Is it really TidBITS#1600 already? The weeks just keep slipping by as we write and edit TidBITS and keep up with all that’s necessary for a modern-day Internet presence.

Celebrating TidBITS#1600

The longer you do something, the more milestones you hit. This issue marks our 1600th publishing of a collection of articles about the Apple world, so I took the opportunity to travel back through some of the twisty little passages we’ve taken in getting here.

1. First came TidBITS#100, where we unveiled our new setext format in “TidBITS in new format” (6 January 1992). Setext later provided some inspiration for John Gruber’s Markdown.
2. Then there was “Two Hundred Issues?” (1 November 1993), where I thanked some of the people who played key roles in the early years of TidBITS.
3. Next, we invited some friends to help brainstorm entries for “300 Reasons the Mac is Great” (23 October 1995). I wonder how many of those reasons are still true?
4. Another two years brought a new site, as explained in “Four Hundred Issues and a Dynamic Web Site” (6 October 1997).
5. For the next milestone, we announced a new home page design in “Five Hundred Issues and a New Home Page” (4 October 1999).
6. In “Six Hundred Issues and New TidBITS Services” (8 October 2001), we rolled out an RSS feed along with an HTML email version of the TidBITS issue.
7. For TidBITS#700, we could only announce our choice of a new content management system in “Seven Hundred Issues, a CMS, and Creative Commons” (6 October 2003) because we weren’t ready to make the switch—publishing on the Internet was getting harder.
8. With no infrastructural changes to announce, “Trends to Watch from 800 Issues of TidBITS” (10 October 2005) reverted to punditry. Happily, it’s not embarrassing to read now.
9. Our 2007 site redesign couldn’t wait for our 900th issue, so Glenn Fleishman and I gave away an ebook version of The Wireless Networking Starter Kit, announced in “900 Issues and a Free Ebook on Wi-Fi” (15 October 2007).
10. For TidBITS#1000, I mused about what sets TidBITS apart from other publications in “1,000 Issues of TidBITS: It’s All about Our Readers” (18 October 2009)

After 1000 issues, we ran out of steam when it came to writing something to commemorate the next notch on the odometer. Just as with birthdays, once you’ve hit a high enough number, the specifics no longer have the power to thrill like they once did. And as with birthdays, it’s probably best not to promise too far into the future—2000 issues of TidBITS would require more than 8 more years of regular publication. That’s not inconceivable, but just as Jim Dalrymple announced today (congratulations, Jim!), retirement is likely at some point in our future.

Dealing with a Card Testing Attack

It was a Sunday, and I was sitting in a comfortable chair with Polly the MacBook Air in my lap and the cat at my side (she’s a right-hand cat, so I sometimes have to resist the temptation to use her head as a pointing device). A notification appeared, telling me that someone had created a TidBITS account in WordPress and signed up for a membership. Such notifications aren’t unusual, but what was strange was when another one appeared, and then another, and another. Curious, I loaded the Users page on our site and realized that a bot was creating accounts with random Gmail addresses, all of which were TidBITS members with $2 monthly subscriptions.

It was clearly not a good thing to have bogus TidBITS memberships created at the rate of about one every 10 seconds. By the time I figured out what was happening and stopped the attack by turning off the Custom Monthly Amount option on our membership page, 70 accounts had been created. I then texted our developer, who enabled Cloudflare’s Bot Fight Mode as well. I had some errands to run, and when I returned a few hours later and enabled Custom Monthly Amount as a test, the attacking bot created a new account within 15 seconds. I shut it off again.

The next day, I contacted Stripe support to see what to do about all the $2 subscriptions. They were all on legitimate credit cards, though many of the accounts used the same card number. Stripe told me that this was likely what’s called “card testing,” a process designed to identify which stolen credit card numbers are still active. I refunded all 71 of the fraudulent charges, and Stripe asked for a report of the refunds; although they aren’t promising anything, I think they may refund me the $25.84 in transaction fees that I would otherwise pay.

After my developer added a reCAPTCHA (which theoretically prevents bots from submitting forms) to the TidBITS membership signup page, I again turned on the Custom Monthly Amount option. No further accounts were created, so I’m hoping the reCAPTCHA does the job.

There’s no great moral to the story here, apart from noting that the Internet has become a place where constant vigilance is necessary for those who try to roll their own services.

Preventing Future Inadvertent Unsubscribes

Finally, I want to close the loop on another recent event that I shared in “LittleBITS: Unsubscribe Bug Reversed and Virtualizing Monterey on an Old Mac” (14 February 2022). We discovered that 201 people had inexplicably been unsubscribed from TidBITS on 6 December 2021, right after that day’s issue went out in email. In TidBITS Talk, Eng Aun Cheng gave me the clue I needed, and correspondence with the developer of the Sendy app that we use for email distribution both confirmed it and provided the solution.

As part of best practices for bulk email, Sendy includes a List-Unsubscribe header in every email it sends. That header contains a unique unsubscribe link for each recipient, and many email clients use it to display a user-friendly Unsubscribe link or button in the message. So far, so good.

The problem comes when an email provider examines all the links in incoming email messages to identify and block phishing attempts. Although there’s no telling what was special about that particular issue, it seems likely that some widely used filter triggered the List-Unsubscribe link for those people. Instant unsubscribe, without alerting anyone.

The solution was a Sendy setting I wasn’t previously familiar with: Double Opt-Out for unsubscribes. With that option set, clicking the List-Unsubscribe link loads a page with a confirmation link that the user must click as well. That’s now in place, which should prevent these inadvertent unsubscribes in the future.

Although the List-Unsubscribe link works, we recommend that you use your profile management page on our site if you want to manage your TidBITS subscriptions. The List-Unsubscribe approach doesn’t communicate back to WordPress, so you’d need to ask us for help to resubscribe in the future.

I won’t pretend to be an expert on international affairs, but it doesn’t take expertise to condemn the Russian invasion of Ukraine. Whatever Vladimir Putin’s trumped-up excuse may be, setting the mighty machines of war in motion is inexcusable, especially in today’s modern, interconnected world. If nothing else, the COVD-19 pandemic has shown just how dependent we all are on one another.

Nothing I can say or do will have any impact on the actual conflict, but I wanted to remind readers that this is not just some tempest in a teapot on the other side of the world. Ukraine has a flourishing Apple development community that’s home to MacPaw (Setapp, Clean My Mac X, Gemini, and more), BeLight Software (Live Home 3D, Swift Publisher, and more), Readdle (PDF Expert, Spark, and more), CS Odessa (ConceptDraw), and Skylum (Luminar), among others. I’ve corresponded with all of these companies over the years, and several have sponsored TidBITS at various times. More personally, I hung out with Julia Petryk and Oleksandr Kosovan at the Jamf Nation User Conference in November 2019, I’ve enjoyed chatting with Irene Stepanovska and others from BeLight at several Macworld Expos, and way back in 2004, folks from BeLight gave me some Ukrainian gifts (see “BeLight Software Sponsoring TidBITS,” 29 November 2010):

Despite their far-off location in Ukraine, I had the pleasure of meeting a few of the BeLight folks at Macworld Boston in 2004; we had corresponded previously and they kindly brought me a few small presents to remember them by, including some excellent Ukrainian vodka and a tiny statue of the Duc de Richelieu, a French nobleman who is considered one of the founding fathers of Odessa and subsequently became Prime Minister of France. He still stands on my desk, reminding me of just how small the world has become.

Not to put too fine a point on it, but these are real people, and I’m worried about them and their families. Their companies are working to protect them and maintain continuity for their customers—MacPaw and Readdle have issued statements, and BeLight has posted a short note on Twitter. And Julia Petryk, who has been staying in a bomb shelter, pointed us to the Help Ukraine Win page, which collects various ways to help Ukrainians. I wish them all the best and fervently hope that they can return to their regular lives soon.

The Russian invasion has caused other ripples in the Apple pond. Frank Blome, CEO of ProjectWizards, has announced that his company is stopping all business with Russia and is calling on other developers to do the same. Given that Merlin Project could be used by Russia in managing the invasion effort and the fact that ProjectWizards likely knows who their clients are, it’s not hard to see what might have triggered Blome’s statement.

On an even wider stage, the economic sanctions imposed by the US, UK, European Union, and Australia have resulted in those governments freezing the assets of Russian banks. That has resulted in the suspension of Apple Pay, Google Pay, and other digital wallets in Russia. Deputy Prime Minister of Ukraine Mykhailo Fedorov has called on Tim Cook to stop selling Apple products to Russia and block Russian access to the App Store. Apple hasn’t responded to that request, though Tim Cook has posted on Twitter, calling for peace and saying that Apple is supporting humanitarian efforts.

I am deeply concerned with the situation in Ukraine. We’re doing all we can for our teams there and will be supporting local humanitarian efforts. I am thinking of the people who are right now in harm’s way and joining all those calling for peace.

— Tim Cook (@tim_cook) February 25, 2022

One thing you can do is remain vigilant for Russian cyberattacks. The US Cybersecurity & Infrastructure Security Agency has published Shields Up, a page offering cybersecurity guidance for organizations and recommendations for corporate leaders. As usual, its advice is probably more urgent for Windows-focused organizations, but particularly with the prevalence of the iPhone and Pegasus-like hacking software out there, Apple users can’t afford to be complacent.

Every so often, you make a discovery that throws the world as you know it into disarray. My latest foray into the Twilight Zone came when I found that it is now possible to create aliases to apps in iOS 15 and iPadOS 15. No longer are you limited to an app appearing just once on your Home screen—it can appear on multiple Home screen pages, in multiple folders, or even multiple times on the same Home screen page, pointless though that may be apart from making seemingly impossible screenshots!

Since each alias looks and works like every other one, this capability enables you to store an app in multiple folders—perhaps you want Messages to appear both in a folder for Apple apps and another that holds communications apps. Or, you could simulate a second iPhone “dock” by positioning the same four apps in the top or bottom row of each of your Home screen pages. It also may make Focus more useful by letting you specify custom Home screen pages containing aliases for different focuses (see “Apple’s New Focus Feature May Be Overkill,” 20 January 2022).

Through the Looking Glass

How do you create these app aliases? Before I explain, let me share another new feature of iOS 15 and iPadOS 15. When you swipe down from the middle of the Home screen page to invoke Search, you can work with any app that appears—either in the Siri Suggestions section or as a result of a search—just as though it were on the Home screen.

In short, you can now delete or move an app from Search. Touch and hold the app to reveal its contextual menu (including the Delete App option) or start dragging to move it to the Home screen. This feature would have been nice to have in pre-App Library days when searching was often the only way to find an app hidden among multiple Home screen pages. Note that deleting an app really deletes it from your device—you don’t get an option to merely remove it from the Home screen.

While playing with the capability to drag apps out of Search to the Home screen, I inadvertently dropped an app into a folder, only to realize that the app already existed on another Home screen page. How could such a thing be possible? Before this, an app could appear only once on the Home screen.

I dug deeper and discovered that as long as I started the search from a Home screen page that did not already contain the app, I could drag the app directly to the Home screen. (When I started the search from a Home screen page containing the app, dragging it from the Search screen resulted in the existing app moving.) The world was turning upside down!

Next, I checked to see if this technique worked from the App Library as well. It did! Dragging an app from the App Library to a Home screen page created an alias. Again, there was a caveat. It worked unless the rightmost Home screen page already contained the app, which again caused the existing app to move.

Since dragging immediately to a Home screen page containing the app prevented an alias from being created, I tried dragging an app from one Home screen page to another that already contained the app. Unlike the previous failures, this drag completed successfully, giving me two icons for the same app next to one another. The insane iPad screenshot at the top of the article is the best evidence yet that we’re living in an alternative reality—I swear that I created it by repeatedly dragging the Messages icon from Siri Suggestions to another Home screen page and then over to this page.

How to Create App Aliases

Here are the step-by-step instructions for creating iOS app aliases from the Search screen. You can see the process live in Josh’s video below (which has nothing to do with Spiderman besides the title card that he couldn’t resist):

1. From a Home screen page that does not contain the app for which you want to create an alias, swipe down to invoke Search.
2. Find the desired app in either Siri Suggestions or by searching.
3. Touch and hold the app icon and start dragging. The Home screen will reappear in jiggle mode.
4. Drop the app in the desired location on any Home screen page.

Or, from the App Library:

1. Ensure that the app for which you want to create an alias is not on the rightmost Home screen page.
2. Swipe left from that page to open the App Library.
3. Find the desired app, either by browsing through the App Library or searching within it.
4. Touch and hold the app icon and start dragging to enter jiggle mode. You can also touch and hold a blank spot in the App Library to enter jiggle mode first and then drag the app.
5. Drop the app in the desired location on any Home screen page.

If you found this article interesting, be sure to check out other techniques I’ve shared about how to work with apps on the Home screen in “Five Tips for Easier Rearranging of iOS Apps” (22 September 2020) and “Manage iPhone Home Screen Apps in Bulk with iOS 14’s App Library” (19 April 2021). They’re some of our most-read articles of recent years.

As you may know, I’ve started a new independent venture called Apple Buying Advice to offer quick Apple product advice to regular people who want to buy Apple gear but aren’t technology hobbyists. Front-page picks are intended to satisfy most people, and short guides go into further detail with the Jobsian intent of narrowing Apple’s increasingly overwhelming list of options.

My front-page Apple Watch pick is the GPS-only Apple Watch Series 7, and in the accompanying guide, I explained why I felt cellular connectivity is a waste of money for most people. Hoo boy, were you quick to set me straight! Many readers pointed out that a cellular Apple Watch is valuable for those whose clothes lack or have insufficient pockets, those who want to be able to call 911 from their wrist if they feel threatened, and those for whom the fall-detection feature could be a lifesaver.

In my defense, I didn’t discourage cellular Apple Watches entirely. For the Family Setup feature, which lets you set up an Apple Watch for a loved one who doesn’t have an iPhone, cellular is required, quite reasonably. But since an Apple Watch configured via Family Setup does not support ECG or irregular heart rhythm notifications (among much else), I recommend the cellular Apple Watch SE for that purpose. It doesn’t have those features anyway, and it’s quite a bit cheaper than the Apple Watch Series 7, so why pay more?

Also in my defense, my wife always has pockets, even when she’s wearing a dress. But she’s not a good example since she once owned an Apple Watch and doesn’t want another, regardless of how it communicates with the outside world.

So who should buy a cellular Apple Watch? And who should save their money?

Reasons to Avoid the Cellular Apple Watch

First off, a cellular Apple Watch isn’t generally a way to avoid owning an iPhone. Unless another person in your family sets up your Apple Watch with their iPhone, you’ll need an iPhone anyway. And as I mentioned, watches using Family Setup lack some potentially welcome features.

The base price of an aluminum Apple Watch Series 7 is $399, and the cellular model is $499, a whopping $100 increase, or 25% more. But it’s hard to make apples-to-apples comparisons across the Apple Watch line. For the $279 Apple Watch SE, cellular adds only $50—about 11% more. The luxury Apple Watch Edition and Apple Watch Hermès models are cellular-only, which simplifies things. So you can see—from a cost perspective—why I recommended the cellular Apple Watch SE but not the cellular Apple Watch Series 7.

You must also factor in the monthly service fee, which hovers around $10 per month or an extra $120 per year, plus taxes and additional fees. Although you’re fine if you use one of the Big Three carriers in the US—AT&T, T-Mobile, and Verizon Wireless—only a few smaller carriers and MVNOs (mobile virtual network operators) support the Apple Watch, and even fewer of those support Family Setup. So if you’re like me or others who prefer to work with an MVNO that resells access to another carrier’s network, a cellular Apple Watch may not be an option (see “Consumer Cellular Offers Cheap, No-Nonsense Access to AT&T’s Cellular Network,” 12 July 2021).

Let’s say you buy a cellular Apple Watch Series 7 and pay for service for 4 years. That would increase the cost from $399 to $979—a $580 difference. Obviously, if you’re going to make use of that connectivity, it’s your money to spend, but if not, it’s a lot to waste.

Note that you can buy a cellular Apple Watch but choose not to activate it. Adam Engst took that path several years ago when he bought an Apple Watch Series 5 (see “Upgrading from an Apple Watch Series 2 to a Series 5,” 20 January 2020). That gave him the flexibility to pay for the cellular connectivity if it ever became useful to him (it hasn’t) and so he could pass it on to his wife Tonya, who relies heavily on the cellular capabilities of the Apple Watch (alas, she opted to buy a new cellular Apple Watch SE instead). The cellular capability might still improve the trade-in or resale value, and it will still call 911 if that ever becomes necessary for him.

Many people buy and activate a cellular Apple Watch only to change their minds later because the benefits don’t end up justifying the cost. In part, that’s because Apple’s built-in features like messaging and fitness tracking are the main win, not third-party apps (see “How I Finally Embraced the Apple Watch as a Fitness Tracker,” 7 February 2022). For instance, you might think it would be helpful to be able to call an Uber from your wrist if you twisted an ankle while on a run, only to realize that Uber and other developers have given up on Apple Watch development.

Reasons to Get a Cellular Apple Watch

Let’s answer the core question: do you need cellular in your Apple Watch? My guess is probably not, but there are some good reasons to get it:

• Separated from an iPhone: If you need to be out in the world without your iPhone, having a cellular Apple Watch gives you basic communication capabilities. This might be the case if you exercise without your iPhone or if you sometimes forget your iPhone due to a lack of sufficient pockets.
• Increased safety: If you’re concerned about your personal safety while away from home, a cellular Apple Watch might enable you to place an emergency call more quickly or surreptitiously than with an iPhone. It could also help a family member see your location using Find My. And as noted, you can make 911 calls even without paying for an account.
• Fall detection: If you’re concerned about falling and not being able to get up or call for help, the fall-detection feature on a cellular Apple Watch could trigger an automatic lifesaving call to emergency services or make it easier to initiate a manual call.
• Family Setup: If you’re getting an Apple Watch for a child or senior who doesn’t have an iPhone, Family Setup requires a cellular Apple Watch.

Those are the most common reasons someone would need a cellular Apple Watch sufficiently to justify the expense. If you have other reasons—particularly apps that take advantage of cellular connectivity—please let us know what they are in the comments.