daring-rss
From the Annals of Underpromising and Overdelivering: Apple’s Timing for the Mac’s Transition to Apple Silicon
In the previous item I mentioned Microsoft’s “the boy who cried wolf” problem regarding its upcoming Surface devices powered by Qualcomm’s Snapdragon X Elite chips. To wit: Microsoft has been trying to promote ARM-based Surface laptops and tablets — and ARM-based Windows PCs in general — for 12 years. Each time they do, they promise that the performance will be great. And each time so far, that’s turned out to be wrong. So their problem now isn’t just whether the performance — including x86 emulation — really will be good with these new Snapdragon X Elite chips. It’s whether anyone will believe them even if performance is great. “Fool me once, shame on you; fool me twice, shame on me” goes the saying.1 Microsoft is way past “twice” at this point.
Compare and contrast with Apple’s transition of the Mac to Apple silicon. They could have made the transition years earlier than they did, but chose to wait until the advantages were overwhelming — in performance, efficiency, and price. Here’s the section on performance from my review of the first-generation iPad Pros in 2015, five years before the M1 Macs debuted:
The iPad Pro is without question faster than the new one-port
MacBook or the latest MacBook Airs. I’ve looked at several of my
favorite benchmarks — Geekbench 3, Mozilla’s
Kraken, and Google’s Octane 2 — and the iPad
Pro is a race car. It’s only a hair slower than my year-old
13-inch MacBook Pro in single-core measurements. Graphics-wise,
testing with GFXBench, it blows my MacBook Pro away. A
one-year-old maxed-out MacBook Pro, rivaled by an iPad in
performance benchmarks. Just think about that. According to
Geekbench’s online results, the iPad Pro is faster in single-core
testing than Microsoft’s new Surface Pro 4 with a Core-i5
processor. The Core-i7 version of the Surface Pro 4 isn’t shipping
until December — that model will almost certainly test faster
than the iPad Pro. But that’s a $1,599 machine with an Intel x86
CPU. The iPad Pro starts at $799 and runs an ARM CPU — Apple’s
A9X. There is no more trade-off. You don’t have to choose between
the performance of x86 and the battery life of ARM.
We’ve now reached an inflection point. The new MacBook is slower,
gets worse battery life, and even its cheapest configuration
costs $200 more than the top-of-the-line iPad Pro. The iPad Pro
is more powerful, cheaper, has a better display, and gets better
battery life. It’s not a clear cut-and-dry win — MacBooks still
have more RAM (the iPad Pro, in all configurations, has 4 GB of
RAM, although Apple still isn’t publishing this information — MacBook Pros have either 8 or 16 GB), are expandable, and offer
far more storage. But at a fundamental level — CPU speed, GPU
speed, quality of the display, quality of the sound output, and
overall responsiveness of interface — the iPad Pro is a better
computer than a MacBook or MacBook Air, and a worthy rival to the
far more expensive MacBook Pros.
The entire x86 computer architecture is living on borrowed time.
It’s a dead platform walking. The future belongs to ARM, and
Apple’s A-series SoC’s are leading the way.
So at a time when Microsoft was already three years into pushing under-powered ARM-based Windows laptops, Apple had ARM chips that really were competitive with Intel’s x86 offerings, but waited five years to build an overwhelming, undeniable advantage before making the switch on the Mac.
By 2018 it was incredibly obvious that Apple would make the switch on the Mac, but it was still two years away. When you ask people to switch from something tried and true to something new, “good enough” isn’t good enough. The new thing needs to be like an entire order of magnitude better in at least one way, if not multiple ways.
Or, if you prefer, George W. Bush’s poetic rendering of the adage: “There’s an old saying in Tennessee — I know it’s in Texas, probably in Tennessee — that says, fool me once, shame on — shame on you. Fool me — you can’t get fooled again.” God bless old W — we all know how hard it is to put food on your family. ↩︎
★
In the previous item I mentioned Microsoft’s “the boy who cried wolf” problem regarding its upcoming Surface devices powered by Qualcomm’s Snapdragon X Elite chips. To wit: Microsoft has been trying to promote ARM-based Surface laptops and tablets — and ARM-based Windows PCs in general — for 12 years. Each time they do, they promise that the performance will be great. And each time so far, that’s turned out to be wrong. So their problem now isn’t just whether the performance — including x86 emulation — really will be good with these new Snapdragon X Elite chips. It’s whether anyone will believe them even if performance is great. “Fool me once, shame on you; fool me twice, shame on me” goes the saying.1 Microsoft is way past “twice” at this point.
Compare and contrast with Apple’s transition of the Mac to Apple silicon. They could have made the transition years earlier than they did, but chose to wait until the advantages were overwhelming — in performance, efficiency, and price. Here’s the section on performance from my review of the first-generation iPad Pros in 2015, five years before the M1 Macs debuted:
The iPad Pro is without question faster than the new one-port
MacBook or the latest MacBook Airs. I’ve looked at several of my
favorite benchmarks — Geekbench 3, Mozilla’s
Kraken, and Google’s Octane 2 — and the iPad
Pro is a race car. It’s only a hair slower than my year-old
13-inch MacBook Pro in single-core measurements. Graphics-wise,
testing with GFXBench, it blows my MacBook Pro away. A
one-year-old maxed-out MacBook Pro, rivaled by an iPad in
performance benchmarks. Just think about that. According to
Geekbench’s online results, the iPad Pro is faster in single-core
testing than Microsoft’s new Surface Pro 4 with a Core-i5
processor. The Core-i7 version of the Surface Pro 4 isn’t shipping
until December — that model will almost certainly test faster
than the iPad Pro. But that’s a $1,599 machine with an Intel x86
CPU. The iPad Pro starts at $799 and runs an ARM CPU — Apple’s
A9X. There is no more trade-off. You don’t have to choose between
the performance of x86 and the battery life of ARM.
We’ve now reached an inflection point. The new MacBook is slower,
gets worse battery life, and even its cheapest configuration
costs $200 more than the top-of-the-line iPad Pro. The iPad Pro
is more powerful, cheaper, has a better display, and gets better
battery life. It’s not a clear cut-and-dry win — MacBooks still
have more RAM (the iPad Pro, in all configurations, has 4 GB of
RAM, although Apple still isn’t publishing this information — MacBook Pros have either 8 or 16 GB), are expandable, and offer
far more storage. But at a fundamental level — CPU speed, GPU
speed, quality of the display, quality of the sound output, and
overall responsiveness of interface — the iPad Pro is a better
computer than a MacBook or MacBook Air, and a worthy rival to the
far more expensive MacBook Pros.
The entire x86 computer architecture is living on borrowed time.
It’s a dead platform walking. The future belongs to ARM, and
Apple’s A-series SoC’s are leading the way.
So at a time when Microsoft was already three years into pushing under-powered ARM-based Windows laptops, Apple had ARM chips that really were competitive with Intel’s x86 offerings, but waited five years to build an overwhelming, undeniable advantage before making the switch on the Mac.
By 2018 it was incredibly obvious that Apple would make the switch on the Mac, but it was still two years away. When you ask people to switch from something tried and true to something new, “good enough” isn’t good enough. The new thing needs to be like an entire order of magnitude better in at least one way, if not multiple ways.
Or, if you prefer, George W. Bush’s poetic rendering of the adage: “There’s an old saying in Tennessee — I know it’s in Texas, probably in Tennessee — that says, fool me once, shame on — shame on you. Fool me — you can’t get fooled again.” God bless old W — we all know how hard it is to put food on your family. ↩︎
Microsoft Preparing New Push for ARM-Powered Windows Laptops
Tom Warren, reporting for The Verge:
Microsoft is getting ready to fully unveil its vision for “AI
PCs” next month at an event in Seattle. Sources familiar
with Microsoft’s plans tell The Verge that Microsoft is
confident that a round of new Arm-powered Windows laptops will
beat Apple’s M3-powered MacBook Air both in CPU performance and
AI-accelerated tasks.
Keep in mind when this event takes place that raw CPU performance isn’t what makes Apple silicon great. It’s performance-per-watt, along with the efficiencies of the entire OSes being optimized for the architecture.
After years of failed promises from Qualcomm, Microsoft believes
the upcoming Snapdragon X Elite processors will finally offer the
performance it has been looking for to push Windows on Arm much
more aggressively. Microsoft is now betting big on Qualcomm’s
upcoming Snapdragon X Elite processors, which will ship in a
variety of Windows laptops this year and Microsoft’s latest
consumer-focused Surface hardware.
And the next version of Bluetooth might offer rock-solid reliability.
Microsoft is so confident in these new Qualcomm chips that it’s
planning a number of demos that will show how these processors
will be faster than an M3 MacBook Air for CPU tasks, AI
acceleration, and even app emulation. Microsoft claims, in
internal documents seen by The Verge, that these new Windows AI
PCs will have “faster app emulation than Rosetta 2” — the
application compatibility layer that Apple uses on its Apple
Silicon Macs to translate apps compiled for 64-bit Intel
processors to Apple’s own processors.
Faster x86 emulation than Rosetta 2 would be quite the achievement, but is it really a bragging point? Three-and-a-half years into the Mac’s Apple silicon era, we’re so far into the transition that almost every app is now native. Are there any remaining pro Mac apps, where performance matters, that still only run under Rosetta?
Whereas on Windows, there’s relatively little ARM-native software, despite the fact that Microsoft started pushing ARM-based Surface devices back in 2012 — 12 years ago. Rosetta emulation is already a non-issue for Mac users in 2024, but x86 emulation might remain forever a problem for Windows. Windows laptop users would surely agree that they’d like longer battery life and quiet fans (if not fanless laptops, like the MacBook Air), but they seemingly have no desire to buy ARM-based machines.
★
Tom Warren, reporting for The Verge:
Microsoft is getting ready to fully unveil its vision for “AI
PCs” next month at an event in Seattle. Sources familiar
with Microsoft’s plans tell The Verge that Microsoft is
confident that a round of new Arm-powered Windows laptops will
beat Apple’s M3-powered MacBook Air both in CPU performance and
AI-accelerated tasks.
Keep in mind when this event takes place that raw CPU performance isn’t what makes Apple silicon great. It’s performance-per-watt, along with the efficiencies of the entire OSes being optimized for the architecture.
After years of failed promises from Qualcomm, Microsoft believes
the upcoming Snapdragon X Elite processors will finally offer the
performance it has been looking for to push Windows on Arm much
more aggressively. Microsoft is now betting big on Qualcomm’s
upcoming Snapdragon X Elite processors, which will ship in a
variety of Windows laptops this year and Microsoft’s latest
consumer-focused Surface hardware.
And the next version of Bluetooth might offer rock-solid reliability.
Microsoft is so confident in these new Qualcomm chips that it’s
planning a number of demos that will show how these processors
will be faster than an M3 MacBook Air for CPU tasks, AI
acceleration, and even app emulation. Microsoft claims, in
internal documents seen by The Verge, that these new Windows AI
PCs will have “faster app emulation than Rosetta 2” — the
application compatibility layer that Apple uses on its Apple
Silicon Macs to translate apps compiled for 64-bit Intel
processors to Apple’s own processors.
Faster x86 emulation than Rosetta 2 would be quite the achievement, but is it really a bragging point? Three-and-a-half years into the Mac’s Apple silicon era, we’re so far into the transition that almost every app is now native. Are there any remaining pro Mac apps, where performance matters, that still only run under Rosetta?
Whereas on Windows, there’s relatively little ARM-native software, despite the fact that Microsoft started pushing ARM-based Surface devices back in 2012 — 12 years ago. Rosetta emulation is already a non-issue for Mac users in 2024, but x86 emulation might remain forever a problem for Windows. Windows laptop users would surely agree that they’d like longer battery life and quiet fans (if not fanless laptops, like the MacBook Air), but they seemingly have no desire to buy ARM-based machines.
Google Expands in-House Chip Efforts for AI Data Centers
Miles Kruppa and Asa Fitch, reporting for The Wall Street Journal (News+):
Google is making more of its own semiconductors, preparing a new
chip that can handle everything from YouTube advertising to big
data analysis as the company tries to combat rising
artificial-intelligence costs.
The new chip, called Axion, is a type of chip commonly used in big
data centers. It adds to Google’s efforts stretching back more
than a decade to develop new computing resources, beginning with
specialized chips used for AI work. Google has leaned into that
strategy since the late 2022 release of ChatGPT kicked off an arms
race that has threatened its dominant position as a gateway to the
internet.
The chip efforts promise to reduce Google’s reliance on outside
vendors and bring it into competition with longtime partners such
as Intel and Nvidia, analysts said. Google officials said they
didn’t view it as a competition. “I see this as a basis for
growing the size of the pie,” said Amin Vahdat, the Google vice
president overseeing the company’s in-house chip operations.
Alan Kay’s adage remains evergreen: “People who are really serious about software should make their own hardware.”
★
Miles Kruppa and Asa Fitch, reporting for The Wall Street Journal (News+):
Google is making more of its own semiconductors, preparing a new
chip that can handle everything from YouTube advertising to big
data analysis as the company tries to combat rising
artificial-intelligence costs.
The new chip, called Axion, is a type of chip commonly used in big
data centers. It adds to Google’s efforts stretching back more
than a decade to develop new computing resources, beginning with
specialized chips used for AI work. Google has leaned into that
strategy since the late 2022 release of ChatGPT kicked off an arms
race that has threatened its dominant position as a gateway to the
internet.
The chip efforts promise to reduce Google’s reliance on outside
vendors and bring it into competition with longtime partners such
as Intel and Nvidia, analysts said. Google officials said they
didn’t view it as a competition. “I see this as a basis for
growing the size of the pie,” said Amin Vahdat, the Google vice
president overseeing the company’s in-house chip operations.
Alan Kay’s adage remains evergreen: “People who are really serious about software should make their own hardware.”
★ From the Department of Spending Tim Cook’s Money: Online Photo Storage Is Surely Expensive to Offer, but Apple Should Offer More
Like the stingy U.S. minimum wage — which was last increased, to $7.25/hour, in 2009 — these tiers ought to be adjusted for “inflation” periodically, but aren’t. If Apple really wants iPhone users not to worry about photo storage, they should offer more with iCloud, cost-to-Apple be damned.
Some follow-up comparison points regarding my gripe today about Apple’s new commercial telling iPhone uses they needn’t worry about photo storage:
The free tier for Google One offers 15 GB of storage. That’s still not much, and only a fraction of the on-device storage for any recent phone, but it’s 3× more than iCloud. 10 extra GB doesn’t sound like much, but 3× is a large factor.
I shot 2.07 GB of footage (96 photos, 5 videos) on Easter Sunday alone. Those are the keepers, after culling all the blurry and meh shots. (iPhone 15 Pro for videos and a few photos; Ricoh GR IIIx for most of the photos.1)
Google used to offer “unlimited storage for photos and videos” to owners of Pixel phones, but they dropped this offer starting with the Pixel 6 in late 2021. That was such an appealing offer — especially considering that much of the appeal of Pixel phones comes from their renowned camera systems. I can only surmise that this proved more expensive to Google than they deemed worthwhile.
Here’s a comparison of the current U.S. pricing for cloud storage, including photos, from Apple and Google:
Price/month
iCloud
Google
Free
5 GB
15 GB
$1
50 GB
—
$2
—
100 GB
$3
200 GB
200 GB
$10
2 TB
2 TB
Google’s only clear win is at the free tier, and once you start paying $3/month, they’re tied. Both companies offer additional storage beyond 2 TB at the same price: $5/month per extra TB. Google only shows those more-than-2-TB storage tiers if you’re signed in and already pay for storage. $5/month per extra TB is also exactly what Dropbox charges.
So on the one hand, it’s not like Apple’s iCloud storage pricing is out of line with its competitors. But on the other hand, the free tier of iCloud has been stuck at 5 GB since the day iCloud was announced, which was so long ago that Steve Jobs announced it at his final WWDC keynote in 2011. iCloud’s $1/month 50 GB and $3/month 200 GB tiers have been unchanged since 2015. Like the stingy U.S. minimum wage — which was last increased, to $7.25/hour, in 2009 — these tiers ought to be adjusted for “inflation” periodically, but aren’t.
In the case of the minimum wage, “inflation” is, well, actual inflation. In the case of cloud storage, “inflation” should account for factors like increased device storage (2011’s iPhone 4S was offered with 16, 32, or 64 GB) and increased image size (the iPhone 4S only shot video up to 1080p 30 fps, which consumes about 65 MB per minute; today’s iPhone 15 shoots up to 4K 60 fps, which consumes about 440 MB per minute).
It’s very easy for me and you to just declare that Apple ought to just foot the bill to offer more storage for over a billion users worldwide, but we’re not the ones making new TV commercials telling iPhone 15 users they needn’t worry about photo storage. If Apple really wants iPhone users not to worry about photo storage, they should offer more with iCloud, cost-to-Apple be damned.
Much like with Fuji’s deservedly-heralded X100 line, the fixed-lens Ricoh GR IIIx is seemingly backordered everywhere — perhaps because Ricoh recently announced a minor upgrade. I bought a Fuji X100S in 2014 and loved it; but bought the GR IIIx a little over a year ago because it’s small enough to fit in a pocket and the X100 cameras aren’t. I just find myself carrying the smaller Ricoh more often than I did the X100S. They’re both absolutely terrific cameras. ↩︎
Apple’s New iPhone Ad: ‘Don’t Let Me Go’
I saw this new iPhone 15 commercial a few times over the weekend, watching basketball. (Congrats to the South Carolina women and UConn men, both of whom won championships convincingly.) The gist of the commercial is that you shouldn’t worry about deleting photos to free up storage, because modern iPhones have plenty of space. The commercial-ending tagline as our protagonist stops deleting photos and resumes shooting new ones of his adorable dog: “Lots of storage for lots of photos / Relax it’s iPhone 15”.
It’s true that the iPhones 15, 14, and 13 all start with 128 GB of storage, which I think is the perfect baseline storage capacity. Only the so-old-it-still-has-a-home-button 3rd-gen iPhone SE starts at 64 GB. Especially when you’re talking about photos, not videos — which is what this commercial is about — 128 GB is a lot of on-device storage.
But this commercial made me want to yell at my TV each time it came on: “The problem is iCloud storage, not on-device storage!” The free tier of iCloud remains just 5 GB, and the $1/month paid tier offers just 50 GB, which may not be enough to back up even a 64 GB iPhone SE. I’m an outlier — 660 GB in iCloud Photos alone — but my wife, a casual/occasional photographer, has 55 GB in iCloud Photos. Even people who don’t shoot many photos in a year can wind up with large photo libraries because they’ve been using iPhones for 10–15 years.
I’d much rather have constrained storage on-device, with ample storage online, than the other way around. iOS does a great job in this situation with the (on by default) “Optimize iPhone Storage” option in Settings → Photos. But the other way around is surely the situation for many, if not most, iPhone users: more space on device than storage in iCloud. And no amount of cleverness in iOS can protect a user with un-backed-up photos and videos if they lose or break their iPhone.
Am I missing something? It feels like this new commercial is just whistling past the single biggest shortcoming in the Apple ecosystem.
★
I saw this new iPhone 15 commercial a few times over the weekend, watching basketball. (Congrats to the South Carolina women and UConn men, both of whom won championships convincingly.) The gist of the commercial is that you shouldn’t worry about deleting photos to free up storage, because modern iPhones have plenty of space. The commercial-ending tagline as our protagonist stops deleting photos and resumes shooting new ones of his adorable dog: “Lots of storage for lots of photos / Relax it’s iPhone 15”.
It’s true that the iPhones 15, 14, and 13 all start with 128 GB of storage, which I think is the perfect baseline storage capacity. Only the so-old-it-still-has-a-home-button 3rd-gen iPhone SE starts at 64 GB. Especially when you’re talking about photos, not videos — which is what this commercial is about — 128 GB is a lot of on-device storage.
But this commercial made me want to yell at my TV each time it came on: “The problem is iCloud storage, not on-device storage!” The free tier of iCloud remains just 5 GB, and the $1/month paid tier offers just 50 GB, which may not be enough to back up even a 64 GB iPhone SE. I’m an outlier — 660 GB in iCloud Photos alone — but my wife, a casual/occasional photographer, has 55 GB in iCloud Photos. Even people who don’t shoot many photos in a year can wind up with large photo libraries because they’ve been using iPhones for 10–15 years.
I’d much rather have constrained storage on-device, with ample storage online, than the other way around. iOS does a great job in this situation with the (on by default) “Optimize iPhone Storage” option in Settings → Photos. But the other way around is surely the situation for many, if not most, iPhone users: more space on device than storage in iCloud. And no amount of cleverness in iOS can protect a user with un-backed-up photos and videos if they lose or break their iPhone.
Am I missing something? It feels like this new commercial is just whistling past the single biggest shortcoming in the Apple ecosystem.
Google Launches Upgraded Find My Device Network for Android
Erik Kay, writing on Google’s company blog:
Today, the all-new Find My Device is rolling out to Android
devices around the world, starting in the U.S. and Canada. With a
new, crowdsourced network of over a billion Android devices, Find
My Device can help you find your misplaced Android devices and
everyday items quickly and securely. Here are five ways you can
try it out. […]
Starting in May, you’ll be able to locate everyday items like your
keys, wallet or luggage with Bluetooth tracker tags from
Chipolo and Pebblebee in the Find My Device app.
These tags, built specifically for the Find My Device network,
will be compatible with unknown tracker alerts across
Android and iOS to help protect you from unwanted tracking.
Keep an eye out later this year for additional Bluetooth tags from
eufy, Jio, Motorola and more.
Sounds like Google isn’t planning to make its own tracker tags.
A separate post by Dave Kleidermacher on the Google Security Blog gives a high-level overview of the platform’s privacy and security features.
★
Erik Kay, writing on Google’s company blog:
Today, the all-new Find My Device is rolling out to Android
devices around the world, starting in the U.S. and Canada. With a
new, crowdsourced network of over a billion Android devices, Find
My Device can help you find your misplaced Android devices and
everyday items quickly and securely. Here are five ways you can
try it out. […]
Starting in May, you’ll be able to locate everyday items like your
keys, wallet or luggage with Bluetooth tracker tags from
Chipolo and Pebblebee in the Find My Device app.
These tags, built specifically for the Find My Device network,
will be compatible with unknown tracker alerts across
Android and iOS to help protect you from unwanted tracking.
Keep an eye out later this year for additional Bluetooth tags from
eufy, Jio, Motorola and more.
Sounds like Google isn’t planning to make its own tracker tags.
A separate post by Dave Kleidermacher on the Google Security Blog gives a high-level overview of the platform’s privacy and security features.
The ‘xz’ Back Door
Dan Goodin, writing for Ars Technica:
The compression utility, known as xz Utils, introduced
the malicious code in versions 5.6.0 and 5.6.1, according
to Andres Freund, the developer who discovered it. There
are no known reports of those versions being incorporated into any
production releases for major Linux distributions, but both Red
Hat and Debian reported that recently published
beta releases used at least one of the backdoored versions — specifically, in Fedora Rawhide and Debian testing, unstable and
experimental distributions. A stable release of Arch Linux is also
affected. That distribution, however, isn’t used in production
systems. […]
Several people, including two Ars readers, reported that the
multiple apps included in the HomeBrew package manager for macOS
rely on the backdoored 5.6.1 version of xz Utils. HomeBrew has now
rolled back the utility to version 5.4.6. Maintainers have more
details available here.
There are several notable things about this hack. One is that it was years in the making — “Jia Tan”, the developer who added the back door, had been contributing legit patches to the xz project for years. Another is that it was very subtle: the ultimate goal was a back door in OpenSSH but the attacker(s) put their code in a compression library that was sometimes a dependency for another library that was itself only sometimes a dependency of OpenSSH. Yet another is that it seems nearly miraculous that it was discovered — Andres Freund, the Microsoft engineer who uncovered it, only became suspicious when he noticed that his SSH connections initiated from the command line went from taking about 0.2 seconds to 0.7 seconds. It pays to be picky sometimes!
More from Goodin here, including a good overview diagram.
Question 1: How do we keep this from happening again?
Question 2: How do we know similar back doors haven’t been successfully put in place already?
Evan Boehs: “Everything I Know About the XZ Backdoor”.
★
Dan Goodin, writing for Ars Technica:
The compression utility, known as xz Utils, introduced
the malicious code in versions 5.6.0 and 5.6.1, according
to Andres Freund, the developer who discovered it. There
are no known reports of those versions being incorporated into any
production releases for major Linux distributions, but both Red
Hat and Debian reported that recently published
beta releases used at least one of the backdoored versions — specifically, in Fedora Rawhide and Debian testing, unstable and
experimental distributions. A stable release of Arch Linux is also
affected. That distribution, however, isn’t used in production
systems. […]
Several people, including two Ars readers, reported that the
multiple apps included in the HomeBrew package manager for macOS
rely on the backdoored 5.6.1 version of xz Utils. HomeBrew has now
rolled back the utility to version 5.4.6. Maintainers have more
details available here.
There are several notable things about this hack. One is that it was years in the making — “Jia Tan”, the developer who added the back door, had been contributing legit patches to the xz project for years. Another is that it was very subtle: the ultimate goal was a back door in OpenSSH but the attacker(s) put their code in a compression library that was sometimes a dependency for another library that was itself only sometimes a dependency of OpenSSH. Yet another is that it seems nearly miraculous that it was discovered — Andres Freund, the Microsoft engineer who uncovered it, only became suspicious when he noticed that his SSH connections initiated from the command line went from taking about 0.2 seconds to 0.7 seconds. It pays to be picky sometimes!
More from Goodin here, including a good overview diagram.
Question 1: How do we keep this from happening again?
Question 2: How do we know similar back doors haven’t been successfully put in place already?
Evan Boehs: “Everything I Know About the XZ Backdoor”.
Amazon Ditches ‘Just Walk Out’ Checkouts at Its Grocery Stores
Maxwell Zell, writing for Gizmodo:
Amazon is phasing out its checkout-less grocery stores
with “Just Walk Out” technology, first reported by The
Information Tuesday. The company’s senior vice president
of grocery stores says they’re moving away from Just Walk Out,
which relied on cameras and sensors to track what people were
leaving the store with.
Just over half of Amazon Fresh stores are equipped with Just Walk
Out. The technology allows customers to skip checkout altogether
by scanning a QR code when they enter the store. Though it seemed
completely automated, Just Walk Out relied on more than 1,000
people in India watching and labeling videos to ensure
accurate checkouts. The cashiers were simply moved off-site, and
they watched you as you shopped.
It was The Information, too, that broke the story about how labor-intensive “Just Walk Out” was, reporting last May:
For its part, Amazon still relies on a significant amount of human
staffing to power Just Walk Out behind the scenes, according to a
person who has worked on the technology. Amazon had more than
1,000 people in India working on Just Walk Out as of mid-2022
whose jobs included manually reviewing transactions and labeling
images from videos to train Just Walk Out’s machine learning
model, the person said. The reliance on backup humans explains in
part why it can take hours for customers to receive receipts after
walking out of a store, the person said.
Molly White, back in January, regarding the purported AI-generated George Carlin comedy special:
Need to start keeping a list of all the times some big supposed
display of bleeding edge technology turns out to just be A Guy.
★
Maxwell Zell, writing for Gizmodo:
Amazon is phasing out its checkout-less grocery stores
with “Just Walk Out” technology, first reported by The
Information Tuesday. The company’s senior vice president
of grocery stores says they’re moving away from Just Walk Out,
which relied on cameras and sensors to track what people were
leaving the store with.
Just over half of Amazon Fresh stores are equipped with Just Walk
Out. The technology allows customers to skip checkout altogether
by scanning a QR code when they enter the store. Though it seemed
completely automated, Just Walk Out relied on more than 1,000
people in India watching and labeling videos to ensure
accurate checkouts. The cashiers were simply moved off-site, and
they watched you as you shopped.
It was The Information, too, that broke the story about how labor-intensive “Just Walk Out” was, reporting last May:
For its part, Amazon still relies on a significant amount of human
staffing to power Just Walk Out behind the scenes, according to a
person who has worked on the technology. Amazon had more than
1,000 people in India working on Just Walk Out as of mid-2022
whose jobs included manually reviewing transactions and labeling
images from videos to train Just Walk Out’s machine learning
model, the person said. The reliance on backup humans explains in
part why it can take hours for customers to receive receipts after
walking out of a store, the person said.
Molly White, back in January, regarding the purported AI-generated George Carlin comedy special:
Need to start keeping a list of all the times some big supposed
display of bleeding edge technology turns out to just be A Guy.
Google to Delete Search Data From Tens of Millions of Users Who Used ‘Incognito’ Mode in Chrome
Bobby Allyn, reporting for NPR:
Google will destroy the private browsing history of millions of
people who used “incognito” mode in its Chrome browser as a part
of a settlement filed to federal court on Monday in a
case over the company’s secret tracking of web activity. For
years, Google simply informed users of Chrome’s internet browser
that “you’ve gone Incognito” and “now you can browse privately,”
when the supposedly untraceable browsing option was turned on — without saying what bits of data the company has been harvesting.
Yet, according to a 2020 class-action lawsuit, the tech
giant continued to scrape searches by hoovering up data about
users who browsed the internet in incognito mode through
advertising tools used by websites, grabbing “potentially
embarrassing” searches of millions of people. Google then used
this data to measure web traffic and sell ads. […]
As the suit was pending, Google changed the splash screen of
incognito mode to state that websites, employers and schools and
internet service providers can view browsing activity in incognito
mode. But under the deal, Google will have to state that the
company itself can also track browsing during incognito mode.
That was quite the omission. I’m not sure there was ever a product in history more purposefully misleadingly named than Chrome’s “Incognito” mode.
★
Bobby Allyn, reporting for NPR:
Google will destroy the private browsing history of millions of
people who used “incognito” mode in its Chrome browser as a part
of a settlement filed to federal court on Monday in a
case over the company’s secret tracking of web activity. For
years, Google simply informed users of Chrome’s internet browser
that “you’ve gone Incognito” and “now you can browse privately,”
when the supposedly untraceable browsing option was turned on — without saying what bits of data the company has been harvesting.
Yet, according to a 2020 class-action lawsuit, the tech
giant continued to scrape searches by hoovering up data about
users who browsed the internet in incognito mode through
advertising tools used by websites, grabbing “potentially
embarrassing” searches of millions of people. Google then used
this data to measure web traffic and sell ads. […]
As the suit was pending, Google changed the splash screen of
incognito mode to state that websites, employers and schools and
internet service providers can view browsing activity in incognito
mode. But under the deal, Google will have to state that the
company itself can also track browsing during incognito mode.
That was quite the omission. I’m not sure there was ever a product in history more purposefully misleadingly named than Chrome’s “Incognito” mode.
Yahoo Is Acquiring Artifact, Folding It Into Yahoo News
Also from David Pierce at The Verge:
The two sides declined to share the cost of the acquisition, but
both made clear Yahoo is acquiring Artifact’s tech rather than its
team. Mike Krieger and Kevin Systrom, Artifact’s co-founders, will
be “special advisors” for Yahoo but won’t be joining the company.
Artifact’s remaining five employees have either gotten other jobs
or are planning to take some time off.
The acquisition comes a bit more than a year after Artifact’s
launch and about three months after Systrom and Krieger
announced its death. “We have built something that a core
group of users love,” the co-founders wrote in January,
“but we have concluded that the market opportunity isn’t big
enough to warrant continued investment in this way.” They said
that the biggest reason to shut down was in order to focus on
“newer, bigger and better things that have the ability to reach
many millions of people.” The bet behind Artifact was always that
AI had the potential to be a huge, internet-changing technology;
maybe there were just more interesting things to work on than a
news app without a big news audience. […]
Artifact, the app, will go away once the acquisition is
complete. But Artifact’s underlying tech for categorizing,
curating, and personalizing content will soon start to show up
on Yahoo News — and eventually on other Yahoo platforms, too.
“You’ll see that stuff flowing into our products in the coming
months,” says Downs Mulder. It sounds like there’s also a good
chance that Yahoo’s apps might get a bit of Artifact’s speed and
polish over time, too.
“Yahoo, where scrappy startup acquisitions go to thrive”, said no one, ever.
★
Also from David Pierce at The Verge:
The two sides declined to share the cost of the acquisition, but
both made clear Yahoo is acquiring Artifact’s tech rather than its
team. Mike Krieger and Kevin Systrom, Artifact’s co-founders, will
be “special advisors” for Yahoo but won’t be joining the company.
Artifact’s remaining five employees have either gotten other jobs
or are planning to take some time off.
The acquisition comes a bit more than a year after Artifact’s
launch and about three months after Systrom and Krieger
announced its death. “We have built something that a core
group of users love,” the co-founders wrote in January,
“but we have concluded that the market opportunity isn’t big
enough to warrant continued investment in this way.” They said
that the biggest reason to shut down was in order to focus on
“newer, bigger and better things that have the ability to reach
many millions of people.” The bet behind Artifact was always that
AI had the potential to be a huge, internet-changing technology;
maybe there were just more interesting things to work on than a
news app without a big news audience. […]
Artifact, the app, will go away once the acquisition is
complete. But Artifact’s underlying tech for categorizing,
curating, and personalizing content will soon start to show up
on Yahoo News — and eventually on other Yahoo platforms, too.
“You’ll see that stuff flowing into our products in the coming
months,” says Downs Mulder. It sounds like there’s also a good
chance that Yahoo’s apps might get a bit of Artifact’s speed and
polish over time, too.
“Yahoo, where scrappy startup acquisitions go to thrive”, said no one, ever.