Jeff Johnson

FYI I just published a follow-up, "The evolution of Mac app window corners": https://lapcatsoftware.com/articles/2026/3/4.html

Ok, we've switched to that from https://lapcatsoftware.com/articles/2025/5/1.html above, and I'll add a link to the follow-up to the top text.

The main issues here are the default opt-in and not announcing this feature way back in September. If someone wants this, they can always enable it if it’s opted out by default. I’d expect Apple to fix this soon. The link below is from the original author of this revelation, and is better suited for discussion, IMO. The author, Jeff Johnson, is a long time developer of applications on macOS and iOS/iPadOS. Apple Photos phones home on iOS 18 and macOS 15 Discussed five days ago at https://news.ycombinator.com/item?id=42533685 December 28 2024 https://lapcatsoftware.com/articles/2024/12/3.html The follow up is also interesting and relevant: The internet is full of experts December 31 2024 https://lapcatsoftware.com/articles/2024/12/4.html

<< this data won't be sent If there is one thing we should have learned over the past decade, it should be that if the data is collected, it will be sent. I followed the argument and I understand what you are saying. What I am saying is that it was not that long ago that FF decided to disable plugins remotely ( I think we even discussed it on HN[1]). What makes you think they won't one day push an update to just upload that local data? [1]https://lapcatsoftware.com/articles/2023/7/1.html

Speaking of macOS's firewall being broken, there's a bug (or "feature"?) in the NetworkExtension framework which causes connections to get initiated (SYN, leaks your IP address) even if there's an explicit rule to deny that connection. This affects LittleSnitch, Lulu, and all the other apps building on top of the framework. Bug reports have been filed and as usual ignored by Apple. More: Little Snitch "denied" connections leak your IP address - https://lapcatsoftware.com/articles/2023/3/4.html Follow-up to Little Snitch "denied" connections leak your IP address - https://lapcatsoftware.com/articles/2023/3/5.html Little Snitch "denied" connections leak your IP address: Developer response - https://lapcatsoftware.com/articles/2023/6/3.html https://twitter.com/JiriPospisil/status/1679838397983064064

According to the follow-up post the issue with LuLu (an alternative firewall) might be due to a bug in Mac https://lapcatsoftware.com/articles/2023/3/5.html But the issue with Little Snitch isn't a platform limitation

https://lapcatsoftware.com/articles/without-notarization.html I don't know if this still works, but it used to be that when you right-click an app bundle in Finder and select "open" (as opposed to double clicking the bundle) you get an "open anyway" option in the OMG APPLE CORP JUST WANTS YOUR BEST warning dialog.

Not sure about browser vendors and their stack. I almost never hear of anyone who develops on a browser vendor's stack, they use 3rd party tools in JS and CSS and webasm etc ... After Node wrapped up the DOM and put a bow on it, it seems that people move on (up? down? sideways?) from webdev at that level (except the people developing alternatives to Node). I'm not sure if this is the source I used, because the date is a little late, but it seems very thorough and excellent: http://lapcatsoftware.com/blog/2007/05/16/working-without-a-nib-part-1…

StopTheMadness would be a great addition to iOS Safari. https://lapcatsoftware.com/articles/StopTheMadness.html

The "not a fan of passkeys" link toward the bottom is a great read [1]. It mentions: As far as Apple is concerned, I would be satisfied if passkeys could be saved in a local, non-iCloud keychain, as normal keychain items with support for export and import. Ideally, the export format would be cross-platform, and I don't see why it couldn't be cross-platform, given that passkeys are just public-private key pairs tied to a domain. In that case, I would be happy to eliminate web passwords, since I already use randomly-generated, keychain-managed web passwords that can't be memorized (by me). Unless and until Apple provides such a solution, though, I remain extremely skeptical of passkeys and feel inclined to fight back against the notion of replacing and eliminating passwords. [1]: https://lapcatsoftware.com/articles/2023/5/1.html Would it be possible/viable for a third party to release such a piece of software? Does one already exist?

Thank you for pointing this out. The macOS appocalypse was a really shocking moment -- it was so disappointing to learn that despite the privacy marketing shtick, macOS engineers chose to have Macs phone home sensitive data in an seemingly aggressive way, with no opt out. Now in 2023 the fact that "A new preference for users to opt out of these security protections" never materialized is also super disappointing. Great write up here [0] - thanks @lapcat! Anecdata: Ever since that day I've blackholed ocsp.apple.com/ocsp2.apple.com at the DNS level, and all my Mac apps have launched just fine since. If anyone at Apple reads this, I want to be given the choice. Warn me, stuff it into whatever plist, CLI edit only -- whatever, but just let me decide. For a company with Apple's resources, it's hard to believe the OCSP test suite somehow didn't consider half-open TCP connections. If a global catastrophe like that can happen once, it can happen again - this is why, in addition to the privacy implications, Apple should IMO give us a clear opt-out. [0] https://lapcatsoftware.com/articles/ocsp.html

In a sense Mastodon reminds of the very early stages of Twitter, where there was mostly no toxicity and people were mostly kind and willing to participate in civilized discussions. Hopefully this will continue that way for longer time, given the get-popular-quick schemes that worked on Twitter don't tend to work in Mastodon. But be careful of the server you choose. I submitted this some days ago to see what people think, albeit it got no traction, so I'll put again here just in case: https://lapcatsoftware.com/articles/mastodon2.html If switching servers is not made painless and straightforward, we'll end up having a single, mostly trusted, mostly centralized server (whatever that happens to end up being), because nobody wants to see themselves in the situation of losing their accounts on a server that seemed to be trustworthy. And also nobody wants to put on themselves the burden of having to make a full research on the viability of each and every potential server that they might want to use, that's something that shouldn't be a problem solved by individual users, but a problem solved by the service itself, somehow. A Covenant is far from enough.

My sample exploit uploads some of your private data (your Top Sites, for example) to a server that I control, because that's an easy thing to do when I can run any JavaScript I want. Note that I'm not really collecting any data, as http://lapcatsoftware.com/test/ is a dead link. I used http so that you can see the private data being sent in a packet trace. Please don't do this when reproducing exploits. Yes, it's just source code, and yes, the url is dead. But it's still source code that, when compiled, will grab your real safari data and attempt to upload to a url that could be switched on. There's a difference between repro'ing an exploit and weaponizing an exploit. alert(1) is generally the best thing to aim for, or even alert(some user data) to illustrate the point. Whereas upload(some user data, my server) is a bit too close to the moral equivalent of `rm -rf $HOME/*`: all of these illustrate the point, but rm'ing a homedir is generally not a great thing to have in your repro; ditto for uploading real user data. exmaple.com was explicitly reserved for scenarios like this, which would accomplish the same thing safely. It may seem like a pedantic point, but it was something I was taught as a pentester: don't weaponize exploits; simply reproduce them. So my instincts kicked in, and it's impossible not to mention it. (That said, I don't mean to make a fuss – it's not a big deal in this case.) By the way, I found this post via the author's twitter:…

This "warning" by Rixstep is pure FUD.  Rixstep are kind of like the trolls of the Apple development community.  They regularly publish "industry watch warnings" about changes in the Mac development ecosystem that are factually incorrect at best, and are intentionally misleading to imply that Apple is killing off Mac development. I don't think anyone takes these guys seriously. Many Mac developers get upset at Rixsteps's constant barrage of fear-mongering, lies and factually incorrect "technical articles" (that are designed to make it look like the Mac SDKs are incapable of doing basic things, which they can actually do quite well). A few random complaints pulled from Google: http://www.bynkii.com/archives/2007/12/no_in_fact_i_dont_think_ill_be.… http://lapcatsoftware.com/blog/2008/02/02/fud-from-rixstep-nsdocumentc… http://forums.macrumors.com/showthread.php?t=208976 There's even a "Fake Rixstep" web site similar to Fake Steve Jobs that attempts to reveal through satire what sort of people these are:  http://thefakerixstep.blogspot.com/

> Snow Leopard was incredibly buggy on release More on that here: The myth and reality of Mac OS X Snow Leopard (November 13 2023) https://lapcatsoftware.com/articles/2023/11/5.html

macOS Tahoe has declared war on app icons with distinctive shapes. No silhouettes. If your icon isn't a squircle, it will be shrunk to fit inside a default shape. The penalty box. https://lapcatsoftware.com/articles/2025/6/2.html The loss of icon silhouettes is a big step down in usability. Erases decades of design guidelines. https://pxlnv.com/blog/roundrect-dictator/ Frankly it's senseless. https://www.flarup.email/p/through-the-liquid-glass Insane but still working legacy workaround: https://simonbs.dev/posts/how-to-bring-back-oddly-shaped-app-icons-on-… … macOS isn't fun anymore.

I'm glad to know some people are working on things that block that... https://lapcatsoftware.com/articles/mouse-tracking.html

It phones home to apple malware servers, among other things: https://lapcatsoftware.com/articles/2024/2/3.html

They asked me for a sysdiagnose when I complained about how crappy their new Finder disk icon looks on macOS 26. See this rant by Jeff Johnson, who called for a boycott on filing bugs with Apple a couple years back (I stuck to the boycott except for two obvious UI design issues in the latest OS because neither required repro steps (so why the sysdiagnose?)). https://lapcatsoftware.com/articles/2025/8/7.html Edit: accidentally called sysdiagnose a spindump.

https://lapcatsoftware.com/articles/2024/10/4.html https://sneak.berlin/20231005/apple-operating-system-surveillance/

> Phil Schiller Rings a bell. >Tim Cook asserted his control over the company, putting his own personnel in place, and now his authority is absolute. Even those few others who remain from the Jobs era, such as “Apple Fellow” Phil Schiller, are overridden by Cook https://lapcatsoftware.com/articles/2025/5/6.html by way of https://mjtsai.com/blog/2025/05/23/apple-turnaround/

https://lapcatsoftware.com/articles/2025/6/1.html > For more than 90 percent of the billings and sales facilitated by the App Store ecosystem, developers did not pay any commission to Apple. Would the remaining 10 percent of App Store sales have meaningful competition from a CLI (no GUI) terminal VM that enables development workflows on iPad?

Don't you do a bunch of original security research? [0,1,2] If there's a descriptor you'd prefer, I'm happy to update it. I'm just going by what I know of the blog and a review of the most popular posts. [0] https://lapcatsoftware.com/articles/disclosure2.html [1] https://lapcatsoftware.com/articles/disclosure.html [2] https://lapcatsoftware.com/articles/2023/7/1.html

macOS workaround: https://lapcatsoftware.com/articles/2025/1/7.html

Ah, the myth that it was some super stable release lives on. https://lapcatsoftware.com/articles/2023/11/5.html

He notes in another article[1] that macOS turns on BT on every update, and apparently the behaviour is "functioning as intended" (Apple's own words). What's not answered is why Apple do this. Possibly as trivial as avoiding bug reports or support issues about BT devices or features not working? Apple already control the stack from hardware to software so it's hardly like they would need a nefarious reason to do this. [1] https://lapcatsoftware.com/articles/bluetooth.html Also is this the same Jeff Johnson of rpm5 "fame"?

a little bit of irony, considering this submission's website: https://lapcatsoftware.com/FeedbackAssistantBoycott/

Beware that Little Snitch and other similar network filter extensions leak your IP address to the remote server even if there's an explicit block for that server. https://lapcatsoftware.com/articles/2023/6/3.html

This article compares ssh keys to passkeys (though its not the main point of the article): https://lapcatsoftware.com/articles/2023/5/1.html Discussion: https://news.ycombinator.com/item?id=35854216

You must have missed the link to the "Feedback Assistant Boycott" at the top of the page. https://lapcatsoftware.com/FeedbackAssistantBoycott/