The European Union narrowed a probe into Apple's allegedly unfair treatment of music streaming firms such as Spotify, refocusing on curbs that prevent firms from steering users away from the App Store. From a report: The European Commission on Tuesday said it's issued a revised charge sheet known as a statement objections, two years after hitting the tech company with a broader complaint laying out how it thinks Apple abused its power as the "gatekeeper" for apps on its devices. The EU regulator said it no longer targets concerns "as to the legality" of Apple's practice of imposing its own in-app purchase payment technology on music streaming app developers. Instead, the probe homes in "on the contractual restrictions that Apple imposed on app developers which prevent them from informing iPhone and iPad users of alternative music subscription options at lower prices outside of the app and to effectively choose those."

Apple has taken billions from game developers but failed to reinvest it, leaving the App Store a confusing mess for mobile gamers, writes Neil Long, former App Store editor. The Guardian: Late last year, the developer of indie hit Vampire Survivors said it had to rush-release a mobile edition to stem the flow of App Store clones and copycats. Recently a fake ChatGPT app made it through app review and quickly climbed the charts before someone noticed and pulled it from sale. It's not good enough. Apple could have reinvested a greater fraction of the billions it has earned from mobile games to make the App Store a good place to find fun, interesting games to fit your tastes. But it hasn't, and today the App Store is a confusing mess, recently made even worse with the addition of ad slots in search, on the front page and even on the product pages themselves.

Search is still terrible, too. Game developers search in vain for their own games on launch day, eventually finding them -- having searched for the exact title -- under a slew of other guff. Mobile games get a bumpy ride from some folks -- this esteemed publication included -- for lots of reasons. [...] However, finding the good stuff is hard. Apple -- and indeed Google's Play store -- opened the floodgates to developers without really making sure that what's out there is up to standard. It's a wild west. Happily things may be about to change -- including that 30% commission on all in-app purchases. After a bruising US court battle between Apple and Epic Games over alleged monopolistic practices, government bodies in the UK, EU, US, Japan and elsewhere are examining Apple and Google's "effective duopoly" over what we see, do and play on our phones.

Since the earliest versions of the iPhone, "The ability to dynamically execute code was nearly completely removed," write security researchers at Trellix, "creating a powerful barrier for exploits which would need to find a way around these mitigations to run a malicious program. As macOS has continually adopted more features of iOS it has also come to enforce code signing more strictly.

"The Trellix Advanced Research Center vulnerability team has discovered a large new class of bugs that allow bypassing code signing to execute arbitrary code in the context of several platform applications, leading to escalation of privileges and sandbox escape on both macOS and iOS.... The vulnerabilities range from medium to high severity with CVSS scores between 5.1 and 7.1. These issues could be used by malicious applications and exploits to gain access to sensitive information such as a user's messages, location data, call history, and photos."

Computer Weekly explains that the vulnerability bypasses strengthened code-signing mitigations put in place by Apple on its developer tool NSPredicate after the infamous ForcedEntry exploit used by Israeli spyware manufacturer NSO Group: So far, the team has found multiple vulnerabilities within the new class of bugs, the first and most significant of which exists in a process designed to catalogue data about behaviour on Apple devices. If an attacker has achieved code execution capability in a process with the right entitlements, they could then use NSPredicate to execute code with the process's full privilege, gaining access to the victim's data.

Emmitt and his team also found other issues that could enable attackers with appropriate privileges to install arbitrary applications on a victim's device, access and read sensitive information, and even wipe a victim's device. Ultimately, all of the new bugs carry a similar level of impact to ForcedEntry.

Senior vulnerability researcher Austin Emmitt said the vulnerabilities constituted a "significant breach" of the macOS and iOS security models, which rely on individual applications having fine-grain access to the subset of resources needed, and querying services with more privileges to get anything else.
"The key thing here is the vulnerabilities break Apple's security model at a fundamental level," Trellix's director of vulnerability research told Wired — though there's some additional context: Apple has fixed the bugs the company found, and there is no evidence they were exploited.... Crucially, any attacker trying to exploit these bugs would require an initial foothold into someone's device. They would need to have found a way in before being able to abuse the NSPredicate system. (The existence of a vulnerability doesn't mean that it has been exploited.)

Apple patched the NSPredicate vulnerabilities Trellix found in its macOS 13.2 and iOS 16.3 software updates, which were released in January. Apple has also issued CVEs for the vulnerabilities that were discovered: CVE-2023-23530 and CVE-2023-23531. Since Apple addressed these vulnerabilities, it has also released newer versions of macOS and iOS. These included security fixes for a bug that was being exploited on people's devices.
TechCrunch explores its severity: While Trellix has seen no evidence to suggest that these vulnerabilities have been actively exploited, the cybersecurity company tells TechCrunch that its research shows that iOS and macOS are "not inherently more secure" than other operating systems....

Will Strafach, a security researcher and founder of the Guardian firewall app, described the vulnerabilities as "pretty clever," but warned that there is little the average user can do about these threats, "besides staying vigilant about installing security updates." And iOS and macOS security researcher Wojciech ReguÅa told TechCrunch that while the vulnerabilities could be significant, in the absence of exploits, more details are needed to determine how big this attack surface is.

Jamf's Michael Covington said that Apple's code-signing measures were "never intended to be a silver bullet or a lone solution" for protecting device data. "The vulnerabilities, though noteworthy, show how layered defenses are so critical to maintaining good security posture," Covington said.

After an iPhone was stolen, $10,000 vanished from the owner's bank account — and they were locked out of their Apple account's photos, contacts and notes. The thieves "stole thousands of dollars through Apple Pay" and "opened an Apple Card to make fraudulent charges," writes 9 to 5 Mac, citing a report from the Wall Street Journal. These thieves often work in groups with one distracting a victim while another records over a shoulder as they enter their passcode. Others have been known to even befriend victims, asking them to open social media or other apps on their iPhones so they can watch and memorize the passcode before stealing it. A 12-person crime ring in Minnesota was recently taken down after targeting iPhones like this in bars. Almost $300,000 was stolen from 40 victims by this group before they were caught.
The Journal adds that "similar stories are piling up in police stations around the country," while one of their article's authors has tweeted Apple's official response. "We sympathize with users who have had this experience and we take all attacks on our users very seriously, no matter how rare.... We will continue to advance the protections to help keep user accounts secure."

The reporter suggests alphanumeric passwords are harder to steal, while MacRumors offers some other simple fixes. "Use Face ID or Touch ID as much as possible when in public to prevent thieves from spying... In situations where entering the passcode is necessary, users can hold their hands over their screen to hide passcode entry."

According to Bloomberg, Apple's quest to bring blood glucose monitoring to the Apple Watch is now at a "proof-of-concept stage." The last remaining hurdle is for it to be made smaller. Engadget reports: The technology, which uses lasers to gauge glucose concentration under the skin, was previously tabletop sized but has reportedly advanced to the point where an iPhone-sized wearable prototype is in the works. The system would not only help people with diabetes monitor their conditions, but would ideally alert people who are prediabetic, the insiders say. They could then make changes that prevent Type 2 (adult onset) diabetes.

The project has supposedly been in development for a long time. It began in 2010, when an ailing Steve Jobs had his company buy blood glucose monitoring startup RareLight. Apple is said to have kept the effort secret by operating it as a seemingly isolated firm, Avolonte Health, but folded it into a previously unknown Exploratory Design Group (XDG). CEO Tim Cook, Apple Watch hardware lead Eugene Kim and other top leaders have been involved.

Any real-world product is likely years away, according to Bloomberg. The industry also doesn't have a great track record of bringing no-prick monitors to market. In 2018, Alphabet's health subsidiary Verily scrapped plans for a smart contact lens that would have tracked glucose using tears. Even major brands with vast resources aren't guaranteed success, in other words, and it's not clear how accurate Apple's solution would be.

Medical device maker AliveCor announced today that President Biden has upheld an International Trade Commission ruling that could result in a potential import ban on the Apple Watch over its EKG feature. The Verge reports: Back in December, the ITC issued a final determination (PDF) that Apple had infringed on AliveCor's wearable EKG tech. In the ruling, the ITC recommended a limited exclusion order and a cease-and-desist order for Apple Watch models with EKG features. If enforced, that would mean that Apple would no longer be able to import Apple Watch with EKG capabilities into the US for sale. According to Apple spokesperson Hannah Smith, the company will appeal the ITC's decision to the Federal Circuit.

A veto from Biden would have rendered the issue moot. According to The Hill, while presidents generally don't interfere with ITC rulings, in 2013, former President Obama vetoed a similar import ban after the ITC ruled that iPhones and iPads infringed on Samsung tech. It's possible that Apple was hoping for history to repeat itself, as it reportedly amped up lobbying last week ahead of Biden's decision.

https://www.theverge.com/2023/1/11/23550036/the-apple-watchs-blood-oxygen-feature-is-at-the-center-of-a-potential-import-ban Biden's decision doesn't mean every Apple Watch from the Series 4 to the Apple Watch Ultra (excluding both generations of the SE) is about to disappear off shelves. Apple's Smith told The Verge the ITC's ruling doesn't have any real impact at the moment. That's because the Patent Trial and Appeal Board recently ruled that AliveCor's EKG tech isn't actually patentable, and AliveCor would have to win its appeal (PDF) to that ruling for any potential ban to take effect. However, AliveCor isn't the only medical tech company that's seeking an import ban on the Apple Watch via the ITC. Masimo also sued Apple for allegedly infringing on five of its pulse oximetry patents. Last month, an ITC judge also ruled in Masimo's favor and will decide whether a potential import ban is warranted in May. If so, that import ban would impact any Apple Watch with an SpO2 sensor (i.e., the Series 6 or later, excluding the SE.)

According to The Register, Google has been paying Apple a portion of search revenue generated by people using Google Chrome on iOS. From the report: This is one of the aspects of the relationship between the two tech goliaths that currently concerns the UK's Competition and Markets Authority (CMA). Though everyone knows Google pays Apple, Samsung, and other manufacturers billions of dollars to make its web search engine the default on devices, it has not been reported until now that the CMA has been looking into Chrome on iOS and its role in a search revenue sharing deal Google has with Apple. The British competition watchdog is worried that Google's payments to Apple discourage the iPhone maker from competing with Google. Substantial payments for doing nothing incentivize more of the same, it's argued. This perhaps explains why Apple, though hugely profitable, has not launched a rival search engine or invested in the development of its Safari browser to the point that it could become a credible challenger to Chrome.

Having Google pay Apple "a significant share of revenue from Google Search traffic" passing through its own Chrome browser on iOS is difficult to explain. Apple does not provide any obvious value to people seeking to use Google Search within Google Chrome. One attempt to explain the arrangement can be found in an antitrust lawsuit filed on December 27, 2021, and subsequently amended [PDF] on March 29, 2022. The complaint, filed by the Alioto Law Firm in San Francisco, claims Apple has been paid for the profits it would have made if it had competed with Google, without the cost and challenge of doing so. "Because more than half of Google's search business was conducted through Apple devices, Apple was a major potential threat to Google, and that threat was designated by Google as 'Code Red,'" the complaint contends. "Google paid billions of dollars to Apple and agreed to share its profits with Apple to eliminate the threat and fear of Apple as a competitor."

These alleged revenue sharing arrangements -- which are known in detail only to a limited number of people and have yet to be fully disclosed -- have been noted by the UK CMA as well as the US Justice Department, which along with eleven US States, filed an antitrust complaint against Google on October 20, 2020. Reached by phone, attorney Joseph M. Alioto, who filed the private antitrust lawsuit, told The Register it would not surprise him to learn that Google has been paying Apple for search revenue derived from Chrome. He said Google's deal with Apple, which began at $1 billion per year, reached as high as $15 billion annually in 2021. "The division of the market is per se illegal under the antitrust laws," said Alioto. Apple and Google are currently trying to have the case dismissed citing lack of evidence of a horizontal agreement between the two companies, and other supposed deficiencies.

Google has been paying Apple a portion of search revenue generated by people using Google Chrome on iOS, The Register reported Friday, citing a source. This is one of the aspects of the relationship between the two tech goliaths that currently concerns the UK's Competition and Markets Authority (CMA), the report added. From the report: Though everyone knows Google pays Apple, Samsung, and other manufacturers billions of dollars to make its web search engine the default on devices, it has not been reported until now that the CMA has been looking into Chrome on iOS and its role in a search revenue sharing deal Google has with Apple. We twice asked Apple and Google to confirm or deny what we've learned, and neither corporation would talk. We also approached the CMA, and a spokesperson for the monopoly regulator said: "The CMA cannot comment on or disclose any confidential information."

A new Apple patent application describes a way to transform an iMessage to a voice note. In this way, the recipient can choose to have your message read to them not in Siri's voice, but in yours. 9to5Mac reports: In other words, when you send an iMessage, your phone would offer you the option to attach a voice file. This file would be automatically created and stored on your phone, based on your use of Siri. If you do this, the recipient would be asked whether they want to receive the voice file as well as the message. If they choose to do this, then both that message and any subsequent messages from you can be read in a simulation of your voice. The patent also allows for the voice file to be sent on its own, so you can do it ahead of time with selected contacts, so there's no delay in downloading it when a message arrives.

Apple has once again delayed its announcement event for the Apple AR/VR headset. Originally expected to debut in the spring, Bloomberg reports that Apple is now targeting its WWDC conference in June as the new date for the product's unveiling. 9to5Mac reports: That's a delay of two months compared to the previously-rumored April release date. The headset device, likely branded the 'Apple Reality Pro', will represent Apple's first hardware venture in the augmented reality and virtual reality market. The product has been many years in the making, and has faced multiple late-stage hardware and software development setbacks in the run up to launch.

Of course, nothing is set in stone until Apple officially announces the event publicly. But there was strong indications that Apple was originally ramping up for a mid-late 2022 debut. This was then pushed back to January of this year, and then April, and now early summer -- according to Bloomberg. The Bloomberg report says the reason for the latest delay is multi-faceted and both hardware and software issues are to blame.

Customers of Spotify's audiobook narration firm say that they were not adequately informed of a contract clause that they agreed to, that ultimately allowed Apple to use their voices in its AI training. From a report: Apple quietly released a range of audio Apple Books in early January 2023, which were narrated by voices entirely generated by Artificial Intelligence. Publishers and professional voice actors objected that this was removing a major source of income, but Apple claimed it was still committed to artists.

Specifically, Apple said that the new AI audiobooks were only done for titles where it was not economic to hire an actor. So that would be low-circulation ones such as textbooks, small presses, and self-published titles. Now according to Wired, voiceover artists and authors working with a company called Findaway have complained about Apple using them to train their own AI replacements. Findaway is effectively a self-publishing audio company that is owned by Spotify, where authors pay to have audiobooks produced. As yet, it appears that no actors working for traditionally published titles -- where the audiobook is produced by the publisher without a charge to the author -- have complained.

The Justice Department has ramped up work in recent months on drafting a potential antitrust complaint against Apple, WSJ reported Wednesday, citing people familiar with the matter. From the report: The investigation into whether Apple has monopoly power that it abuses began in 2019, but enforcers have escalated their efforts in recent months, with more litigators now assigned to the case and new requests for documents and consultations with companies involved, the people said. The Justice Department's investigation deals in part with Apple's policies governing mobile third-party software on its devices, which has been the focus of much of the criticism targeting Apple's competitive practices. The department is also looking at whether Apple's mobile operating system, iOS, operates in an anticompetitive way by favoring its own products over those of outside developers, the people said.

A 50% rejection rate for iPhone casings produced by an Indian company is a stark illustration of the difficulties Apple faces in reducing its dependence on China. 9to5Mac reports: Apple's target for casings that fail to pass quality control is 0%, with Chinese suppliers reportedly getting extremely close to this. The attitude of Indian suppliers is also said to compare poorly with the can-do approach of Chinese companies, with one former Apple engineer saying that there is no sense of urgency in its Indian supply chain...

The Financial Times reports that poor yields is a key challenge faced by Apple in attempting to replicate its Chinese supply chain in India: "At an iPhone casings factory in Hosur run by Indian conglomerate Tata, one of Apple's suppliers, just about one out of every two components coming off the production line is in good enough shape to eventually be sent to Foxconn, Apple's assembly partner for building iPhones, according to a person familiar with the matter. This 50 per cent 'yield' fares badly compared with Apple's goal for zero defects. Two people that have worked in Apple's offshore operations said the factory is on a plan towards improving proficiency but the road ahead is long."

Tech entrepreneur and academic Vivek Wadhwa said that it will likely take three years or so for Indian suppliers to be capable of the kind of volume production needed to make a noticeable dent in Chinese production. [...] He also suggested that Apple, too, will need to adapt -- especially when it comes to dealing with the bureaucratic government: "He suggested its engineers learn the art of jugaad -- a way of 'making do' or transcending obstacles. 'Because everything in India is an obstacle,' he said."

Two non-profit news site, the Markup and Grist, have co-published their investigation into how big tech rewrote America's first cellphone repair law.

"That New York passed any electronics right-to-repair bill is 'huge,' Repair.org executive director Gay Gordon-Byrne told Grist. But 'it could have been huger' if not for tech industry interference." The passage of the Digital Fair Repair Act last June reportedly caught the tech industry off guard, but it had time to act before Governor Kathy Hochul would sign it into law. Corporate lobbyists went to work, pressing for exemptions and changes that would water the bill down. They were largely successful: While the bill Hochul signed in late December remains a victory for the right-to-repair movement, the more corporate-friendly text gives consumers and independent repair shops less access to parts and tools than the original proposal called for. (The state Senate still has to vote to adopt the revised bill, but it's widely expected to do so.)

The new version of the law applies only to devices built after mid-2023, so it won't help people to fix stuff they currently own. It also exempts electronics used exclusively by businesses or the government. All those devices are likely to become electronic waste faster than they would have had Hochul, a Democrat, signed a tougher bill. And more greenhouse gases will be emitted manufacturing new devices to replace broken electronics....

Jessa Jones, who founded iPad Rehab, an independent repair shop in Honeoye Falls, about 20 miles south of Rochester, New York, says the original bill included provisions that would have made it far easier for independent shops like hers to get the tools, parts, and know-how needed to make repairs. She pointed to changes that allow manufacturers to release repair tools that only work with spare parts they make, while at the same time controlling how those spare parts are used... "If you keep going down this road, allowing manufacturers to force us to use their branded parts and service, where they're allowed to tie the function of the device to their branded parts and service, that's not repair," Jones said. "That's authoritarian control."
The bill's sponsor believes it could create momentum for dozens of other states trying to pass similar laws, the article points out, possibly leading ultimately to one national agreement between electronics manufacturers and the repair community. A lawmaker from another state argued that New York's law "gives us something to work from. We're going to take that now and try to do a better piece of legislation."

Thanks to long-time Slashdot reader Z00L00K for submitting the article.

Months after a successful vote, Apple Store employees in Glasgow have become the company's first retail workers to form a union in the UK. Engadget reports: Apple and the trade union GMB Scotland have signed a collective bargaining agreement that theoretically gives staff at the Buchanan Street store more clout when pushing for improved working conditions. The Glasgow employees voted to unionize in November. They sought better pay, increased wage transparency and improved shift scheduling. Union negotiators characterized talks with Apple as positive, but it took several months before workers cast ballots. Further reading: Are Unionization Efforts Picking Up at Tech Companies?

An anonymous reader shares a report: Apple Chief Executive Officer Tim Cook, speaking on an earnings call that was mostly focused on holiday results, made an off-the-cuff remark that could be quite telling about the company's future. Cook was fielding a question about whether the iPhone's rising average sales price was sustainable. After all, a top-of-the-line model that cost $1,150 in 2017 (the iPhone X with 256 gigabytes of storage) now fetches $1,600 (the iPhone 14 Pro Max with 1 terabyte).

His response: The price increase is no problem. In fact, consumers could probably be persuaded to spend more. "I think people are willing to really stretch to get the best they can afford in that category," Cook said on the call, noting that the iPhone has become "integral" to people's lives. Consumers now use the device to make payments, control smart-home appliances, manage their health and store banking data, he said. While Cook wouldn't say if he anticipates further price increases, he made a good argument for why even more upscale iPhones could make sense -- especially if they deliver new features. Apple has internally discussed adding a higher-end iPhone to the top of its smartphone lineup.

9to5Mac is reporting that Apple pulled the Damus app from its App Store in China on Thursday, "with the developers being informed that the Nostr app 'includes content that is illegal in China.'" Apple rejected the app multiple times, applying the app review guidelines that would apply to a social networking service. In reality, all Damus does is provide access to Nostr feeds, so it would be more accurate to consider it akin to a web browser, with the developers having no control over, or responsibility for, the content of those feeds. Damus finally made it into the App Store this week.

Apple has now pulled Damus from the App Store in China. Damus developer William Casarin posted a screengrab of the notice, which claimed it included illegal content....

The app doesn't contain any content at all. It would be like banning Safari because it can be used to access the websites of terrorist organizations.

Dispatchers for 911 emergency calls "are being inundated with false, automated distress calls from Apple devices owned by skiers who are very much alive," reports the New York Times: "Do you have an emergency?" [911 emergency dispatcher] Betts asked. No, the man said, he was skiing — safely, happily, unharmed. Slightly annoyed, he added, "For the last three days, my watch has been dialing 911."

Winter has brought a decent amount of snowfall to [Colorado]'s ski resorts, and with it an avalanche of false emergency calls. Virtually all of them have been placed by Apple Watches or iPhone 14s under the mistaken impression that their owners have been debilitated in collisions. As of September, these devices have come equipped with technology meant to detect car crashes and alert 911 dispatchers. It is a more sensitive upgrade to software on Apple devices, now several years old, that can detect when a user falls and then dial for help. But the latest innovation appears to send the device into overdrive: It keeps mistaking skiers, and some other fitness enthusiasts, for car-wreck victims.

Lately, emergency call centers in some ski regions have been inundated with inadvertent, automated calls, dozens or more a week. Phone operators often must put other calls, including real emergencies, on hold to clarify whether the latest siren has been prompted by a human at risk or an overzealous device. "My whole day is managing crash notifications," said Trina Dummer, interim director of Summit County's emergency services, which received 185 such calls in the week from Jan. 13 to Jan. 22. (In winters past, the typical call volume on a busy day was roughly half that.) Ms. Dummer said that the onslaught was threatening to desensitize dispatchers and divert limited resources from true emergencies.

"Apple needs to put in their own call center if this is a feature they want," she said.
Apple acknowledged this was occuring in "some specific scenarios," the Times reports — but a spokesperson also "noted that when a crash is detected, the watch buzzes and sends a loud warning alerting the user that a call is being placed to 911, and it provides 10 seconds in which to cancel the call."

But the Times points out that "skiers, in helmets and layers of clothing, often do not to detect the warning, so they may not cancel the call or respond to the 911 dispatcher."

Longtime Slashdot reader Dotnaught writes: "Google's Chromium developers have begun work on an experimental web browser for Apple's iOS using the search giant's Blink engine," reports The Register. "That's unexpected because the current version of Chrome for iOS uses Apple's WebKit rendering engine under the hood. Apple requires every iOS browser to use WebKit and its iOS App Store Review Guidelines state, 'Apps that browse the web must use the appropriate WebKit framework and WebKit Javascript.'"

Google insists this is an experiment and isn't intended for release. But the stripped-down, Blink-based browser could be preparation for European competition rules that look like they will require Apple to stop requiring that other browser makers use its WebKit engine. "This is an experimental prototype that we are developing as part of an open source project with the goal to understand certain aspects of performance on iOS," said a Google spokesperson. "It will not be available to users and we'll continue to abide by Apple's policies."

In its quarterly earnings report today, Apple said the company passed the 2 billion device milestone while Services have hit a new revenue record. 9to5Mac reports: Apple saw a dip for its Q1 2023 fiscal quarter with just over $117 billion in revenue. That's down 5% YoY -- with the compare being its all-time record for fiscal Q1 in 2022 which saw $123.95 billion in revenue. However, the company pointed out two bright spots with 2 billion of its devices now in use and a fresh revenue record for its Services.

Last year at this time Apple shared it hit 1.8 billion active devices. That means it added more than 200 million Apple devices in the last 12 months to surpass the 2 billion mark. That's impressive since its installed base was growing by around 100-150 million new devices per year since 2019. And active devices doubled from 1 to 2 billion in just seven years. As for the Services, it saw a record $20.8 billion in revenue for the quarter, slightly beating the $19.5 billion estimate.