It is easier than at any time in history to wallow in the morass of negative news. New words have even been coined to describe the act of reading news you know will make you sad, anxious, or angry: doomsurfing and doomscrolling. I’m usually pretty good about ignoring the noxious media maelstrom—particularly the cesspool of social media—but in these uncertain days of pandemic, reading about what’s happening with the coronavirus feels essential for planning and evaluating everyday life.

However, I recently ran across Future Crunch, a refreshing 4-year-old email newsletter that disseminates positive news. You won’t find feel-good pieces about valiant citizens saving pets from burning buildings, but instead, evidence that humankind actually can improve the world in significant ways. Every issue contains numerous one- or two-sentence summaries of and links to original articles.

The content is much broader than what we cover in TidBITS—Future Crunch’s tagline is “Science, technology, intelligent optimism.” Nonetheless, some topics will sound familiar. Its most recent issue mentions Apple’s pledge to make its entire supply chain and product lifecycle carbon-neutral by 2030. Also in that issue is news that open-source host Github has just finished burying 21 TB of digital film containing all its active public repositories of code underneath a mountain in the Arctic. Fascinating stuff, and I look forward to receiving each issue and carving out the time to read the articles that interest me.

In the past, Future Crunch has been entirely free, with voluntary donations (of over $100,000) going to charity. The good news stories remain available to everyone on a weekly basis, but since the people behind Future Crunch have essentially lost their jobs presenting at large conferences, they’re adding premium content that will require a subscription after the next few months. I haven’t seen the premium content yet to make a recommendation either way, but I encourage you to subscribe to the free email newsletter for now. As someone who has been making a living in the online journalism space for decades, I wish the Future Crunch crew the best.

Apple has announced that Phil Schiller will become an Apple Fellow and Greg “Joz” Joswiak will replace him on the executive team as the company’s senior vice president of Worldwide Marketing.

Phil Schiller

Although Schiller, who is now 60, is presumably moving toward retirement, he won’t just be thinking big thoughts as an Apple Fellow. Apple said he would continue to lead the App Store and Apple Events. Given the importance and high profile of the App Store these days, that sounds like more than a full-time job on its own. Schiller also led the effort to plan and execute Apple’s first virtual Worldwide Developers Conference, which was widely seen as a success.

Schiller has worked at Apple since 1987 and has helped guide the company’s marketing efforts for 30 years. I’ve spent real time with him only once, at a press briefing at Macworld Expo in 2004. The main thing I remember was asking him if Apple was considering adding Bluetooth support to the iPod to enable wireless earbuds because I felt the wires were awkward and fussy. Nine months later, in “i-Phono Eliminates iPod Wires” (13 September 2004), I wrote:

Nevertheless, when I asked Phil Schiller about the possibility of a Bluetooth-enabled iPod back at Macworld Expo San Francisco in January of 2004, he basically laughed at me. Now, thanks to the i-Phono from Bluetake, I can laugh right back at him.

At the time, Apple was running the Silhouettes ads that featured black silhouettes of people dancing to music piped from their iPods through Apple’s iconic white earbuds, and Schiller had pointed out that the wires were an integral part of the look. Nevertheless, as I maintained then, a wireless solution seemed like it would be both more elegant and more in keeping with Apple’s design sensibility.

In retrospect, I was just too early, with Apple adding Bluetooth headphone support to the original iPhone (see “iPhone Seeks to Redefine the Mobile Phone,” 15 January 2007) and a year later to the second-generation iPod touch. Finally, of course, the company released the wildly popular AirPods and now wired earbuds seem quaint (see “W1-powered AirPods Usher in a New Era of Wireless Audio,” 7 September 2016).

Schiller is the first Apple Fellow the company has named since the 1990s, and he will join such luminaries as Steve Wozniak, Guy Kawasaki, Bill Atkinson, Steve Capps, and Don Norman.

Greg “Joz” Joswiak

I’m particularly pleased to hear that Joz is joining Apple’s executive team, since he has read TidBITS for many years, even contributing a few kind words for our twentieth anniversary in “Twenty Years of Memories from Friends of TidBITS” (19 April 2010):

Wow! It’s mind-boggling that TidBITS is turning 20. I remember when I first discovered TidBITS in the early 1990s and thinking of it as an unbelievably timely, informative, authoritative, and classy publication. I couldn’t wait to get each issue to stay up on the happenings in our beloved Mac community. Little did I realize that Adam and team were inventing the future with TidBITS long years before any of us would ever use the word “blog.” But more importantly, they were also part of the fabric and soul of our community. We’ve all been through a lot with each other. And like a good friend, through good times and bad, TidBITS was always there for us. Never getting into the muck, always staying true to the TidBITS mission to keep us up on the latest news and info. Now 20 years later, TidBITS hasn’t skipped a beat and is every bit as timely, informative, authoritative, and classy! Congrats on your first 20 years. And THANK YOU to the entire team at TidBITS.

Joz must like us because he wrote that even after we tweaked him earlier in “Apple Ships Pink iPod nano, Apologizes to Tonya” (22 January 2008):

“We’re sure Tonya will appreciate the new color, and we apologize for dragging our heels on releasing the pink iPod nano,” said Greg Joswiak, Apple’s vice president of Worldwide iPod Product Marketing. “We had to get Jonathan Ive to sign off on the exact shade of pink, and it turns out to be harder than you’d expect to color aluminum pink.”

Well, actually, he didn’t say that. His actual quote was, “The pink iPod nano is perfect for people who want a great new color this spring, or who are searching for a special Valentine’s Day gift.” But I know Joz, and I can’t imagine he actually said that, given that he is a verified guy. My money is on the quote having been put in Joz’s mouth by Christine Monaghan, Apple PR’s iPod contact, who I’m willing to bet is a woman and would thus be much more likely to use “a great new color this spring” in a sentence.

And Joz, I’m betting the whole Valentine’s Day gift thing is a hint.

Joz brings more than 20 years in leadership roles in Apple product marketing, and I had press briefings with him on quite a few occasions during the days of Macworld Expo. When he was vice president of hardware products, he even took over for Steve Jobs in delivering the keynote at New York’s final Macworld Expo (see “Macworld Expo New York 2003: Highly Concentrated,” 21 July 2003). Plus, for the past four years, Joz has served as Apple’s vice president of Worldwide Marketing under Phil Schiller, so I can’t imagine anyone who could be more qualified. We wish him the best of luck in what is a tremendously important position for Apple.

Time for a new iMac! For me, I mean. My 27-inch iMac with Retina 5K display from 2014 has been limping along since its internal SSD failed (see “Six Lessons Learned from Dealing with an iMac’s Dead SSD,” 27 April 2020). Although the Samsung T5 external SSD itself has been working fine once everything is up and running, the iMac starts up and shuts down slowly, Wi-Fi doesn’t become available for several minutes after startup, my Apple Watch works only sporadically for unlocking the Mac even though it always works for approving app authentication requests, and I’ve seen some kernel panics. It’s not dead, but it’s not a happy Mac.

So Apple’s announcement of a significant update to the 27-inch iMac with Retina 5K display comes at a welcome time. While there are no industrial design changes, it’s not a half-hearted speed bump update. Along with faster 10th-generation Intel processors, twice the memory capacity, newer AMD graphics chips, and larger SSD options, the new iMac boasts a 1080p FaceTime HD camera, better speakers, and a three-microphone array. Plus, for those afflicted with glare problems, a nano-texture glass option provides a matte finish.

Simultaneously, Apple tweaked the configurations of the 21.5-inch iMac, finally removing the option for a performance-draining hard drive, and the iMac Pro, dropping the 8-core model and making the 10-core model the base config.

Faster CPUs, More Memory, Updated Graphics, More Storage, and T2

When it comes to chips, the new 27-inch iMacs feature 10th-generation Intel Core i5, i7, and i9 processors. In the low-end model, there’s a 3.1 GHz 6-core i5. That configuration isn’t upgradable. The mid-range iMac includes a 3.3 GHz 6-core i5 and can be upgraded to a 3.6 GHz 10-core i9 for $500. The top-of-the-line model starts with a 3.8 GHz 8-core i7 and lets you jump to the 3.6 GHz 10-core i9 for $400.

All 27-inch iMac models start with 8 GB of RAM in the form of two 4 GB DIMMs, with two more user-accessible DIMM slots available. You can upgrade to 16 GB ($200), 32 GB ($600), 64 GB ($1000) or, for the first time in the iMac line, 128 GB ($2600). Frankly, there’s no good reason I can see to buy RAM from Apple, given that it’s so much cheaper from third-parties and so easily upgraded by merely popping off a panel on the back. To give you an idea, OWC sells 32 GB of RAM for $135, 64 GB for $310, or 128 GB for $600.

Graphics processing will also improve significantly, thanks to a next-generation AMD Radeon Pro 5300 with 4 GB of memory in the low-end and mid-range models. The high-end model starts with a Radeon Pro 5500 XT with 8 GB of RAM, and you can upgrade to a Radeon Pro 5700 with 8 GB for $300 or a Radeon Pro 5700 XT with 16 GB for $500.

In terms of storage, Apple has dropped the Fusion Drive entirely from the 27-inch iMac. Slightly perturbingly, the company limits your storage options based on which model you choose. The low-end model is locked at 256 GB of storage, which isn’t very much. The mid-range model starts with 512 GB, which feels like a reasonable minimum these days, and lets you expand to 1 TB ($200) or 2 TB ($600). And the high-end model takes the iMac into new and eye-wateringly expensive territory, again starting at 512 GB and offering the same 1 TB and 2 TB upgrades, but then adding 4 TB ($1200) and 8 TB ($2400) options.

Like the iMac Pro, the 27-inch iMac now sports Apple’s T2 security chip, which provides on-the-fly data encryption for everything stored on the SSD and verifies that the operating system hasn’t been tampered with during boot. Of course, it also makes certain kinds of troubleshooting and hardware repair much more difficult or even impossible. In addition, the T2 chip features an image signal processor that promises to improve video and offers variable EQ for better audio. Speaking of which…

Better Audio, Video, and Networking

For some people, the big news with this new iMac is the option to swap the glass face of the Retina 5K display for a nano-texture glass. First introduced on Apple’s insanely expensive Pro Display XDR, the nano-texture glass option provides a matte finish that offers better viewing in bright rooms or indirect sunlight without requiring an add-on coating. If glare is a major problem for you, the nano-texture glass option may be worth the $500 additional cost.

The Retina display also now supports Apple’s True Tone technology, which automatically adjusts the color temperature of the display to match the ambient lighting in the room. It’s relatively minor, but welcome.

Also welcome in this era of non-stop videoconferencing will be the 1080p FaceTime HD camera, backed by the T2 chip’s image signal processor. Although Apple doesn’t specify the resolution on the FaceTime HD camera used in previous models, I believe it was 720p. Previously, the iMac Pro was the only Mac with a 1080p webcam.

Resolution isn’t the entire story with video quality, and I’ll be curious to see how well the iMac’s new camera and image signal processor deal with low-light situations. We recently had two outdoor Zoom calls, one using a 10.5-inch iPad Pro’s 1080p front-facing camera and the other using a 2012 MacBook Air’s 720p FaceTime HD camera. The iPad Pro handled the light fading throughout the evening far better than the MacBook Air.

Apple says the iMac has higher-fidelity speakers, although it’s hard to know how much of that is better speaker hardware and how much comes from the T2 chip doing more processing on the audio output.

Previously, the iMac had just a single microphone, but it now boasts a three-mic array with a high signal-to-noise ratio and directional beamforming. And of course, thanks to the T2 chip, the new iMac has support for “Hey Siri.”

Ports remain almost the same with a 3.5 mm headphone jack, an SDXC card slot, four USB-A ports, two Thunderbolt 3 ports, a Gigabit Ethernet jack, and a Kensington lock slot. New in this update is a $100 option for 10 Gigabit Ethernet. 802.11ac Wi-Fi and Bluetooth 5.0 are standard.

Pricing and Availability

As previously noted, it’s important to start with the appropriate model of the 27-inch iMac, depending on what options you might want.

• The low-end model starts at $1799 and offers only upgrades to RAM, the nano-texture glass, and 10 Gigabit Ethernet.
• The mid-range model starts at $1999 and doesn’t provide the top two storage options or let you choose among Radeon Pro graphics chips.
• The high-end model, which lets you access all the options, starts at $2299.

These prices are the same as the iMac’s last revision, making the new models a generally good deal.

Apple’s online store shows quick delivery dates for the three stock configurations, but as soon as you make any configuration changes, those dates jump by about three weeks.

Onward to Apple Silicon

It’s impossible to know what variables will cause Apple to update certain Mac models with Intel chips instead of taking them to the new custom chips that the company is developing. However, the release of this iMac model does suggest that the first Mac with Apple silicon will be a laptop or a Mac mini. It wouldn’t make much sense to update the 27-inch iMac with 10th-generation Intel chips in August and revise it again with new Apple silicon within a few months.

I’ll be ordering one of these iMacs as soon as I can figure out the best combination of CPU and GPU for my needs. None of my work is performance-intensive, but I run many apps at once and hit RAM pretty hard. Typically, I buy a beefier model than is absolutely necessary because I expect a Mac to last for around 5 years—I got almost 6 years from my current iMac—but given the switch to Apple silicon, it will probably make sense to replace it sooner.

While I had planned to replace my 2012 MacBook Air with the new 2020 model, I shelved those plans when it became clear I wouldn’t be traveling in the foreseeable future. With luck, the first Mac with Apple silicon will be a laptop in the MacBook Air mode, letting me dip my toes into Apple’s new chips and get a snazzy new travel machine.

21.5-inch iMac: Ding, Dong, the Internal Hard Drive Is Dead!

Although Apple didn’t update the 21.5-inch iMac in any way, the company made one small adjustment to its configuration that will save effort for consultants and heartache for consumers. That’s right, Apple has finally replaced the universally reviled 5400-rpm hard drive that came in the low-end 21.5-inch iMac with an SSD. No longer will consultants have to warn people not to buy it, and no longer will those who do be saddled with substandard performance.

This move makes SSDs standard across the 21.5-inch iMac line, and in fact, across the entire Mac line. That’s not to say that the Fusion Drive, which combines a 1 TB hard drive with a small 32 GB SSD, is entirely gone, but it’s now solely a no-fee alternative to the standard 256 GB SSD. I’m not a fan of the Fusion Drive either, because problems with either half render the entire thing unusable, and it’s difficult to replace (plus, see “iMac 1 TB Fusion Drives Have Smaller SSDs,” 7 August 2017). Stick with an internal SSD and add an external drive if you need more space. You’ll need one for backups anyway.

iMac Pro Base Configuration Gets More Cores

In an even less interesting change, Apple dropped the 8-core Intel Xeon W processor from the iMac Pro’s configurations, making the 10-core Xeon W the base-level processor. That means you get a little more performance for your money, but it’s sad that Apple hasn’t paid any other attention to the iMac Pro since its December 2017 launch. Its 14-core and 18-core configurations likely still provide more performance than the 27-inch iMac’s new 10-core configuration, but the gap is undoubtedly narrowing and may no longer be worth the extra several thousand dollars.

Apple recently announced the Security Research Device Program (SRD), in which select security researchers receive special iPhones to help them root out iOS security problems (see “Apple Releases Dedicated Security Research Device,” 23 July 2020). Apple can then fix any security vulnerabilities they find, hopefully before they’re exploited.

Based on Apple’s announcement, backed up by some logical deduction, we can speculate about how this program and the particular devices will work.

When you buy an iPhone from Apple, it’s a production phone, with a production code signing key burned into its system on a chip (SoC). Having a production key is referred to as production fused (often shortened to prod fused). It runs release versions of iOS, which have been signed with Apple’s production certificate (internally called the prod cert). When the iPhone boots, code burned into the SoC checks the operating system. If it’s not properly signed with a prod cert, the iPhone refuses to boot at all. Jailbreaking is (partly) the art of figuring a way around this restriction.

Similarly, iOS will run only apps that have been signed by the production App Store cert, which prevents sideloading, the option of installing apps directly, without going through the App Store. There are a few exceptions, such as a third-party developer signing an app they build with their third-party development cert, which allows the app to run on their iPhones. In practice, this process is often fraught with problems. (This description greatly simplifies the details of code signing, but it covers the general procedure.)

Developing software internally at Apple would be extremely difficult with these restrictions in place. Internally, Apple engineers use iPhones with a development key (they’re referred to as dev fused), and they run development builds of iOS. Dev builds of iOS include a shell, debugging and profiling code inside many apps, test hooks, and internal frameworks. Dev iOS builds are signed with a dev cert, so they boot on dev-fused iPhones.

Additionally, dev builds of iOS don’t check an app’s cert before running it. You can load any app you want onto a dev-fused iPhone. This fact makes it a lot easier for Apple engineers to do their work. One reason the process for signing apps works poorly for third-party developers is probably because Apple engineers don’t use it, so they don’t apply any pressure to fix problems.

Even if you managed to get a copy of an iOS development build and somehow load it onto your production iPhone, it wouldn’t boot, because it’s not signed with a production cert. Likewise, release builds of iOS won’t boot on dev-fused iPhones.

As I noted, dev builds of iOS include a shell, the app behind Terminal that runs Unix commands and scripts. macOS and iOS used to default to the bash shell. macOS recently moved to zsh; iOS may have moved to zsh too.

Since an iPhone is a full-blown computer, Apple engineers log into their dev iPhones using ssh and work in the shell. It’s no different than server engineers sshing into a remote server to work on server code. It’s very difficult to work on a computer if you can’t log in to it. Release versions of iOS don’t include a shell, specifically to improve security (and make life difficult for jailbreakers), since there’s nothing to log into.

If Apple wants to help security researchers find vulnerabilities, Apple must give them iPhones with a shell they can ssh into. I’ve heard unofficially that the SRD iPhones are neither production nor internal development, but are probably iPhone 11s with a new SRD cert—call them SRD fused. They’ll run a special iOS build that has some of the features in Apple’s internal iOS builds and is signed with the SRD cert. This implies that the SRD build of iOS won’t run on production iPhones, nor on Apple internal dev iPhones.

Apple is also likely providing researchers with a special internal build of Xcode, plus tools designed for loading software onto iPhones and debugging the internals of iOS. Apple has a wide range of internal tools for spelunking into the dark recesses of iOS where normal third-party developers never go. These tools would definitely help security researchers. Apple makes new internal builds of iOS, Xcode, and support frameworks daily. While security researchers are unlikely to get daily builds, they’ll probably get regular updates.

SRD builds of iOS probably also run apps without checking that they’re code-signed, just like iOS dev builds. I don’t have any specific information indicating this is true, but it would make sense. This would allow a security researcher to set any entitlements they want on an app and learn a lot about how iOS’s internal protections actually work. It would also mean they don’t have to fight with Xcode’s code signing feature every time they load an app onto the iPhone.

iOS has many levels of security. A fully working exploit is usually built by chaining together several individual vulnerabilities. For instance, one vulnerability may allow a malformed JPEG to take over the JPEG decoder. But the JPEG decoder is sandboxed, specifically so that if it’s compromised, it can’t access very much. Another vulnerability might allow escaping the sandbox. A third vulnerability might allow escalation to root. Chain these three together, and you have an exploit, where just looking at a picture compromises your iPhone. (That’s called a “drive-by exploit.”)

While a few of the dozens of iOS security restrictions will be turned off in the SRD builds of iOS so security researchers can more easily do their work, most will remain in place. Apple doesn’t need security researchers to find full-blown, multi-stage exploits. Apple will be happy if the researchers find ways around individual security restrictions so its engineers can fix those mistakes discreetly.

Have you wondered what prevents bad guys from getting their hands on one of these SRDs? Apple likely has some strong measures to keep the SRDs and special iOS builds from leaking beyond the intended recipients. For starters, there’s probably a non-disclosure agreement as tight as anything in the industry. In the past, Apple security has required that people who have access to unreleased hardware must keep it in a locked, windowless room and give keys only to specific people. Apple sometimes uses different code names with different groups, so if a code name leaks, it can be traced.

Inside Apple, unreleased iPhones “phone home” via the Internet every few days, so Apple knows the employee it’s assigned to still has it. The SRDs may do this too.

Even though the SRD is likely to be a standard iPhone 11, albeit with a special cert, Apple still may not want pictures of it or screenshots from it circulating. In the past, Apple security has put “random” markings on the cases of unreleased products, so if a picture were to appear on the Internet, Apple would know which device it was. Each SRD build of iOS could have identifying markers added, so if a build were to leak, Apple would know where it came from. An Apple engineer once told me that some internal OS builds use steganography to hide the iPhone’s IP address and MAC address in the low order bits of screenshots. The data isn’t visible to the naked eye, but if a screenshot appears online, Apple has tools that can see where it came from.

If an SRD were stolen, depending on how the SRD builds of iOS are signed, Apple might be able to revoke the certificate for that device to prevent future iOS builds from running on it. Apple could also likely brick an SRD remotely, though I assume anyone smart enough to steal an SRD would keep it in a Faraday bag and make sure it never appeared on the Internet to receive the brick command.

Recent high-profile iPhone hacks may have prompted Apple to re-evaluate how it does security research. Given how secretive Apple usually is, the Security Research Device Program is an unusual step. As you can see, it’s also one that undoubtedly required a significant amount of work to ensure that it couldn’t be exploited by organized crime and government intelligence agencies. Hopefully, we’ll all get more secure iPhones as a result.