each step, maintain a backup, and keep your old manager running in parallel as you complete the migration, you should be able to achieve success.

This article was updated on Sept. 10th to add missing details about fixing a broken TOTP import.

[Got a question for the column? You can email glenn@sixcolors.com or use /glenn in our subscriber-only Discord community.]

I know there’s no connection between my local area network and our house’s plumbing system, but when the faucet started running uncontrollably literally seconds after I fixed a network outage, I had to wonder: did we have a poltergeist? The jury is still out. But I can tell you that my hour of fruitless examination of router settings is to your benefit: you won’t have to do this when it happens to you.

The weakest TP-Link

As a guy known for Wi-Fi since the early 2000s, you might think my house is ablaze with wireless signals.¹ Yes, it is: we have six Wi-Fi access points and gateways in a relatively small house by modern standards (about 1,200 sq. ft. on the main floor and 800 in the finished basement). But we also have Ethernet strung through the house to connect most of them, with powerline networking adapters where that doesn’t work due to the ancient and mysterious innards of the walls. The innards’ outsides are covered with heavy, old plaster, which absorbs some of the power of the Wi-Fi signals—hence the large number of emitters.

Normally, this works fine. We have four TP-Link routers, some purchased a while back, and a Netgear Nighthawk as our primary base station, which distributes network addresses and is connected to the fiber-optic ISP router.² When something goes wrong, it’s usually an issue with a router crashing, even though its various green lights remain in a happy state.

This time, something was more deeply wrong. The TP-Link routers showed orange Internet connection lights, which in this case meant they were connected via LAN to the Netgear, but they couldn’t reach the Internet. Perversely, I seemed to be able to connect from my iPhone and my office Mac, which has both Ethernet and Wi-Fi connections active.³

TP-Link has one of the most irritating admin approaches for its routers of nearly any networked product I’ve ever used. You can connect directly, but it’s difficult to store the device’s password because it uses a potentially changing local IP address on your LAN. There’s also a centralized system where you can use an app called Tether or a TP-Link website to log in remotely to a router, even when you’re on the same LAN, rather than finding its local address. Tether also scans the local network, letting you connect even when Internet access is disrupted.

Without the routers “seeing” the Internet, I couldn’t use the website, and Tether worked erratically. I eventually was able to figure out the IP addresses of two of the four routers, connect via a web browser, and find a working password for one of them. (To reset the password, you have to factory reset the router. That’s for a future day.)

But I remained baffled. My ISP gateway was up. My Mac could reach the Internet. The Netgear router seemed to be routing my Mac’s traffic to the Internet. Some of the devices on our network were also connected to the rest of the world. Had my TP-Link routers been compromised? Was something more sophisticated going on? Nope.

It’s coming from inside your smart house

Some of you may be yelling at me from the safe distance of your phone or computer. “Glenn, Glenn, why didn’t you check DNS?” The circulatory system of the Internet may be the IP-addressed traffic that passes over the series of tubes that make up the network. But DNS is the helpful labeling system, like an editorial cartoon that uses captions like “taxes” and “fat cats” to mark characters in an illustration. DNS turns human-readable domain names into the underlying numbers required for connections.

Surely DNS was working? My iPhone, Mac, and other devices were resolving addresses, or turning them from names into numbers. Then I found a clue in Network Time Protocol (NTP), a somewhat obscure bit of plumbing that also makes things tick. When I went to Advanced: Administration: NTP Settings on the Netgear, the last time it had been able to grab the current time and date was hours earlier. That seemed problematic.

Digging more deeply, literally, I found that the dig Unix command couldn’t pull up IP addresses from the Netgear router. On a LAN in which you’re using DHCP to handle local address assignment, your router may require that you enter Internet IP addresses for one or two DNS servers, or it might retrieve them automatically from your ISP. When a device on your network requests an address, the DHCP server assigns an address and tells the device to use the router address for DNS resolution. The router relays your requests to the real DNS server.

I tried dig @10.0.0.1 apple.com (use the router to return the IP address for apple.com) via Terminal on my Mac, and it timed out. I then tried the same lookup using my ISP’s DNS servers. Same timeout. The Mac had no problem with domain lookups, however, nor did my iPhone.

Now comes the time to insert a head-slapping emoji. Some time ago, and I can’t recall how long ago, I set my Netgear router to use my ISP’s primary and secondary DNS addresses. I know many people have switched to Google, Quad9, Cloudflare, or other free, public DNS servers to improve lookup speeds, which, at one point, would have helped speed up network operations tremendously because ISPs invested so little in their DNS operations.

However, using public DNS can cause issues in particular cases. For one, it can confuse content delivery networks (CDNs), which try to guess the closest server to you topologically based on your DNS lookup request to their servers. When that works, you’re getting the shortest path and likely faster throughput. Public DNS can misdirect CDNs, resulting in severe slowdowns in data transfers for big files and with streaming. Much of that has been resolved, but not all of it. I had had some issues, so I reverted from one of the public DNS services to my ISP’s servers. (This has largely been solved now.)

So what happened? My ISP, CenturyLink, must have had a DNS failure. I couldn’t get replies from its DNS servers when I checked (directly or via my router). I found postings later from other CenturyLink customers around the same time, but no public message from the company.

Why did my Mac and iPhone keep resolving? My Mac’s Ethernet connection had a manually set DNS server that was an alternate one provided by my ISP, one that apparently continued to work. I can’t explain the iPhone situation, unless it’s possible that iOS will pull DNS over a cellular connection when it fails over Wi-Fi—I don’t know that it does that, but I don’t have another explanation.

I removed my ISP’s DNS values, replaced them with 1.1.1.1 (Cloudflare) and 8.8.8.8 (Google), clicked Apply, and an hour of my time suddenly was marked on my internal spreadsheet as “wasted.”

Where I went wrong

I’m always trying to learn from my mistakes, particularly because I turn mistakes into opportunities to write columns like this one to save time for you, dear reader. In this case, I was led astray by the half-working network and the fact that, seemingly, only one brand of router in one configuration was failing. I should have remembered to start with DNS—and I will in the future.

If you’ve read this long, I’m sure you’re dying to know about the faucet. I had just finished fixing the network, walked to the freezer, grabbed a fruit-only frozen treat, and was walking across the kitchen when a small stream of water came out of the faucet. I tested the taps. I put the frozen delight back into the freezer, turned off the taps while my spouse was on speaker so we could figure out which tap’s cartridge decided at that moment to give up the ghost, and ordered a replacement. This was another kind of DNS failure: do not spout!

For further reading

While this column may have given you less confidence in me than you had before you read it, I share much more information about Wi-Fi, networking, and troubleshooting in my book Take Control of Wi-Fi Networking and Security.

[Got a question for the column? You can email glenn@sixcolors.com or use /glenn in our subscriber-only Discord community.]

Apple’s overhaul of Siri and its expansion of Apple Intelligence are extensive. Take Control publisher Joe Kissell and I looked at this mountain of changes and opted to research and write an entirely new book, Take Control of Siri AI and Apple Intelligence, to help us get a handle on what’s new and thus pass it along to readers. This title is now available in its 1.0 release, ahead of the version 27 operating systems shipping in September. We also have our books on iOS 27/iPadOS 27 and Golden Gate available in 1.0 versions. All will receive free updates when the production versions ship.

We look at everything related to Siri AI, including the new Siri app and its ability to handle contextually aware conversations, the expansion of Apple Intelligence into new apps, enhancements to accessibility features, and, in particular, Visual Intelligence’s heightened prominence as a camera feature on the iPhone and iPad. We also dive into how Apple’s Private Compute Cloud works and associated privacy issues, particularly around the company’s extension of this on-device processing to Apple-managed hardware at Google Cloud.

Go to the linked site.

Read on Six Colors.

Wallet on iPhone is a bulging catch-all. Apple stores all your payment card information there, and it’s an interface for adding and removing cards, as well as viewing associated details. It’s the place where you interact with your Apple Card (like scheduling payments or viewing transaction reports), the Apple Card savings account, and Apple Cash. But it also handles related but miscellaneous categories of other things: tickets for events, reward cards, membership cards, your library card… really, anything with a number, a scannable code, or a connection to payment winds up there.

Despite all that, Wallet has been deficient: you couldn’t easily add items to Wallet that the party issuing them hadn’t formatted and made available with an “Add to Apple Wallet” button, whether from a website or within its app. Starting in iOS 27—coming in September but available in a public beta now—you can use a new pass-creation tool to make your virtual billfold even larger. Third-party tools still fill the gap for iOS 26 and earlier users, or for those who want customization that Apple isn’t providing in Create a Pass.

Make your own Wallet entry

In iOS 27, open the Wallet app and tap the Add button in the upper-right corner. You’ll notice that among the options you’re familiar with, Create a Pass appears. Tap that.

If you have a device that supports Visual Intelligence and the pass has a barcode or QR code, tap Continue, and Wallet opens a camera sheet.¹ When you tap the shutter button, Visual Intelligence analyzes the image and tries to extract elements, like your name, the organization name, or the code. If it can’t, it will offer a Try Again and Create Pass Manually dialog.

If it’s successful, Wallet next displays a preview screen. You can tap Add to accept the pass as it appears, or tap Edit Pass to modify the fields shown and the contents of those fields.

There’s a quirk in editing fields that baffled me for a while, but I teased out the answer in testing. Apple pre-populates field areas, marked with white rounded rectangles with subtle glowing edges. If you tap the Edit button (in the lower-right corner) and choose Add/Remove Fields, you cannot add new field areas. (See the figure for how I’ve labeled this.) What you can do is tap on an existing field within a field area to change it, or you can tap within a glowing rectangle (the field area) to add another field. This is not a great interface, and I expect it will mature.

Tap the Palette icon to change the background color or choose a different background image from a small set in the Wallet library.

If Visual Intelligence isn’t available or you want to build the pass element-by-element:

1. Tap Create Pass Manually.
2. On the Choose Pass Template screen, pick the data format and default color scheme to use for your pass: Standard, Membership, or Event. This pre-populates different fields for you to fill out. (You can change the color later via the Palette icon.)
3. Next, tap fields to enter data. Each field has a label in smaller type and placeholder text in larger type.
4. Tap Add Code to scan a barcode or QR code.
5. When finished, tap the blue checkmark.

You can then tap the Palette icon to change its appearance, or tap Edit: Add/Remove Fields icon to further edit the pass.

After the pass is added to Wallet, you can tap it, tap the More button, then tap Edit Pass. You can also tap Pass Details to see the raw information added. The View Original Photo button lets you bring up the picture you took if you used Visual Intelligence.

If you’re not yet using the iOS 27 beta or want options that Apple isn’t offering, you could try one of these free tools. Be aware, however, that Wallet passes have to be signed, so any data you provide to these companies is sent to them in the clear. Both have details in their privacy policies about how they protect your data.

• Wallet Creator (iOS app) has over 80 prebuilt templates for existing businesses, or you can roll your own pass or card. Wallet Creator says the app collects no data. However, the App Store’s description for the app, under “Our Terms of Use & Privacy Policy,” provides more information about how data is sent to a server, processed, and deleted.

• WalletWallet (web app) is a single-page form to create a pass. The page offers no privacy information, but it’s built using a business-oriented API the company makes, and that API has this explanation on the trip your data takes.

My book on Wallet, Take Control of Apple Wallet, will be updated later this year to incorporate all of this new information.

iPad and Mac have empty pockets

While Apple brought the Phone app to iPad and Mac in iPadOS 26 and Tahoe, the company still treats Wallet as a second-class citizen on those two platforms, even though both allow the use of Apple Pay. I’d love to have Wallet synced and fully available for managing all cards, not just payment-related ones, as a standalone app in the future.

[Got a question for the column? You can email glenn@sixcolors.com or use /glenn in our subscriber-only Discord community.]

We trust Apple with a lot of our data. In general, that hasn’t seemed like a bad idea; in particular, compared to its competitors, Apple seems to ensure that it can inspect or interact with very little of our data. The company has built its platform and its reputation on being an elegant, frictionless, hands-off conduit. While we can make many complaints about Liquid Glass, its increased focus on invasive (and poor) advertising, its software quality, and much else, Apple has kept its corporate nose cleaner than anybody else. Its transparency and documentation are, oddly, worse than its actions and clear intent.

I was thinking about this when I received an email from an anonymized iCloud Hide My Email account, asking for more detail about how Apple managed the transition from the old method of presenting or escrowing (in iCloud) your macOS FileVault Recovery Key to the new method, in which the key is stored in Passwords. This transition, which I’ve documented in a few places, was a step forward in privacy and security.

But not transparency! I’ll explain, but you can’t find an explanation on Apple’s site about the transition. The support documentation remains out of sync with Tahoe. That leaves it to yours truly to explicate.

Don’t trust and verify

The Electronic Frontier Foundation recently published a newsletter with a round-up of how fitness wearables, like rings, watches, and bands, preserve your privacy from government intrusion, as well as whether they protect you from unwanted security invasions by using end-to-end encryption (E2EE). (The former often requires the latter: governments typically can’t break through E2EE.)

I want to quote two full paragraphs to make this point:

In the end, we found that only four of these companies (Apple, Google, Whoop, and Oura) promise to notify users of law enforcement requests in publicly available documentation. And just two of those companies, Apple and Google (which also owns Fitbit), currently publish transparency reports on how often they hand users’ data to the government.

Support for end-to-end encryption—a method that ensures your personal data is only accessible by you, and not the company who makes the device and manages the cloud storage—is more rare than transparency reports among wearable device makers. The Apple Watch is the only popular fitness wearable that supports end-to-end encryption.¹

Apple wasn’t an early player with E2EE. Really, it was seen as the kind of thing only true security geeks cared about, even while people like EFF and other digital privacy advocacy groups and individuals warned us that our data was only lightly protected. Over time, as the criminal, exploitative, and political monitoring and extraction of our secrets became clear, Apple kept stepping up.

The Secure Enclave is a keystone of those moves, as the tamper-resistant silicon subsystem allows devices to keep locally generated security keys entirely private. Most of these keys never leave the Secure Enclave! Rather, it’s the encryption hub.²

iCloud initially had a fairly cursory level of protection, with the then-Apple ID account password serving as the only real bar. Two-step verification in March 2013 provided better account protection, but didn’t cover iCloud backups, which could be retrieved without that second step. A rash of celebrity account leaks in late summer 2014 led Apple to extend two-step to iCloud data within a couple of weeks. The next year, it upgraded security to the more rigorous two-factor authentication, which later became mandatory.

As part of its response to the iCloud data hijacks, Apple began to beef up iCloud. It began rolling out E2EE for all the device-based services it could, leaving synced data still relatively lightly protected. (iCloud data is always encrypted with Apple’s at-rest keys, which only it ostensibly has access to, and in transit with HTTPS. However, a security breach at Apple or someone able to hijack one end of an in-progress HTTPS sync allows access to that unencrypted data.)

Then, suddenly, months after shipping major updates to its operating systems, Apple announced Advanced Data Protection in December 2022. Enabling this feature put the E2EE aegis over nearly all synced or stored data at iCloud; mail, contacts, and calendar entries remain an exception because of their interoperability with third-party apps and services. You can view Apple’s document that explains what level of protection applies to data, with and without ADP enabled.

With that in mind, let’s talk about the Recovery Key transition.

Recovery Key is not recovered? I think not

The particular reader question driving this was their concern about the FileVault Recovery Key that was in place when the Tahoe-driven transition occurred. Was the old key destroyed and a new one created and stashed in Passwords? Or was the old one just moved over? If the latter, isn’t that a security hole, if a tiny one?

My initial reply wasn’t entirely glib, but I said, having not documented the upgrade, I believed Apple explained the process when it occurred. But I couldn’t find any screen captures of how that occurred. Apple’s documentation remains in the past—it doesn’t mention the Passwords method at all. The Passwords User Guide perversely mentions the Recovery Key, but not how to interact with turning it off or on.

People who had FileVault disabled (whether they never turned it on, or turned it off at some point) did receive an alert during the upgrade:

Your Mac is Ready for FileVault: FileVault keeps your Mac safe by encrypting your data and protecting it with the password you use to log in. If you forget your password, you can use your Recovery Key to reset it.

Clicking Not Now bypassed the process; Turn On opted the user into the new Passwords-based storage for the Recovery Key.

I’ve explained in previous columns how FileVault provides an extra layer of protection. FileVault requires a Recovery Key, so you have recourse if your password stops working, you forget it, or corruption happens in the boot data. This shouldn’t happen, but it can. The Recovery Key and your password (transformed by a cryptographic formula—or hash—after you enter it) are both “key encryption keys,” delightfully named KEKs. Neither directly encrypts your data. Each instead unwraps the key that the Secure Enclave uses to unlock your drive for use in macOS.³ (You can find out a lot more about this topic in my Take Control of Securing Your Apple Devices, a revised version of which, including “27” betas, will be out shortly as a free update.)

Apple never knows your macOS passwords, and it shouldn’t know your Recovery Key. That was the flaw with iCloud escrow: your Recovery Key could be retrieved by someone with your Apple Account information who had access to your Mac.

With that said, how did Apple manage the transition from the old system to the new one that uses Passwords? Into this lacuna of details, jump I with inferential logic about what Apple must have done.

With a “show me once” Recovery Key: Apple would generate this key, show it to you, then destroy it. The company (and macOS) didn’t need a record of it, because its purpose was to be used to decrypt another key: don’t have the key, can’t decrypt that other key. If you opted for that method, Apple had to destroy the existing KEK to replace it with a new one derived from the newly created Recovery Key.

With an iCloud escrow key: The same scenario applies from a different angle. Apple can’t retrieve your escrowed key unless you use your Apple Account. That isn’t a per se security weakness, but Apple doesn’t need that escrowed key, and it doesn’t want to decrypt it at iCloud to send it to you. I would warrant that the company once again destroys the KEK, creates a new one, and that’s what’s stored in Passwords. Anything else leaves a potential gap in my explanation of why Apple made this change in the first place.

Now, you say, if macOS generated the key and it stored it in Passwords, doesn’t it “know” the key? Not exactly. The key is ostensibly generated in memory, added to Passwords, and destroyed. To have accessed the key, an attacker would need to be monitoring your screen or grab particular memory locations at an exact moment. If someone has undetected remote observation of your Mac display, the game is already over.

Passwords uses end-to-end encryption with device-based secrets. You can enter a device password or use biometrics to unlock Passwords (or chained biometrics with an Apple Watch linked to your Mac). That’s as secure as we can get to protect any password. If someone wanted to access your Recovery Key through Passwords, they need access to one of your devices; cracking your Apple Account and its second-factor or passkey authentication wouldn’t help—and that’s a big stretch to begin with. Nor does just having your macOS account name and password without the ability to have physical or remote screen access to your device.

I believe Apple handled this transition awkwardly. The company could have provided more clarity about the requirement to change how a FileVault Recovery Key was stored, and explain exactly what measures it took to ensure security across that transition. And it could update its support pages!

[Got a question for the column? You can email glenn@sixcolors.com or use /glenn in our subscriber-only Discord community.]

The almost-natural-language notepad calculator Soulver’s latest release adds better tools for calculating durations or intervals between dates and times, planning travel itineraries, tracking inflation, finding distances, performing bandwidth math, and splitting restaurant bills or other expenses. That’s not all, but a good starting list. Should it do all these things? A point we could argue about! But many of the features it offered in the past, and several of the new ones it provides, previously required one or more web searches to find a tool or to pull together disparate information. That’s welcome.

Soulver 4’s release comes at an interesting time, when many people have turned to chatbots and Google’s search dialog—and soon will turn to Siri AI—to answer questions that are better written out or spoken than described as just numbers or operators.

This significant update succeeds in bringing a sort of authoritative basis to stuff you need to calculate or convert. Behind the scenes, there’s no inference or autocompletion—it’s numbers, baby, all the way down. However, the developers aren’t unaware of the AI glow-up. They’ve addressed it in an interesting way, making it easy for agents to ask questions of Soulver!

How many bushels in a peck as I travel a furlong faster than a parsec?

Soulver has filled a gap for me in my calculating needs since I dug into the subject in 2015. While I love PCalc and use it for regular and advanced calculator needs, Soulver is where I go when I need to mix things up.¹

PCalc and Soulver offer overlapping Venn diagrams of what’s possible in number space, but they are distinctly different beasts at heart. Where PCalc mostly calculates within a calculator-style interface, Soulver mostly offers a way to make sense of numbers, units, percentages, time, intervals, and much more. I think of it as a “take stuff in various units or other formulations and then produce an output in a way I want” tool.

I sometimes go days without using Soulver, and then find myself typing in an array of calculations. For instance, as a tiny print book publisher (it’s just me), I am often dealing with the weight of paper, the weight of books, the cost of shipping, and other variables. The number of sheets I have in some of my Numbers documents is alarming, but I often need conversion that sounds like a story problem: “The printer in Canada is giving me paper weight in gsm (grams per square meter). I know the book’s area per page (typically in inches). I need to calculate the weight of 1,000 copies in pounds.” I can type the query faster than I describe it. For instance, I need to estimate the weight of a new book based on the weight and page count of one I am holding:

(6 inches x 9 inches) / (5.875 inches × 8.25 inches) × (352 / 204) × 302g in lbs

Version 4 continues to offer all of what I consider its basics. You type out numbers and units with operators between them. You can set variables, add comments, and drag results into subsequent lines as part of further calculations. You can force-convert units, as above, telling it to use a metric unit instead of imperial, or to use a different unit scale. Say you want inches instead of feet, or kilograms instead of pounds.

Because it’s a notepad, your work is persistent. You can use Soulver to create the equivalent of tabs within sheets, collected into a “sheetbook.” This is somewhat like the Notes app, and it lets you organize calculations into projects and sub-projects. I have a monolithic sheet I use for essentially everything. Soulver can store files locally or sync via iCloud.

Where version 4 starts to diverge from previous releases is in what feels like a baroque set of options that aren’t stapled on, but most require a bit more effort to get the nuance and make them work for you.

How much did Minions & Monsters make in 1940 dollars?

It took me a few weeks to write this review, quite honestly, because every time I looked at the upgrade page, my eyes glazed over as I thought about how to best present this. I mean, the release notes page is broken into ten sections. The answer—which didn’t require Soulver 4—is that I need to cherry-pick more than usual for an app to give you the flavor.

Here are a few new elements that will keep me away from search engines and other resources more than any other:

Inflation calculation. As a historian, and as somebody who just wants to use his numeracy to interpret the world, I find myself jumping for an inflation calculator all the time.² You need an online source, as it has to have a table of the historical values to provide the correct cumulative percentage between two years or dates. Because of the relatively high inflation in developed nations since the start of the pandemic, I find myself trying to understand why I’m staring at a jar of peanut butter and can’t comprehend what it costs now. (Soulver currently does annual inflation calculations, but will add monthly data in a future update.)

It’s a date: Date math is the hardest math, in my experience. Soulver previously let you perform the magic of subtracting one date from another or adding days to a date to figure out the right month, day, and year. In the update, you can do more tricks, like figuring out work hours (set by default, and you can change) in periods of time or differences, calculating relative to cultural and religious holidays, finding the number of daylight hours in a particular place, and (as should be obvious so far) much more. As a person of the Jewish faith, I honestly never know when Hanukkah starts, and Soulver doesn’t appear to know either. (Soulver says Hanukkah is coming in a future update.) However, it does include Christmas and Ramadan; there’s no list of this category, but you can look in Soulver: Settings: Dates & Times and click Public holidays to see that list, set by your region.

How far away? I don’t know about you, but I regularly want to know the distance between two places, sometimes nearby, sometimes far away. Soulver 4 lets you ask, distance between [place name] and [place name], and get the proper curvature-adjusted distance. (I have a proviso about this that you can read at the end.)

How long to upload? I’ve used Soulver for bandwidth and file-transfer time calculations since I first installed it. With the latest release, you don’t have to punch in nearly as many units or conversions to get an answer to a question like time to upload 1TB at 900Mbps. (Answer: 2.47 hours.)

Elements you’ll find added or improved that I haven’t found a particular use for yet but seem significant include:

• Better formatting: You can highlight expression lines with one of eight preset colors, as well as add divider lines. This makes data in sheets easier to parse. In addition to the previously available export function, Soulver 4 lets you email sheets to yourself with full HTML formatting.

• Trip planning: I’ll be honest that this feature looks powerful, but requires breaking out of the Soulver mold, as it uses a multi-line approach by defining the top and bottom of the trip range as a “time point” via the contextual menu. However, because of how it calculates time intervals and provides warnings if the duration you’ve set doesn’t fit, you can use it for short itineraries (getting to the airport on time) or planning a long trip.

• Tags workflow: Coders are amazing people, and you can see that in the simplicity and complexity of this tagging feature. When you tag a line with a hashtag and a tag name, the associated value can be summed, and operations can be performed on it. For instance, you can tag everyone’s individual orders on a dinner bill, add in tax and tip, and then have it divvied out. But that’s just one example. A spreadsheet could be easier, but it can also be overkill.

• A command-line interface: If you’re the kind of person who doesn’t like a GUI, a command-line approach to Soulver might fit you, but the developers created it mostly to allow a simple way for you to have various other things, whether scripts, editor plug-ins, or coding agents, use Soulver as a kind of engine of numerical accuracy.

Weather goest thou?

Soulver is a $59 one-time purchase and gives you access to Mac, iPhone, and iPad versions. (There’s a 60-day free trial to test it out.) While that might seem high, I think given inflation—wink, wink—that’s comparable to the $30–$40 we might pay for a single-platform great utility in 2010! The iPhone version can be purchased on its own for $15. Soulver 3 owners pay $29 to upgrade to version 4. You can also get Soulver 4 via the $15 a month Setapp subscription, and have full access to it and over 330 other apps.

But you might run into one not-quite-hidden subscription option if you make certain weather or stock queries. With the App Store version of Soulver, $26 a year gives you access to what the app labels Live Weather (a number of current metrics), Live & Historical Stocks (a deep trove of data and real-time), and Inline Knowledge Assistant (which lets you use Wolfram|Alpha). It’s included at no extra cost for Setapp subscribers.

I ran afoul of an aspect of this in testing, as Soulver (as of 4.0.2) included about the top 700 most populous cities and leaned on Wolfram for more, but didn’t prompt me as to why it couldn’t identify a city I mentioned. Developer Zac Cohan said the next minor update will add dynamic place-name lookups as part of the base price to reduce confusion and better fit the user base.

This subscription is not at all necessary to use Soulver 4, and Zac says the vast majority of Soulver users don’t need it. However, the cost to provide the data and services is too high to include for all users, hence the subscription to defray those costs.

The reckoning is coming. Apple has done it before, and it’s doing it again. After macOS 27 Golden Gate, you will no longer be able to run legacy Intel apps using Rosetta 2. After the 26.4 update in March, when running any affected app in macOS 26 Tahoe, you see a notification banner when you launch affected software or a background component launches that uses Intel code:

Support Ending for Intel-based Apps. This version of “[App Name Here]” will not open in a future release of macOS. Learn how to update to an Apple silicon version. [Learn More pop-up menu]

There is one carveout noted for “certain older, unmaintained games that rely on Intel-based frameworks,” so far unnamed.

With information in hand, you can plan how to deal with Intel-only apps that have been abandoned, or the developers have seemingly no interest in updating. Printer makers are, so far, the worst.

A history of looking backward

Apple has done this before—many times, in fact. I’ve argued in the past that one of Apple’s key strengths, and a key to the continuity of the Mac’s operating system, is how well it’s managed transitions across chip architectures, frameworks, and operating system changes.¹

Look at what Apple has managed:

• Motorola 680×0 to PowerPC (silent emulator)
• Mac OS 9.1 (or later) to Mac OS X (Classic)
• PowerPC to Intel (Rosetta, original flavor)
• 32-bit to 64-bit code (warnings)
• Intel to Apple silicon M-series chips (Rosetta 2)

At each of those milestones, Apple offered either advance warnings about a future lack of compatibility, an emulator tool, or both. Does anyone have fond memories of running QuarkXPress using Classic in Mac OS X in its early days? When it crashed, which was often, it only took down the Classic “app” and didn’t require a Mac restart.

To be fair, Apple could have continued to let older software run for as long as it was willing to devote time to maintaining emulators or compatibility layers. We could be using apps written for Motorola 68030s on our M5 Macs right now! However, it makes increasingly less sense to support the past after a reasonable transition, particularly one that stretches years and sees the company discontinuing compatible hardware.

Apple released the last Intel-based model in August 2020, introduced its first M-series computer in November 2020, and halted sales of computers with Intel inside in 2023.

As part of this shift, you receive the Intel software warning, not just the first time you launch an affected app or an Intel-based component or even Terminal-accessed binary runs, but the next time you do it after a restart. Yes, it is trying to bug you to get a newer version of your software. Golden Gate also pulls an interesting trick: When you upgrade, it removes the Rosetta emulator. You’re prompted to install it the first time you need Intel code. I guess this is an extra spur to remind you.

Because Intel-only apps will continue to work under Rosetta until you install macOS 28 Dumbarton, these reminders will continue for at least another 16 months or so.² Once you upgrade to macOS 28, those apps and components will simply stop working.

Sunsets can be beautiful

Apple includes a helpful tool in Golden Gate in System Settings: General: About. Click Details next to Intel-based Apps, and a dialog box appears that lists everything installed that requires Rosetta. As a nice touch, Apple shows you apps launched in the last year, along with when, so you know the most critical to upgrade or swap out.

You can also examine any app in the Finder, choose Get Info from the File menu, and note the warning next to Kind. Apple allows apps to be compiled as universal binaries that include both Intel and Apple silicon code, and offers an Open using Rosetta checkbox that was useful in the early days of the swapover when some M-series versions of an app were missing features or were buggy compared to the Intel version. You sometimes checked that box to use the more stable Intel variety, and then surely forgot about it. (For instance, Adobe updated its primary apps faster than third parties did their plug-ins. To use some Photoshop plug-ins, you had to force Photoshop to run in emulation.)

Hover over the item, and you can click Visit Website if Apple has a link to one, or click the More … button and choose Show App in Finder or Move to Trash. Not every app or component has a Move to Trash item, and I’m not sure why. I also suggest installing AppCleaner, a free app that will root out all files associated with an app when it’s deleted. (Turn on SmartDelete to monitor the Trash, or you can drag apps onto it.) This ensures you’re not leaving cruft behind when you get rid of the app proper.

This is all fine for rooting out installed apps, but Apple may not catch every system component, command-line utility, or other software that lives in crevices and emerges in particular conditions. For that, you should take a look at:

• Go64: The free app from St. Clair Software, the makers of our favorite app, Default Folder X, provides details in a list form.
• Rosetta Check ($7): Turn to Rosetta Check for even more information about each unsupported app, which may be useful if you have a lot of software to work through updating.
• HoudahSpot: If you use HoudahSpot, you can construct a search.

A few companies that have Intel-only apps or components have explained their migration path, with PaperCut being an excellent example. Others without any financial incentive—such as hardware makers, who sometimes barely care about compatibility for software required to support their products—may wait until after the 2027 transition to wake up and make changes. This has happened many times before!

[Got a question for the column? You can email glenn@sixcolors.com or use /glenn in our subscriber-only Discord community.]

Back in April of this year, I suggested that the MailMaven email app for macOS might become my new best friend. Months later, with continuous minor and major improvements, the friendship has only grown richer. MailMaven 1.1 in April added POP support for those people who rely on the ancient email mailbox protocol. But MailMaven 1.2, out last week, packed more punch: fully realized AppleScript support coupled with the open standard Model Context Protocol (MCP) to allow large language model AIs to engage with MailMaven. Michael Tsai evaluated the AppleScript support and wrote that it is “really impressive.”

Support for MCP via AppleScript means that you can have AI agents communicate directly with MailMaven to improve spam detection, recognize important messages, collect order or financial information, or perform an infinite number of other tasks in which your incoming or outgoing email acts as the hub of knowledge. SmallCubed, the app’s developer, has created a basic MCP server for Claude as a working example. You can write AppleScript from scratch using its terse, thorough guide, or point a code chatbot at the page to write AppleScript for you. I currently have a few nightly scripts that collate book sales and archive the day’s email by digging into MailMaven’s database; I need to rewrite those to use AppleScript instead!

Go to the linked site.

Read on Six Colors.

Several years ago, Apple began hiding disk partitions and volumes on the startup drive. The first was a secret volume with a tiny operating system on it that would let you boot from it, after which you could restore from a Time Machine backup, run First Aid in Disk Utility, or reinstall Mac OS X or macOS. Over the years, Apple has multiplied those hidden locations and added more sophistication to what they offer.

These boot volumes are:

• recoveryOS: The current name and form of the special volume described above, which boots into the Recovery Assistant “app.” You can run Disk Utility (and First Aid), reinstall macOS, launch Safari to access Apple Support pages, modify startup security settings (rarely required these days), and access Terminal. With Terminal, you can reset your macOS password. If your Mac can’t start up properly, it will try to launch the Recovery process within recoveryOS, which performs automatic repairs that Apple doesn’t document. If successful, you can then restart into macOS.

• Fallback recoveryOS: If recoveryOS is damaged—and that can happen—you can press the power button twice, quickly, and then keep holding it the second time. This fallback recovery volume can’t change startup security, but it can help you diagnose what’s going on. This is the duct-tape belt that helps if your pants come unbuttoned (macOS won’t boot) and your suspenders break (regular recoveryOS fails).

• Repair Assistant: From a powered-down state, press the power button until you hear the startup chime, then press and hold Command-D. (On an Intel Mac, hold the D key at startup.) The Diagnostics app can run hardware tests that might help narrow down a problem before you bring in Apple Support, or they may ask you to boot into that mode and share the results of the tests they have you run. Repair Assistant can fail, too, if its volume is damaged. You may then have to perform a special “revive or restore” operation, which requires another Mac. Or you may need a full reinstall using a bootable macOS installer.

• macOS: macOS is a sort of hidden boot volume for the last several releases. You don’t boot from the system; instead, a read-only snapshot of the system is mounted, and then booted from. This is part of Apple making system resources immutable through cryptography and at startup.

Besides using recoveryOS for the above tasks, you might also need to use it to unlock your Mac after locking it in Find My and to reset your password using a FileVault Recovery Key. Here’s how.

Unlock your Mac

While it’s not a common scenario, it could happen to you: you accidentally leave your Mac somewhere, or it’s stolen. Thinking quickly, you launch Find My on another of your devices or go to iCloud.com/find and log in. You then tap or click a few buttons to lock your Mac. If the Mac is connected to the Internet, it restarts and locks immediately. (Despite promising to display the message you entered when you locked it, macOS does not do so.) If it’s not connected, it restarts the next time it has Internet access.

The account used to lock the Mac is the only one that can unlock it, and you must be in front of the Mac to perform that operation. Apple limits each Mac to having Find My enabled from a single account. Here are the steps:

1. When you see the macOS Recovery title, click the account profile below it. Enter the account’s password and click Continue.
2. If you entered it correctly, “Authentication succeeded” appears. Click Restart.
3. The Mac restarts and shows Activate Mac after it boots up. This time, all the active macOS accounts are shown. Click one, and then enter its password. Click Next.
4. You now can choose to either use your Apple Account or a macOS password to continue. If you opt for the Apple Account, enter the full address or phone number as shown. Then enter the account’s password. Otherwise, you can click to enter the Mac password, which Apple says is the last one used to unlock the Mac in a regular session before it was locked. If you’re the only user on the Mac, that’s easy to figure out. (In testing with Golden Gate public beta 2, I wasn’t able to get the Mac password option to work, and I’ve had it fail in Tahoe, too.) Sometimes neither works. Choose Restart from the Apple menu in that case and try again.
5. On a successful entry, the Mac restarts yet again after a one-minute countdown. Enter your password when prompted to start up into a regular session.
6. Apple Pay will have been disabled, and your iCloud sync will probably be paused as well. When prompted after the macOS session starts, enter your Apple Account password (or passwords if you have multiple accounts linked to your macOS account).

If you try this too often, as I did while testing, or for other security reasons only Apple knows, your Apple Account may be locked. At step 6, I was told I had to reset my Apple Account password from one of my other devices; all four linked to the account were shown. I made that change. In the Golden Gate second public beta, clicking Unlock Account did nothing before or after changing. I was able to click Cancel, complete step 4 again with the new Apple Account password, and proceed to step 5 and restart.¹

Years ago, when you locked your Mac, you had to set a passcode to unlock it. While that isn’t supported on M-series Macs or Intel Macs with the T2 Security Chip, the email Apple sends still shows an image of a screen where you would enter that code and says you can only unlock your Mac with that non-existent passcode.

Unlock via FileVault

If you try to log into your Mac and can’t recall the password or it isn’t accepted, you can use your FileVault Recovery Key to unlock the volume and reset your password. The Recovery Key is a long code that’s a last-ditch way to unlock your startup volume. It’s also a back-door way to help with a post-Find My lock operation if your password won’t work or you’ve forgotten it.

[I’ve described how to set up FileVault and how to deal with the Recovery Key in “FileVault on macOS Tahoe uses iCloud Keychain to store its Recovery Key” and “FileVault keys can’t be escrowed in iCloud anymore.”]

Here’s how to use your Recovery Key to unlock FileVault:

1. At the login prompt, click the ? icon to the right of Enter Password to bring up the Reset Password link. (This also appears if you enter your password incorrectly a few times.) Click Reset Password.
2. Your Mac restarts into Recovery Assistant using its Reset Password pathway. Enter your Recovery Key (see articles above). Click Next.
3. If you entered your Recovery Key correctly, you are prompted to enter a new password for the account you rebooted from, and confirm it. Do so.
4. When you restart, you can now enter the new password.

If you forgot or can’t enter a correct password for unlocking your Mac in step 1 in the previous section, you can click “Forgot all passwords?” This will launch the FileVault-based password reset, let you reset the password for that account, then proceed with unlocking.

For further reading

To learn a lot more about Find My locking and unlocking, consult my book Take Control of Find My and AirTags, which covers the whole ecosystem. For a lot of insight into iOS, iPadOS, and macOS security, including FileVault, check out Take Control of Securing Your Apple Devices.

Revisions of those two titles for the 27 series of operating systems are coming out soon. You can purchase either today and receive a free update to the new version when it’s out.

[Got a question for the column? You can email glenn@sixcolors.com or use /glenn in our subscriber-only Discord community.]

I dispense what might be called valuable insight to my friends, as well as in this public forum. My friends know the danger: they might become the topic of a column, which is true for my buddy Jeff, who left a bag containing his passport behind at a hotel. Fortunately, he had an AirTag in his bag. That was, however, just the beginning of the journey. (Jeff gave me permission to share his story.)¹

To avoid suspense, I’ll tell you that Jeff doesn’t have his bag back, but will soon.

Grate news

Jeff was out of town on business for a few days—he’s one of those nearly extinct creatures called a “full-time technology reporter“—and was carrying his passport to Texas not because it’s another country (it hasn’t seceded yet), but because he lacks a Real ID-upgraded driver’s license. He had a small bag with a few items, including the passport and an AirTag, that he didn’t need to carry, so he used the hotel safe. There have been many articles written about how unsafe hotel safes are, but it feels as if you’re in a decent hotel, it’s still another bar for someone to get through to steal your stuff.

Leaving in a bit of a rush, Jeff didn’t retrieve the bag from the safe. When he realized it wasn’t with him, thousands of miles later, he was peeved. Shouldn’t the “left behind” feature in Find My have alerted him? Find My showed the bag’s location, however. For some reason, it appeared as if it were in the hotel parking lot. I catastrophized with him, assuming it was stolen. He called the hotel, which said it wasn’t in lost and found.

A staff member went out, looked in the parking lot, and said the rough location was a grate—perhaps the bag had been stolen and someone had found the AirTag and dropped it through the slats? Which would imply that a hotel employee or a thief had managed to get into Jeff’s room after he left, open the safe, leave the hotel, and rummage through the bag in the parking lot before absconding.

That wasn’t the case (or valise). The hotel called back the next day. The previous staffer didn’t know, for some reason, that valuable left-behind items were tagged and placed in a safe in the basement, presumably below or near the parking lot. His bag, containing his passport and other items, would be sent back to him.

Jeff’s experience reveals several aspects of the Find My tracking system that you can take advantage of in advance or use if you’ve lost something or left it behind.

Don’t leave me!

Every device and item you have can be set to alert you when you “leave it behind.” I believe this setting is enabled by default, though Apple’s documentation isn’t clear on this point. All of my devices and items have it enabled, and Jeff found it was turned on for all his gear. Here’s how to check:

1. In a native Find My app, select the device (like a Mac) or an item (an AirTag or other Find My network item) in the list of such things.
2. On an iPhone, iPad, or Apple Watch, the action sheet appears. On a Mac, click the info (i) icon next to the item’s name on the map. In the upcoming version 27 operating system releases on all platforms, tap or click the More (…) button that appears when you select the device from the list.
3. Tap or click Notify When Left Behind, which should already show On. (In the 27 releases, tap or click When Left Behind.)
4. If disabled, turn it on.

Here’s a crucial detail: examine the “Notify me, except at” list. You can manually add to this set of locations (tap or click New Location). However, it primarily grows when you’re notified by an item or device being left behind, and then you tap or click in the notification to ignore it at that location. You are presented with the option to just exclude that item or device from that location or all of your equipment.

It’s very easy to approve that exclude-all button. (Jeff did not; his list didn’t include the hotel.) This can be convenient when you’re at a hotel, a friend’s house, or another location for a few days or frequently, and sometimes leave Find My-tracked stuff there. But once you ignore the location, you won’t get notified in the future. You can modify the list by hand, too.

Jeff may instead have been tripped up by the safe acting as a Faraday cage—a metal mesh or box that shields electromagnetic signals from passing through. The AirTag and other Find My items use Bluetooth to broadcast a rotating identifier at regular intervals.² If the safe blocked that signal, Jeff’s iPhone lost contact with the AirTag the moment the bag went in—a few days before he left. With no fresh separation between the phone and the item at departure time, the alert may have lacked the necessary trigger. Jeff was on the verge of sharing the location with the hotel when they found it.

Apple says this takes longer than the few days Jeff was on his trip: “You can see its last known location for up to seven days in the Find My app.” After seven days, the device or item’s location will appear as “No location found” or “Offline.” Jeff could see the item’s location, which made the lack of notification seem like a bug.

Now for the grate part (not great part): once Jeff’s bag was removed from the safe in his former room, it would have been carried through the hotel and detected by every iPhone, iPad, or Mac nearby. When it reached the hotel’s lost-and-found safe, the rough location would likely still be relatively close before it entered that particular Faraday cage. At which point, when Jeff looked at Find My, he saw it at (or under) the parking lot.

Sack attack

The hotel works with a service that handles the return. Jeff paid both a whopping and reasonable $60 to have it sent two-day air back to him. Fair enough! Unfair enough, days after he paid, the bag is still at the hotel (as I write this). Jeff will, of course, follow its progress via Find My.

[Got a question for the column? You can email glenn@sixcolors.com or use /glenn in our subscriber-only Discord community.]

I had a simple task that involved Apple Home. If you use Apple Home, you know what happened next. Tears, frustration, the arrival of batteries, paperclips pushed into hard-to-reach holes, many online searches, and—if you are lucky, as I was—success.

Siri, am I lazy?

My goal was straightforward: can I know if the garage door is open without going to look? Early in the pandemic, we occasionally forgot to close it. While there was a locked door between the garage and the house, it still felt like we were playing with fire, as someone could steal a bike or other lesser goodies from the garage.¹ The garage is on our basement floor (ground level on one half of the house), and the last thing I enjoy doing at night is walking downstairs before bed to check the door.²

I purchased an Eve Door & Window Contact Sensor to have this capability reported by Apple Home, joining a growing set of HomeKit devices, including our front-door deadbolt. Because of our old-style single-piece swing-up garage door, I had a heck of a time finding the right place and right adhesive to stick the sensor where it was close enough for the two components to register.

I spent enough time on the vagaries of physics and materials that I was probably more frustrated than I needed to be when I tried to make a workflow with the danged thing. An Automation wouldn’t work because I wanted an alert, not for the sensor to trigger other Home devices. A Shortcut should have worked, but after many hours of trying over weeks, I was unable to get anything reliable to happen. The Automation was quite simple: at 9 p.m., check the state of the sensor, and send me a message if the sensor shows Open rather than Closed. I left it in place and walked away for literally years.

After recently installing a back-driveway camera, I was determined to get this sensor online.³ First, I replaced the battery, which had died during my period of disinterest. The Eve sensor uses a weird, tiny battery: a 3.6V 1/2 AA (ER14250). After that arrived, using some better adhesive—thin-film 3M 468MP—I positioned the sensor pieces in a better location and more securely.

Now it should work! Except that after adding it, I saw Characteristic in red text on a pink background in Shortcuts. Some online research led me to reset the sensor by inserting a paperclip into a hole I hadn’t noticed. After re-pairing the sensor, I was in business! Or was I?! The sensor wasn’t responding, despite recent status updates.

Threading the sensor through the house needle

This led me to the next culprit: the garage is too far away (one floor and the other end of the house) from my Apple TV, which acts as a Matter controller, while the Eve sensor relies on Thread as its communication protocol. What’s a Matter controller?⁴ And what’s Thread?

Matter is an overarching standard, painstakingly developed even as low-power sensing devices and other equipment proliferated in silos. Matter enables Amazon Alexa, Apple Home, Google Home, and Samsung SmartThings devices to communicate across a network, regardless of the network transport medium (Ethernet, Thread, or Wi-Fi). This prevents you from needing ecosystem-specific hubs and lets manufacturers build to a common standard.

Thread fits into this mix as a low-power, wireless networking standard for sensors, allowing them to communicate their status without rapidly draining their batteries, as would happen with Wi-Fi.⁵ Apple initially supported Thread with a proprietary standard, HomeKit-over-Thread, and later added direct Matter support. The Eve sensor was just old enough that it was running on the older standard, but the Eve app allowed me to apply a firmware upgrade. I could then migrate the sensor to Matter, which seems to be more reliable.

Apple made things a little confusing here, too. The 1st-generation Apple TV 4K supports Matter, but lacks a Thread radio, so it can’t work with Thread-based devices. The 2nd generation added that radio, so you can do Matter over Thread. But then, with the 3rd generation, Apple bifurcated Thread hardware support: the 64 GB Wi-Fi only model lacks a Thread radio; you have to spend the now-whopping $249 for a 128 GB Wi-Fi + Ethernet version if you want to use Thread.

Failing an Apple TV 4K with Thread, you can use a Thread border router (TBR), which sometimes comes with sensor kits. This plugs into your network via Wi-Fi or Ethernet and bridges to the Thread network, allowing the Apple TV’s Matter controller to work with the Home app on your devices for automations, notifications, and so forth.

It’s that easy, folks. Sigh.

I do own a 3rd-generation Apple TV 4K with Wi-Fi + Ethernet, because I am a fancy man and a big spender, but I really wanted the reliability of plugging it into my Ethernet network. Yet, I couldn’t get the Eve sensor’s Thread radio to reach across my house to talk to the Apple TV. I bought a TBR, thinking it would solve the problem.

By the time the TBR was delivered, however, the garage door sensor magically connected via Thread to the Apple TV and has been rock solid. The TBR that arrived, on the other hand, I was unable to pair and get working, so back it goes for a refund.

Now my nightly Shortcut works! The only fly in that ointment is that the sensor status reports as Closed or Open in iOS and iPadOS, but as 0 (closed) or 1 (open) in the macOS Home app, in both macOS 26 and the beta of 27. I can live with running the Shortcut from my phone.

[Got a question for the column? You can email glenn@sixcolors.com or use /glenn in our subscriber-only Discord community.]

My beloved sister-in-law-in-law (my wife’s brother’s spouse) texted me with an important problem. Her mother had managed to delete the App Store from her Home Screen. How to restore it? While this is a common problem, I realized that the process is completely unintuitive.

For her mother’s particular situation, the answer felt like a cheat code for a video game: unlock, swipe left (once or more), search, touch and hold, drag. Done.

It’s worth a full review of how modern Home Screen management even works in iOS (and iPadOS), with the App Library view off some people’s radar entirely. Apple has, fortunately, not changed this process so far in the iOS 27/iPadOS 27 betas.

Delete or hide an app

I don’t use the term baroque lightly. However, Apple’s flowchart for choices you can make when deleting an app and what happens next has added some curlicues and ornamentation that can confuse the best of us.

It works like this:

First, touch and hold an app. That’s the easy part.

Now we fork into various swirls and pathways. Choose either Remove App or Require Face ID.

Remove App: You can pick from two options (or tap Cancel):

• Remove from Home Screen: The app’s icon disappears from your Home Screen page. However, it remains in the App Library, which I’ll describe below. More importantly, any data stored on your device remains accessible to the app. It’s like hiding, but not hiding!

• Delete App: Deleting an app removes the app from your device and its data stored on the device. This shouldn’t affect iCloud-synced data if you use the app on other platforms or other identical devices.

Require Face ID: Enabling Require Face ID hides content within the app from Spotlight results. You can add Hide to Require Face ID and also hide the app itself from Spotlight searches. Here are the two Face ID variations:

• Require Face ID: You can’t launch the app without using Face ID, separate from any authentication that may occur within an app for access to its data. You also can’t use data from the app in other apps without Face ID.

• Hide and Require Face ID: One step further, the app icon isn’t actually hidden! It remains in “obscured” fashion on the Home Screen, and appears in Hidden Apps in App Library. A hidden app that produces notifications, handles calls, or sends critical alerts has those suppressed as well. (Despite the statement that “This app will be obscured on your Home Screen,” it was simply removed for me.)

So, let me get this straight. If you remove the app from the Home Screen or Require Face ID, you can still search for it in Spotlight. If you delete it, it’s gone (though Spotlight may show it as a tap-to-download option from the App Store in results). If you Hide and Require Face ID, you can’t search for it or its contents, but you can find it in a Hidden folder in App Library. Got it, got it.

Despite the above, I have to throw in a big HOWEVER.¹ If the app is one of a few made by Apple and preinstalled, you can only remove it from the Home Screen. For instance, touch and hold Settings, Camera, Safari, and a few others, and then choose Remove App: only Remove from Home Screen appears; you can’t delete it, and you can’t use Hide and Require Face ID. Other Apple apps, like Stocks or Weather, may be freely tossed. Perfectly consistent and clear.

Since you now have perfect knowledge of all of these states and interactions, let’s look next at App Library, your Home Screen away from Home Screen.

Apple refused to call it Junk Drawer

I have used a succession of apps that I call, with affection, my “junk-drawer” apps. If you don’t have a drawer in your kitchen that is full of miscellaneous crap that you nonetheless occasionally or regularly need, but which has no place in any other drawer or organizational system, congratulations: you’ve just outed yourself as an extraterrestrial and Earth’s First Contact Committee is on its way.

For example, I throw in every piece of text, PDF, photo of receipt, file, and other detritus that I need to keep handy and email or a folder isn’t accessible enough. Then I can search within the app—convenient since everything is now OCR’d by default, so I can find any word or phrase across all media in the app.²

App Library is the equivalent of this, but just for apps. Do you find Spotlight too effusive in its results? Want to have an organizational scheme for apps you don’t have to set up or maintain? Swipe left until you get to the App Library page. You can scroll through pseudo-folders, from which you can tap to launch apps with full-size icons or tap groups of tiny icons to open the pseudo-folder categorizing those apps. You can also use the search field at the top to search only for apps, as opposed to using Spotlight. At the very bottom of the library is where you find Hidden, the not-exactly hidden set of Hide and Require Face ID apps.

To reverse previous choices from an app, App Library, or via Spotlight if the app is searchable:

• Find the app, touch and hold it, then drag it leftwards onto another Home Page page.
• For a Require Face ID app that’s not hidden, touch and hold it, validate with Face ID, then choose Don’t Require Face ID.
• For a hidden app, tap the Hidden folder, validate with Face ID, then touch and hold the app, and choose Don’t Require Face ID. This removes it from the Hidden folder.

If you deleted an app, you can search for its name in Spotlight, and you may see it in a list with a cloud download icon; you can tap that to restore it, but not its data, which you might be able to recall via logging into an account or it syncing with iCloud. You can also tap Search App Store in Spotlight. Or, launch App Store, search for the app’s name, and tap the cloud download button.

You can’t go Home Screen again

Reader Peter wrote in with a related question I can answer briefly: “No.” I’m sad about that, though. His question? He has a weirdly undeletable app—he can delete it, but it always reappears immediately and persists across migrations and devices. He wondered whether, after he triggered Settings: General: Transfer or Reset Phone: Reset: Reset Home Screen Layout, he could restore his painstakingly set-up Home Screen layouts.

If you have a suggestion, write me, or post in the Six Colors Discord, available to members. Discord is also where you can send a question for the column directly by using /glenn.

We live in a modern, jet-set, hyper-fast world! When we want to buy something online, boom, zoom, we use our fingerprint or face to approve the transaction, so we can grab the next Segway outta here! We don’t have time to enter a credit card! And can we trust a webpage form? Pfeh!

All right, calm down, 1950s inner voice, it’s not that bad. Most of our transactions involving a payment card or other sensitive data can be safely handled over a secure web connection. Apple Pay in Safari is the highest standard, of course, because the payment process involves encrypted elements, and your card number isn’t disclosed to the merchant. The Wallet app in iOS and the Wallet features in iPadOS and macOS further let us automate the entry of numbers and identifiers on pages we trust.

That’s all for automated commerce. What about other scenarios where you need to provide information to someone, often a friend or a local business, in order to transfer money or conduct a transaction? How can you be sure no one else is snooping in?

Make a call

Voice is still one of the most secure means of providing data. The landline wired and cellular wireless networks may be fertile ground for government agencies, but if you need to read a credit-card number or provide a PIN, a call is often the safest way to do so. By voice, you can always have the other person verify details that you believe only they know, or you can verify details to them for the same.

Because we live in a cyberpunk dystopian future, I do have to add a proviso. AI-generated voices have been convincing for a couple of years now—long enough that you shouldn’t trust an incoming call from someone you think you know, and certainly not from a bank, credit-card company, or other financial institution. I mean, I wrote “How To Avoid AI Voice Impersonation and Similar Scams” in January 2024! I assume the state-of-the-art scam is even better.

(The biggest takeaway is analog, too. Set a family password that you demand from a family member who calls asking for money or to do some weird phone or computer set of instructions.¹)

Unless recorded, voice calls also lack persistence, making them impossible to recover later. A real-time Bob needs to be either between Alice and Carol or doing an AI impression of Alice or Carol.

Use secure messaging

I could make the argument that using secure messaging carries even less risk than a voice call if you’ve had an ongoing messaging conversation with someone, so you know it’s really them. Are unsecured text messages being intercepted willy-nilly?² No, but there is also something about sending plain text all over the cellular networks that gives me the willies, nillies aside.

Secure messaging systems include:

• iMessage: While iMessage has seen exploits, they’re government-grade ones. Its secure end-to-end infrastructure is creaky, but unbroken. There’s an extra detail I’ll mention below.
• RCS with encryption: Between Apple Messages on iOS 26.5 or later and an Android device with RCS encryption support, you have a similar level of end-to-end protection. Make sure you see RCS encryption in the text field, or it’s just plain text. You can also use RCS encryption between two capable Android devices—as if!
• Signal: The Signal app and ecosystem have the best end-to-end encryption, as it implements some of the most modern approaches to protecting older messages and current conversations available so far.

The extra note on iMessage is complicated. Briefly, if you use Messages in iCloud, an encryption key to retrieve those messages is included in an iCloud-based iPhone or iPad backup. With access to your Apple Account, someone could potentially retrieve your stored messages. However, if you enable iCloud’s Advanced Data Protection, the backup is encrypted and requires endpoint decryption using one of your devices, protecting the Messages in iCloud encryption key. This should be a worry only if someone manages to obtain your Apple Account, can activate a second factor, and the information you passed via Messages is so sensitive that someone would hunt to uncover it.

Avoid using SMS or MMS text messages (unencrypted plain text), unencrypted RCS (in-transit/at-rest encryption), or other messaging systems where you’re not sure how they handle data protection. WhatsApp can be used if you either have backups disabled or have enabled end-to-end encrypted backups.

Don’t use most collaborative tools

I know that I spend a lot of time in shared documents, whether Google Docs, Notes, Pages, or more esoteric apps or web apps. Most lack the highest level of protection. Shared Pages and Numbers files on iCloud Drive, as well as Google Docs, are encrypted in transit and at rest, and granting shared access is relatively easy (very easy in Google Docs). For iCloud Drive documents, this is true even with Advanced Data Protection enabled.

I’d be dubious about pasting my driver’s license or credit-card information into any of them that are shared with someone else. Ditto, don’t take a picture of your payment card or driver’s license and share it via a Shared Album in Photos, as it has the same issue.

There are two notable (heh) exceptions: if you and the other party or parties to a shared Notes entry or an iCloud Shared Photo Library all have Advanced Data Protection enabled, end-to-end encryption is used.

Consider the risk

As with all decisions around privacy, consider how at risk you and your data are, including voice as data. In most cases, ensuring a baseline level of encryption can be enough. Even when the app or server can “see” your unscrambled information, the transport between your device and the server and another person’s device is encrypted. Someone would have to break into the server to sniff data. If stored on the server, the baseline state would be encrypted at rest; however, the server operator would manage those encryption keys.

For peace of mind, if not strictly necessary, I’d encourage you to consider using end-to-end encryption when you can. It’s so easily available. For someone to crack your connection, they would need to obtain one of your devices and be able to unlock it. Otherwise, the path between you and someone else is effectively impregnable.

For further reading

I cover message security extensively in my book Take Control of FaceTime and Messages, which I recently updated to include the beta release of RCS encryption for Apple-to-Android communication.

For more on Wallet, I wrote an entire book on that seemingly simple app and set of features, Take Control of Apple Wallet. The book arose from the frustrations of finding where things in Wallet (and outside Wallet but related to it) lived.

On the security side of things, Take Control of Securing Your Apple Devices includes detailed advice on the ins and outs of physical security: how to ensure someone with access to your hardware can’t reach your data.

[Got a question for the column? You can email glenn@sixcolors.com or use /glenn in our subscriber-only Discord community.]

Years ago, in the era between the introduction of the iPhone and the modern period of widespread cellular coverage, my wife and I were driving with our quite young children across the vast, unexplored expanse of north-central Pennsylvania, en route to a family wedding. We had plotted out the route and knew where we were going: Eagles Mere, a tiny, former luxury resort town once at the end of a railway line. The town used to attract well-known actors, as well as New York City denizens, who would escape the summer heat and polio outbreaks back in the city.

As we tootled along, chatting with the kids and keeping them occupied, we suddenly went off the grid. We were still on a state highway, not yet turned to a smaller road, and yet there was no coverage. We figuratively slapped ourselves in the head. Had we gotten AAA maps or printed out whatever the technology was of the day—did MapQuest even still exist? No. We relied on having continuous cellular service. Readers, we did not wind up in the forest for a week, discovered by rescuers clad in bark and branches, feeding the children non-toxic berries. But we did learn a lesson.

Always have a map that doesn’t require cellular access! I mean, duh, of course, but we had been lulled in our coastal urban elitism to expect service, service, everywhere!

Of course, it wasn’t long after that Google introduced a download option; Apple added one for its Maps app a full decade later.¹ Downloading a map lets you access nearly everything you need while off the cellular grid, in an area where you don’t have service, when you have just a trickle of data, or when data access is metered and high-cost.

The usual provisos apply: something could go wrong, you might not have access to your iPhone or iPad, the map might be missing details you need, and so on. If you want a belt to go with your suspenders, consider printing out a paper map! Yes, paper still exists.

Common offline features

In both Google and Apple’s mapping apps—say that five times fast—a Download button should appear whenever you search by a name, like a park, business, or city. Otherwise, you have to hunt a bit, as I’ll explain below. Downloadable maps may require from about 150 MB to over 1 GB of storage, depending on the area you select and the amount of detail Apple or Google downloads for that selection.

The settings for both apps are quite similar: tap your profile picture in either app, then tap Offline Maps; in Google Maps, tap the gear icon. Now you can change preferences:

• Downloads (Apple)/Download preferences (Google): Opt whether to download only over Wi-Fi or over both Wi-Fi and cellular.
• Automatic Updates (Apple)/Auto-update offline maps (Google): When enabled, maps are periodically refreshed.
• Optimize Storage (Apple): The app automatically purges maps you haven’t used “in a while.”
• Sync with Apple Watch (iPhone only): You can also push offline maps to your Apple Watch, which has a lot less storage, but, really, how much are you keeping on it, anyway?
• Only Use Offline Maps (Apple): This forces the use of offline maps even when you have an Internet connection, which is useful when you are in one of the bandwidth scenarios above: low throughput or expensive usage-based service. Google automatically switches to an offline map when there’s low throughput available, or you have no connection.

Download from Apple Maps

If you search for a city name and there’s an exact best result, a Download button appears in the search result. I’ve also found that if Maps isn’t certain the match is correct, you may have to tap the city link, and then a Download button will appear. Enter a business name, tap the link that corresponds to the firm you want, and you can then tap the more (…) icon and choose Download Map. This also works for street addresses.

In all of the above cases, Maps shows you a portrait selection by default on an iPhone and a landscape one on an iPad. Adjust the area shape, and pinch and expand to zoom in or out, then tap Download. The estimated map download size appears above the Cancel and Download buttons.

Manage your offline data by tapping your profile picture and tapping Offline Maps. You’ll see all the stored maps, can delete them, and control settings. Tap a map, and you can then tap Rename, change the included area, or tap Delete Map. In the main Offline Maps view, tap Download New Map (iOS/iPadOS 26) or Add Offline Map (iOS/iPadOS 27) to search for a location and then immediately have the area-selection view appear.

Download from Google Maps

Search for a city name and tap a result. You may have to swipe left in the button bar to see the “Download offline map” link; tap it. If you’re viewing a map, tap your profile picture, then tap “Offline maps.” Tap “Select your own map,” then zoom in or out on the current map area; tap Download when you have the selection you want.

From your profile picture, tap “Offline maps” to view the list of available maps. Tap a map and tap Delete or Update, or tap the Edit (pencil) icon to rename it. From the main view, you can also tap the More (…) button to the right of a map to update, rename, or delete. You can’t change the selected area, however.

Print a goldarned map out

Having a physical map may seem like something from the early 2000s, so long ago few living souls remember it, but it’s an extra backup against calamity. With a color inkjet printer, you can squeeze a fair amount of detail into a letter-sized or A4 page.

Printing directions via Apple Maps in macOS Tahoe worked surprisingly well. It was like the good old days, but better, offering multiple pages of maps and step-by-step directions. You just get a standard print dialog, with no details to tweak. Google Maps on maps.google.com has a print mode, but it’s lackluster, with no step-by-step directions. In Safari, the preview and printed output were incorrect.

Postscript: Where she’s going, there are no Offline Maps

Of course, right after I wrote this, my older went off on a hike and came back…complaining about the poor performance of Offline Maps in Apple Maps. She was in a not-terribly-remote area in the mountains, about 90 minutes away, with intermittent cellular access. She had downloaded the map before she left, thinking it was successful. But even with no cell access or with the Offline Maps forced-use option enabled, she couldn’t get the offline map to work. Fortunately, the trail was well-signed and full of people, and there was no real chance of getting lost.

Back in Seattle, examining Offline Maps, these out-of-area maps she downloaded showed up as 0 KB. We tried to download the map again, but Apple Maps wouldn’t let us use the trailhead as a landmark. We found a nearby place and tried to download. The progress circle showed that a download was first underway, then complete, yet the download was again 0 KB. This happened repeatedly. More bizarrely, the offline map couldn’t be deleted. I attempted to replicate on my iPhone, where everything worked without error, including using the trailhead as the place name—a Download button appeared as expected.

We didn’t test Google Maps for comparison, since her hike was over, but it’s another reason to download and check that your offline maps are up to date and valid before departing.

[Got a question for the column? You can email glenn@sixcolors.com or use /glenn in our subscriber-only Discord community.]

I have a Mac Studio M2 Max with 32 GB of RAM and a 1 TB SSD in front of me. While not the most powerful personal computer you can purchase today, it is among the most computationally capable ever made—a vastly capable machine. So why do I have to wait for typing to catch up with me and see a rainbow spinner on the regular?

I’ll tell you why: iCloud Drive and Spotlight. Apple lacks any transparency about how iCloud Drive works or fails. The same is true of Spotlight. These big black boxes churn away, performing a million billion operations a day, and we don’t know exactly what they do. That’s not me being conspiratorial: I honestly don’t care what’s happening under the hood—until it breaks. Without diagnostic tools, even someone like me, ostensibly an expert, can be completely at a loss and waste many hours.

I wrote “Cloudy with a Chance of Insanity: Unsticking iCloud Drive” for TidBITS back in October 2023 about a multi-month odyssey with Apple technical support in trying to dislodge unsyncable files.¹ That problem has barely surfaced since—an 80K file will sometimes get stuck for a while—and I thought Apple might have really solved syncing, at least as exhibited on my Mac. I receive dramatically fewer emails about iCloud Drive than I used to, which is another data point.

But Mr. Edge Case here can always find a way to break something.² I’ve been working on a large manuscript for my upcoming book, Flong Time, No See, a revised and expanded collection of researched articles I’ve written about printing and type history over the last several years.³ I pasted in text that was typically copied from Web pages, and wound up with over 250 footnotes.

While putting together the files for this book, Apple released its Creator Studio system, and shipped Pages 15. After having no problems, I dutifully switched over. This was months ago, and as I continued to work on this reasonably large file—weighing it at about 60,000 words now—everything seemed fine.

A few weeks ago, however, I started to experience system slowdowns. Pages was taking up 12 GB of system memory! System load went through the roof! CPU consumption was outlandish! All signs pointed to corespotlightd, a long-time enemy of performance. That daemon handles background indexing for Spotlight, and the slightest thing wrong in a file or directory, or perhaps due to mild corruption in its underlying files, turns it into a rampaging beast that eats processor cycles like I consume potato chips.⁴

There’s a well-known procedure for killing this beast, though another is spawned from its remains: stop the index, delete the index files, restart, and re-enable indexing. From the Terminal, use these commands. Make a backup before proceeding. Take extreme care with rm -rf, as a misstep in entering or copying can wipe out files!

 sudo mdutil -a -i off
 rm -rf ~/Library/Metadata/CoreSpotlight

You can use Restart from the Apple Menu while holding down the Option key (to avoid being asked), or you can take a shortcut from Terminal, assuming you have ensured all files are saved:

 sudo reboot

After your Mac restarts, go back to the Terminal and re-enable indexing:

 sudo mdutil -a -i on

For many (perhaps most) people, this solves the problem. For me, it just delayed it. With some isolation using System Settings: Spotlight: Search Privacy, I added specific folders, such as mail archives, since that seemed like it might be part of the problem.

One piece of advice I found suggested that if I thought Pages was the problem, I should exclude the iCloud Drive path containing Pages files. Fine! I clicked the plus icon in Search Privacy, pressed Command-Shift-G to bring up the path dialog, entered ~/Library/Mobile Documents/com~apple~Pages/, and clicked Choose. This seemed to work for a while, then nothing availed.

Finally, after analyzing logs and caches, the culprit was clear. It was not that large a Pages file: every time I saved, Spotlight’s worker bee was performing excessive re-indexing that consumed gigabytes and one or more processor cores. Moving the file to a local directory (in my Documents folder) while editing eliminated the problem. It also freed up space, as the temporary Spotlight indexes and Time Machine snapshots had become absurdly large.

What could Apple have done to help here? This is where I would hope machine learning, coupled with some interactive code- and system-expertise bots, could help:

• Note that a system component is acting well outside known parameters.
• Identify CPU usage that is tied to Apple-owned processes.
• Provide a troubleshooting tool, even suggesting it in notifications.
• Create human-readable logs that don’t require system administrator knowledge to interpret.

In the case I describe above, an Apple-created daemon was rampaging out of control due to a single identifiable file!—cascading into other problems. It should be solvable by Apple. The fact that we have more power under the hood by orders of magnitude in the past, coupled with neural cores in the CPU packages, just makes this even more embarrassing. Solve Siri, Apple, yes, but real transparency and troubleshooting in macOS would also make a big difference.

[Got a question for the column? You can email glenn@sixcolors.com or use /glenn in our subscriber-only Discord community.]

Adam Engst at TidBITS took the time to extract every item on the WWDC 2026 keynote slide that captured our attention last week. Even better, Adam grouped the changes into operating systems, apps, and other categories. While the 27 OSes dominate the list with improvements and revisions, you can also note how many changes Apple is making to Photos and Shared Albums, Find My, Music, and a number of other across-the-ecosystem tools.

Then Marcin Wichary used Adam’s post to slice the data in a different way, counting the number of times the slide used words like fast (59 times) and reliable (22 times). Marcin reasonably argues that speed is the easier problem to attack, while reliability is fuzzier and much harder to pin down.

Go to the linked site.

Read on Six Colors.

Apple’s pattern of updates is often described as two beats, maybe like the lub-dub sound of your heart: a year of big changes, followed by a year of tweaks that feature just a couple of marquee improvements.¹ The 27 series of operating systems marks a big dub year, but there’s a backbeat to the rhythm, too, as Apple retreats from what most of us believe were overreaches in the interface department.

Liquid Glass was not beloved. I didn’t mind it so much on the Mac, and I found some iPhone and iPad improvements worthwhile, and the rest tolerable. Some people hated it. John Gruber notably decided to hold off on updating his primary Mac to Tahoe. Apple ironically highlighted a slider in its WWDC keynote that one could describe as “mostly forget about Liquid Glass,” with an option from “full-on, nobody wanted this” to “as close to zero as we can go without breaking the interface.” Good.

Stacey Ford, Apple’s Vice President of OS Program Management, called out a broad mandate in the keynote. “We scoured every part of the OS for opportunities to refine our systems from the UI to the foundations,” she said. “Nothing was off limits, no enhancement too small.” In other words, there are no sacred cows leftover from the design team that left, and maybe Ford and her group hate the same things that we do, and they’ve been given the authority to fix them.

Maybe as a consequence, Liquid Glass will improve legibility through several changes, which you’ll see even with the slider set to zero. The layers of Liquid Glass elements will now be rendered so that the diffusion of the underlying material won’t interfere as much with legibility. When content moves beneath a floating bar, the bar will now—shocking!—float on top and increase contrast to keep its contents comprehensible, too. Edges will now be darker, and icons sharper.

Gruber despised a secondary macOS change perhaps as much as Liquid Glass: the tiny icons on drop-down menus that were unhelpful, patronizing, and inconsistent across apps. Those are effectively gone now, with new guidance from Apple that is nearly contemptuous of the one-year glitch in the approach.

A lot of digital ink was also spilled about corner radii, dragging, and consistency with macOS 26. So much so that Apple’s Shubham Kedia—Director, Human Interface—said in the keynote this remarkable phrase: “…every window on macOS now has the same tighter corner radius ensuring greater consistency across all of your apps, even if they haven’t been updated.” It’s the weirdest time in the company’s history that an Apple leader had to utter those words, but there you go, and there was mostly rejoicing. The lower-right-corner drag area appears fixed, too, in my testing with the first beta.

Tahoe’s other missteps that will be drawn back to the norm include ending the weirdly inset sidebars, such as in Photos, which now extend to the edges; the mouse-over hand cursor has mostly reverted to pre-Tahoe format, with slightly different finger positions, and indications that it’s a Mickey Mouse-style glove; and even the default wallpaper has rolled backwards, with iOS, iPadOS, and macOS all having access to the same set, if that’s the kind of thing you like.

More generally, I heard grumblings and read long essays about the instability people experienced with Tahoe, and still do, even though we’re at version 26.5. Often, the “tweak” year involves thousands of under-the-hood fixes. Apple was more frank about making things better this year than it has been since, I want to say, the year after Yosemite.² It would be like Microsoft making fun of blue screens of death.

Apple’s Ford said, “We made things faster, smoother, even easier to use, and we took care of a bunch of things you’ve been asking about.” She later described speed improvements in iOS and iPadOS app launch times, a fix for a long-running Wi-Fi/cellular poor handoff issue, a complete overhaul of Spotlight, and much more. She noted, “We’ve all had that moment where you search for something you know is there, but it just won’t show up. So on iOS, iPadOS, and macOS, we’ve rebuilt the foundation of search that powers Spotlight, Photos, and Mail.” That is a heck of an admission of the truth we experience day to day—almost un-Apple-like.

There’s more I won’t enumerate in detail, such as the “OS improvements” section that appears on Apple’s sites for iOS, iPadOS, and macOS, in which Apple confesses to imperfections and proclaims it has solved them. Because all iPhones, most iPads,³ a few Apple Watches,⁴ and all M-series Macs (but no Intel Macs) that could run version 26 can run 27, no harm, no foul, right? Just took a year.

These rollbacks and improvements may finally push people like Gruber to, er, cross the Golden Gate in a way that they could never bring themselves to plunge into the imperfect, quirky, and irritating waters of Tahoe. Because of how Apple pushes users to upgrade, I expect that iPhone and iPad users may find more relief, as they’re running the current release!

For further reading (and writing)

My summer’s work will include a lot of reading to write updates for around 10 Take Control Books titles. I’ll also be working to keep a new micro-site, currently called Apple Specs, up to date, where you can look up operating system and hardware features to figure out which devices and releases support them. I welcome feedback via a link on each page of the site.

Apple’s built-in screen sharing support for Mac-to-Mac connections has always been a help for those of us with remote setups: headless Macs acting as servers, an office and home Mac, or the laziness of having Macs in different parts of your house you want to access without standing up.¹

Under the hood, Apple relies on VNC (Virtual Network Computing), a fairly ancient standard at this point in time, and you probably get the sense of its creaking joints if you use the Screen Sharing app regularly.² But it’s possible you didn’t know that, starting in Sonoma, Apple added a “super excellent” mode to Screen Sharing as an option when you connect two Macs with M-series chips. Called High Performance, it can deliver on its name.

Let’s shift into overdrive

When you connect to another Mac using Screen Sharing, you’re given a choice of which mode to use. Let’s walk through the connection steps:

1. Either launch the Screen Sharing app and double-click the Mac’s name in a list, or, in the Finder, Control-click/right-click the Mac’s name and choose Screen Sharing. (There are still more ways to start, too.)
2. From the Select Screen Sharing Type options, you can select Standard, which is VNC-based, or High Performance, which adds Apple’s secret sauce on top.
3. Click Continue.
4. Enter your credentials.
5. The screen appears, and you may need to enter your macOS account password on the remote Mac to unlock it.

In that pathway, if you choose High Performance, you’re presented with different options. You can also click the info (i) button to the right of an existing connection in the Connections window in Screen Sharing, and choose High Performance from the Screen Sharing Type pop-up menu to save that option for the next connection.

With a Standard connection, you get a pixel-for-pixel remote view of the other Mac’s display or displays. It’s just like you’re sitting in front of it. In fact, if you use the same account as the currently logged-in user, the remote Mac shows what you’re doing to anyone who looks at it. (You can log in as another user, and a session starts in the background that doesn’t appear on the remote display screen.)

High Performance takes a different approach. You can opt to create one or two virtual displays on the remote Mac, each with independent resolution, high-dynamic-range (HDR) support, and other features. It’s like being a remote user of the computer rather than sharing. (This mode doesn’t change the remote display resolution or other settings.)

With a High Performance connection between Apple silicon Macs, you gain these advantages:

• You can choose one or two virtual displays, regardless of the number of displays connected to the shared computer.
• The Dynamic Resolution option lets you resize a virtual display to the native resolution of your local screen, up to 4K (3840×2160 pixels) or, with HiDPI, up to 1920×1080. You can click the Dynamic button on the Screen Sharing toolbar or choose View: Dynamic Resolution during a live session.
• Stereo audio passes over the connection, as does improved video. The connection supports HDR (for richer low-light and shadow tones), 4:4:4 chroma subsampling (uncompressed color data for improved fidelity), and high frame rates of 30 or 60 frames per second (for more stable video streaming, such as when watching a video or using video-editing software).

The downside of High Performance is that it imposes severe requirements for it to work well. You need 75 Mbps per 4K display and low network latency, which requires fast Wi-Fi with a gigabit-or-faster mesh or wired backbone if there are multiple network routers or base stations. However, that requirement also means that when you’re using High Performance, it feels very much like sitting in front of the other display rather than viewing it remotely.

If you want the depth of HDR Video, you have to enable it on the remote Mac via System Settings: Displays. The option for HDR Video appears in a Preset pop-up menu, but, of course, only if the display supports the right HDR signal. HDR can be enabled or disabled from the View menu and Screen Sharing toolbar, if it’s available.

Because the remote display is blacked out when using High Performance (even when connecting as the currently logged-in user), this can be seen as a privacy advantage if you have concerns about anyone else viewing the remote Mac’s screen. However, High Performance mode’s utility really lies in treating Screen Sharing like a high-speed display tunnel instead of a jerky remote view.

For further reading

If you’re looking for more detailed information about High Performance mode or any aspect of Mac-based file and screen sharing, you might consult my book, Take Control of Apple Screen and File Sharing.

[Got a question for the column? You can email glenn@sixcolors.com or use /glenn in our subscriber-only Discord community.]