An anonymous reader quotes a report from Wired: Apple has a well-earned reputation for security, but in recent years its Safari browser has had its share of missteps. This week, a security researcher publicly shared new findings about vulnerabilities that would have allowed an attacker to exploit three Safari bugs in succession and take over a target's webcam and microphone on iOS and macOS devices. Apple patched the vulnerabilities in January and March updates. But before the fixes, all a victim would have needed to do is click one malicious link and an attacker would have been able to spy on them remotely.

The bugs Pickren found all stem from seemingly minor oversights. For example, he discovered that Safari's list of the permissions a user has granted to websites treated all sorts of URL variations as being part of the same site, like https://www.example.com, http://example.com and fake://example.com. By "wiggling around," as Pickren puts it, he was able to generate specially crafted URLs that could work with scripts embedded in a malicious site to launch the bait-and-switch that would trick Safari. A hacker who tricked a victim into clicking their malicious link would be able to quietly launch the target's webcam and microphone to capture video, take photos, or record audio. And the attack would work on iPhones, iPads, and Macs alike. None of the flaws are in Apple's microphone and webcam protections themselves, or even in Safari's defenses that keep malicious sites from accessing the sensors. Instead, the attack surmounts all of these barriers just by generating a convincing disguise.

Apple has brought its hardware microphone disconnect security feature to its latest iPads. From a report: The microphone disconnect security feature aims to make it far more difficult for hackers to use malware or a malicious app to eavesdrop on a device's surroundings. The feature was first introduced to Macs by way of Apple's T2 security chip last year. The security chip ensured that the microphone was physically disconnected from the device when the user shuts their MacBook lid. The idea goes that physically cutting off the microphone from the device prevents malware -- even with the highest level of âoerootâ device permissions -- from listening in to nearby conversations. Apple confirmed in a support guide that its newest iPads have the same feature. Any certified "Made for iPad" case that's attached and closed will trigger the hardware disconnect.

Yesterday, Apple said it would stop taking a cut of some sales for "qualifying" streaming video services on iPhones and other Apple devices, including Amazon's Prime Video. Reuters reports: To make purchases inside apps on its App Store, Apple requires the use of its own payment systems and takes a commission of between 15% and 30% before passing on the rest to the third-party app developer. Many of Apple's rivals in streaming music and video, such as Netflix and Spotify, avoid paying those commissions by asking users to sign up with a credit card outside the App Store. That leaves those rivals' apps serving as log-in screens for existing customers.

In an emailed statement, Apple said that for "qualifying premium video entertainment apps such as Prime Video, Altice One, and Canal+, customers have the option to buy or rent movies and TV shows using the payment method tied to their existing video subscription." Apple also said the services will function better with Apple devices and apps, for example by letting users ask its voice assistant, Siri, to find shows on the third-party services. Last March, Spotify filed a complaint with EU antitrust regulators against Apple, saying the iPhone maker unfairly limits rivals to its own Apple Music streaming service. Spotify also raised the issue with the U.S. Justice Department and the House Judiciary Committee, "both of which have antitrust probes pending regarding Apple," notes Reuters.

Apple's native iOS password manager may be getting an overhaul later this year with the presumed release of iOS 14 that will make it more competitive with third-party options like 1Password and LastPass, reports 9to5Mac. From a report: Right now, iCloud Keychain can store your passwords and help autofill them on the iPhone, where copying and pasting long strings of letters and numbers or manually doing so has been a headache since the advent of the mobile touchscreen. But it doesn't have reminders for changing those passwords like competitors do, and it doesn't support two-factor authentication (2FA) options. That means users are still stuck using potentially insecure methods like SMS or email in the event that they do have 2FA set up.

Apple acquired popular mobile weather service Dark Sky to help bolster the Weather applications on its devices. From a report: The service, which has existed on the web and on iPhone and Android platforms, stood out from the competition by offering more specific data and notifications such as when it is about to rain. Dark Sky announced the deal on its website, saying "we're thrilled to have the opportunity to reach far more people, with far more impact, than we ever could alone." The companies didn't specify the price of the deal. Apple has included a Weather app on its devices since the first iPhone and currently gets its data from The Weather Channel. It could use this purchase to revamp its Weather app.

Apple launched its own coronavirus screening site and iOS app developed alongside the White House, CDC and FEMA. From a report: The site is pretty simple with basic information about best practices and safety tips alongside a basic screening tool which should give you a fairly solid idea on whether or not you need to be tested for COVID-19. The site which is -- of course -- accessible on mobile and desktop also includes some quick tips on social distancing, isolation, hand-washing, surface disinfecting and symptom monitoring. The app, which contains identical information to the site, is US-only at the moment while the website is available worldwide. Depending on your symptoms, the site will push you to get in contact with your health provider, contact emergency services or it will inform you that you likely do not need to be tested. It will not route you to a testing center directly. Apple says that its app and website gather or collect zero personal information about anyone using it.

An anonymous reader quotes a report from Bleeping Computer: A currently unpatched security vulnerability affecting iOS 13.3.1 or later prevents virtual private network (VPNs) from encrypting all traffic and can lead to some Internet connections bypassing VPN encryption to expose users' data or leak their IP addresses. While connections made after connecting to a VPN on your iOS device are not affected by this bug, all previously established connections will remain outside the VPN's secure tunnel as ProtonVPN disclosed.

The bug is due to Apple's iOS not terminating all existing Internet connections when the user connects to a VPN and having them automatically reconnect to the destination servers after the VPN tunnel is established. "Most connections are short-lived and will eventually be re-established through the VPN tunnel on their own," ProtonVPN explains. "However, some are long-lasting and can remain open for minutes to hours outside the VPN tunnel." During the time the connections are outside of the VPN secure communication channels, this issue can lead to serious consequences. For instance, user data could be exposed to third parties if the connections are not encrypted themselves, and IP address leaks could potentially reveal the users' location or expose them and destination servers to attacks. Until Apple provides a fix, the company recommends using Always-on VPN to mitigate this problem. "However, since this workaround uses device management, it cannot be used to mitigate the vulnerability for third-party VPN apps such as ProtonVPN," the report adds.

iFixit tore apart the updated MacBook Air and found that Apple made a few changes making for a more repairable notebook than the last generation. All in all, the new 2020 MacBook Air got a 4/10 repairability score from iFixit, which is one point higher than the previous-gen model which scored 3/10. 9to5Mac reports: iFixit highlights in its full teardown that the update to the reliable Magic Keyboard only added 0.5mm to the thick end of the new MacBook Air... a more than worth it trade-off: "More than anything, that 0.5 mm illustrates the sheer unnecessary-ness of the five painful years that Mac fans spent smashing on unresponsive butterfly keyboards. Knowing that Apple's thinnest-and-lightest notebook accommodates a scissor-switch keyboard so gracefully makes us wonder what it was all for. We understand as well as anyone the urge to fix things, but Apple's insistence on reworking and re-reworking the troubled butterfly design came at such a high cost -- financially, environmentally, and to the Mac's reputation -- and for what? We'll probably never know all the factors that led to the creation and persistence of the butterfly keyboard, but this Magic keyboard is a reminder that sometimes the difference between usable and unusable, or repairable and unrepairable, can be as small as half a millimeter."

Past the keyboard update, iFixit found a nice improvement to how Apple has implemented the trackpad cable: "Where last year the trackpad cables were trapped under the logic board, they are now free to be disconnected anytime -- meaning trackpad removal can happen as soon as the back cover comes off. And since the battery rests under these same cables, this new configuration also greatly speeds up battery removal by leaving the logic board in place. That's two very tasty birds, one stone, for those of you counting. This is one of those happy (but all too rare) occasions where we can identify a hardware change from Apple that's squarely aimed at improving serviceability in the existing design. Sometimes they do listen!"

Video-game fans suddenly have their pick of a huge menu of titles thanks to a raft of new mobile subscription services from Apple, Microsoft, Alphabet's Google and Nvidia. But for the more than 1 billion users of Apple's iPhone and iPad, the only real option is Arcade, the subscription service launched by the company in September. From a report: That's because Apple imposes strict limits on the kinds of apps users can access on its devices. For example, App Store guidelines ban services that rely on streaming from the cloud. Arcade adheres to the requirements, in part, because it's included as a feature within the App Store itself. This is the latest example of what critics say are arbitrary rules favoring Apple's own apps at the expense of similar software from outside developers. "There's a fraught relationship between developers and Apple precisely because of rules like this," said David Barnard, a longtime independent developer and advocate at RevenueCat. "In some ways, I am incredibly grateful to their marketplace for helping me make millions of dollars I wouldn't have made without it. On the flip side, them being so heavy handed at times does kill apps and does cause developers to miss out on other potential revenue." If software developers want to reach as many consumers as possible, they have to be on Apple's iOS. The operating system powers more than 1 billion smartphones and tablets and it's the only way to access the iOS App Store, which accounted for 65% of app spending globally last year, according to Sensor Tower. The Cupertino, California-based company can also make or break mobile gaming businesses: More than half of the $62 billion spent on smartphone gaming last year happened on Apple products.

Apple today officially released versions 13.4 of iOS, iPadOS, and tvOS to the public, alongside macOS 10.15.4 and watchOS 6.2. While many of their improvements are minor, there are a few standout features across the updates. From a report: One of the most noteworthy additions is a dramatic expansion of iPadOS 13's prior trackpad and mouse support, which was limited solely to an Accessibility option before evolving to full system-wide support across all iPad models capable of running iPadOS 13.4. Now, keyboard-trackpad hybrids (such as the upcoming Magic Keyboard for iPad), standalone trackpads, and standalone mice can create a cursor that highlights and selects on-screen text and objects, paving the way for more Mac-like apps on Apple's tablets. Another major improvement is cross-platform support for a new universal app purchase option, enabling a single app developed using Apple's shared Catalyst framework to be purchased and run across Macs, iPhones, iPads, and Apple TVs. This feature went live for developers yesterday, and it uses the iOS App Store as the base for universal apps. Standalone Mac App Store app listings will likely need to be abandoned for the transition to universal apps.

Remember how Apple closed all of its stores outside China? It's preventing some customers from picking up their repaired devices, according to 9to5Mac: As we noted last week, Apple Stores remained partially open for two days following the shutdown announcement. During this time, Apple contacted customers with pending device repairs and asked them to come pick up their products. Inevitably, some customers missed this opportunity. An Apple spokesperson told Business Insider that there's no way for customers who missed the two-day pickup period to get their devices:

Some customers did not pick up their devices within the two-day pickup period, and those devices are still in Apple Stores, the spokesperson said. Unfortunately for those who missed the pickup window, there's no way for them to get their devices until Apple Stores re-open, the spokesperson said....

It's also important to note that devices sent offsite for repair, whether it be iPhone, iPad, Mac, or Apple Watch, are still being returned to customers via shipment. In a normal scenario, Apple would ship the repaired devices back to retail stores, then customers would come pick them up. During the Apple Store shutdown, however, devices are being shipped directly from repair centers to customers instead.

An anonymous reader quotes Engadget: Hospitals in numerous countries are struggling to provide basic supplies to healthcare workers, and tech companies are pitching in to address the shortfall. Tim Cook has revealed that Apple is donating "millions" of masks to healthcare professionals in Europe and the U.S.
Their article notes that Alibaba has also been donating masks, test kits, protective suits and face shields, while Elon Musk's companies are exploring the production of ventilators.

"It's part of a positive trend and suggests that tech companies may play a significant role in fighting the pandemic whether or not they have directly relevant expertise."

U.K. based road safety charity IAM RoadSmart has released a study showing how in-vehicle infotainment systems can substantially impair driver's reaction times even more than alcohol and cannabis. AppleInsider reports: The test involved two experimental trials focusing on Android Auto and Apple CarPlay. Twenty Android and twenty Apple users would be subjected to the same simulated test route. Each driver drove three times: A control drive, where they did not interact with the system, a voice-enabled drive where they used the voice system only, and a touch-enabled drive, where they used the touch screen of the system only. As part of the test, users would be required to follow another car, navigate an erratic motorway, and perform a figure-eight loop. During these tests, users would be told to perform a task, such as accessing music on Spotify, input data into a navigation app, or read texts and take phone calls. Additionally, participants would be asked to flash their headlights whenever a red bar appeared on the screen, which measured their reaction time to external events.

Regardless of the infotainment system, all users showed significantly slowed reaction time. Undistracted drivers typically showed a one-second reaction time. Those who used the voice-controlled Apple CarPlay saw a 36% increase in their reaction time, which rose to 57% when they used the touch interface. Android Auto users faired only slightly better -- a 30% increase in reaction time when using voice control, and 53% when using touch controls. For comparison, those who drive under the influence at the drink-drive limit showed a 12% increase in reaction time, and those who used cannabis saw a 21% increase. Those who used Android Auto saw a 1.73-foot (0.53-meter) deviation on their lane positioning when performing navigation tasks with Android Auto. Those who used Apple CarPlay saw a deviation of 1.64 feet (0.50 meters.)

One of the biggest new additions to Apple's new iPad Pro is a new "Light Detection and Ranging" (LIDAR) system on the rear camera, which Apple argued was the missing piece for revolutionary augmented reality applications. "It claims that by combining the depth information from the LIDAR scanner with camera data, motion sensors, and computer vision algorithms, the new iPad Pro will be faster and better at placing AR objects and tracking the location of people," reports The Verge. "But it doesn't change the fact that, right now, there still aren't a lot of compelling reasons to actually use augmented reality apps on a mobile device beyond the cool, tech-demo-y purposes that already exist." From the report: R apps on iOS today are a thing you try out once, marvel at how novel of an idea it is, and move on -- they're not essential parts of how we use our phones. And nearly three years into Apple's push for AR, there's still no killer app that makes the case for why customers -- or developers -- should care. Maybe the LIDAR sensor really is the missing piece of the puzzle. Apple certainly has a few impressive tech demos showing off applications of the LIDAR sensor, like its Apple Arcade Hot Lava game, which can use the data to more quickly and accurately model a living room to generate the gameplay surface. There's a CAD app that can scan and make a 3D model of the room to see how additions will look. Another demo promises accurate determinations of the range of motion of your arm.

The fact that Apple is debuting the iPad for AR doesn't help the case, either. While Apple has been rumored to be working on a proper augmented reality headset or glasses for years -- a kind of product that could make augmented digital overlays a seamless part of your day-to-day life -- the iPad (in 11-inch and 12.9-inch sizes) is effectively the opposite of that idea. It's the same awkwardness of the man who holds up an iPad to film an entire concert; holding a hardcover book-sized display in front of your face for the entire time you're using it just isn't a very natural use case.

It's possible that Apple is just laying the groundwork here, and more portable LIDAR-equipped AR devices (like a new iPhone or even a head-mounted display) are on their way in the future. Maybe the LIDAR sensor is the key to making more immersive, faster, and better augmented apps. Apple might be right, and the next wave of AR apps really will turn the gimmicks into a critical part of day-to-day life. But right now, it's hard not to look at Apple's LIDAR-based AR push as another hardware feature looking for the software to justify it.

Apple on Wednesday announced the Magic Keyboard, featuring a trackpad, that will work with newly unveiled iPad Pro models and some previous generation iPads. Is this the "convergence" everyone had been waiting for? A "2 in 1" or a tablet or a toaster-refrigerator? Did Apple capitulate? Some context on the evolution of devices, from Steven Sinofsky, former President of the Windows Division at Microsoft. He writes: Hardware evolves just like software but we don't often see it the same way. We're used to talking about the cycle software bundling and unbundling, but hardware does the same thing. Every new generation of hardware begins this cycle anew. Certainly we're used to hardware adding ports or absorbing new technologies over time. Where things get really interesting with hardware is when a new "form" is introduced, often the first step is jettisoning many features from the leader. With the introduction of a form, the debate immediately begins over whether the new form can take over or whether it is a substitute for the old one. Tech dialog is rather divisive over these questions (dodged by marketing). "It can never work" or "It will eventually work." The industry works hard to create these dividing lines. The way it does this is first because usually there are new manufacturers that make the new form.

Second, pundits attach labels to form factors and begin a process of very specific definitions (dimensions, peripherals.) The first one of these transitions I remember is the introduction of portable computers. Out of the gate, these were way less powerful than "PCs." The debate over whether a portable can "replace" a "PC" was in full force. Quickly the form factor of portable evolved and with that came all sorts of labels: luggable, portable, notebook, desktop, sub-notebook, and so on. This continued all the way until the introduction of "ultra-books." If you're a maker these labels are annoying at best. (1987) Quite often these are marketing at work -- manufacturers looking to differentiate an otherwise commodity product create a new name for the old thing done slightly differently. Under the hood, however, the forms are evolving. In fact the way they are evolving is often surprising. The evolution of new forms almost always follows the surprising pattern of *adding back* all those things from the old form factor. So all those portables, added more floppies, hard disks, then expansion through ports/docks, and then ultimately CPUs as powerful as desktop.

Then we wake up one day and look at the "new" form and realize it seems to have morphed into the old form, capabilities and all. All along the way, the new form is editing, innovating, and reimagining how those old things should be expressed in the new one. These innovations can change software or hardware. But this is where hardware devices like USB come from -- the needs of the new form dictate new types of hardware even if it solves the same problem again. The evolution of PCs to become Servers offers an interesting arc. PCs were literally created to be smaller and less complex computers. They eliminated all the complexity of mainframes at every level while making computing accessible and cheap. When first PCs began to do server tasks, they did those in an entirely different way than mainframes that were servers of the day. They used commodity desktop PCs -- literally the same as a desktop running in an office. That was the big advantage -- cheap, ubiquitous, open! Mainframe people balked at this crazy notion. It was an obvious moment of "that is a toy." Then the age of client server computing was before us, starting in the late 1990s. But what followed was a classic case of convergent evolution. PC Servers started to add attributes of mainframes. At first this seemed totally crazy -- redundant power supplies, RAID, multi processors, etc. THAT was crazy stuff for those $1M mainframes. Pretty soon at h/w level telling a PC Server from a MF became a vocabulary exercise. And here we are today where server to stripped the very elements rooted in PC (like monitors and keyboards!) Guess what? That's a mainframe! On Twitter, this would be: "Mainframe, you've invented a mainframe.

Except, the operating system and software platform is entirely different. The evolution was not a copy, but a useful convergence done through an early series of steps copying followed by distinct and innovative approaches that created a new value ... a new form factor. So here we are today with an iPad that has a trackpad. Many are chuckling at the capitulation that the iPad was never a real computer and finally Apple admitted it. Laptop, Apple has invented the laptop. This was always going to happen. From the earliest days there were keyboard cases that turned iPads into "laptops" (w/o trackpads) and these could be thought of as experiments copying the past. It took time (too much?) to invent the expression of the old in the new. The PC server everyone uses in the cloud today is no mainframe. It is vastly cheaper, more accessible, more scaleable, runs different software (yes people will fight me on these in some way, but the pedantic argument isn't the point). Adding a trackpad to iPad was done in a way that reimagined not just the idea of a pointer, but in the entire package -- hardware and software. That's what makes this interesting. To think of it as capitulation would be to do so independent of how computing has evolved over decades.

Despite COVID-19 forcing Apple to close down all retail stores outside of China indefinitely, the company just announced a new 11- and 12.9-inch iPad Pro (starting at $799 and $949, respectively). From a report: Last refreshed in 2018, the new iPad Pros come with a faster A12Z Bionic chip equipped with an 8-core CPU and GPU, a new ultra-wide camera and a "LiDAR scanner" for AR. However, the most surprising (or not surprising) announcement is a new Magic Keyboard accessory with a trackpad (which starts at $249). Simply put: Apple just turned the iPad Pro into a laptop. The gap between an iPad Pro and Microsoft's Surface Pro is now narrower than ever before. This could mean the beginning of the end for MacBooks. There's lots to unpack about the new iPad Pros.

Apple is saying the A12Z Bionic chip has an 8-core CPU and 8-core GPU, but stopped short of saying how much faster it is compared to the A12 Bionic in the iPhone 11 and 11 Pro. Apple only says the gigabit-class LTE is 60 percent faster and the battery life is still the same 10 hours. The cameras on the back look like the iPhone 11 Pro's triple-camera setup at first glance. But they're not. First, the ultra-wide camera is 10 megapixels versus 12 megapixels on the iPhone 11 and 11 Pro. And second, the third lens isn't a telephoto lens, but a "LiDAR Scanner" which Apple says improves AR applications. The LiDAR Scanner "measures the distance to surrounding objects up to 5 meters away, works both indoors and outdoors, and operates at the photon level at nano-second speeds."

Apple's A14 processor that's expected to debut this fall in Apple's iPhone 12 models is rumored to have a frequency reaching 3.1GHz. "This would be 400MHz higher than Apple's current A13 Bionic chip with a frequency of 2.7GHz," reports MacRumors. From the report: At such a frequency, the chip's Geekbench 5 running points have surged. The report mentions that the A14's single-core performance shows a score of 1658 (up 25% from the A13), and a multi-core score of 4612 points (up 33% from the A13). The extra processing power will be helpful in running simultaneous workflows, navigating through apps, and more. Apple chipmaker TSMC is expected to ramp up production of Apple's 5nm-based A14 chipsets in as early as April of this year. Also, according to 9to5Mac, Apple is reportedly planning to launch a new 5.5-inch entry-level iPhone with a solid state home button, Touch ID, and support for Apple Pay's Express Transit feature.

The 5.5-inch iPhone is expected to be priced $100 more than the 4.7-inch model that will start at $399, according to Apple analyst Ming-Chi Kuo. It's slated to launch at the end of March, but it's possible the launch will be delayed due to the coronavirus.

France's competition agency has announced a $1.23 billion fine against Apple, claiming the tech giant conspired with distributors of gadgets such as the iPad to fix prices and limit competition. From a report: The decision came from France's L'Autorite de la concurrence and is its largest fine ever. The agency said Apple tightly restricted supplies and effectively required distributors such as Tech Data and Ingram Micro to charge the same prices for devices that could also be purchased through its own online and physical retail stores. "It is the heaviest sanction pronounced against an economic player, in this case Apple, whose extraordinary size has been duly taken into account," said agency director Isabelle de Silva in a statement. The agency also respectively levied fines of $84.7 million and $69 million against Tech Data and Ingram Micro for their roles in agreeing to terms that hurt other smaller distributors.

AmiMoJo quotes MacRumors: Apple today updated its support document on cleaning Apple products with new information that confirms it's okay to to use a 70 percent isopropyl alcohol wipe or Clorox Disinfecting Wipes for the purpose of cleaning germs from your devices. Prior to now, Apple's cleaning guidelines have recommended against all cleaners, warning that the chemicals have the potential to damage the oleophobic coating on iPhone and iPad displays. Apple still warns against aerosol sprays, ammonia, window cleaners, hydrogen peroxide, bleach, compressed air, and abrasives.

The Wall Street Journal's Joanna Stern tested Apple's new guidelines over the course of the last week. Using a new iPhone 8, she wiped the display 1,095 times with Clorox Disinfecting Wipes, the estimated equivalent of the number of times an iPhone might be cleaned over the course of three years. After all the wiping, the oleophobic coating on the iPhone's display was in good condition with no perceived damage.

Willy English writes: Apple will be temporarily closing its stores outside Greater China until March 27 but its online stores will still be open.

In a tweet, CEO Tim Cook said that "we must do all we can to prevent the spread of COVID-19...." He added that the iPhone-maker will also be committing $15 million to help with the recovery. [Apple is also matching employee donations two-to-one to support COVID-19 response efforts locally, nationally and internationally.]

All of Apple's stores in China were set to open after the outbreak forced a prolonged closure of its retail locations. The U.S. technology giant has 42 stores in China and while all have opened their doors, some are operating on limited hours. [CNBC noted that they opened "with limited operating hours."]