Apple’s next product announcement event will be held on 14 September 2021 at 10 AM PDT from the company’s Apple Park headquarters. You’ll be able to stream the event from Apple’s website or the Apple TV app. You can also add the event to your calendar.

Unlike last year, when Apple’s iPhone release was delayed until October, we expect new iPhones will be announced at this event, along with new Apple Watch models. If the rumor mill is to be believed, Apple will announce an iPhone 13 in plain, Pro, mini, and Pro Max flavors with smaller notches and 120Hz ProMotion displays.

The rumor mill also points to redesigned and slightly larger Apple Watches. Mark Gurman of Bloomberg reports that each size will be 1 millimeter larger than the current models, increasing to 41 and 45 millimeters. The new design will also reportedly have flatter edges. Other rumored features include blood pressure, blood sugar, and fertility monitoring.

We may be waiting a while for the Apple Watch Series 7 to ship because it’s reportedly suffering from the supply chain challenges that Tim Cook warned about (see “Apple’s Q3 2021: Still Making Money Hand Over Fist,” 27 July 2021). However, analyst Ming-Chi Kuo now says Apple has resolved those issues.

We’ve also seen rumors of new AirPods. Apple hasn’t updated them for a few years, so it’s reasonable to expect something new this year, though they may not make the cut for inclusion in this announcement.

Apple will almost certainly launch at least iOS 15 and iPadOS 15 either that day or very soon after. My new book, Take Control of iOS 15 and iPadOS 15, covers all of the new features in these new operating systems so you can get ready. It’s also likely that Apple will push out watchOS 8 and tvOS 15 at the same time. Last year, however, the company delayed the macOS 11 Big Sur update until November, and something similar could happen with macOS 12 Monterey this year.

You can learn about everything Apple announces with us by joining us in the #events channel of our SlackBITS group. We’ve been chatting with our readers during the events for a few years now, and it’s always a good time. To join the group, go to slackbits.herokuapp.com, enter your email address, and agree to the code of conduct. You’ll receive an invitation in email right away.

On the eve of Apple’s next big product announcement, the company has released macOS 11.6 Big Sur, iOS 14.8, iPadOS 14.8, watchOS 7.6.2, and Security Update 2021-005 Catalina to fix a PDF-related security issue: “Processing a maliciously crafted PDF may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.”

macOS 11.6, iOS 14.8, and iPadOS 14.8 also fix a Web browsing vulnerability: “Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.”

9to5Mac suggests that NSO Group exploited the PDF vulnerability in the Pegasus spyware used to target Bahraini activists; apparently, the vulnerability circumvents Apple’s BlastDoor protections (see “BlastDoor Hardens iMessage Against Malware Assaults,” 4 February 2021). We recommend installing these updates right away.

Here’s how to update on each platform:

• macOS: You can install macOS 11.6 (2.64 GB on an Intel-based 27-inch iMac) or Security Update 2021-005 Catalina from System Preferences > Software Update.
• iOS and iPadOS: You can install iOS 14.8 (402.6 MB on an iPhone 11) or iPadOS 14.8 from Settings > General > Software Update.
• watchOS: You can install the watchOS 7.6.2 update (70.1 MB on an Apple Watch Series 4) in the Watch app on your iPhone under My Watch > General > Software Update. Have your watch on its charger and charged to at least 50%.

Late last week, US District Judge Yvonne Gonzalez Rogers issued a 185-page ruling in the Epic Games antitrust suit against Apple, finding that Apple’s App Store policies are not evidence of monopolistic power. More broadly, her ruling doesn’t require that Apple allow third-party app stores, let users sideload apps, or reduce its App Store commission fees. Nor did she require Apple to restore Epic’s developer account or allow Epic’s popular game Fortnite back into the App Store. Plus, she ordered Epic to pay Apple 30% of what it collected from users of its iOS app outside of Apple’s in-app purchasing system after August 2020—a fine of at least $3.6 million. Epic has appealed, but most observers give the appeal little chance of overturning the judge’s decision.

However, the decision came with a likely significant blow to Apple as well. In a one-page injunction finding for Epic on a violation of California’s Unfair Competition Law, Judge Gonzalez Rogers dinged Apple for anticompetitive behavior:

Apple Inc. and its officers, agents, servants, employees, and any person in active concert or participation with them (“Apple”), are hereby permanently restrained and enjoined from prohibiting developers from (i) including in their apps and their metadata buttons, external links, or other calls to action that direct customers to purchasing mechanisms, in addition to In-App Purchasing and (ii) communicating with customers through points of contact obtained voluntarily from customers through account registration within the app.

In other words, the judge struck down Apple’s anti-steering policies that prevent developers from including or linking to their own purchasing systems within iOS apps. She also prohibited Apple from preventing developers from communicating with their customers through accounts set up through in-app registration. The injunction goes into effect in 90 days, although John Voorhees of MacStories suggests that Apple might be able to delay it by filing an appeal. Ben Thompson of Stratechery offers an extensive explanation of how the judge came to her decision.

If Apple doesn’t appeal, or if its appeal isn’t successful, the question becomes what Apple—and iOS developers—do next. The Verge’s Nilay Patel points out that the injunction’s inclusion of both buttons and external links would seem to suggest that Amazon could integrate its own payment processing system into the Kindle app. That goes well beyond Apple’s recent settlement with the Japan Fair Trade Commission to allow “reader” apps to include in-app links to external account management systems (see “Several Bricks Removed from Apple’s Garden Wall,” 3 September 2021).

But many questions remain to be answered, presumably in what will essentially be a three-way negotiation between Apple, developers, and Judge Gonzalez Rogers. Will reduced transaction fees outweigh the amount of work for developers involved in building and maintaining separate payment systems? Will payment processing firms like Stripe offer software development kits for plug-and-play purchasing within iOS apps? Will Apple’s App Store review process suddenly pay much closer attention to apps that implement third-party payment systems? Developer Marco Arment has some opinions about how it’s likely to work out.

A couple of recent media reports involving the WhatsApp messaging service and the ProtonMail email service highlight the limits of communication services that claim to provide privacy.

ProPublica Reveals WhatsApp Message Monitoring

The non-profit investigative journalism site ProPublica published a lengthy report on WhatsApp privacy, or its supposed lack thereof. The messaging app, which Facebook purchased in 2014, promises end-to-end encryption and total privacy. WhatsApp’s privacy page states:

Our mission is to connect the world privately by designing a product that’s simple and private. Whether you are sending a personal message to your friends or family, or texting with a business, your communications are secure and you are in control.

ProPublica’s article implies that isn’t true and says that over 1000 contract workers monitor and police traffic on the service. But dig deep enough down into the article, and you reach this bit (emphasis ours):

Their jobs differ in other ways. Because WhatsApp’s content is encrypted, artificial intelligence systems can’t automatically scan all chats, images and videos, as they do on Facebook and Instagram. Instead, WhatsApp reviewers gain access to private content when users hit the “report” button on the app, identifying a message as allegedly violating the platform’s terms of service. This forwards five messages — the allegedly offending one along with the four previous ones in the exchange, including any images or videos — to WhatsApp in unscrambled form, according to former WhatsApp engineers and moderators. Automated systems then feed these tickets into “reactive” queues for contract workers to assess.

In other words, your WhatsApp messages are encrypted, and Facebook can’t see them unless a party in the conversation reports a message as violating WhatsApp’s terms of service. Facebook is in a tight spot here because if it didn’t have a reporting feature and human reviewers, it would be accused of enabling abusive behavior and criminal activities. If it does, it’s accused of violating your privacy. Damned if it does, damned if it doesn’t.

(It’s worth noting that Apple’s iMessage service is also end-to-end encrypted; there’s no way of reporting abusive behavior other than reporting junk messages from people not in your contact list. It’s entirely unclear what Apple does with those reports, but it hasn’t taken significant flak for that design. However, if you have iCloud Backup enabled, your Messages conversations are encrypted within the backup using a key that Apple controls, making it possible for law enforcement to subpoena the data from Apple. Until recently, WhatsApp had the same loophole but has announced that it will start encrypting its backups.)

However, many WhatsApp users abuse the reporting system to harass others:

The system is also undercut by the human failings of the people who instigate reports. Complaints are frequently filed to punish, harass or prank someone, according to moderators. In messages from Brazil and Mexico, one moderator explained, “we had a couple of months where AI was banning groups left and right because people were messing with their friends by changing their group names” and then reporting them. “At the worst of it, we were probably getting tens of thousands of those. They figured out some words the algorithm did not like.”

The broader lesson here is that your private messages are only as secure as the people you’re messaging keep them, which is true of all multi-party communications.

However, there are also real concerns with WhatsApp and its collection of metadata to further Facebook’s business of gathering data to sell ads:

Four months later, however, WhatsApp disclosed it would begin sharing user data with Facebook — precisely what Zuckerberg had said would not happen — a move that cleared the way for an array of future revenue-generating plans. The new WhatsApp terms of service said the app would share information such as users’ phone numbers, profile photos, status messages and IP addresses for the purposes of ad targeting, fighting spam and abuse and gathering metrics. “By connecting your phone number with Facebook’s systems,” WhatsApp explained, “Facebook can offer better friend suggestions and show you more relevant ads if you have an account with them.”

Whatever metadata Facebook collects, it’s required to hand over to law enforcement, and Facebook sneakily turns on logging whenever it’s convenient:

WhatsApp has for years downplayed how much unencrypted information it shares with law enforcement, largely limiting mentions of the practice to boilerplate language buried deep in its terms of service. It does not routinely keep permanent logs of who users are communicating with and how often, but company officials confirmed they do turn on such tracking at their own discretion — even for internal Facebook leak investigations — or in response to law enforcement requests. The company declined to tell ProPublica how frequently it does so.

The takeaway here is blatantly obvious: don’t trust Facebook, of all companies, with your privacy. But that said, WhatsApp is still a better option for private communications than email or SMS, even if it’s not as good as iMessage. I prefer Signal (see “Signal Provides Secure Cross-Platform Replacement for WhatsApp,” 18 January 2021), and although I don’t trust it entirely, the service has a good record on privacy so far. ProPublica says of Signal:

Other encrypted platforms take a vastly different approach to monitoring their users than WhatsApp. Signal employs no content moderators, collects far less user and group data, allows no cloud backups and generally rejects the notion that it should be policing user activities. It submits no child exploitation reports to NCMEC.

However, that could always change if Signal faced an existential threat of some kind: sufficient governmental pressure, for instance, or the need to monetize user information to stave off bankruptcy.

ProtonMail Reveals Data to Comply with Swiss Legal Order

Email service ProtonMail claims to be the most secure email service, with end-to-end encryption and “Swiss privacy.” Switzerland, where ProtonMail is based, is known for its strong privacy laws (and its famously private bank accounts), but ProtonMail has come under fire after hitting the limits on those laws.

While ProtonMail normally doesn’t collect IP addresses, it was ordered to by a Swiss judge, which led to the arrest of a French activist. In a public statement, the company said this was a single incident compelled by a court that ProtonMail couldn’t appeal. It also reiterated that Swiss law prevents ProtonMail from sharing data with foreign governments and that its encryption cannot be bypassed. ProtonMail recommends using its Tor onion site to obfuscate your IP address when using ProtonMail.

Many ProtonMail fans were upset with the company, but the lesson here is that businesses have to follow local laws. Even if Switzerland’s laws are better than those of most countries, with appropriate pressure from foreign governments, they can still be used against people who might not obviously seem to have violated the law.

Key Privacy Takeaways

Here’s what we can learn from these reports:

1. It takes two to tango. Messages you believe to be private will remain so only as long as the people who receive them maintain that privacy, technically and socially.
2. Be aware that most online services collect metadata surrounding your communications, such as your IP address, name, phone number, etc. Regardless of the encryption status of the content of your communications, that metadata may reveal information about you, and it’s almost always accessible to law enforcement with appropriate warrants.
3. Companies and organizations have to follow local laws and comply with legal orders that require them to turn over what data they do have.
4. A company’s policies or privacy stance could change at any time. Many people saw Apple’s recently bungled CSAM detection announcement as an indication that the company was moving away from its “privacy is a human right” stance (see “Apple Delays CSAM Detection Launch,” 3 September 2021). In response to the French activist situation, ProtonMail has removed the section about not logging IP addresses from its privacy policy.
5. When a company’s business model is based on selling user information, as it is for Facebook, its privacy promises are inherently suspect.

Perhaps the best privacy advice of all came from Boston political boss Martin Lomasney: “Never write if you can speak; never speak if you can nod; never nod if you can wink.” Or former New York governor Elliot Spitzer’s updated version: “Never talk when you can nod and never nod when you can wink and never write an e-mail, because it’s death. You’re giving prosecutors all the evidence we need.” Unfortunately for Mr. Spitzer, he didn’t follow his own advice.

For more realistic advice for those of us who aren’t worried about rival politicians or federal wiretaps, I’d share a recommendation I received in journalism school, which was, “Never put in an email anything you wouldn’t want on the front page of the New York Times.” I’d merely update that to change “in an email” to “on the Internet.”

Since 2005 or so, I’ve been listening to music on my Mac through an Altec Lansing FX6021 speaker system with two stereo speakers and a subwoofer. The sound has been excellent, and I have appreciated having a dedicated controller for power and volume—it makes turning the sound off or adjusting the volume easier than using keyboard shortcuts or a graphical interface. Alas, something in the controller failed recently, rendering the controls inoperable and causing the sound to cut out or disappear entirely. After some troubleshooting, I determined that replacement was probably the better part of valor and asked for (and received) recommendations on TidBITS Talk.

However, I still want to listen to music while I’m working through all the suggestions. I work on a 27-inch iMac with a 27-inch Thunderbolt Display, and both have decent stereo speakers. When I tried using either one, however, the sound felt unbalanced. I stand pretty much right between them, so routing audio through the iMac (which sits on the right side of my desk) made it seem to come from my right, whereas sending it through the Thunderbolt Display moved the sound to my left. I wanted to find a way to balance the signal between both pairs of speakers for more accurate stereo sound.

With thoughts of HomePod stereo pairs running through my head, I did a little research and discovered that Apple has long provided a way to combine multiple audio output devices into a single destination. By combining the speakers in my iMac and Thunderbolt Display, I can again have sound emanating equally from both sides of my desk. You could use this capability to play the same audio through your Mac and a set of connected speakers or to configure a 5:1 or 7:1 surround-sound system. Sadly, you can’t include AirPlay speakers like a HomePod in that mix; more on that later.

Create a Multi-Output Device

The trick to performing this combinatorial audio magic is the Audio MIDI Setup app, which you’ll find in the Utilities folder inside the Applications folder. I won’t pretend to understand much of what it does—I’m not an audio guy—but combining multiple audio output devices into a single destination is relatively straightforward, albeit with several gotchas.

(Dear Apple, you might want to update Audio MIDI Setup to sync its interface with your corporate style guide that deprecates the term “master.” Practice what you preach, and all that. Check your Feedback Assistant reports.)

Follow these steps to create a multi-output device:

1. In Audio MIDI Setup, click the + button under the list of audio devices, and choose Create Multi-Output Device.
2. Click the Use checkbox for each of the audio devices you want to combine.
   
3. As far as I can tell, it makes no difference which device is selected in the Master Device pop-up menu, although the Drift Correction checkbox will automatically be selected for devices other than the master device.
4. Unless you have a DAC (digital-to-analog converter) that provides higher sample rates, leave the Sample Rate pop-up menu at 44.1 kHz. If you do have a DAC, choose the highest sample rate at which you can hear an audio quality difference.
5. You should see a little speaker icon below and to the right of the Multi-Output Device entry in the list. If not, Control-click Multi-Output Device and choose Use This Device For Sound Output. (That has the same effect as selecting it for output in System Preferences > Sound > Output.)
6. To ensure that you don’t blast your ears with too-loud music the first time you use your Multi-Output Device, click the entry for your master device in the list and adjust the Master slider in the Channel Volume pane to something fairly low. Repeat the process with your secondary output device—as you can see below, my Thunderbolt Display has separate sliders for Front Left and Front Right.
   
7. Switch to the Music app and start playing a track with which you’re intimately familiar, preferably one with good stereo separation. I always default to the Dire Straits Brothers in Arms album—it was also my first CD back in the late 1980s.
8. Back in Audio MIDI Setup, work back and forth between the individual output devices to set the volume to a good level and adjust the left/right balance. How you do that may vary by device. For my iMac’s speakers, there’s a Balance slider that I’ve tweaked to the right to favor its right-hand speaker. For the Thunderbolt Display, there’s no Balance slider, so I had to increase the Front Left volume to favor its left-hand speaker. Because the iMac’s left speaker and the Thunderbolt Display’s right speaker sit right in front of me and work together, I’ve deemphasized them.
   
9. Pay attention to the Mute checkbox to the left of the volume sliders. I found it extremely helpful to mute one set of speakers and then the other as I worked to set the volumes and balances appropriately. (For a more precise way of determining the ideal volumes, you could use a sound pressure level app like Decibel X to measure the sound from each speaker in turn.)
10. If you’re configuring a surround-sound system with more speakers, click the Configure Speakers button to bring up an interface for connecting speakers with channels. I don’t have the hardware to test this, so I recommend clicking the ? button in the Configure Speakers interface for more information.
    
11. Finally, if you would prefer to see a more descriptive name, click the name of the Multi-Output Device entry and edit it as desired.

You’re done, but now it’s time to investigate the gotchas.

Gotcha #1: No Volume Control for Multi-Output Devices

Unfortunately, as you’ll quickly discover, a multi-output device has no master volume control in the Sound preference pane, the Volume menu bar item doesn’t work, and macOS’s built-in keyboard shortcuts are disabled. Needless to say, this is a problem, albeit one that has numerous workarounds.

• SoundSource: The best solution to this problem is the SoundSource utility from Rogue Amoeba (a recent TidBITS sponsor), which provides menu bar access to system devices (including multi-output devices), lets you control volume on a per-app basis, and can add effects to any device or app. Even better, if you take a quick trip to SoundSource > Preferences > Audio, you can select Super Volume Keys, which enables the system volume keys to control otherwise uncontrollable audio devices. SoundSource costs $39, though TidBITS members can save 20%, dropping the price to $31.20.
  
• Music: Although I always think about controlling volume at a system level, I was reminded that the Music app has its own volume control and keyboard shortcuts. If you play audio only through Music, you could manage volume entirely within the app.
• Keyboard Maestro: It’s always worth trying to solve problems with Stairways Software’s Keyboard Maestro, though in this case, it’s not a complete solution. Although Keyboard Maestro has actions that can increase, decrease, and mute the system volume, those actions won’t work unless you also have SoundSource’s Super Volume Keys enabled. More effective are Keyboard Maestro’s actions for controlling volume and playback in the Music app. With those, you can create macros that let you increase or decrease the volume of currently playing music, or just pause playback. Keyboard Maestro costs $36, and TidBITS members can save 20%, dropping the price to $28.80.
  
• Boom 3D: I’m quite fond of the 3D sound effect provided by Boom 3D from Global Delight (another recent TidBITS sponsor). It provides some features that intersect with this problem, though it’s not entirely satisfactory. Most notably, Boom 3D has a volume control in its menu bar interface, and you can assign hotkeys to control it within any other app. Plus, Boom 3D enables per-app volume settings, much like SoundSource. The problem is that the main volume control doesn’t go to zero, rendering it useless as a mute option. The per-app volume does go to zero, so you can mute a particular app, but that requires an extra click and slider manipulation—there are no hotkeys for per-app volume. Boom 3D costs $14.99, and TidBITS members can save 25%, dropping the price to $11.24.
  

Realistically, since I have all these apps at my disposal, I’m going to employ all of them. SoundSource provides a nice dashboard to all sound-related activities on my Mac and enables the system volume controls, Keyboard Maestro lets me control audio from the keyboard, and Boom 3D enhances the music.

Gotcha #2: No AirPlay in Multi-Output Devices

You can add an AirPlay device to Audio MIDI Setup by clicking the + button and choosing it from the Connect AirPlay Device menu. Once you do that, an AirPlay output becomes available for selecting as part of the multi-output device. Unfortunately, as soon as you make the multi-output device the default audio output, the AirPlay device disappears, and no audio is sent to it by the multi-output device.

However, there is a workaround, at least for those using the Music app. If you click the AirPlay button in the Music toolbar, you can select multiple AirPlay destinations and set their volumes independently. The Computer destination uses whatever audio output is selected in the Sound preference pane, so in this situation, it would be my Multi-Output Device. When I combined that with the Bedroom HomePod that I borrowed temporarily, my office was filled with sound.

There are two downsides to this workaround:

• It works only in Music. That may be obvious, but if you want to listen to music on YouTube through Safari, say, you’re out of luck.
• The only volume slider that controls all the selected speakers is in the Music app itself. You may find yourself, like me, thoroughly confused when other apps seem to be controlling volume without making any appreciable difference. (The HomePod was loud enough that I could barely tell when my iMac and Thunderbolt Display speakers weren’t contributing to the overall sound.)

The solution to those problems is Rogue Amoeba’s Airfoil. It can distribute audio from any Mac app—or all system audio—to AirPlay and non-AirPlay audio devices, working around the Music limitation. You can even independently choose which speaker through which to play “computer” audio. And it provides keyboard shortcuts for controlling volume and muting audio. Airfoil costs $29, or $23.20 for TidBITS members after the 20% discount.

On to Speaker Research

Although I’ve thoroughly enjoyed working through all the implications of bonding the speakers in my iMac and Thunderbolt Display, when I brought the HomePod into the mix, it instantly became apparent that it produces much higher quality audio on its own, particularly in terms of bass. That suggests that my audio hacking won’t preclude the need to replace my Altec Lansing FX6201 speakers, perhaps with something that has a subwoofer. So now it’s time to stop writing and start researching all the recommendations in TidBITS Talk (and if you have any others, please contribute them).