It seems like this amazing Easter egg only launched yesterday, to celebrate the original iPod’s 25th anniversary. Exquisitely well done. More like this, please.

Link: music.apple.com/404

I hadn’t heard of Tim Pan or Mediastorm until running across his 24-minute video review of the Duo. It’s a good and fair review, but what struck me are the rather astonishing production values. Amongst other things, they stress-tested the hinge with an industrial robot by opening/closing it 10,000 times. (That’s less than one-third the folds tested by Joanna Stern’s Hingey, but still.) It’s an incredible piece of work, especially given the one-week time constraint. English is Pan’s second language, and there’s an entire alternate version of the whole review, under the Mediastorm channel, in Chinese. It’s not just a different soundtrack — it’s an entirely separate cut of the video, where all his on-camera shots are spoken in Chinese.

At about 7:30 in the (English) review, Pan mentions that they (he?) offer every employee in the company a new iPhone each year. This year’s choices, by employee count:

• iPhone 18 Pro: 17
• iPhone 18 Pro Max: 41
• iPhone Duo: 140

The point of this in the review was to show how strong demand is for the Duo amongst Pan’s company’s Chinese employees. But what struck me is that the company has 198 employees. (Last year, he says, 150 chose the 17 Pro or Pro Max; only 1 chose the Air.) Pan’s YouTube channel includes interviews with Christopher Nolan and Hans Zimmer. I never heard of him before but he obviously didn’t come out of nowhere. (Perhaps this is only a function of how little YouTube content I watch.)

Pan only launched his X account this week. He posted the entire review video there, too, and it’s got 187,000 likes and 6,700 comments. As a promotion to launch his X account, he’s giving away 100 iPhone 18 Pros. Even if they’re base models purchased somewhere without sales tax, that’s $120,000.

Remarkable.

Link: youtube.com/watch?v=8pCccpKjjos

Glenn Fleishman:

The odds of this change in standards causing a security breach and your messages being exposed seem unlikely, at least right now. But after scrolling through conversations and seeing what’s going on, I feel Apple has omitted important signals for users when iMessage suddenly stops being used during a conversation.

[…]

The impact of that hit me while revising my book: when iMessage isn’t available, Apple tells you only inline. Despite all the information Messages displays about iMessage being encrypted, the inverse state is faint. This kind of negative knowledge, or information about something not happening, can often be as important as something that does happen. A warning about a fuel tank approaching empty is the kind of information every driver (or pilot) needs, for instance. If you think end-to-end encryption—or Apple-based encryption—is critical for you, then a pop-up message or other warning is what you would expect.

[…]

If you’d like to prevent Messages from downgrading security, you have options, although they may not be fully desirable. All of these are managed on an iPhone at Settings: Apps: Messages. You can’t control these message settings from an iPad or Mac.

This recently happened to my mother, and it was very confusing for her. For unknown reasons, while at home on Wi-Fi, she got signed out of iMessage. But it was not clear to her that this had happened or that she should try to sign back in. She was not aware that the Messages app supports multiple protocols or what the different bubble colors mean. All she noticed was that certain messages (e.g. ones sharing files) would no longer send and that she was not receiving some of the messages that people were sending to her. She saw the inline warning about encryption and interpreted it as that the sender was using a newer form of encryption that her phone didn’t support, so maybe she needed to upgrade.

I went over to take a look and quickly figured out that she was signed out of iMessage, but I couldn’t fix it. I kept getting errors that iMessage couldn’t be activated, even after rebooting the phone. Eventually, much later and again for unknown reasons, activation succeeded.

The Hack (Hacker News):

Like the Trojan Horse, passkeys are legitimately elegant on the surface, but there is something troubling inside.

What’s important to know is that unlike with any other kind of login credential, you do not have ultimate control over your passkeys. With passwords, you can choose where to write them down; with authenticator apps, you can decide for yourself which ones to use (they’re pretty interchangeable); and with physical security keys you can hand them to your colleague if you really trust them. But with passkeys come a hidden dial that lets the websites you use them on gradually remove your ability to do as you please with them.

[…]

This is the feature that means you no longer get to make the calls about your passkeys. Fortunately, attested passkeys are not yet required on most websites. But the FIDO Alliance standard makes attestation a part of the passkey ecosystem, whether you want it or not. And even if the website doesn’t require attestation now, simply by using passkeys you indicate to the website that your setup supports the FIDO Alliance’s passkey standard and that you as a user are capable of using passkeys. This means that once Twitter (formally X) is satisfied that the overwhelming majority of its users would be unaffected, they can flip the switch – perhaps not all at once, perhaps just for ten thousand users at a time so as not to cause a fuss – and start rejecting non-attested passkeys.

[…]

My expectation is that the industry will start off with very few constraints on your passkeys, and gradually add more and more, not all at the same time, but staggered on different sites, and then in a few years people will forget that they were ever offered a choice in which security measures they want to enable on their passkeys (if they even knew there were different kinds of passkeys at all).

[…]

Remote attestation can allow them to verify that your device is not capable of, say, sending and receiving encrypted messages, or running a competitor’s app, or using social media without verifying your ID.

Apple’s passkey implementation currently does not support attestation, but it sounds like this is only until they can work out how to do syncing:

Attestation was designed to attest to a specific device, exclusively at the point of creation, with a specific set of security properties. It doesn’t make sense for synced credentials for a number of reasons, including syncing to devices with different security properties, changes in security properties that happen after key creation, security properties of the sync fabric, sharing the passkey, or exporting to other passkey providers. We’re working hard with W3C and FIDO to solve these problems.

Ricky Mondello:

The post is predicated on the idea that a feature of WebAuthn called “attestation”, which is only used in high-assurance and usually corporate scenarios, and usually with physical hardware security keys, will be leveraged to hurt people, somehow.

The post posits that a website like X will bait and switch users: first, you get a passkey. Then, later, scary “attested” passkeys! This simply isn’t possible to do because attestation isn’t supported on the web for mass market, consumer authentication.

Attestation for passkeys (software-based, syncable credentials) is antithetical to their mass market goals, and would freeze out independent, non-corporate-backed credential managers. It’s an explicit non-goal of the designers of passkeys, who work together in a forum anyone can join.

And trust me, websites and apps like banks repeatedly asked for attestation at the beginning of the industry’s passkey journey. The platforms, browsers, and credential management apps have held firm that the goal of passkeys is reducing phishing and not some kind of trusted computing scheme. (And I will note: over my dead body!)

I believe this is not the goal of Mondello and some of the others working on this, but so far I’ve not been convinced that they will be able to control it. It sounds like Apple is working on it, and once the technology is out there, what’s to prevent key sites from forcing it on users? It seems like all this would take is the cooperation of a few big credential managers. This would be to their benefit in the sense that it would make their products required. Smaller credential managers who resisted would be frozen out.

varx:

The fact that websites and apps have been asking for attestation just reinforces the main point of the passkeys post! Sure, browsers aren’t supporting it yet, but that’s the sort of thing that can change, and the sort of thing that has changed in the past. See the footnote on Widevine and Firefox. (“Currently not supported” is also very subject to change.)

And we already have sites and apps allowlisting passkey vendors. That’s no theoretical, slippery slope fear -- it’s a real restriction on user freedoms that’s already happening right now.

I don’t think that a couple of bad points (e.g. the TOTP thing) invalidate the main point of the post, because the post wasn’t an argument from authority. The author makes some good points that stand on their own.

Ricky Mondello:

To be clear, the websites have stopped asking for attestation. Or at least, they’ve stopped asking me. Why? Because they know there’s no use in asking — that the OS vendors, browsers, and passkey managers are unified on this front. And now they’ve seen firsthand that passkeys without attestation are awesome and a big step forward.

iinuwa:

This is antithetical to users, as the types of authenticators that can pull this off are difficult to use (security keys). Companies with IT departments who can do account recovery for the user can handle this, an average user cannot. Synced passkeys are the answer to this for consumers and therefore attestation does not belong in the consumer space. Which is why password managers are in the spec groups pushing back against this every time it comes up.

Scott Helme (Hacker News):

If a consumer website decided tomorrow that it would only accept attested passkeys, it would lock out almost all of its own users, instantly. What website is going to do that?

[…]

If you’re worried about attestation creeping into consumer logins, then that’s worth pushing back on, loudly (if it ever happens). But it hasn’t happened, the biggest providers don’t support it, and avoiding passkeys today while you wait for it won’t protect you from anything, it just leaves you open to phishing.

It seems like rejecting passkeys is the only way the average user has to push back. The main thing protecting us is that sites don’t want to lock out their users who rely on passwords and 2FA. Once most people have adopted passkeys, if Apple and Google sell us out, I don’t think it matters much what the rest of the alliance thinks. Sites would be able to require attestation with the assurance that users could easily comply. Safari would probably opt everyone into attested passkeys, as it currently opts you into passkeys in general (unless you uncheck “Allow Automatic Passkey Upgrades”).

Previously:

• Attestation News
• Locked Down Passkey and Keychain Backups
• Forcing Passkeys
• Passkeys Credential Exchange
• Web Environment Integrity

Prime minister orders ministers to tackle students’ five major demands, including organising replacement teachers and school repairs

Hundreds of schools in France remained fully or partially closed on Monday as teenagers continued to blockade buildings and the government struggled to contain the biggest youth protest movement in years.

A 15-year-old protesting against what the demonstrators say are France’s dilapidated ⁠and understaffed ​schools ‌had his hand ‌blown off on ‌Monday in the northern town of Lens, the local prefect François-Xavier Lauch ‌said.

SpaceXAI (MacRumors):

Grok Bot is in beta and available today for SuperGrok, SuperGrok Plus, and SuperGrok Heavy; Cursor Pro, Pro+, and Ultra; and Cursor Teams Standard and Premium subscribers on desktop and iOS. Grok Bot comes with its own usage, separate from your Grok and Cursor plans, so anything you hand off to a Bot won’t count against your existing usage. Download the app, create your first teammate, and start handing off work.

[…]

Inside SpaceXAI, that already looks like real, multi-step coordinated jobs being handled: a sales Bot updating the CRM with call transcript notes and drafting follow-ups, an ops Bot seating new hires and processing invoices received in Gmail, and an engineering Bot reproducing a bug in the product UI, filing the ticket, and handing the fix off to a debugging Bot.

[…]

People inside SpaceXAI often run multiple Bots in parallel, with one to manage the others. A chief of staff sits on top, with a specialist for each lane: inbox management, expenses, recruiting, bug fixes, or operations. Instead of multiple agents you have to manage, Grok Bot gives you a small team that can work in parallel so you’re not the middleman.

Artificial Analysis (Hacker News):

Grok 4.6 gains 5 points over Grok 4.5 on the Intelligence Index just over one month after its release, or +23 points compared to Grok 4.3. This brings SpaceXAI back to the intelligence frontier alongside OpenAI, behind only Anthropic.

Kun Chen:

i’m 80% sure Grok Bot was originally built by the Cursor product team, and got rebranded after the acquisition

John Bai:

Believe it or not, the original Grok Bot started as an exploration of what an ambient computer assistant might look like.

I wanted to give an expressive face to a helper that could also use your computer. The character evolved, but that sense of presence stuck around.

Dare Obasanjo:

A real dilemma. People whose opinions on tech topics I take seriously are saying good things about Grok Bot.

It sounds like it nailed OpenClaw/Hermes for the masses but as a point of principle I don’t use MechaHitler. I would love an overview of what it gets right that everyone else missed.

I don’t trust xAI (or Meta) with my data, but it doesn’t seem like Siri AI can do all that much. So far, I’ve been too busy to do much with agents, even on a test Mac. But I don’t think agents are going away, so there’s a tension here that will need to be resolved eventually. My guess is that most people will throw caution to the wind in order to get results. Maybe Google will have something more trustworthy and powerful by then.

Previously:

• Meta AI for Mac and Muse
• OpenClaw 2.0
• Siri AI Ships (But Still Beta)
• ChatGPT Work and ChatGPT Classic
• SpaceX Acquires xAI, Goes Public, Acquires Cursor
• Claude Desktop App
• Gemini App for Mac