Dan Goodin, writing for ArsTechnica: Earlier this year, Apple patched one of the most breathtaking iPhone vulnerabilities ever: a memory corruption bug in the iOS kernel that gave attackers remote access to the entire device -- over Wi-Fi, with no user interaction required at all. Oh, and exploits were wormable -- meaning radio-proximity exploits could spread from one nearby device to another, once again, with no user interaction needed. This Wi-Fi packet of death exploit was devised by Ian Beer, a researcher at Project Zero, Google's vulnerability research arm. In a 30,000-word post published on Tuesday afternoon, Beer described the vulnerability and the proof-of-concept exploit he spent six months developing single-handedly. Almost immediately, fellow security researchers took notice.

"This is a fantastic piece of work," Chris Evans, a semi-retired security researcher and executive and the founder of Project Zero, said in an interview. "It really is pretty serious. The fact you don't have to really interact with your phone for this to be set off on you is really quite scary. This attack is just you're walking along, the phone is in your pocket, and over Wi-Fi someone just worms in with some dodgy Wi-Fi packets." Beer's attack worked by exploiting a buffer overflow bug in a driver for AWDL, an Apple-proprietary mesh networking protocol that makes things like Airdrop work. Because drivers reside in the kernel -- one of the most privileged parts of any operating system -- the AWDL flaw had the potential for serious hacks. And because AWDL parses Wi-Fi packets, exploits can be transmitted over the air, with no indication that anything is amiss.

AWS today opened its re:Invent conference with a surprise announcement: the company is bringing the Mac mini to its cloud. These new EC2 Mac instances, as AWS calls them, are now available in preview. They won't come cheap, though. From a report: The target audience here -- and the only one AWS is targeting for now -- is developers who want cloud-based build and testing environments for their Mac and iOS apps. But it's worth noting that with remote access, you get a fully-featured Mac mini in the cloud, and I'm sure developers will find all kinds of other use cases for this as well. Given the recent launch of the M1 Mac minis, it's worth pointing out that the hardware AWS is using -- at least for the time being -- are i7 machines with six physical and 12 logical cores and 32 GB of memory. Using the Mac's built-in networking options, AWS connects them to its Nitro System for fast network and storage access. This means you'll also be able to attach AWS block storage to these instances, for example.

Growl is being retired after surviving for 17 years.

Its page on GitHub explains: Growl is a notification system for OS X. Growl has been around since 2004, and was originally called Global Notifications Center. The name was changed to Growl (like the noise a dog makes) since we felt the name Notifications Center was too geeky. We were wrong about that haha.

Growl was meant as a proof of concept which became something more for a long period of time. Before Growl was made developers either had to pop up a very basic window or some other ugliness nobody liked. Working with developers on Adium and Colloquy who wanted to implement their own custom notifications into their applications is what birthed this project.

Growl is a retired project, we couldn't think of another thing to change which would be substantial enough to bring out a new updated release. Growl is stable and should work for as long as intel based programs work. Anyone who wants to run Growl is free to do so in an unsupported fashion.
Lead developer Christopher Forsythe writes at 336699.org: With the announcement of Apple's new hardware platform, a general shift of developers to Apple's notification system, and a lack of obvious ways to improve Growl beyond what it is and has been, we're announcing the retirement of Growl as of today.

It's been a long time coming. Growl is the project I worked on for the longest period of my open source career... There's even a SourceForge project for Global Notifications Center still out there if you want to go find it... Without Growl I do not know that we would have any sort of decent notification system in OS X, iOS, Android or who knows what else...

For developers we recommend transitioning away from Growl at this point. The apps themselves are gone from the app store, however the code itself still lives. Everything from our rake build system to our code is available for use on our GitHub page.

Microsoft is in the early phases of rolling out its xCloud streaming service on mobile devices, but TVs are the next logical step. From a report:In an interview with The Verge, Xbox chief Phil Spencer has revealed we'll likely see an Xbox app appear on smart TVs over the next year. "I think you're going to see that in the next 12 months," said Spencer, when asked about turning the Xbox into a TV app. "I don't think anything is going to stop us from doing that." Spencer previously hinted at TV streaming sticks for Microsoft's xCloud service last month, and this latest hint suggests we might see similar hardware or an Xbox app for TVs during 2021. Microsoft is currently working on bringing xCloud to the web to enable it on iOS devices, and this work would naturally allow xCloud to expand to TVs, browsers, and elsewhere. Microsoft was previously working on a lightweight Xbox streaming device back in 2016, but it canceled the hardware. Microsoft has been testing the idea of streaming and TV sticks ever since the company originally demonstrated Halo 4 streaming from the cloud to Windows and Windows Phones all the way back in 2013.

This week Purism began shipping its mass-produced Librem 5 phone to customers, according to announcement from the company: The Librem 5 is a one-of-a-kind general-purpose computer in a phone form-factor that Purism has designed and built from scratch following a successful crowdfunding campaign that raised over $2.2 million. Both the hardware and software design is focused on respecting the end user's freedom and giving them control over their privacy and security.

The Librem 5 doesn't run Android nor iOS but instead runs the same PureOS operating system as Purism's laptops and mini PC.

The Librem 5 has unique hardware features including a user-removable cellular modem, WiFi card, and battery. Like with Librem laptops, the Librem 5 also features external hardware kill switches that cut power to the cellular modem, WiFi/Bluetooth, and front and back cameras and microphone so that the user can control when these devices are in use. All hardware switches can also be triggered together to enable "lockdown mode" which also disables the GPS, accelerometer and all other sensors...

Another unique feature of the Librem 5 is convergence: the ability to connect the Librem 5 to a monitor or laptop dock and use it as a desktop computer running the same full-sized desktop applications as on Librem laptops. When in a phone form-factor, applications behave much like "responsive websites" and change their appearance for the smaller screen. This allows you to use the Librem 5 as a phone, a desktop, or a laptop with the same applications and same files.
Their announcement notes their work on software making desktop applications "adaptive" to phone form factors, adding "This suite of software has now become the most popular software stack to use on other handheld Linux hardware." And they close with an appreciative comment from Purism's founder and CEO Todd Weaver:

"Shipping the Librem 5 has been an immense multi-year developmental effort. It is the culmination of people's desire to see an alternative to Android and iOS and fund it, coupled with dedication from a team of experts addressing hardware, kernel, operating system, and applications that has turned a lofty near-impossible goal into reality. We have built a strong foundation and with the continued support of customers, the community, and developers, we will continue to deliver revolutionary products like the Librem 5 running PureOS."

"Security researchers are blasting Apple for a feature in the latest Big Sur release of macOS that allows some Apple apps to bypass content filters and VPNs..." reports Threatpost. "While users assumed Apple would fix the flaw before the OS emerged from beta into full release, this doesn't appear to have happened."

"Beginning with macOS Catalina released last year, Apple added a list of 50 Apple-specific apps and processes that were to be exempted from firewalls like Little Snitch and Lulu," explains Ars Technica: The undocumented exemption, which didn't take effect until firewalls were rewritten to implement changes in Big Sur, first came to light in October. Patrick Wardle, a security researcher at Mac and iOS enterprise developer Jamf, further documented the new behavior over the weekend. To demonstrate the risks that come with this move, Wardle — a former hacker for the NSA — demonstrated how malware developers could exploit the change to make an end-run around a tried-and-true security measure...

Wardle tweeted a portion of a bug report he submitted to Apple during the Big Sur beta phase. It specifically warns that "essential security tools such as firewalls are ineffective" under the change.

Apple has yet to explain the reason behind the change.

Apple and Microsoft are working on adding support for the Xbox Series X controller to Apple devices, according to an Apple Support page spotted by a Reddit user. MacRumors reports: The support page states that Apple devices only support the Xbox Wireless Controller with Bluetooth, Xbox Elite Wireless Controller Series 2, Xbox Adaptive Controller, PlayStation DualShock 4 Wireless Controller, and various other MFi Bluetooth controllers. However, small print on the page states: "Microsoft and Apple are working together to bring compatibility for the Xbox Series X controller to customers in a future update." There is no mention of the Sony PlayStation 5 DualSense Controller or the Amazon Luna Controller on the Apple Support page, but MacRumors has spotted code mentioning the controllers in the iOS and iPadOS 14.3 betas.

Apple has slammed Facebook and other internet giants for their ad-targeting practices in response to a letter questioning a decision by the iPhone maker to delay a new privacy feature. From a report: The Cupertino, California-based technology company criticized Facebook's approach to advertising and user tracking, according to a written reply sent to several human rights and privacy organizations, including the Electronic Frontier Foundation and Human Rights Watch: "By contrast, Facebook and others have a very different approach to targeting. Not only do they allow the grouping of users into smaller segments, they use detailed data about online browsing activity to target ads. Facebook executives have made clear their intent is to collect as much data as possible across both first and third party products to develop and monetize detailed profiles of their users, and this disregard for user privacy continues to expand to include more of their products."

Apple's letter, reviewed by Bloomberg News, defended the company's decision to delay an iPhone feature that requires users to give explicit permission before letting apps track them for advertising purposes. The enhancement was added as part of the company's iOS 14 operating system in September, but a requirement that all apps use it was delayed until early 2021 after several developers, including Facebook, said the change would hurt their businesses. The human rights and privacy organizations criticized the delay in a letter earlier this year to Apple.

Google's Stadia game-streaming service, which has been limited to Android phones, computers and TVs, will launch for the iPhone in the coming weeks. The Verge reports: Google on Thursday announced iOS support for its Stadia cloud gaming service, following in the footsteps of Microsoft in turning to the mobile web to circumvent Apple's App Store restrictions. Google says it has been building a progressive web app version of Stadia that will run in the mobile version of Apple's Safari browser, similar to how Microsoft intends to deliver its competing xCloud service on iOS sometime next year. But Google intends to beat Microsoft to the punch with public testing of its version in the coming weeks. Nvidia also announced today that it a beta web app version of its GeForce Now cloud gaming service on iOS is available today.

Apple in late August clarified its rules around cloud gaming, telling providers like Google and Microsoft that their apps were not allowed on the App Store due to restrictions Apple imposes on software that streams games to the iPhone and iPad. Apple eventually loosened its restrictions after public criticism from Microsoft and others, but the App Store still requires companies to submit individual games for App Store review. Microsoft called the compromise a "bad experience for consumers" before deciding it would develop a web app version of xCloud for iOS instead. Now, Google is doing the same.

GeForce NOW, NVIDIA's streaming gaming service, today announced the launch of Safari integration, which will bring Fortnite and other games to Apple's iOS devices through the Safari browser. From a report: The new Safari integration is available in a beta capacity, and NVIDIA says that many games in the GeForce NOW library can be played on iOS devices. Using GeForce NOW on an iOS device requires a gamepad, and keyboard and mouse-only games are not available. NVIDIA has a list of recommended gamepads. NVIDIA is working alongside Epic Games on a touch-friendly version of Fortnite that will run on iOS devices through Safari, so Fortnite is not launching today, but it will be coming soon. Rumors earlier this month suggested that Fortnite would return to Apple's devices through a partnership with NVIDIA, and when the game launches on the GeForce NOW service, it will be the first time Fortnite has been accessible on iOS devices since the Apple vs. âOEEpic GamesâOE dispute kicked off in August.

Google is launching a major redesign of its Google Pay app on both Android and iOS today. From a report: Like similar phone-based contactless payment services, Google Pay -- or Android Pay as it was known then -- started out as a basic replacement for your credit card. Over time, the company added a few more features on top of that but the overall focus never really changed. After about five years in the market, Google Pay now has about 150 million users in 30 countries. With today's update and redesign, Google is keeping all the core features intact but also taking the service in a new direction with a strong emphasis on helping you manage your personal finances (and maybe get a deal here and there as well). Google is also partnering with 11 banks to launch a new kind of bank account in 2021. Called Plex, these mobile-first bank accounts will have no monthly fees, overdraft charges or minimum balances. The banks will own the accounts but the Google Pay app will be the main conduit for managing these accounts. The launch partners for this are Citi and Stanford Federal Credit Union.

"What we're doing in this new Google Pay app, think of it is combining three things into one," Google director of product management Josh Woodward said as he walked me through a demo of the new app. "The three things are three tabs in the app. One is the ability to pay friends and businesses really fast. The second is to explore offers and rewards, so you can save money at shops. And the third is getting insights about your spending so you can stay on top of your money." Paying friends and businesses was obviously always at the core of Google Pay -- but the emphasis here has shifted a bit. "You'll notice that everything in the product is built around your relationships," Caesar Sengupta, Google's lead for Payments and Next Billion Users, told me. "It's not about long lists of transactions or weird numbers. All your engagements pivot around people, groups, and businesses."

An anonymous reader shares a report: Marissa Mayer shoves her iPhone toward her MacBook's webcam until it overwhelms the screen on the Google Meet video call we are sharing. "I admire Apple," she declares. "They are the best at what they do. But the fact that the biggest and most successful company on Earth by some measures -- and certainly the best at design, bar none -- thinks that when you meet someone new, that this is an ideal interface is mind-blowing. It's like bad nerd humor." What Mayer is critiquing is the New Contact feature in iOS's Contacts app -- an exceedingly generic screen with fields for you to type first and last names, phone numbers, and other information. It's not uniquely uninspired. Actually, it's comparable to Google's equivalent on an Android phone -- and reminiscent of nearly every other piece of software for managing contacts we've seen throughout the history of smartphones and PCs.

[...] Now Mayer is back in the product business -- and as you may have already guessed, she thinks she has a better way to wrangle contacts. That would be Sunshine Contacts, the new iPhone app (Android is in the works) from her latest company, Sunshine. If you've previously heard of the largely stealthy startup, it was under the name Lumi Labs, which Mayer, its CEO, says was a placeholder all along. The app is launching as an invite-only closed beta; you can download it from the App Store and sign up for an alert when it's ready to let you in. Joining Mayer as cofounder and president is Enrique Munoz Torres, whose entire career has been intertwined with hers. An MIT senior when Mayer hired him as a Google associate product manager in 2004, he left that company in 2013 to join her at Yahoo, where he eventually led the advertising and search businesses. Though both Mayer and Munoz Torres have copious experience creating and ramping up successful products, they are first-time founders. Their company currently has about 20 employees, making it the same size as Google was when Mayer joined it.

Google has released today version 87 of its Chrome browser, a release that comes with a security fix for the NAT Slipstream attack technique and a broader deprecation of the FTP protocol. From a report: Todays' release is available for Windows, Mac, Linux, Chrome OS, Android, and iOS. Users can update to the new version via Chrome's built-in update utility. While in previous versions, Google has shipped some changes to Chrome settings and UI elements, almost all the major new Chrome 87 features are aimed at web developers. In Chrome 87, we have new APIs and updates to Chrome's built-in Developer Tools, such as: Support for the new Cookie Store API; new features to allow easier modification of web fonts via CSS; a new feature to let websites enumerate all the locally installed fonts; support for pan, tilt, and zoom controls on webcam streams; and, support for debugging WebAuthn operations via the Chrome DevTools.

Joseph Cox, reporting for Motherboard at Vice: The U.S. military is buying the granular movement data of people around the world, harvested from innocuous-seeming apps, Motherboard has learned. The most popular app among a group Motherboard analyzed connected to this sort of data sale is a Muslim prayer and Quran app that has more than 98 million downloads worldwide. Others include a Muslim dating app, a popular Craigslist app, an app for following storms, and a "level" app that can be used to help, for example, install shelves in a bedroom. Through public records, interviews with developers, and technical analysis, Motherboard uncovered two separate, parallel data streams that the U.S. military uses, or has used, to obtain location data. One relies on a company called Babel Street, which creates a product called Locate X. U.S. Special Operations Command (USSOCOM), a branch of the military tasked with counterterrorism, counterinsurgency, and special reconnaissance, bought access to Locate X to assist on overseas special forces operations. The other stream is through a company called X-Mode, which obtains location data directly from apps, then sells that data to contractors, and by extension, the military.

The news highlights the opaque location data industry and the fact that the U.S. military, which has infamously used other location data to target drone strikes, is purchasing access to sensitive data. Many of the users of apps involved in the data supply chain are Muslim, which is notable considering that the United States has waged a decades-long war on predominantly Muslim terror groups in the Middle East, and has killed hundreds of thousands of civilians during its military operations in Pakistan, Afghanistan, and Iraq. Motherboard does not know of any specific operations in which this type of app-based location data has been used by the U.S. military. The apps sending data to X-Mode include Muslim Pro, an app that reminds users when to pray and what direction Mecca is in relation to the user's current location. The app has been downloaded over 50 million times on Android according to the Google Play Store, and over 98 million in total across other platforms including iOS, according to Muslim Pro's website.

The first benchmark of Apple's M1 chip shows that the multi-core performance of the new MacBook Air with 8GB RAM beats out all of the 2019 16-inch MacBook Pro models, including the 10th-generation high-end 2.4GHz Intel Core i9 model. "That high-end 16-inch MacBook Pro earned a single-core score of 1096 and a multi-core score of 6870," reports MacRumors. The MacBook Air with M1 chip and 8GB RAM features a single-core score of 1687 and a multi-core score of 7433. From the report: Though the M1 chip is outperforming the 16-inch MacBook Pro models when it comes to raw CPU benchmarks, the 16-inch MacBook Pro likely offers better performance in other areas such as the GPU as those models have high-power discrete GPUs. It's worth noting that there are likely to be some performance differences between the MacBook Pro and the "MacBook Air" even though they're using the same M1 chip because the "MacBook Air" has a fanless design and the MacBook Pro has an new Apple-designed cooling system. There's also a benchmark for the Mac mini, though, and it has about the same scores. The "Mac mini" with M1 chip that was benchmarked earned a single-core score of 1682 and a multi-core score of 7067.

There's also a benchmark for the 13-inch MacBook Pro with M1 chip and 16GB RAM that has a single-core score of 1714 and a multi-core score of 6802. Like the "MacBook Air," it has a 3.2GHz base frequency. A few other "MacBook Air" benchmarks have surfaced too with similar scores, and the full list is available on Geekbench. [...] When compared to existing devices, the M1 chip in the "MacBook Air" outperforms all iOS devices. For comparison's sake, the iPhone 12 Pro earned a single-core score of 1584 and a multi-core score of 3898, while the highest ranked iOS device on Geekbench's charts, the A14 iPad Air, earned a single-core score of 1585 and a multi-core score of 4647.

Apple on Thursday released the latest version of macOS: macOS Big Sur (also known as macOS 11.0), which is available to download now -- assuming you have a compatible Mac. From a report: Big Sur is one of the biggest updates to Apple's laptop and desktop software in years, featuring a top-to-bottom redesign of the interface, icons, and menu bar, a new control center UI borrowed from iOS, widgets (also borrowed from iOS), and a variety of other improvements (see here for the full list). It's such a big change that Apple is actually moving on from the OS X / OS 10 branding that it's been using for Macs for almost 20 years. Apple's also adding some new privacy-focused features, including better tracking information in Safari and new privacy data in the Mac App Store for any apps you download. ArsTechnica has published a comprehensive review of the new operating system. An excerpt from their conclusion: The Good
The bright, fresh visual style mostly looks pretty good.
The Control Center (and other changes to the upper-right section of the Menu Bar) are genuinely useful additions.
The Messages app finally catches up to its iOS/iPadOS counterpart, thanks to Catalyst.
The APFS version of Time Machine seems like an improvement, though we'll need to wait to see what its long-term reliability is like.
Aside from the old AFP file-sharing protocol and the Network Utility, Big Sur doesn't remove too many things or add many new security settings that will break apps. There may be some visual issues, but my experience has actually been that Apple breaks a lot fewer apps moving from Catalina to Big Sur than it did moving from Mojave to Catalina.

The Bad
A general reduction in contrast makes it harder to discern the difference between many buttons and controls at a glance.
If you want to fix any of these contrast issues in the Accessibility settings, it should be possible to increase contrast or reduce transparency in certain places without making it an all-or-nothing setting. Some of the new buttons and icons are nice. Some of them are less nice.
Big Sur on Apple Silicon Macs will give up the ability to run Windows in a virtual machine or on a separate partition, though Intel Macs can still do both things.

The Ugly
As usual, Apple is just a year or two more aggressive about dropping support for old Macs than I think they really need to be.

Casey Liss: For the last year or two, I've come to realize that the number one thing that makes it harder for me to do my job is documentation. Or, more specifically, the utter dearth of documentation that Apple provides for its platforms. As a developer, Apple provides us a series of tools -- APIs -- that allow us to make apps on iOS, iPadOS, macOS, and tvOS. In many cases, it's fairly straightforward to figure out how to use these APIs. There's only so many ways you can use a screwdriver, and similarly, in many cases there's only one obvious way to use an API. However, as users rightly demand more complicated and fancy apps, the APIs often need to get more fancy and complicated as well. Suddenly you look up and, instead of only using screwdrivers and hammers, you're using power tools and complicated saws, and everything is much more fiddly than it once was. With real tools, you'd expect to receive an owner's manual, which explains how to use the tool you've just purchased. A rough analogy exists for APIs, insofar as most platform vendors will provide documentation. This is basically the "owner's manual" for that API.

Apple's documentation has, for years, been pretty bad. Over the last couple years, it has gone from bad to awful to despicable to embarrassing. All too often, I go to research how to do something new, and use an API I'm not familiar with, only to be stymied by those three dreaded words:

No overview available.

This is Apple's way of saying "Fuck you, figure it out." No overview available is so bad that a popular Apple resource -- itself something that probably shouldn't have to exist -- used it as its namesake for a single-serving site to highlight how bad Apple's documentation is. The march of progress doesn't help, either. As my friend Adam Swinden pointed out to me on Twitter, as old APIs get deprecated, often times the new ones can't be bothered to include documentation. Check out the difference between this API and the one that replaces it. No overview available. Fuck you, figure it out.

Sony confirmed today that the existing PS4 will soon let you access your other PlayStation consoles remotely, including the PS5: "We're updating PS4's Remote Play feature. Now, in addition to being able to access your PS4 from a PC or a mobile device, your PS4 can access other consoles via Remote Play too, right on your TV. This includes the ability to connect to your PS5 and stream a PS5 game to your PS4 so you can play it there." The Verge reports: VGC and Eurogamer reported today that a "PS5 Remote Play" app has already popped up on the PS4, offering up to a 1080p stream from your new console to your existing one. Perhaps you'll hook up your PS4 to the bedroom TV -- or the living room if you keep your primary console in the den? You don't necessarily need a PS4 to stream a PS5 to another room of your house, though, since the PS Remote Play app is getting updated on other platforms as well. The Windows version not only adds PS5 support at 1080p but also HDR. Sony's PS Remote Play apps for Android and iOS have been updated for the PS5, and we'd be surprised if the Mac version wasn't ready as well.

Owners of iPhones and iPads will soon be able to play Fortnite again, via a cloud service, the BBC has discovered. From a report: Nvidia has developed a version of its GeForce cloud gaming service that runs in the mobile web browser Safari. Apple will not get a cut of virtual items sold within the battle royale fighting title when played this way. Apple is embroiled in a legal fight with Fortnite's developer Epic, which led the iPhone-maker to remove the game from its iOS App Store. Epic has claimed that the 30% commission Apple charges on in-app gaming purchases is anti-competitive. But Apple has accused Epic of wanting a "free ride". The case is due to go to trial in May and could take years to be resolved. Papers filed in the case indicate that Fortnite had 116 million users on iOS, 73 million of whom only played it via Apple's operating system. Unlike Android, Apple does not allow games or other apps to be loaded on to its phones or tablets via app stores other than its own. But it does not restrict which third-party services can run within Safari or other web browsers available via its store.

Facebook recently announced that WhatsApp passed the whopping milestone of 100 billion messages sent per day, but not everyone wants those chats to stick around forever. Now, Facebook's wildly popular messaging app with 2 billion users is adding a feature to give people more control on how their words and pictures live within the app. From today, messages -- including photos and videos -- can now be marked to disappear after 7 days. From a report: Disappearing messages are being rolled out globally across Android and iOS starting today, WhatsApp said. While it's starting with a 7 day lifespan, it is already looking at playing around with the time limits. "We will keep an eye on feedback about how people are using it and liking it and see if it needs adjusting in the future," a spokesperson said. "For now we are starting with seven days, because it feels like a nice balance between the utility you need for global text based conversations and the feeling of things not sticking around forever." And just to be clear, the 7-day limit will exist regardless of whether the message gets read or not. (The disappearing message clock starts counting when the message is sent, as it does on other apps like Telegram.)