Linuz Henze, a credible researcher, has revealed an exploit that in a single button press can reveal the passwords in a Mac's keychain. From a report: Keychain is where macOS stores most of the passwords used on the machine, ranging from iMessage private encryption keys to certificates, secured notes, Wi-Fi, and other Apple hardware passwords, app passwords, and web passwords. A pre-installed app called Keychain Access enables users to view the entire list of stored items, unlocking each one individually by repeatedly entering the system password, but Henze's KeySteal exploit grabs everything with a single press of a "Show me your secrets" button.

While the demo is run on a 2014 MacBook Pro without Apple's latest security chips, Henze says that it works "without root or administrator privileges and without password prompts, of course." It appears to work on the Mac's login and system keychains, but not iCloud's keychain. Generally, white hat security researchers publicly reveal flaws like this only after informing the company and giving it ample time to fix the issues. But Henze is refusing to assist Apple because it doesn't offer paid bug bounties for macOS.

Following Mozilla's footsteps, Google has released Chrome 72 for Windows, Mac, and Linux. From a report: The release includes code injection blocking and new developer features. You can update to the latest version now using Chrome's built-in updater or download it directly from google.com/chrome. With over 1 billion users, Chrome is both a browser and a major platform that web developers must consider. In fact, with Chrome's regular additions and changes, developers often must make an effort to stay on top of everything available -- as well as what has been deprecated or removed -- most notably, Chrome 72 removes support for Chromecast setup on a computer. To set up a Chromecast, you'll now need to use a mobile device.

As this isn't a major release, there aren't many new features to cover. Chrome 72 for Windows, however, blocks code injections, reducing crashes caused by third-party software. The initiative to block code injections in Chrome started last year, with warnings letting users know that Chrome was fighting back. Those warnings are now gone, and Chrome blocks code injections full stop. Further reading: All the Chromium-based browsers.

Due to an economic slowdown in China and diminishing demand for new iPhones, Apple's profits in its most recent quarter were flat compared with a year earlier. "The disappointing financial performance had been expected since Jan. 2, when Apple, for the first time in 16 years, revised its forecast for the quarter," reports The New York Times. "But the announcement on Tuesday indicates a difficult road head for Apple, which just five months ago became the first company to be worth more than $1 trillion. The company said it expected between $55 billion and $59 billion in revenue in the current quarter, just below analysts' expectations for $59 billion. Apple's earnings per share were $4.18, beating analysts' expectations by a penny."

In addition to the quarterly earnings, Apple reported revenue of $84.3 billion, a decline of 5 percent from one year ago. "Revenue from iPhone declined 15 percent from the prior year, while total revenue from all other products and services grew 19 percent," Apple said in a press release. Analysts had estimated revenue of $83.97 billion and earnings of $4.17 per share. "While it was disappointing to miss our revenue guidance, we manage Apple for the long term, and this quarter's results demonstrate that the underlying strength of our business runs deep and wide," said Tim Cook. Apple's active install base of 1.4 billion is "a great testament to the satisfaction and loyalty of our customers, and it's driving our services business to new records thanks to our large and fast-growing ecosystem," Cook said. The Verge adds: "iPhones account for 900 million of those devices. iPad revenues were up 17 percent against the year-ago quarter; Mac was up 9 percent; and Wearables/Home/Accessories were up by 33 percent."

Firefox 65, the latest version of Mozilla's web browser, is now available for Windows, Mac, Linux, and Android platforms. The release brings simplified Content Blocking controls for Enhanced Tracking Protection, support for WebP image support with the Windows client getting an additional feature: support for AV1 format. From a report: Across all platforms, Firefox can now handle Google's WebP image format. WebP supports both lossy and lossless compression and promises the same image quality as existing formats at smaller file sizes. Firefox 65 for desktop brings redesigned controls for the Content Blocking section to let users choose their desired level of privacy protection. You can access it by either clicking on the small "i" icon in the address bar and clicking on the gear on the right side under Content Blocking or by going to Preferences, Privacy & Security, and then Content Blocking.

Next, Firefox now supports AV1, the royalty-free video codec developed by the Alliance for Open Media. AV1 improves compression efficiency by more than 30 percent over the codec VP9, which it is meant to succeed. Lastly, Firefox's new Task Manager page (just navigate to about:performance or find it under "Other" in the main menu) is complete. Introduced in Firefox 64, Task Manager now reports memory usage for tabs and add-ons.

An anonymous reader quotes a report from ZDNet: A Microsoft program manager has caused a stir on Twitter over the weekend by suggesting that Firefox-maker Mozilla should give up on its own rendering engine and move on with Chromium. "Thought: It's time for @mozilla to get down from their philosophical ivory tower. The web is dominated by Chromium, if they really 'cared' about the web, they would be contributing instead of building a parallel universe that's used by less than five percent?" wrote Kenneth Auchenberg, who builds web developer tools for Microsoft's Visual Studio Code.

Auchenberg's post referred to Mozilla's response to Microsoft's announcement in December that it would scrap Edge's EdgeHTML rendering engine for Chromium's. The move will leave Firefox's Gecko engine as the only alternative to Chromium, which is used by Opera and dozens of other browsers. Few people agreed with Auchenberg, including engineers from both Mozilla and Chromium. Long-serving Mozillian Asa Dotzler was not impressed. "Just because your employer gave up on its own people and technology doesn't mean that others should follow," Dotzler replied to Auchenberg. Auchenberg clarified that he didn't want to see Mozilla vanish, but said it should reorganize into a research institution "instead of trying to to justify themselves with the 'protectors of the web' narrative."

An anonymous reader shares a report: Despite a trade war between the United States and China and past admonishments from President Trump "to start building their damn computers and things in this country," Apple is unlikely to bring its manufacturing closer to home. A tiny screw illustrates why. [Editor's note: the link may be paywalled; alternative source.]

In 2012, Apple's chief executive, Timothy D. Cook, went on prime-time television to announce that Apple would make a Mac computer in the United States. It would be the first Apple product in years to be manufactured by American workers, and the top-of-the-line Mac Pro would come with an unusual inscription: "Assembled in USA." But when Apple began making the $3,000 computer in Austin, Tex., it struggled to find enough screws, according to three people who worked on the project and spoke on the condition of anonymity because of confidentiality agreements.

In China, Apple relied on factories that can produce vast quantities of custom screws on short notice. In Texas, where they say everything is bigger, it turned out the screw suppliers were not. Tests of new versions of the computer were hamstrung because a 20-employee machine shop that Apple's manufacturing contractor was relying on could produce at most 1,000 screws a day. The screw shortage was one of several problems that postponed sales of the computer for months, the people who worked on the project said. By the time the computer was ready for mass production, Apple had ordered screws from China.

On Thursday, Tim Cook took to Twitter to celebrate the 35th anniversary of the Macintosh, recalling how it changed the world. "35 years ago, Macintosh said hello. It changed the way we think about computers and went on to change the world. We love the Mac, and today weâ(TM)re proud that more people than ever are using it to follow their passions and create the future," Cook tweeted. The Register provides a brief history lesson on how the Mac changed how users interact with computers. Here is an excerpt from the report: After the disastrous debut of the Lisa, and the abject failure of the Apple III, it was down to the Steve Jobs-led Macintosh project to save the day for the troubled computer manufacturer. Rival IBM had launched the Personal Computer XT just under a year earlier, in March 1983, with up to 640KB of RAM and a mighty Intel 8088 CPU. It also included PC-DOS 2, which would go on to underpin Microsoft's operating system efforts in subsequent decades. IBM had started to rule the PC industry, but what the IBM PC XT did not have was a graphical user interface, sticking instead with the sober command line of DOS. The Macintosh, on the other hand, had a GUI lifted from Apple's ill-fated Lisa project, except (and unusually, as things would turn out) retailed at a lower price of $2,495 (just over $6,000 in today's money). It ran faster than the Lisa too, with its Motorola 68000 CPU clocked at 7.8MHz.

The good news ended there. The machine shipped with a woeful 128KB of RAM, which was shared with the black and white 512 x 342 pixel display built into the box. That 128KB was resolutely not upgradable, and fans would have to wait until September for Apple to unleash a 512KB version for another $300. The only storage provided was a single 400KB 3 1/2;-inch disk, an improvement over the 360KB 5¼-inch floppies of IBM's PC XT and the nature of the box meant that any extra storage would have to be external. Users became quickly accustomed to swapping floppies in order to do what little useful work the pitiful 128K would afford. Third parties eventually launched hard drives for the machines, which had to be attached via the serial port. Apple would make a 20MB drive in the form of the Hard Disk 20 available in September 1985 for the 512KB Mac at a cost of $1,495. Owners of the original 128K Mac, however, needed not apply. The limited RAM made the new Hierarchical File System a non-starter.

Apple has hired an executive from the battery-making division of Samsung to help lead its own battery work. The new hire suggests that the company might start making its own batteries for iPhones and Macs. Bloomberg reports: Soonho Ahn joined Apple in December as global head of battery developments, after working as a senior vice president at Samsung SDI since 2015, according to his LinkedIn profile. At Samsung SDI, Ahn led development of lithium battery packs and worked on "next-generation" battery technology, the profile says. Apple has used batteries from Samsung SDI to power its own products in the past. The iPhone maker has been trying to reduce reliance on third-party components, and the notable battery technology hire suggests it may be doing the same for batteries. Apple has been working on its own MicroLED display technology for future devices, which would help wean itself off Samsung in other areas. It's also increasingly building its own processors and is investigating the development of its own cellular modems.

The next time you open up a new Apple computer, go to the App Store to start downloading apps, and type in "Microsoft Office," you'll actually get something. From a report: Until now, anyone who wanted to use Microsoft Office and its popular Word, Excel, PowerPoint and OneNote apps had to do so by going to Microsoft's website and downloading it all from there. Now, the are available on the Mac App Store as well, making it even easier for people to download and use.

An anonymous reader quotes a report from Ars Technica, written by Sean Gallagher: Want to be able to run classic Mac OS applications compiled for the Motorola 68000 series of processors on your ever-so-modern Mac OS X machine? Or maybe you'd rather run them on a Raspberry Pi, or an Android device for that matter? There's an emulation project that's trying to achieve just that: Advanced Mac Substitute (AMS). Advanced Mac Substitute is an effort by long-time Mac hacker Josh Juran to make it possible to run old Mac OS software (up to Mac OS 6) without a need for an Apple ROM or system software. Other emulators out there for 64000 Mac applications such as Basilisk II require a copy of MacOS installation media -- such as install CDs from Mac OS 7.5 or Mac OS 8. But AMS uses a set of software libraries that allow old Mac applications to launch right within the operating environment of the host device, without needing to have a full virtual hardware and operating system instance behind them. And it's all open source.

I got a demo of AMS from Juran at Shmoocon in Washington, DC, this past weekend. He showed me an early attempt at getting the game LoadRunner to work with the emulator -- it's not yet interactive. A version of the project, downloadable from Github, includes a "Welcome" screen application (a sort of Mac OS "hello world"), Mac Tic-Tac-Toe, and an animation of NyanCat. Applications are launched from the command line for now and are executed by the emulation software, which interprets the system and firmware calls. Unfortunately, there's still a lot of work to be done. While AMS works on Mac OS X up to version 10.12 -- both on Intel and PowerPC versions of the operating system -- the code currently won't compile on MacOS Mojave. And the Linux implementation of AMS does not yet support keyboard input. I was unable to get the front end to execute at all on Debian 9 on Intel.

"Google engineers have proposed changes to the open-source Chromium browser that will break content-blocking extensions, including various ad blockers," reports The Register. "The drafted changes will also limit the capabilities available to extension developers, ostensibly for the sake of speed and safety. Chromium forms the central core of Google Chrome, and, soon, Microsoft Edge." From the report: In a note posted Tuesday to the Chromium bug tracker, Raymond Hill, the developer behind uBlock Origin and uMatrix, said the changes contemplated by the Manifest v3 proposal will ruin his ad and content blocking extensions, and take control of content away from users. Manifest v3 refers to the specification for browser extension manifest files, which enumerate the resources and capabilities available to browser extensions. Google's stated rationale for making the proposed changes is to improve security, privacy and performance, and supposedly to enhance user control.

But one way Google would like to achieve these goals involves replacing the webRequest API with a new one, declarativeNetRequest. The webRequest API allows extensions to intercept network requests, so they can be blocked, modified, or redirected. This can cause delays in web page loading because Chrome has to wait for the extension. In the future, webRequest will only be able to read network requests, not modify them. The declarativeNetRequest allows Chrome (rather than the extension itself) to decide how to handle network requests, thereby removing a possible source of bottlenecks and a potentially useful mechanism for changing browser behavior. The report notes that Adblock Plus "should still be available" since "Google and other internet advertising networks apparently pay Adblock Plus to whitelist their online adverts."

An anonymous reader quotes a report from Motherboard: Apple security expert Jon Callas, who helped build protection for billions of computers and smartphones against criminal hackers and government surveillance, is now taking on government and corporate spying in the policy realm. Jon Callas is an elder statesman in the world of computer security and cryptography. He's been a vanguard in developing security for mobile communications and email as chief technology officer and co-founder of PGP Corporation -- which created Pretty Good Privacy, the first widely available commercial encryption software -- and serving the same roles at Silent Circle and Blackphone, touted as the world's most secure Android phone.

As a security architect and analyst for Apple computers -- he served three stints with the tech giant in 1995-1997, 2009-2011, and 2016-2018 -- he has played an integral role in helping to develop and assess security for the Mac and iOS operating systems and various components before their release to the public. His last stretch there as manager of a Red Team (red teams hack systems to expose and fix their vulnerabilities) began just after the FBI tried to force the tech giant to undermine security it had spent years developing for its phones to break into an iPhone belonging to one of the San Bernardino shooters. But after realizing there's a limit to the privacy and surveillance issues technology companies can address, Callas decided to tackle the issues from the policy side, accepting a two-year position as senior technology fellow for the American Civil Liberties Union. Callas spoke to Motherboard about government backdoors, the need for tech expertise in policymaking, and what he considers the biggest challenge for the security industry.

Windows 10 Mobile devices will be officially unsupported starting on December 10, 2019. As a result, Microsoft is recommending users move to an Android or iOS device instead. Mac Rumors reports: Microsoft made the recommendation in a Windows 10 Mobile support document (via Thurrott) explaining its plans to stop offering security updates and patches for Windows 10 Mobile: "With the Windows 10 Mobile OS end of support, we recommend that customers move to a supported Android or iOS device. Microsoft's mission statement to empower every person and every organization on the planet to achieve more, compels us to support our Mobile apps on those platforms and devices." All customers who have a Windows 10 Mobile device will be able to keep using it after December 10, 2019, but no further updates will be available.

An anonymous reader quotes ZDNet: German authorities have asked the public for help in surfacing more details and potentially identifying the owner of a MAC address known to have been used by a bomber in late 2017... The MAC address is f8:e0:79:af:57:eb. Brandenburg police say it belongs to a suspect who tried to blackmail German courier service DHL between November 2017 and April 2018. The suspect demanded large sums of money from DHL and threatened to detonate bombs across Germany, at DHL courier stations, private companies, and in public spaces. [The bomb threats were real, but one caught fire instead of exploding, while the second failed to explode, albeit containing real explosives.]

Investigators called in to negotiate with the bomber managed to exchange emails with the attacker on three occasions, on April 6, 2018, April 13, 2018, and April 14, 2018. One of the details obtained during these conversations was the bomber's MAC address, which based on the hardware industry's MAC address allocation tables, should theoretically belong to a Motorola phone... Now, they're asking router owners to check router access logs for this address, and report any sightings to authorities. Investigators want to know to what routers/networks the bomber has connected before and after the attacks, in order to track his movements and maybe gain an insight into his identity.

Apple CEO Tim Cook told CNBC's Mad Money host Jim Cramer that the company will announce new "services" this year, suggesting that Apple might be planning to launch its long-awaited TV service in the first half of 2019. "While Cook didn't say what kind of services -- Cramer was asking whether Apple had any tricks up its services sleeve, including healthcare or mobile payments -- it's the long-awaited TV service that has recently seen all the pieces fall into place," notes The Verge. From the report: Here at CES 2019, there's been a series of surprise announcements from TV manufacturers that are suddenly supporting Apple's AirPlay 2 and HomeKit features to allow you to cast content directly from your iPhone, iPad and Mac -- including TVs running rival operating systems from Google and Samsung. New TVs from rival Samsung will actually support iTunes, too, letting you access your movies and TV shows there as well. It wouldn't be a stretch to think Apple might be priming the pump with those hardware manufacturers for the upcoming TV service, too.

Then, there's content: We reported last June how Apple has been spending over $1 billion on original TV content with no obvious place for users to watch it. Another report suggested that some of those original shows were slated to debut as soon as this March. And another still claimed that those shows might be free for people who own Apple devices. But even if the TV service is one of the "services" Cook mentioned, it's not clear what other services Apple might be talking about.

Albums sold on vinyl and cassette both saw a growth in sales according to BuzzAngle Music's End-Year Report profiling U.S. music industry consumption for 2018. From a report: Vinyl sales grew by just shy of 12% from 8.6 to 9.7 million sales, while cassette sales grew by almost 19% from 99,400 to 118,200 copies sold in the US, The Verge reported. Sixty-six percent of those vinyl sales were of albums that are more than three years old and feature classic bands like The Beatles, Fleetwood Mac, and Pink Floyd, reported BuzzAngle. Cassettes saw popularity in newer releases. CDs on the other hand have declined by 18.5% in popularity leading to a total decline in physical album sales of over 15%, reported The Verge. Meanwhile, audio streaming saw an increase of 41.8%, the largest of all music consumption.

Rather than serving up platitudes about innovation, the man charged with saving former unicorn Evernote says his priority this year is addressing the long list of user complaints. From a report: Despite some progress, Evernote continued to struggle last year, cutting 15 percent of its staff and losing many top executives.So what doesn't work? Lots of stuff, much of it very basic, new CEO Ian Small says: "Frankly, it's a bit disingenuous for me to try to get our most dedicated users all fired up about inventing the future of Evernote when exactly those same people are the ones who know best that sync doesn't always work right. Or that Evernote on Windows is a bit tired, and is missing features that are found on the Mac version. Or that each version of Evernote seems to work slightly differently, and exhibits its own unique collection of bugs and undesirable behaviors. Or that Evernote on mobile devices sometimes feels like a pared-down version of a powerful desktop app, instead of a mobile-first view into a powerful cloud-enabled productivity environment." Small says these problems have lingered for years and were well-known, but he didn't want to get into why they weren't fixed sooner. Instead, he promises the main focus of 2019 will be dealing with these and numerous other issues.

Glenn Fleishman, writing for MacWorld: It seems like it was only yesterday that I first used BareBones Software's BBEdit, but in actuality, yesterday is so far away -- 25 years, in fact. With all the twists and turns across more than two decades of Apple as a company, Mac hardware, and the underlying operating system, you might think that BBEdit stands alone as a continuously-developed app shepherded largely or exclusively by the same independent developer -- an app without a giant company behind it. As it turns out, BBEdit is one of several apps that's been around the block more than a few times.

The longevity of indie apps is more extraordinary when you consider the changes Apple put the Mac through from the early 1990s to 2018. Apple switched from Motorola 680x0 processors to PowerPC to Intel chips, from 32-bit to 64-bit code, and among supported coding languages. It revved System 7 to 8 to 9, then to Unix across now 15 major releases (from 10.0 to 10.14). That's a lot for any individual programmer or small company to cope with. Bare Bones's head honcho, Rich Siegel, and the developers behind three other long-running Mac software programs shared with me their insight on development histories for over 25 years, what's changed the most during that time, and any hidden treasures users haven't yet found. You can hear more on BareBones Software's in this recent episode of The Talk Show, a podcast by DaringFireball's John Gruber.

Apple has for years been a premium brand that rarely, if ever discounted products. Every year, the company could raise prices on products, and consumers would not only happily pay, but stand in long lines for the privilege of doing so. From a report: So when Apple started putting misleading, but seemingly consumer-friendly posters in front of Apple Stores at the end of 2018 offering a new iPhone model for $300 off (with trade-in of your current phone), you know something different happened for the company this year. Consumers fought back. Many analysts have reported that in the wake of poorer-than-expected sales for this year's crop of iPhones, Apple cut back on production, including on the $1,100 iPhone XS Max, the $999 iPhone XS and the XR, the "budget" model that replaced the previous entry-level new phone, the $349 SE. The price for the XR (the one Apple is hawking discounts for): $749.

"This should be a wakeup call for Apple," says Daniel Ives, an analyst with Wedbush Securities. "They swung, and they really missed." The prices on the new phones are "far too high," says Terry Walton, a tourist from Auckland, New Zealand. He has an iPhone 7 and didn't even consider any of the X-series iPhones because it still works just fine. Upgrading "didn't enter my mind at all," he says. It wasn't just iPhones that got price hikes. Apple also upped the cost of the top-of-the-line iPad to $1,000 as well (or over $2,800 for a loaded model) and added $300 to the cost of the Mac Mini and new MacBook Air computers.

Tim May, co-founder of the influential Cypherpunks mailing list and a significant influence on both bitcoin and WikiLeaks, passed away in mid-December at his home in Corralitos, California. The news was announced last Saturday on a Facebook post written by his friend Lucky Green. Long-time Slashdot reader SonicSpike quotes Reason: In his influential 1988 essay, "The Crypto Anarchist Manifesto," May predicted that advances in computer technology would eventually allow "individuals and groups to communicate and interact with each other" anonymously and without government intrusion. "These developments will alter completely the nature of government regulation [and] the ability to tax and control economic interactions," he wrote... Running 497 words, it was his most influential piece of writing... May became convinced that public-key cryptography combined with networked computing would break apart social power structures...

In September 1992, May and his friends Eric Hughes and Hugh Daniels came up with the idea of setting up an online mailing list to discuss their ideas. Within a few days of its launch, a hundred people had signed up for the Cypherpunks mailing list. (The group's name was coined by Hughes' girlfriend as a play on the "cyberpunk" genre of fiction.) By 1997, it averaged 30 messages daily with about 2,000 subscribers. May was its most prolific contributor. May and Hughes, along with free speech activist John Gilmore, wore masks on the cover of the second issue of Wired magazine accompanying a profile by journalist Steven Levy, who described the Cypherpunks as "more a gathering of those who share a predilection for codes, a passion for privacy, and the gumption to do something about it...."

WikiLeaks founder Julian Assange was an active reader and participant on the list, contributing his first posts in 1995 under the name "Proff."
The article notes that May "recently expressed disgust with the current state of the cryptocurrency community, citing its overpriced conferences and the advent of 'bitcoin exchanges that have draconian rules about KYC, AML, passports, freezes on accounts and laws about reporting 'suspicious activity' to the local secret police.'"

In his last published interview he told CoinDesk "I think Satoshi would barf."