Malwarebytes:

If you’ve encountered websites in maintenance mode today, it may be a security precaution. Reports of attacks targeting two critical PHP vulnerabilities have prompted warnings to install emergency updates and consider temporarily taking affected services offline until they can be patched.

[…]

Successful exploitation could let an attacker run malicious code on an affected server without logging in. That code would run with the permissions available to the PHP process, potentially allowing attackers to steal application data, alter website content, or establish a backdoor.

[…]

The PHP team scheduled its emergency security updates for October 21 at 10:00 am ET (14:00 UTC). It has now released fixes in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, and urges users to update immediately. Administrators should check with their hosting provider or operating system vendor for the appropriate updated packages.

Adam Engst:

Expect to see numerous websites go down or serve “Page not found” errors as they update PHP, the programming language that underpins 70% of websites. If you run a WordPress, Drupal, or Joomla site, this affects you directly.

Nick Heer:

Word on the street is that these exploits have leaked, and that remote code can likely be executed all the way back to PHP 5. If you have access to your website’s php.ini file, it might be worth turning off multipart uploads for now.

Vincent Schmalbach:

Two changes reduce the risk until the fixed versions are out. They were checked against PHP’s source code and the PHP manual, but they are not an official PHP mitigation. When someone suggested that turning off session upload progress might be enough, PHP core developer Gina Peter Banyard replied, “The only thing I can say is that the only mitigation is patching / upgrading PHP. I sadly know too much.” Use the stopgaps to lower the risk for a few hours, and update PHP as soon as the fixed builds exist.

Add to php.ini:

session.upload_progress.enabled = Off

Add to .htaccess:

<If "req('Content-Type') =~ /multipart/i">
    Require all denied
</If>

Guido Fawkes:

Ofcom boss Dame Melanie Dawes has admitted today that tech firms have paid just two of the eleven fines handed out under the Online Safety Act since March last year. Giving evidence to the Culture, Media and Sport Committee, she conceded nine remain unpaid, four of the offending sites have simply geo-blocked the UK, and three are still up and running with nothing changed.

Via Preston Byrne (Hacker News):

American courts have, by now, provided their preliminary view on the likelihood of Ofcom’s enforcement powers being successful in U.S. courts – the obiter dicta in 4chan v. Ofcom, the opinion in the case we filed against Ofcom in the federal District Court for the District of Columbia a little over a year ago.

[…]

Ofcom can’t enforce the Online Safety Act in America. Ofcom knows it, Ofcom has known it for a long time, and now, Ofcom has, finally, admitted it.

[…]

The GRANITE Act, a foreign censorship shield now before both the House and Senate (H.R. 10174 / S. 5478), is one proposed legal response America could adopt. The HOMEFRONT Act, H.R. 10309, is another. Either of GRANITE or HOMEFRONT would strip sovereign immunity from foreign censors and let Americans targeted by their orders drag those agencies into federal court, where they could be held accountable for their actions.

Previously:

• UK Child Protections and Messaging Backdoor
• Imgur Blocks UK Users Over Age Verification
• UK Online Safety Act
• UK Proposal to Weaken Messaging Security

Sean Allen (via Rebecca Sloane):

iOS dev course sales plummeted due to AI. It costs a lot of money to host my courses online and with sales at basically $0, I’ve cancelled that hosting.

This closes down the site which unfortunately removes access to the courses.

[…]

I’ve put my recent course on sale at a large discount so you can get it before it’s gone and I’ve made old courses available for free if you want to grab those too.

The school will be online until November 24th so you have a few weeks to download these videos at seanallen.teachable.com.

Teddy Svoronos (Hacker News):

As of iPadOS 27, if you have multiple windows open while AirPlaying (whether or not Stage Manager is on), tapping on anything other than the presenting app will snap the external display into showing your whole iPad screen. This means that my students see all my notes on who I want to call on, or poll results that should be hidden from them. They also get distracted from what we’re learning by all these jarring windows popping up and disappearing. If you’re presenting at a big conference, it’s extremely embarrassing.

[…]

As for what the behavior should be, I’m not a developer, but here’s a proposal: if you’re using an app that is in presenter mode (e.g., PowerPoint playing a presentation, or a GoodNotes document open), it should always get precedence on the external display, until that presentation gets stopped, the document is closed, or the app is quit.

Previously:

• iPadOS 27

Howard Oakley:

Now move the pointer to the right edge of the list of folder contents, just far enough to the left to avoid moving the window divider, but not so far as to fully select items from within that folder. Click there and the item will be selected, but in grey, the same as would appear if it had been fully selected but its window was no longer in focus. At this stage, the original folder will still be fully highlighted, as if nothing had been selected inside it, but you can drag that grey unfocussed selection to include other items inside the folder.

On my Mac, if I click on a file icon in the second column, the first column retains focus. The second column only gets focus if I click on a filename (or even farther to the right).

Now using the up and down arrow keys doesn’t move within the items inside that folder, but back with the fully highlighted folder. With a few of the items inside that folder in grey, so they’re selected but not in focus, press the spacebar for a QuickLook preview, and you’ll see the greyed items, not the folder that’s still fully selected to the left.

[…]

In other situations, this becomes infuriating.

In my log browser LogUI, separation of selection from focus can leave you clicking wildly without being able to select log entries.

Previously:

• Tahoe Broke Resizing Finder Column View
• Viewing Metadata in the Finder
• Mojave Finder’s Preview Column Shouldn’t Prioritize Thumbnail Size

Update (2026-10-21): Philip Savoulidis:

I too was wondering if there was something peculiar with my Mac. Focus seems so broken in Golden Gate that I was expecting macOS reviews to mention it. In this regard, I am glad to see focus problems mentioned here.

The behaviour seems inconsistent. For example, in Finder and Mail the sidebar does not gain focus on click, but it does in Contacts and NetNewsWire (a third-party app). The Passwords app seems like the worst offender: the password list itself does not gain focus on click (e.g. click the search field then click an item and focus remains in the search field).

I spent some time investigating this, and I think it comes down to a SwiftUI bug. List and Table in SwiftUI are affected. Both use NSTableView under the hood, but they never become first responder on click.

But I don’t think NSBrowser is built on SwiftUI, so there are probably multiple issues here.

Artem Novichkov (via Fatbobman):

Xcode also ships two command-line tools for the new format:

• xcprojformatter came with the format in beta 2. It’s a formatter for project files, like swift-format for code: it checks that a project.xcproj file is valid and rewrites it with sorted keys and consistent layout.
• xcodeproj arrived in beta 3. It reads and edits projects from the terminal: targets, build phases, groups, build settings, xcconfig files, and Swift packages.

Neither is on your PATH, so run them with xcrun.

Previously:

• Xcode’s New .xcproj Files Are JSON

Seth Willits (2024, bug):

There’s a deprecation warning in Xcode for URL.path that reads:

WARNING: path will be deprecated in a future version of macOS: Use path(percentEncoded:) instead

The problem is something like this:

Bundle.main.url(forAuxiliaryExecutable: "tool")!.path

… which returns the expected file path (ex: /Applications/MyApp.app/Contents/tool)

would be quickly rewritten as suggested to:

Bundle.main.url(forAuxiliaryExecutable: "tool")!.path(percentEncoded: false)

… which simply returns tool, because the URL returned is relative to a base URL.

[…]

I’ve always found it not-completely-obvious to newcomers how to get a standard file path string from a file URL and this only makes it more confusing.

There are at least three issues here:

1. url.path returns an absolute path, but url.path(percentEncoded: false) returned a relative path as of his writing. I tested this on macOS 26, and now it returns an absolute path. The documentation now says, “This function will resolve against the base URL.” It seems the behavior of the method changed without it being documented when, so be careful if you’re deploying to a mix of OS versions.

2. percentEncoded has a default value of true, whereas path did not return an encoded string. In other words, url.path() and url.path are completely different. So this is another case where Apple updated the API but flipped the default—a good way to introduce bugs.

3. It’s not obvious how to get the full file system path out of a URL. With NSURL, url.path was natural and did the right thing. Now, the URL equivalent is deprecated.

   The natural replacement, url.path(), is wrong. So is Xcode’s recommendation of url.(percentEncoded: false).

   url.absoluteURL.path(percentEncoded: false) is correct but verbose.

   url.absoluteURL.standardizedFileURL.path(percentEncoded: false) is possibly better but even more verbose.

   FilePath(url)?.string uses a newer API but gives you an optional, even though for a file URL it should never fail.

   This seems like such basic functionality, but there’s no API that’s the obvious right choice, concise, and ergonomic.

Previously:

• The Switch From File Paths to URLs
• Swift URL Improvements at WWDC 2022
• Proposed Foundation URL Improvements
• URL Path Retrieval Cheat Sheet
• NSURL Path Handling

Giovanni Colantonio:

Seven years later, Apple Arcade hasn’t gone anywhere, and Apple itself hasn’t slowed its broader gaming efforts either. Between courting major publishers like Capcom to release their games on Mac to launching a proper gaming app, it’s clear that Apple still has its sights set on being a major player.

The latest example of that came this week as Apple launched an App Store event dubbed Indie Games Week. The week-long initiative saw Apple welcoming games like Vampire Crawlers to iOS and announcing an ambitious mobile version of No Man’s Sky. At the center of that push was Carson Oliver, the new head of App Store Worldwide following Phil Schiller’s sudden departure from the role this past August. The fact that one of his first acts in the role was spearheading an indie gaming showcase hints at where Oliver’s priorities might lie.

[…]

While Oliver sells the narrative with carefully worded precision, questions still linger around Apple’s wider gaming efforts. Continued investment in mixed reality gaming is uncertain given that Apple has reportedly cut down production of its Vision Pro headset due to underwhelming sales. And though Apple continues to court publishers and get games on iOS, we haven’t seen the full-throated support from major players like Capcom and Ubisoft in 2026 that was crucial to raising Apple’s gaming profile in 2023.

Previously:

• Apple TV 4K 2026
• App Store Moves From Phil Schiller to Eddy Cue
• Apple Games App
• Testimony on External Purchase Fee and Scare Screens
• App Store Business Reorg
• Monument Valley 3 in Netflix Games
• Inside Apple Arcade
• Hearing for Apple Violating Epic’s Injunction
• Apple Arcade’s Uncertain Future
• Apple’s Mac Gaming Push

Brent Simmons:

We’ve released NetNewsWire 7.2 for Mac with a new column view layout: choose View > Use Column Layout to switch.

I really missed this feature from the old NetNewsWire, so I was happy to see its return. Now that I’m using it, I have mixed feelings. I love the columns, how I can scan the titles without the feed names and dates getting in the way. But some titles aren’t very informative, so I miss how the iOS-style view shows a little preview of the article’s body. I wish I could see that, either appended after the title itself or in a second line below it.

We’ve also added a second long-requested feature: you can now hide unread counts or replace them with a •, so you don’t have to deal with the anxiety of an ever-increasing unread count and the feeling like you have to get caught up.

Here are the other changes.

Previously:

• NetNewsWire 7.1

DropDMG 3.7.2 is a maintenance update of my app for disk images and archives.

• It still works back to macOS 10.13, but this will probably be the last such release. There’s no reason the code can’t continue to run there, but soon I will be switching to Xcode 27, which deploys back to macOS 12.

• From some reason, this build was hard to submit to the Mac App Store. altool kept retrying, or something, right at the end of the upload. There’s usually a delay before a build shows up in App Store Connect, but this time I saw it there before altool had finished running.

• I also ran into trouble submitting the app for review. It kept showing a spinner or reporting errors when I tried to save the build, and also when adding it for review.

• The actual review was pretty quick by modern standards—three days including a weekend. It warned me ahead of time that review “can take up to 48 hours.”

• When I was approving the build for release, it asked if I was “enjoying” App Store Connect and wanted me to rate the app.

Previously:

• Ending the Golden Era for Backward-Compatible Apps
• Mac App Store Review Times Increasing
• DropDMG 3.7.1

Apple (xip, downloads):

Xcode 27.1 includes Swift 6.4 and SDKs for iOS 27.1, iPadOS 27, tvOS 27, watchOS 27, macOS 27, and visionOS 27. Xcode 27.1 supports on-device debugging in iOS 17 and later, tvOS 17 and later, watchOS 10 and later, and visionOS. Xcode 27.1 requires a Mac running macOS Tahoe 26.6 or later.

Christian Beer:

You can’t run macOS UI tests on Xcode cloud as soon as your app uses „restricted entitlements“[…]

Previously:

• Jumping to 27.2
• Xcode 27
• Developing for iPhone Duo

Glenn Fleishman:

The odds of this change in standards causing a security breach and your messages being exposed seem unlikely, at least right now. But after scrolling through conversations and seeing what’s going on, I feel Apple has omitted important signals for users when iMessage suddenly stops being used during a conversation.

[…]

The impact of that hit me while revising my book: when iMessage isn’t available, Apple tells you only inline. Despite all the information Messages displays about iMessage being encrypted, the inverse state is faint. This kind of negative knowledge, or information about something not happening, can often be as important as something that does happen. A warning about a fuel tank approaching empty is the kind of information every driver (or pilot) needs, for instance. If you think end-to-end encryption—or Apple-based encryption—is critical for you, then a pop-up message or other warning is what you would expect.

[…]

If you’d like to prevent Messages from downgrading security, you have options, although they may not be fully desirable. All of these are managed on an iPhone at Settings: Apps: Messages. You can’t control these message settings from an iPad or Mac.

This recently happened to my mother, and it was very confusing for her. For unknown reasons, while at home on Wi-Fi, she got signed out of iMessage. But it was not clear to her that this had happened or that she should try to sign back in. She was not aware that the Messages app supports multiple protocols or what the different bubble colors mean. All she noticed was that certain messages (e.g. ones sharing files) would no longer send and that she was not receiving some of the messages that people were sending to her. She saw the inline warning about encryption and interpreted it as that the sender was using a newer form of encryption that her phone didn’t support, so maybe she needed to upgrade.

I went over to take a look and quickly figured out that she was signed out of iMessage, but I couldn’t fix it. I kept getting errors that iMessage couldn’t be activated, even after rebooting the phone. Eventually, much later and again for unknown reasons, activation succeeded.

Update (2026-10-20): Boris Yurkevich:

My concern is that the Retry as Text Message toggle no longer exist. Just a couple of weeks ago my sister sent me an iMessage while I was flying. I was not reachable. Later she told me that messages turned from blue to green.

Mary Alyce Stephens (Hacker News, Reddit, TidBITS Talk):

Mark Stephens, known to much of the world as Robert X. Cringely, passed away on October 3, 2026. He was 73.

Mark was a gifted writer, journalist, storyteller, husband, father, brother, and friend. To millions of readers and viewers, he was Robert X. Cringely, the witty and sometimes irreverent observer of the technology world. But to those of us fortunate enough to love him, he was simply Mark-and losing him leaves an emptiness that is difficult to put into words.

[…]

Writing as Robert X. Cringely, Mark became a distinctive voice in technology journalism. He had an unusual ability to understand not only technology but also the human beings behind it-the dreamers, inventors, entrepreneurs, eccentrics, and risk-takers who were changing the world. He could take a complicated subject and make it understandable, entertaining, funny, and deeply human.

Steven Sinofsky (via John Gruber):

Bob wrote “Accidental Empires” that chronicled SV and the tech industry of the PC era, 1970s-90s. It led to the highly regarded PBS series “Triumph of the Nerds” a definitive series of interviews of the era. Through that time he authored the “gossip” column” in InfoWorld on the latest goings on at OG PC companies. Everyone read it in print religiously.

See also: I, Cringely and Wikipedia.

Previously:

• Revolution in the Valley

Update (2026-10-20): Paul Tyma (Hacker News):

The next day Bob and I went to Sun Microsystems. He and I sat in a room with Jonathan Schwartz (CEO) and Rich Greene (C-something-else) while they defended Java and gave me nasty looks wondering who the hell I was and why the hell I was even there. They seemed plenty interested in impressing Bob though. By the way, Dotnet didn’t squish Java but I did get a Sun t-shirt.

The Hack (Hacker News):

Like the Trojan Horse, passkeys are legitimately elegant on the surface, but there is something troubling inside.

What’s important to know is that unlike with any other kind of login credential, you do not have ultimate control over your passkeys. With passwords, you can choose where to write them down; with authenticator apps, you can decide for yourself which ones to use (they’re pretty interchangeable); and with physical security keys you can hand them to your colleague if you really trust them. But with passkeys come a hidden dial that lets the websites you use them on gradually remove your ability to do as you please with them.

[…]

This is the feature that means you no longer get to make the calls about your passkeys. Fortunately, attested passkeys are not yet required on most websites. But the FIDO Alliance standard makes attestation a part of the passkey ecosystem, whether you want it or not. And even if the website doesn’t require attestation now, simply by using passkeys you indicate to the website that your setup supports the FIDO Alliance’s passkey standard and that you as a user are capable of using passkeys. This means that once Twitter (formally X) is satisfied that the overwhelming majority of its users would be unaffected, they can flip the switch – perhaps not all at once, perhaps just for ten thousand users at a time so as not to cause a fuss – and start rejecting non-attested passkeys.

[…]

My expectation is that the industry will start off with very few constraints on your passkeys, and gradually add more and more, not all at the same time, but staggered on different sites, and then in a few years people will forget that they were ever offered a choice in which security measures they want to enable on their passkeys (if they even knew there were different kinds of passkeys at all).

[…]

Remote attestation can allow them to verify that your device is not capable of, say, sending and receiving encrypted messages, or running a competitor’s app, or using social media without verifying your ID.

Apple’s passkey implementation currently does not support attestation, but it sounds like this is only until they can work out how to do syncing:

Attestation was designed to attest to a specific device, exclusively at the point of creation, with a specific set of security properties. It doesn’t make sense for synced credentials for a number of reasons, including syncing to devices with different security properties, changes in security properties that happen after key creation, security properties of the sync fabric, sharing the passkey, or exporting to other passkey providers. We’re working hard with W3C and FIDO to solve these problems.

Ricky Mondello:

The post is predicated on the idea that a feature of WebAuthn called “attestation”, which is only used in high-assurance and usually corporate scenarios, and usually with physical hardware security keys, will be leveraged to hurt people, somehow.

The post posits that a website like X will bait and switch users: first, you get a passkey. Then, later, scary “attested” passkeys! This simply isn’t possible to do because attestation isn’t supported on the web for mass market, consumer authentication.

Attestation for passkeys (software-based, syncable credentials) is antithetical to their mass market goals, and would freeze out independent, non-corporate-backed credential managers. It’s an explicit non-goal of the designers of passkeys, who work together in a forum anyone can join.

And trust me, websites and apps like banks repeatedly asked for attestation at the beginning of the industry’s passkey journey. The platforms, browsers, and credential management apps have held firm that the goal of passkeys is reducing phishing and not some kind of trusted computing scheme. (And I will note: over my dead body!)

I believe this is not the goal of Mondello and some of the others working on this, but so far I’ve not been convinced that they will be able to control it. It sounds like Apple is working on it, and once the technology is out there, what’s to prevent key sites from forcing it on users? It seems like all this would take is the cooperation of a few big credential managers. This would be to their benefit in the sense that it would make their products required. Smaller credential managers who resisted would be frozen out.

varx:

The fact that websites and apps have been asking for attestation just reinforces the main point of the passkeys post! Sure, browsers aren’t supporting it yet, but that’s the sort of thing that can change, and the sort of thing that has changed in the past. See the footnote on Widevine and Firefox. (“Currently not supported” is also very subject to change.)

And we already have sites and apps allowlisting passkey vendors. That’s no theoretical, slippery slope fear -- it’s a real restriction on user freedoms that’s already happening right now.

I don’t think that a couple of bad points (e.g. the TOTP thing) invalidate the main point of the post, because the post wasn’t an argument from authority. The author makes some good points that stand on their own.

Ricky Mondello:

To be clear, the websites have stopped asking for attestation. Or at least, they’ve stopped asking me. Why? Because they know there’s no use in asking — that the OS vendors, browsers, and passkey managers are unified on this front. And now they’ve seen firsthand that passkeys without attestation are awesome and a big step forward.

iinuwa:

This is antithetical to users, as the types of authenticators that can pull this off are difficult to use (security keys). Companies with IT departments who can do account recovery for the user can handle this, an average user cannot. Synced passkeys are the answer to this for consumers and therefore attestation does not belong in the consumer space. Which is why password managers are in the spec groups pushing back against this every time it comes up.

Scott Helme (Hacker News):

If a consumer website decided tomorrow that it would only accept attested passkeys, it would lock out almost all of its own users, instantly. What website is going to do that?

[…]

If you’re worried about attestation creeping into consumer logins, then that’s worth pushing back on, loudly (if it ever happens). But it hasn’t happened, the biggest providers don’t support it, and avoiding passkeys today while you wait for it won’t protect you from anything, it just leaves you open to phishing.

It seems like rejecting passkeys is the only way the average user has to push back. The main thing protecting us is that sites don’t want to lock out their users who rely on passwords and 2FA. Once most people have adopted passkeys, if Apple and Google sell us out, I don’t think it matters much what the rest of the alliance thinks. Sites would be able to require attestation with the assurance that users could easily comply. Safari would probably opt everyone into attested passkeys, as it currently opts you into passkeys in general (unless you uncheck “Allow Automatic Passkey Upgrades”).

Previously:

• Attestation News
• Locked Down Passkey and Keychain Backups
• Forcing Passkeys
• Passkeys Credential Exchange
• Web Environment Integrity

TheLastProject (Hacker News):

In the [EU age verification] README, the following is listed:

App and device verification based on Google Play Integrity API and Apple App Attestation

I would like to strongly urge to abandon this plan. Requiring a dependency on American tech giants for age verification further deepens the EU’s dependency on America and the USA’s control over the internet.

Bobby Borisov (Hacker News):

The European Union’s open-source age-verification project has drawn criticism after a maintainer confirmed that hardware-bound attestation is a mandatory architectural requirement, raising concerns about Linux, custom Android ROMs, and independently compiled applications.

[…]

The solution lets users prove they are over a certain age without revealing their name, exact birth date, or full identity document. To prevent credentials from being copied, cloned, or reused by modified clients, the project relies on keys stored in protected hardware like Android TEE, StrongBox, or Apple’s Secure Enclave.

However, critics claim that this approach endangers the system by making it dependent on a small number of approved devices, operating systems, and attestation providers.

Positiveblue (Hacker News):

Cloudflare’s new “signed agents” pitch sounds like safety but it’s a wolf in sheep’s clothing. They’ve built an allowlist for the open web and told builders to apply for permission. That’s not how the internet works. An application form is not a standard.

GrapheneOS:

Apple and Google are gradually expanding their use of hardware-based attestation. They’re convincing a growing number of services to adopt it. Google’s Play Integrity API and Apple’s App Attest API are very similar. Apple brought it to the web via Privacy Pass, which Google intends on doing too.

Google’s Play Integrity API requires hardware attestation for the strong integrity level and is gradually phasing in requiring it for the more commonly used device integrity level. Apple already has it as a requirement. Over the long term, this will increasingly lock out hardware and OS competition.

The purpose of these systems is disallowing people from using hardware and software not approved by Apple or Google. This is wrongly presented as being a security feature. Banks and government services are the main ones adopting it but Apple and Google are encouraging every service to use it.

German National EUDI Wallet Architecture Documentation (Hacker News):

When issuing the PID, the WB confirms to the PP (via OpenID4VCI Key Attestation) that the keys to which a PID is to be bound are controlled by an authentication means that meets certain security requirements with regard to resistance against attackers with a certain attack potential (see ISO/IEC 18045).

Simon B. Støvring:

It’s great that App Attest is coming to Mac with macOS 27. It means I can ship Canvases’ intelligence and sharing features with much more confidence, knowing I can protect the endpoints with App Attest.

Previously:

• Instagram Charging for Links
• The Age Verification Trap
• Apple Platform Security Guide (January 2026)
• EU Council Approves New “Chat Control” Mandate
• Google Abandons Web Environment Integrity API
• Web Environment Integrity
• App Attest

Howard Oakley:

Of all the privacy protections in macOS, those for local networking are among the most recent and the least understood.

[…]

All non-exempted apps and other processes start without any privilege. Those that try to make a local network connection result in the user being prompted to allow or deny their access. Your decision is then recorded in that app’s new entry in the Local Network section, and you can then set that to allow or deny its future access. For that to happen, the responsible app needs an additional item in its property list to explain to you why it requires that access, something that should appear in any prompt for access.

[…]

A process with a short life that immediately fails if it can’t complete a local network operation may not trigger a user prompt, and can continue to fail repeatedly as it can’t be granted the privilege. Apple recommends changing the code so that it doesn’t exit immediately after failure, to allow the prompt to be displayed and access granted.

Howard Oakley:

Another clue came in the statement in that note that “on macOS there’s no way to reset your program’s Local Network privilege to the undetermined state”. This contrasts with pretty well every other category of privacy protection, which are handled by the dreaded TCC, Transparency Consent and Control.

This has now changed in macOS 27.2.

TN3179:

During testing, you might want to reset your program’s Local Network privilege to the undetermined state. Your options for this vary by platform.

On iOS, the easiest option is to delete your app.

Alternatively, if you don’t want to delete your app for some reason, reset the entire privacy subsystem using Settings > General > Transfer or Reset > Reset > Reset Location & Privacy.

On macOS, the list in System Settings > Privacy & Security > Local Network has add (+) and remove (-) buttons. To reset your program’s Local Network privilege, select it in the list and click the remove button.

Previously:

• Local Network Privacy on Sequoia
• Local Network Privacy FAQ

Apple (MacRumors, Six Colors):

Apple today announced Apple Home Collection, a new lineup of smart home accessories — including indoor and outdoor cameras, thermostats, temperature sensors, and a video doorbell and door lock — designed in collaboration with LG Electronics and Schneider Electric. These new accessories are simple to set up starting with one tap with iPhone, and everything is managed through the Apple Home app — no separate app or account required. Each accessory is encrypted end-to-end in Apple Home, so only users and the people they choose can access their home data.

[…]

• LG’s Video Doorbell offers dual cameras that capture separate views of visitors and packages — allowing users to switch between the front and bottom camera views seamlessly — along with a built-in spotlight and a chime that plays through HomeView, HomePod, and HomePod mini. The front camera captures 2.5K resolution video, and the bottom camera captures full HD resolution.
• LG’s Floodlight Cam delivers powerful perimeter monitoring with adaptive dual floodlights that activate automatically when motion is detected, and low-light color night vision that preserves clarity in darker conditions so users can see more of what’s happening outside.

[…]

LG’s Smart Deadbolt Lock brings a new level of convenience to home access. Using Ultra Wideband technology, the lock can tell how close a user is and when they’re approaching the door. As a user with a home key on a compatible iPhone or Apple Watch walks up, the door unlocks automatically, with no tapping required.

[…]

Two new Smart Thermostats are available — one from LG Electronics and one from Schneider Electric — so users can choose the product that best fits their home’s broader energy ecosystem.

John Gruber:

The thing that makes this partnership awkward for Apple is that these products — doorbells, cameras, deadbolt locks — are products that require the utmost of trust. What products could possibly require more trust than a camera with footage of what’s going on in or at your home, or a lock that controls who can get in? I think that’s why Apple wants to get into this market with products that they can put their stamp of approval on. But LG, of all companies, was just exposed in a scandal for shipping “smart” TVs that literally listen to the ambient audio in the room — even in standby! — and invade your privacy by tracking what content appears on screen.

Previously:

• HomeView

Apple (video, Hacker News, MacRumors Six Colors, MacStories, Slashdot):

Apple today introduced Apple HomeView, designed to be central to the home and personal to everyone in it. With a stunning 7-inch Liquid Retina display, HomeView brings entertainment, connection, and smart home management together in one place, from playing music and making FaceTime calls to home monitoring and hands-free automations with voice control — all designed with privacy and security at the core. HomeView recognizes users by their faces, adapting so they can access their personal content in Messages, FaceTime, Calendar, Reminders, and Find My.

[…]

Designed to fit in any space, HomeView can be placed on a tabletop as the center of the home or wall-mounted to fit in spaces like the entryway or hallway.

I guess the best part is the price. $299 (not including wall mount) is less than the base iPad and the same as the Apple TV. But I just can’t imagine what I would use this thing for. It does not seem more appealing than an iPhone or HomePod for any tasks. I wouldn’t want to dedicate any kitchen space for it, and the cord is a problem. Why would I not just use an old iPad or iPhone, which are wireless and support apps and standalone video? Maybe it would be interesting if it could do something extra, like act as a Time Capsule.

John Gruber:

HomeView does not have FaceID. I asked about this and Apple reps said that first, your home is (reasonably!) presumed to be a safe space. But in order for users to be recognized — by voice or face — they must have a “registered [non-watch] personal device” that supports Apple Intelligence and Siri AI, that device must be present on the home’s Wi-Fi network, and it must have been recently unlocked.

Hartley Charlton:

Apple said it is “working constructively with the EU in an attempt to find a path forward,” but provided no timeline for EU availability.

Previously:

• HomePod mini 2
• Siri AI Ships (But Still Beta)
• No Siri AI in EU
• Apple Officially Discontinues AirPort Router Line
• Amazon Echo Show

Update (2026-10-14): Julian Chokkattu:

It doesn’t have an App Store. Instead, Apple has a curated selection of apps, including FaceTime, Messages, and Safari. A handful of third-party media apps like Spotify are available, and developers can bring over existing CarPlay apps. If your iPhone already has one of these CarPlay apps installed, it can automatically appear on the HomeView after setup. (There are no video streaming apps like YouTube, Netflix, or Disney+, but if those companies choose to make their apps available on the CarPlay framework, they will show up on the HomeView; for now, you’ll have to consume videos by using the Safari browser.)

Via John Voorhees:

CarPlay makes some sense as a way to push apps to the HomeView, but unless the entitlement is opened wider, it also makes no sense at all.

I suspect this is just the mechanism for audio and video apps and not a more general developer channel for making apps.

Jason Snell (MacRumors):

Beyond that, though, it seems like HomeView is at least starting life as a very limited app platform. Apple does say that if you make a Siri AI query for your personal content, it will search everything on your iPhone or iPad—and that includes apps that aren’t on the HomeView. So you should be able to query your iPhone apps, but not actually run them.

Rui Carmo:

I do think I want one, but there are a few things to settle besides price and value. For starters, having more screens in the house doesn’t seem like a winning proposition (the HomePods we’ve got work OK for alarms, reminders, etc.), and the American fascination with the kitchen island (which, by the way, needs power sockets in the middle…) doesn’t translate to European flats.

Paul Solt:

Are you going to cut a hole in your island to feature HomeView?

Mr. Macintosh:

I really like the new Apple HomeView device!

The only thing I can’t get past, (as a previous iMac G4 owner) is the screen can’t rotate vertically.

Notice the slick Apple video edit:

If someone needs to rotate HomeView, the whole base needs to rotate along with the power cord.

Mr. Macintosh:

Wait… I just noticed something else from the HomeView video🤔

When she goes to grab the HomeView, you can see her right hand reach out to grab the lower right hand corner of the screen. But then the cut shows her grab the top of the base to rotate it?

Did they not like the cut where the entire base rotates? (This would would have shown the USB-C plug rotate along with the entire unit)

Basic Apple Guy:

iOS Icon History: iPod/Music

Bob Burrough:

Folks speculating HomeView is the tail end of Tim Cook’s product “leadership,” but 1) Ternus is the CEO and can torpedo it if he thinks it’s a stinker. 2) He’s also the guy who spearheaded iPad’s “what’s a computer?” campaign and the idea that an iPad was a viable replacement.

Quinn Nelson:

The biggest issue with Apple’s Home ecosystem is the absolutely garbage Home app. Still, in 2026, there is a tab dedicated fully to buying more smart home gadgets (aka, an ad) within the iOS Home app and it can’t be removed. Yet rooms are buried up top. Pitiful.

Scott:

This is the ONE THING (“One more thing”?) I’d been hoping to get from @Apple in this announcement: they were redoubling efforts on HomeKit/Home.app to make the ecosystem actually work better… annnnnd did not get that impression. At all.

IMHO, as an HomeKit user with dozens of devices in 2 Homes, there is SO MUCH low-hanging fruit that @Apple could be working on to improve the UX, it is pathetic.

Steve Troughton-Smith:

The original HomePod didn’t come to the EU either for 5 months, and even then it was only in two countries. The original HomePod never came to Ireland at all, before it was discontinued. But if you only listened to the pundits, this is somehow now the DMA’s fault.

See also: Marques Brownlee.

Update (2026-10-16): Jesper:

It is so convoluted that people will be having trouble understanding it, and if they have trouble understanding it they’ll be having trouble trusting it. Most of what it does involves somehow sucking in the juices from the people’s devices that cohabitate with it.

[…]

That it works at all is impressive, but will people really put their integrity in its hands? Between this and the various “always-listening” features of the recent Apple Watch releases, I’m thinking Apple has gotten a bit too high on its own supply.

Steve Troughton-Smith:

Apple overhauled the external display APIs in iOS 27 for unclear reasons and replaced it with a ‘scene accessory’ API, which I believe powers the iPhone Duo’s both-screens-at-once entitlement-gated API.

Enter HomeView, with its ‘CarPlay’ API, which is clearly a stopgap solution that will please nobody.

But if we’re beaming UI from a connected iPhone, the external scene accessory API suddenly looks more promising. That way you could do ‘real’ apps without an App Store.

See also: Dithering and Accidental Tech Podcast.

Update (2026-10-19): John Gruber (Mastodon, tweet, Bluesky):

I do think the basic concept is an intriguing idea. But as an implementation of that concept, my initial impressions are threefold. First, I am unconvinced that anyone in a family would use this for anything other than playing music or podcasts, rather than just using their phones. And if that’s the case, why not just have a HomePod? Apple’s video shows family members taking turns to use the HomeView, rotating it on the kitchen island to face themselves. Why? Why does the mom check her calendar on this, rather than on her iPhone, while the dad is using it to follow a French toast recipe? There’s a real “Why do we need this?” question here and I don’t think Apple’s video answers it, at all.

Lex Friedman:

I don’t have a HomeView yet. But I’m excited to own one.

[…]

I’m confident that Apple won’t show endlessly scrolling promos on that screen.

[…]

Yes, my phone shows those things. Yes, my Apple Watch shows those things. But I like that data being glanceable and not requiring I look at a full-on distraction machine. I’m thinking the HomeView might be the Kindle hardware of tiny bits of data I want.

Mark Gurman (via John Gruber):

Apple postponed the HomeView repeatedly — first until spring 2025, then summer, then fall, and then again throughout 2026 before finally unveiling it this past week. And the hardware betrays its age. With thick bezels, an A18 processor and 8 gigabytes of memory, this is clearly a product conceived years ago. Finished units have been sitting boxed up in warehouses for the better part of a year, waiting for the software to catch up.

Adam Engst:

Apple produced a 3-minute promotional video that purports to show a “typical” family using a HomeView. The ad has drawn criticism from John Gruber and TidBITS readers, who were horrified by the behaviors portrayed, and more to the point, it doesn’t seem to show the HomeView making life any better. Certainly, nothing in that video matches how any “typical” morning has ever gone in our household.

Although we use our HomePods heavily to turn lights on and off and listen to music, it’s hard to think of much else we would choose to do on the HomeView.

[…]

As someone who cooks seriously, I’m skeptical of HomeView’s one-step-at-a-time approach.

I cook a lot and can’t imagine using HomeView for recipes. I always reformat and edit them beforehand. I print them out so I can jot notes as I’m cooking and easily see more than one at once without having to fiddle with a screen.

Apple (video, Hacker News, MacRumors, Six Colors):

Apple today announced the next generation of Apple TV 4K, delivering its most immersive home theater experience yet. The new Apple TV 4K features Siri AI, an entirely new version of Siri powered by the next generation of Apple Intelligence, transforming how users search for, discover, and enjoy their favorite movies and TV shows through a full-screen Siri AI experience. With built-in far-field microphones, Apple TV 4K also lets users talk to Siri completely hands-free.

[…]

The A19 chip in the new Apple TV 4K delivers up to 50 percent faster CPU performance and up to 2x faster GPU performance than the previous generation, for greater responsiveness, faster navigation, and smoother animations. The A19 chip also includes a new, dedicated AV1 decoder, enabling more efficient, high-quality streaming while using less bandwidth.

The new Siri Remote keeps its familiar design while adding Find My support with Precision Finding and an option to play a sound on the remote — making it far easier to locate.

The price is now $299. Apple TV doesn’t get updated very often, so if you need one I guess now is the time to buy.

But I’ve really soured on this product. The software design is worse than when I bought it. I just want a basic interface like the iTunes column browser. Instead, we get all this extra stuff so that the text I care about is secondary, truncated, and obscured. It seems designed to hide the content I want to see, and which I am in the middle of watching, while constantly promoting what Apple wants me to watch. The search has always been bad and is still bad. The main thing it’s supposed to do is play video, and lately that’s been failing, too. It either won’t play at all or it’ll play for a while, and then after a commercial break it will switch to a different episode.

I’m considering just getting a $40 Fire TV Stick to see whether things are any better over there. Maybe the privacy is worse, but I have to weigh that against the product actually working. We watch TV to relax in the evening, and instead I keep getting agitated that either it didn’t work at all or we had to go through hassles like logging in again or rebooting. I would miss the screensaver, though.

Previously:

• HomeView
• HomePod mini 2
• Siri AI Ships (But Still Beta)
• Ads When You Start Your Fire TV
• Apple TV 4K 2022
• An Unsolicited Streaming App Spec
• Apple TV App for Amazon Fire TV

Update (2026-10-14): Joe Rossignol:

Here are 11 changes coming with the new Apple TV[…]

Scott:

Oh, yeah, one more thing: does the $300 Apple TV have a USB C port for UVC cams, for FaceTime/vidconf apps.

If not, why not? Really fucking stupid if it doesn’t, especially at that price. The chipset and OS HAVE the capability.

It does not.

Maynard Handley:

1. There is nothing compelling here for existing owners.

2. The price is so high compared to Roku or Fire that it’s hard to justify telling friends to upgrade for the better experience.

Apple should probably, at the very least, have kept the existing 64GB box at a lower price point, and bundled in a year of Apple TV+, to work with market.

[…]

It’s about “WTF is Apple thinking? Who is this targeted at?” We have three products released today all of which look like flailing.

[…]

I’ve been on team Apple (customer and employee) since 1990. This is the first time (even including the Wired Pray cover days) that I feel genuinely worried that Apple is fumbling the future.

Joe Rosensteel:

I don’t understand the direction the team working on the Apple TV has been given. I know people are excited by it, because they’ve been waiting to buy the best one, and cycle the old ones down to lesser TVs in their homes, but this update is going to be around next year and the year after so it’s worth thinking about it from that point of view. What will you get out of this when it isn’t just “new”? A microphone array? Chip bumps?

Asleep at the jog wheel.

Update (2026-10-16): Andrew Orr:

According to Apple’s footnotes, Precision Finding requires an iPhone Duo, iPhone Air, or iPhone 17 or later, excluding the iPhone 17e. Compatible iPhones must run the latest version of iOS, and availability varies by region.

The restriction is particularly notable because the iPhone 15 lineup and most iPhone 16 models already feature Apple’s second-generation Ultra Wideband chip. Those iPhones support expanded Precision Finding with the AirTag 2, but they can’t use the new Siri Remote’s Precision Finding feature.

John Gruber:

I’m sure the graphics and CPU improvements matter for gaming, but the only mention of gaming in Apple’s own Newsroom announcement is this sentence: “With Apple Fitness+, the living room becomes a workout studio, while Apple Arcade and the App Store’s library of games turn it into a home arcade.” I wish it were otherwise, but gaming is such an afterthought on Apple TV that it only garnered the second half of a sentence that started with Fitness+, a service that has only been in the news this year because Mark Gurman says Apple laid off part of the team.

[…]

The elephant in the room, though, is price.

Adam Engst:

You can pre-order a 128 GB fourth-generation Apple TV 4K with Wi-Fi and gigabit Ethernet for $299, and it ships on 13 November 2026. In comparison, the third-generation model started at $129 for 64 GB with Wi-Fi and $149 for 128 GB with added Ethernet. In June, Apple raised those prices to $199 and $249 (see “Apple Raises Prices for Many Products,” 26 June 2026). Apple eliminated the lower-capacity option, so now we have only the higher-end model at twice its initial price.

Jason Snell:

For the people who do care, who do want something better, the options are more limited. Amazon’s Fire TV Cube is $199. Roku’s “Ultra” is $149. The Google TV streamer, my favorite of all the non-Apple products on the market, is $150.

When you could get an Apple TV starting at $199, you could spot Apple playing its usual game—not the low-price leader, but in the ballpark. At $299, though, it becomes a lot harder for me to convince my relative who is complaining about how slow and terrible their streaming interface is to spring for the Apple one and solve their problems.

[…]

I’ve seen some commentators suggest this is a good thing because it “simplifies the product line.”

I don’t follow that argument at all. Having a cheaper product is good, because not only do some people not need Ethernet or large amounts of storage on a streamer box, but lower prices broaden the market!

Update (2026-10-19): John Gruber:

Inflation adjusted, a $69 Apple TV box today would cost a little under $99. Even if we only consider the $99 price in 2015 dollars, that’s about $137 in today’s dollars. Round that up to $150 and it would still be half the price of the only Apple TV hardware Apple now sells: this week’s new 4th-gen Apple TV 4K.

The new Siri Remote, with precision Find My support (and a speaker), is compatible with all prior generations of Apple TV 4K. So if you just want the new remote you can just buy the new remote. But it costs $59, which is almost as much as an entire Apple TV (with remote, of course) did in 2015.

Glenn Fleishman:

I wondered what the entry-level, initial price of each Apple TV box at introduction was, from the March 2007 original to the Apple TV 4K (4th generation) announced October 13, 2026, adjusted for inflation. So I charted it.

Steve Troughton-Smith:

I was ready to buy three new Apple TVs at the previous price point. At the new price point, I’ve bought zero 🤷‍♂️

John Siracusa says that pause/resume has been broken for him—in Apple’s own TV.app—and that he had to force-quit it several times.

Apple (video, MacRumors, MacStories, Six Colors):

Apple today announced HomePod mini 2, featuring Siri AI, gorgeous new colors, and enhanced audio experiences. Siri AI, coming to HomePod mini 2 in a future software update, is a profoundly more capable and conversational assistant with personal context understanding, broad world knowledge that powers tasks like richer music discovery, and the ability to tap into even more apps — bringing a whole new level of capability to HomePod mini.

[…]

With Sound Glow, the top of HomePod mini transforms into a visual canvas that glows and pulses in sync with the music, reacting in real time to bass and treble.

[…]

Sound Recognition gives HomePod mini users peace of mind by listening for a smoke or carbon monoxide alarm and, if one is detected, sending a notification immediately to the user’s iPhone, iPad, and Apple Watch.

The price has increased from $99 to $149. Our HomePod is placed high enough that the top isn’t visible, anyway. I assume it still can’t play all my purchased music.

Previously:

• HomeView
• Siri AI Ships (But Still Beta)
• Midnight HomePod mini
• HomePod (2nd Generation)
• HomePod mini

Update (2026-10-14): Scott:

Annnd… apparently the HomePod mini 2 cable IS still captive.

Mr. Macintosh:

The new HomePod mini 2 is “built with the environment in mind” yet still has a non-removable power cable.

Did you move furniture onto the cable, or did your cat eat through it?

Buy a new one.