0:00:00It's been too long. It really has. I don't know why. It's like some of my favorite people to have on the show are the ones that I put off putting them back on the show because I want it to be special.
0:00:10And then it gets to the point where I'm like, you know what? I can't wait any longer. I gotta have jalapeno on the show.
0:00:17I'm just curious what the sandwich is going to be. You should get Adam Lizagor on a sandwich sandwich.
0:00:27Then it'd be a sandwich sandwich right last episode was
0:00:29Ben Thompson, that was my emergency
0:00:33Johnny Ive has retired episode. Yes, and that was good
0:00:38It was good Ben Thompson always good Ben Thompson very insightful on stuff like that
0:00:44But it was also I was saving it up. See, you know me, you know me very well. That's it
0:00:49It's you know, I think you've got me down cold
0:00:54Gotcha, I don't I don't celebrate stuff like episode 200. You know, I mean like when episode 200 rolls around
0:01:01I don't do anything special. I don't even mention it last episode though was episode 256 and as a nerd
0:01:07256 hits me harder than something like an episode 200. Are you the same way?
0:01:14Yeah, except for I would have to you know, I this excitement's over by 256. It's all 255
0:01:21It's all it's all the party is like 255 and 256 is the hangover see because the thing is
0:01:27The thing is as you know as well as I do that if if there's intelligent life elsewhere in the universe
0:01:34Maybe and if they're even vaguely
0:01:37Hominid type
0:01:41Life forms, you know if they even look vaguely like us, maybe they have eight fingers. Maybe they have 12 fingers
0:01:47Maybe they only have six fingers
0:01:49But the fact that we have a decimal
0:01:52mathematical system is
0:01:55clearly and
0:01:56unambiguously the fact that we have ten figures
0:01:59right, so these numbers like a hundred and two hundred are
0:02:03Completely arbitrary based on the number of fingers we have I'm not saying I don't notice
0:02:09I notice when I'm publishing episode 200 or you know a
0:02:13Couple weeks from now or months from now when I episode when I do episode 300
0:02:18I'll notice but it doesn't hit me the way like 255 or 256 does because I
0:02:23realized that no matter where you are in the universe even if you've got you know
0:02:29you're a species with eight fingers maybe you're a species with 12 maybe
0:02:33you're a species that doesn't have hands I don't know what the hell yeah but if
0:02:37you've invented computers you're gonna know that 256 is a magic number who
0:02:42knows what representation you're gonna put it in but it's gonna be a magic
0:02:46number because binary is magic. That's a good point, good observation.
0:02:53Well, but now you're 257 so... I'm gonna be a part of a
0:03:02beautiful sandwich though. That's all I have. How's your summer going? It's freaking hot.
0:03:11You're in Philly, right? So, or have you been in Philly through the heat wave?
0:03:17Well, we were in Florida earlier in the month and it was actually less hot and humid than it is right now.
0:03:24Right now, they say, I'm looking at the Dark Sky app, 91 feels like 99, but yesterday it was
0:03:34six o'clock at night and it was 94 degrees but it felt like I guess that's
0:03:40the heat index 106 which is insane like plus 12 on the heat index is absolutely
0:03:47insane yeah that's nuts we we just went actually for a quick weekend to get away
0:03:54up to Vermont we don't have any particular tie to Vermont it's just you
0:03:58know as you know you lived in Massachusetts for a while suddenly
0:04:00you're close when you're in Massachusetts to all these great northeastern states and Vermont is one
0:04:06of them. What's great about a place like Vermont is it's relatively unspoiled compared to the rest
0:04:13of the country/world. And so we went up to Vermont and it was freaking hot there as well, but it's
0:04:22the kind of place where you can just like walk over to the nearest river and sit down in a river.
0:04:28You wouldn't want to do that in Philly.
0:04:30- One of the things I love about Vermont,
0:04:32and I don't know if it's statewide,
0:04:34I don't know if it's only the roads I've been on
0:04:36the handful of times I've been there,
0:04:38but I have been there.
0:04:39One of the things I love is that when I've been there,
0:04:41and it might be statewide, I don't know,
0:04:43but there's no billboard advertisements at all.
0:04:46It's illegal, it is against the law, they just preserve it.
0:04:50So you're driving on these roads,
0:04:52and the only thing interrupting the natural woods
0:04:57Woods and and the mountains is the road you're on, you know
0:05:01like the actual macadam you're driving on is the only interruption and there's no advertisements for
0:05:08Coca-cola or movies or what whatever you have and and it's truly a beautiful beautiful state it is
0:05:16Yeah, and I didn't know that about Vermont, but I'm not surprised if that's true at the but the place I had consciously
0:05:22Noticed that is also true about before is Maine. Yeah, which is also huge and it's also beautiful
0:05:27And one of the funny things I noticed is there's no billboards
0:05:32But apparently the state just thinks you get too bored or something if you don't see something every once in a while
0:05:37So occasionally there's like an advertisement for the state itself. Oh
0:05:40State they just keep driving along. It's like hey, Maine. How about that? You know, I like it. There's also
0:05:47Signs that we don't have in Pennsylvania like a moose crossing
0:05:51Right? Yeah. We don't have moose in Pennsylvania. No, no, no. You got a problem
0:05:56if you got a moose in Pennsylvania. Yeah, we've got deer but they just let you hit
0:06:00them. They don't even warn you when you when you're crossing. They're just like
0:06:03just just drive right through them. Just get it over with? Yeah, just get it
0:06:06over with. Take your car into the shop. Get the dents taken out. Somebody will
0:06:10pick up the cars. Oh my god. You know what? What do you want to talk about? You got
0:06:17anything on your mind? Well, I actually just, as luck would have it, I just kind
0:06:25of like maybe even kind of rushed out a blog post, so I hope I didn't screw
0:06:28anything up, but I wanted to publish something that was on my mind and you
0:06:34invited me on the show today and I thought well I'm gonna get this out
0:06:36because I want to talk to John about it. And so it's gonna be one of these things
0:06:41I think it's gonna be either really interesting or somebody will point out
0:06:45some reason I got it all wrong, or both.
0:06:49But the key takeaway from this blog post I just published is sort of a consequence that
0:06:57I observed with the whole new app notarization thing on the Mac.
0:07:02You know about this.
0:07:04And it's the next level of all of these mounting restrictions/security enhancements that Mac
0:07:13developers have been facing over the past 10 years plus.
0:07:18And the notarization system is new last year and it essentially is a process where you,
0:07:23before shipping an app, you send it to Apple and they scan it for, I guess they say known
0:07:30malware, but then they also sort of verify that it's using, it's not a very restrictive
0:07:36set of APIs, but like there's certain APIs and certain like library loading behaviors
0:07:40that you're not allowed to use.
0:07:44- Things that they know are bad news.
0:07:47- Yeah, mostly, or things, and then there's some things--
0:07:50- Or that they think are bad news, without being judged.
0:07:51- They think are bad news, yeah, exactly.
0:07:53Some of them, I think most people would agree are bad news,
0:07:55so that's good, and they're scanning for that.
0:07:57And then some of it's kind of middle of the road,
0:07:58and then there's this kind of opt-in system
0:08:00where you just say, "Okay, I'm doing this thing."
0:08:02Like, for instance, you can say,
0:08:05"I want to be able to load libraries
0:08:09signed by entities that are not myself or Apple.
0:08:13By default, with this new notarization system,
0:08:17it's called the hardened runtime goes with it,
0:08:19and by default, you're only allowed to load shared libraries
0:08:22by, signed by the company that also signed the app,
0:08:26or by Apple itself.
0:08:28So that's an example of something where you can opt out
0:08:30of it because Apple realizes there are companies out there
0:08:33that load plugins from diverse developers, for example.
0:08:38For instance, recently I've been working for another company on some plugins for Apple's
0:08:44logic.
0:08:45And those plugins will not work if it can't load this way.
0:08:49Anyway, kind of going off on a tangent here, but the key takeaway from this blog post is
0:08:56something I noticed while working on the notarization process, which is...
0:09:00And to emphasize this, notarization is a new thing that is different than App Store.
0:09:08It has nothing to do with the App Store, really.
0:09:12The stuff that gets notarized can go right from the developer's website to your computer
0:09:17without ever going through the App Store.
0:09:19It's a different form of verification.
0:09:23And I think that's worth emphasizing.
0:09:26It is worth emphasizing especially because it shines the light on the one peculiar implementation
0:09:33detail which is that all of the notarization happens through App Store servers.
0:09:41So you submit your binary using this tool called AL tool. If you do it from the command
0:09:48line, Apple has stuff to let you do it automatically through Xcode. But most like, I think most
0:09:53companies of a certain size and then most companies that just kind of have things automated
0:09:57in a certain way, myself included.
0:10:00Do the things you build and submit whatever from the command line.
0:10:03Anyway, I noticed that...
0:10:06So the rough outline is you build your app, you submit it to Apple in binary form, you
0:10:10don't have to give them source code or anything.
0:10:12They scan it and then they basically keep like a dictionary of, you know, a look up
0:10:17table of hashes from binaries that exist that have been, you know, in the world that have
0:10:22been notarized. And then at runtime, when the OS is about to launch your app, I think
0:10:27just for the first time still, it goes and actually checks in with Apple and says, "Hey,
0:10:32this is the hash. What do you got?" And then Apple says, "Yes" or "No." Like, "This is scanned"
0:10:37or not. That's kind of the rough outline. Anyway, when I was going to notarize one of
0:10:42my apps, I got an error back that said the error wasn't like your app is messed up or
0:10:49It wasn't like Apple's servers were messed up.
0:10:52You have not signed the latest versions of the contracts at App Store Connect.
0:11:01As I said in this blog post I wrote, I sort of just flew right over.
0:11:04I didn't even think about it.
0:11:06This is kind of like that same criticism many people have for all these new dialogues that
0:11:12say "Do you want to allow this?
0:11:13Do you want to allow that?"
0:11:15classic like we criticized Windows for this and now Apple's doing it.
0:11:19Whatever it is, you get so used to approving things, you just do it almost automatically.
0:11:26And I think a lot of developers are like that with the App Store contracts.
0:11:30We're not lawyers.
0:11:31We're also not prepared to say, well, that's it.
0:11:35I guess this is my last day being an Apple App Store developer.
0:11:38>> Yeah, I'm out.
0:11:39>> Yeah, I'm out.
0:11:41You got me there.
0:11:42But what's interesting about this is,
0:11:45if I'm understanding everything correctly,
0:11:47I literally had to go agree to App Store developer contracts
0:11:52in order to notarize my app to ship directly to customers.
0:11:57- Right, in other words, you have to agree
0:11:59to App Store terms to distribute a non-App Store app
0:12:03if you're going to comply with this notarization,
0:12:06which in theory, on the surface, is a good idea,
0:12:11at least the spirit is good.
0:12:13There's no malfeasance on Apple's part to encourage this.
0:12:18But there are very reasonable reasons
0:12:25why some developers for certain apps
0:12:28do not want to agree to App Store terms.
0:12:30- Yeah, that's one aspect of it.
0:12:33And then the other aspect to me is just the granularity
0:12:37of how this has the potential to inter,
0:12:40so even if you're just like me
0:12:41you kind of blindly agree to the contracts every day.
0:12:43Whatever, not every day, but however often they come out.
0:12:47This is still a situation now where it's like,
0:12:49hmm, you just tried to ship an app,
0:12:51but uh-uh-uh, you haven't agreed to the latest contract.
0:12:55And that's a substantial difference from,
0:13:01people complained about developer ID when it came out,
0:13:04but with the developer ID,
0:13:05you essentially went through this process
0:13:07of getting a certificate that was then good for years
0:13:11of uninterrupted software distribution on the Mac.
0:13:14So I guess you could say, well, you had to agree
0:13:17to the terms to get a developer ID.
0:13:20But this feels different to me because of the granularity
0:13:25of it and the fact that you could at any time,
0:13:28theoretically there's companies out there
0:13:31that might actually look at the new contract and say no.
0:13:35I know that a lot of companies have lawyers who they at least have review every iteration
0:13:40of the contract.
0:13:42So you're looking at a situation now where you could face a situation where you're trying
0:13:49to ship an important bug fix and…
0:13:51Well, and it's very clear that if we're not there already, we're clearly heading towards
0:13:57a world where a non-notarized app is going to be a second-class citizen.
0:14:03Yes.
0:14:04Yes, well, I mean, this is--
0:14:06I think we're probably there already, right?
0:14:09It's come to a head in Catalina,
0:14:11in the Mac OS Catalina public beta,
0:14:13because, I mean, we are already there
0:14:16because right now, as it stands,
0:14:17if you are not developer ID signed,
0:14:20then by default, you know, the system just says,
0:14:22"You can't open this, sorry. It's not trustworthy."
0:14:25And you have to kind of know that you can do this whole dance
0:14:27of right-clicking it and selecting open.
0:14:29Right, or selecting it,
0:14:31and the other way to get around it
0:14:33it would be to select the icon in the finder and then in that if you have the
0:14:39toolbar in your finder window you can go up to the gear gear menu in the window
0:14:45and select open but there's something you know it's it's a it's equivalent it's
0:14:51the single click way of getting around the the control click or right click way
0:14:56of you know selecting an icon and hitting open because if you just double
0:15:02click the icon, you're never going to get there, right? It
0:15:04just, it only gives you the option to quit.
0:15:07Yep, that's right. And the behavior as of Catalina is it's
0:15:12intensified, because I think previously said, you know,
0:15:15something like, sorry, I can't open this because it's from an
0:15:18unknown developer. And now it says something like, can't open
0:15:22this because it's dangerous, and we can't scan it for
0:15:26vulnerabilities or whatever, you know, something a little bit
0:15:28more. So that's sort of the premise of my blog post is you have to start with the assumption
0:15:37that every reasonable developer who is shipping Mac software for, you know, for either for
0:15:43a living or because they want to have a broad reach, you have to start with the assumption
0:15:47that they acknowledge that they have to sign things with developer ID and that now we have
0:15:54to notarize our software.
0:15:58Starting with that premise, of course you can still ship software and people can right-click
0:16:02it or whatever, but it's an interesting new world.
0:16:07Starting in 1015, there's an interesting barrier now that could potentially be significant
0:16:17if, I don't know, some companies, like I said, they have to have lawyers review these contracts
0:16:22before they agreed to them.
0:16:23And that's going to slow some releases down.
0:16:27One thing I mentioned to you before we started recording,
0:16:32just when we were texting, setting this up, but for years,
0:16:37we, meaning Mac experts, Mac nerds, Mac aficionados,
0:16:43Mac developers, people who really, really care deeply
0:16:48about the Macintosh as a platform,
0:16:50have been worried for years that Apple is going to force.
0:16:56IOS style restrictions on Mac OS, meaning, hey,
0:17:01the they're going to issue an update, they're going to have a WWDC
0:17:05where they say everything outside the app store is deprecated next year.
0:17:09You know, and they never say next year.
0:17:11But you know, when they mean next year, they'll they'll be like in quotes,
0:17:15you know, next year it's going to be App Store only.
0:17:19and everything you're going to run on your Mac has to go through the App Store.
0:17:23That's the thing that we've been worried about.
0:17:24We don't want I don't want that.
0:17:26I really don't. I think that would be very bad for the platform.
0:17:29I don't think it'd be the death of the platform.
0:17:32But I really do think that part of what makes the Mac, the Mac
0:17:35is that you can run arbitrary software.
0:17:37And and I've been worried about it
0:17:41just because it seems like something Apple might do.
0:17:43And and, you know, you and I have a slew of friends
0:17:47who are all in the same racket, and we've all been vaguely worried about it.
0:17:51And the truth is, like many things in life, it's like the simplistic thing you're worried
0:17:57about isn't the thing to worry about.
0:17:59It's not working out like that.
0:18:01I don't think that's going to happen now because year after year as we see the screws tighten
0:18:07on some of this security stuff, the Mac is evolving in very different ways.
0:18:13It's not like, I wouldn't call it like iOS at all, but it is, in broad terms though,
0:18:20it is definitely more and more under Apple's control.
0:18:26And it's not in a simplistic way like the way that iOS is where any kind of broad-based
0:18:34software you want to distribute has to go through the App Store or you have to cheat
0:18:38like Facebook and Google did and abuse your beta certificate.
0:18:43But to play by the rules on iOS, you need to go through the app store.
0:18:49It's very simple.
0:18:50And then your app needs to comply with all the various app store rules.
0:18:53The Mac isn't like that at all. It still isn't.
0:18:56I don't think it ever will.
0:18:58But things like this notarization are
0:19:02Apple is a is a gatekeeper on this.
0:19:08Yeah, absolutely. And that's why it's so appropriate that the technology on the Mac is called Gatekeeper.
0:19:14When it came out, I think people read a lot into that and was like, "Wait a minute, they're
0:19:18not going to let certain software run." And you're right, everyone jumped to conclusions.
0:19:24But yeah, I mean, I don't know. It's funny because I often have a take on these kinds
0:19:29of things that is simultaneously a little bit worried and like a little bit, I guess
0:19:33I guess you could say I'm kind of conservative in that sense
0:19:38that I kind of want things to just stay as they are.
0:19:41But then I think I'm also pretty pragmatic
0:19:43about the security improvements.
0:19:45Like if I look at my Mac today
0:19:48and the world that we're living in
0:19:49and the things that crap people are out there doing,
0:19:52I frankly can't relate too well to people who are like,
0:19:58it should just be the way it used to be
0:19:59where you could download anything you want
0:20:01everything has access to every file on your Mac more and more I'm like geez I'm
0:20:06kind of glad I have this locked down Mac but well and I'm kind of glad I'm really
0:20:12glad by my parents have it I'm really glad my wife has it yeah my son has it
0:20:17you know like and I you know it's it sounds a little pretentious to say that
0:20:24I'm special because I I understand I quote understand this stuff and so I
0:20:30I want special privileges, but I do because I kind of do understand this, but I really
0:20:36am.
0:20:37And I feel like that's the line that Apple is walking is the line between what they do
0:20:43for the typical 98% of Mac users versus what they allow for the expert slash developers
0:20:55slash power users, however you want to describe them,
0:20:592% of Mac users who this stuff
0:21:03is sort of getting in the way of.
0:21:04And I do feel, I'm worried with 1015 Catalina
0:21:11that they've sort of, they're crossing the line
0:21:16and this is the version where they might start
0:21:19really inconveniencing us.
0:21:21- Yeah, yeah, I mean,
0:21:24I imagine that depending on what your particular niche interest is there's been a release in the past three years or whatever four years
0:21:32Maybe longer where that was the line, you know, I think I'm like scripters, right? I think really had it
0:21:37tough in the past year I
0:21:40Think because of that, you know, I mentioned that thing about only loading Apple or your own
0:21:46Libraries and yes that basically I think in
0:21:501014
0:21:52effectively just killed a bunch of,
0:21:55like I don't think you can,
0:21:56I should know more about this off the top of my head
0:21:58probably because of my involvement with scripting utilities
0:22:01but--
0:22:01- You should.
0:22:03- I should but I kind of just,
0:22:06I'm not completely up over my head in that these days.
0:22:10But I think effectively you can't load
0:22:13like third party OSX anymore from,
0:22:17like if you use Apple's script runner,
0:22:20you can't do that and that's like whole workflows
0:22:22that just got broken.
0:22:24And yeah, you're right though,
0:22:25there's a new thing every year,
0:22:27and I think this is gonna be another one of those years
0:22:31where it's like, oh well, there's a whole realm
0:22:33of productivity things that you can't do anymore.
0:22:36But getting back real quickly, what you were saying,
0:22:39are we being maybe a little bit presumptuous
0:22:42about thinking that we know how to be safe
0:22:45when others don't?
0:22:46I really feel myself gradually shifting over the years
0:22:51where every time Apple comes out with another one
0:22:53of these rounds of security improvements,
0:22:55I have to say I understand less and less,
0:22:59intrinsically, why they did it.
0:23:01And then I start looking into it, I'm like, oh.
0:23:04And they explain why they did it.
0:23:06And I'm like, ah, geez, I have to be honest,
0:23:08I would have never thought about that.
0:23:10And so it's like, maybe kind of edge cases,
0:23:14but I think they're doing these things
0:23:15because they spot legitimate vulnerabilities.
0:23:19And I guess I feel less and less competent myself
0:23:24to manage all the different aspects of my computer security.
0:23:29- Yeah, that's very true.
0:23:30All right, let me take a break and thank our first sponsor.
0:23:32And it is one of my best friends on the internet,
0:23:35Squarespace.
0:23:36Oh, I love Squarespace.
0:23:38Look, you need a website,
0:23:41maybe your friend needs a website,
0:23:42maybe there's a company, a local restaurant,
0:23:45a local business around the corner needs a new website.
0:23:49They come to you because you're the neighborhood nerd.
0:23:52They know you know what you're doing.
0:23:54Don't build them a website from scratch.
0:23:57And then you're on the hook for all the updates
0:24:00and when things need to change,
0:24:02and then they're calling you and calling you.
0:24:04Send them to Squarespace
0:24:06or get them started on Squarespace yourself, build it,
0:24:09hand over the keys to them.
0:24:12because Squarespace is so easy to keep going
0:24:17and it's so easy to get started.
0:24:19It is so easy.
0:24:20It is a CMS, so you can add blog posts or podcast episodes
0:24:25or whatever you want on a periodic basis.
0:24:28Or if you just need to add new pages,
0:24:30just new sections of the website, you can do that.
0:24:34All of it very easy, but it's also a design tool.
0:24:38All of the design stuff, all of the templates,
0:24:41all of the tweaking of the design,
0:24:43putting a logo at the top,
0:24:44making sure everything is responsive.
0:24:46So it looks great on a giant display,
0:24:49looks great on an iPad, looks great on a phone.
0:24:52All of it is built right into Squarespace,
0:24:54super whizzy wig, whizzy wig.
0:24:56That's a term that really has sort of fallen out of favor.
0:25:00We don't really think about it anymore.
0:25:01What you see is what you get,
0:25:02but Squarespace is like the epitome of whizzy wig,
0:25:06because when you're the owner of the website
0:25:10or you're just a rando visitor to the website.
0:25:13You're looking at the same thing,
0:25:15but when you're the administrator,
0:25:17you have edit buttons where you can change things,
0:25:20move things around,
0:25:21but you do it all directly right on the website.
0:25:24It is so great, such a great place.
0:25:26You can do everything from registering domain names
0:25:29to updating the site, to designing the site,
0:25:32all on Squarespace.
0:25:34Here's what you do to get started.
0:25:36Go to squarespace.com and remember this code, talk show.
0:25:40No, the not the talk show, just talk show ta lk s h o w.
0:25:46And when you check out, you'll save 10% off. And that counts,
0:25:49including up to a year, you can just sign up for a year in
0:25:52advance. That's like getting two months free. It's amazing. Go to
0:25:55Squarespace calm, remember that code, talk show, go to
0:25:59squarespace.com slash talk show, and you can get started. But
0:26:02just remember that code talk show when you pay. So one of the
0:26:07things I've been writing about lately, and I think it ties into
0:26:10this and it's this term, it's like my obsession for the summer is non-consensual technology.
0:26:17And it started with the Zoom thing, right? That wasn't this ridiculous? I'd never heard of Zoom
0:26:25before. And this is one of those things where me working at home without any colleagues,
0:26:32and every time I do talk to somebody, it's either FaceTime or when I do a podcast at Skype. Zoom is
0:26:39is apparently a very popular sort of virtual meeting
0:26:44software type thing.
0:26:47It's got a webcam.
0:26:48You can look in a--
0:26:50and you can have a virtual meeting.
0:26:52You could have eight people around the world.
0:26:55And there you go.
0:26:57You're all looking at each other in this thing.
0:27:00And you can talk to each other and share notes
0:27:02and whatever the hell else you do in a meeting.
0:27:06You wouldn't know.
0:27:07Right.
0:27:07The way that Zoom had set this up is to me, absolutely criminal.
0:27:14I mean this literally, I don't think that it is literally against any particular US federal law,
0:27:22but it ought to be. It ought to be against the law. And in terms of computer ethics,
0:27:29it is absolutely criminal. They set their software up such that when you install their software,
0:27:36they'd ask for, you know, hey, can we have administrator privileges or whatever? And you say,
0:27:41okay, because this is what I need to do to install this. And they installed a local host web server
0:27:48that was set to launch whenever you logged in. And it was outside the app bundle. And the thing that
0:27:58whatever mechanism, I don't know what mechanism they were using to make sure it launched whenever
0:28:03you logged in. But whatever it was, it was all outside the app bundle. So even if you deleted
0:28:09the Zoom app, you're like, I don't like this or I only installed it once because somebody told me
0:28:14I needed to have a meeting. I don't really care for it. I'm going to delete it. You delete the
0:28:19app, you hit empty trash, it's gone. You can even restart your Mac. Unbeknownst to you, innocent
0:28:29user of Zoom even just one time, this invisible web server is still running on your Mac, which
0:28:36is insane, absolutely insane, especially if you deleted the app.
0:28:41And if you're ever on a web page and the web page sends your computer on any web browser
0:28:49a URL like addressed with their custom Zoom URL scheme, it would go to the local host
0:28:57running invisible web server that you didn't even know was there.
0:29:01And it would download and reinstall the zoom client that you
0:29:07purposefully deleted and then open it up,
0:29:10which all of what I just described is exactly
0:29:16what they designed it to do. None of that is out of spec.
0:29:21None of that is a bug. None of that is, is, is, uh,
0:29:26in error. And guess what? Turns out they did have at least one bug that would allow somebody
0:29:34to completely denial of service your computer by sending an unending stream of requests
0:29:42for the Zoom thing. So you could load a Web page just by going to a Web page. And if the
0:29:48Web page decided to attack your computer, it would just send an unending number of requests
0:29:53for this and it would completely lock up your computer, which it was clearly a bug.
0:29:59And then there was some kind of way where they could turn the webcam on, which of course
0:30:03is terrifying and is everybody's worst nightmare with webcams and ties into the whole Joanna
0:30:11Stern piece from a couple of weeks ago about whether you should put a piece of tape over
0:30:14your webcam or not. There was another bug where they could turn on your webcam without
0:30:20you knowing or requesting it or allowing it, which is insane.
0:30:23Absolutely insane.
0:30:26But the whole thing that
0:30:29the starting point of them doing something that you never permitted,
0:30:33never would have permitted if they had asked for it is to me,
0:30:37it gets to the bottom of what's wrong with the entire industry.
0:30:41And it's kind of it.
0:30:43It makes me feel like a gray beard.
0:30:47You know, it's like I'm only 46.
0:30:49I'm not that old, but I really feel like, oh my God,
0:30:54when I got started really becoming
0:30:56a serious computer enthusiast and thought,
0:30:58this is what I wanna do with my life,
0:31:00I wanna get into this industry,
0:31:02nobody would have ever done anything so contrary
0:31:05to the user's wishes or best interests.
0:31:09- Well, not nobody maybe, but nobody who was--
0:31:13(laughing)
0:31:15Nobody who was--
0:31:17- Selling a legitimate product.
0:31:18- Right, right, right, this kind of gets back to the,
0:31:20such a perfect segue from the whole question of like,
0:31:24can we look out after ourselves or not, right?
0:31:26Like this is a great example.
0:31:28- Zoom is, again, I'm very contrary to them.
0:31:31I could not be more critical of them,
0:31:33but their fundamental product is a real product
0:31:35that people use and seem to like.
0:31:36- It's a product that people use and they love it.
0:31:39And I didn't know this either.
0:31:40I had never heard of the company.
0:31:42And I was discussing it with some folks,
0:31:45kind of like, well, there's this little,
0:31:46you know, nobody heard of it, app that has this bug.
0:31:50And everyone was like, everyone was like,
0:31:52what do you mean nobody's heard of it?
0:31:54Like everybody I want to teleconference with
0:31:56uses this thing, and it's great.
0:31:58- That's totally me, that is totally me.
0:32:00- So I had the same experience,
0:32:02but this is a perfect example.
0:32:04Who the heck thought that you'd download
0:32:06a teleconferencing app from a reputable, quote unquote,
0:32:09seemingly, presumably I should say,
0:32:11reputable software company,
0:32:14and it would install a secret web server that makes you vulnerable to browser attacks.
0:32:20And that's probably a perfect case in point for why we need...
0:32:26Why is Apple doing all this security junk? Well, it's people doing stuff like this.
0:32:30And I think your broader point there, though, is correct that there seems to be...
0:32:37And this extends way beyond the Mac. This probably extends to judging the ethics of
0:32:43of companies like Uber and people who have done things
0:32:47where you take a step back and you say,
0:32:49well, why the heck would anybody do that?
0:32:51That's a violation of somebody's privacy
0:32:54or their rights, whatever.
0:32:58And it just seems like we're in one of these eras right now
0:33:01where it's very,
0:33:04I think people are making a lot of excuses
0:33:07for doing things in the name of profit or--
0:33:11- Yeah, or what they think is profitable.
0:33:13- Yeah, or profit.
0:33:14- Even if it isn't profitable, but they think it is, right?
0:33:16- Yeah, and in this case, I mean, they had a,
0:33:19they said, you know, they had a pretty good case
0:33:21for making this, for defending this
0:33:23as being driven by user experience, right?
0:33:27They said, I think if I remember it correctly
0:33:30with the Zoom thing, it was like, well,
0:33:31this saves users a click so they could just
0:33:33automatically get connected, and when that works,
0:33:36customers are delighted because it saved them a click.
0:33:39And if you can save customers a click
0:33:41without making them suddenly exposed to new vulnerabilities,
0:33:46then that is laudable,
0:33:48and that's something you should be doing.
0:33:50So it wasn't like in this case they were saying,
0:33:51hey, if we install this secret web server,
0:33:53we can make a dollar extra for every customer.
0:33:55They were saying,
0:33:56we can make a competitive advantage with this.
0:33:59- It sort of ties into MarsEdit in a way,
0:34:03because if I've read the story correctly,
0:34:07when they came up with this scheme
0:34:10to install the invisible web server behind the scenes so that you could click a button
0:34:17in a web page to say, I want to talk to Daniel over Zoom and it would download the client
0:34:25and install it and open it and then all of a sudden, you know, me and you are web chatting
0:34:30or whatever you want to call it.
0:34:33If I'm reading it correctly, it started when Safari was updated so that bookmarklets require
0:34:44user interaction.
0:34:48I forget the actual vulnerability, but there was a real vulnerability that that was in
0:34:53response to.
0:34:54In other words, does Mars Edit use a Mars Edit colon URL scheme?
0:35:03Is that what it is?
0:35:04It does have that, yeah.
0:35:06So lots of apps have this sort of thing.
0:35:09So for example, Daniel's app, Mars Edit, has a URL scheme.
0:35:13And it starts, instead of HTTP colon URL, the rest of the URL goes here.
0:35:20It's Mars Edit colon and then there's like a command and then parameters so that you
0:35:27could open a new blog post with this as the title and this text as the body.
0:35:35There's a whole bunch of things you can do with it and all sorts of apps, more apps than
0:35:41we could name have schemes like this so that you can click a link and you can make links
0:35:48in e-mail or text or wherever, and you can create a new to-do in things or other apps
0:35:58and all sorts of neat things you can do. But the problem was that they were being abused.
0:36:03And there were ways that certain Web sites were abusing this system.
0:36:08And so Apple changed Safari so that whenever you open any URL
0:36:16whose-- the resolution of the URL
0:36:18is going to result in another app opening,
0:36:22it would ask for confirmation in the Safari window.
0:36:26And you have to click a button.
0:36:29One button.
0:36:30Yep.
0:36:31Yeah, one button.
0:36:32Isn't that bad.
0:36:36But on the other hand, if you're used to clicking no buttons, it does seem like,
0:36:40Oh, this is annoying.
0:36:41But it, it there, there's sort of no middle ground where they,
0:36:47they can't close the security hole that was opened by the fact that,
0:36:52that it would automatically open these other apps without this.
0:36:56And so in, in response to this is why they started this. But, uh,
0:37:02that's really the wrong way to go.
0:37:05Really, yeah, I mean, that's really the most. That's the most
0:37:08damning thing I think about the zoom incident was that when
0:37:12people broke it down, they basically discovered that, you
0:37:16know, they're working around something that's specifically
0:37:21designed to get user consent. And so it's back to what you
0:37:24were saying, right? What was it? What did you call it the non
0:37:26consensual technology?
0:37:28Really love and it applies to so many things that we've, you
0:37:33know, so many of the last couple of years of topics for podcasts and stuff. It's so
0:37:40perfect. Nonconsensual technology. Nobody, maybe nobody said, nobody said, you know
0:37:46what, I would like to have to make an extra click every time I start a zoom
0:37:50call. Nobody said that nobody wants that everybody would like it. If, if everybody
0:37:55played fair, and nobody did anything dishonest. Everybody would like it if you
0:38:01didn't have to make the extra click to make your Zoom call. But...
0:38:05Yep. I think what...
0:38:08It's sort of like saying, wouldn't it be great if you could leave the doors of
0:38:11your house unlocked all the time? And then even if you come home with two
0:38:15hands full of groceries, you can just put your elbow on the doorknob and come in
0:38:19the house. Wouldn't that be great? It would be great, but you can't leave your
0:38:23doors unlocked all the time because who knows who's going to come and jigger the
0:38:28door. Right? So you've got to lock the door and then once the door is locked, you have
0:38:33to click the extra button to make a Zoom call. And they decided, "Well, wouldn't it be...
0:38:41How about once you let us in your house, we'll unlock one of your windows without telling
0:38:45you?"
0:38:46Right. It'll be convenient. Trust us.
0:38:50And then if you ever need to make a Zoom call, we'll crawl in the window and open the door
0:38:54for you. Creepy. I don't think that's that much of a stretch as an analogy, that they
0:39:01came in and unlocked window 80.
0:39:03Right. They put some toilet paper in the door lock thing just in case they needed to get
0:39:09in later. But I think what you're getting at also points to a problem with Apple's approach
0:39:16to some of these security things is that I don't think Apple, either they don't think
0:39:22through extensively enough what the usability implications are going to be, or they don't
0:39:28consider them as important.
0:39:31This whole thing with the... you click on a custom link and now it prompts you... the
0:39:38consent is important, but I think most users agree that consent doesn't need to be... in
0:39:47In a lot of situations in life, consent doesn't have to be granted explicitly every single
0:39:52time.
0:39:53Right?
0:39:54Right.
0:39:55And so you click the link once and it says, "Are you sure you want to open this Zoom thing?"
0:39:59And then maybe if Apple had thought it through a little bit more, maybe they'd realize how
0:40:02annoying this was going to be, not just for Zoom, but for all this other software that
0:40:06uses this kind of solution, for my bookmarklet, for example.
0:40:09And then maybe they are motivated then to engineer a solution that establishes a compromise
0:40:16where it's like, "You know what? I pretty much know, I trust whatever Mars Edit URLs
0:40:21are not dangerous to me." Or they say, "You know what? Zoom URLs, they seem like they
0:40:27could be dangerous, so why don't you just only allow those to be opened from the zoom.com
0:40:31or whatever."
0:40:34And I say this because you and I, and you know this, I mean, I don't want to go too
0:40:37far into the weeds here, but you and I have gone... It is absolutely my privilege that
0:40:45I know you and you're my friend, but Mars Edit happens to be one of the very small handful
0:40:51of apps that I most rely on, literally professionally. I mean, tens of thousands, the overwhelming
0:41:00vast majority of posts to Daring Fireball over the last, the entire history of the site,
0:41:06frankly, go through Mars Edit. Mars Edit is, I forget, how long, when did you take over
0:41:13Mars Edit. It's 2006. 2007. Yeah, so it's been 12 years, believe it or not. But it is a... 12 years, Jesus.
0:41:22It is a blog editing app that speaks to any app that uses any of the various
0:41:32open blog editing APIs. WordPress would be by far and away the most prevalent. I
0:41:39I still use movable type, but movable type uses,
0:41:43has a remote API that Mars Edit can speak to.
0:41:47That's what I use it through.
0:41:49But almost everything I post to Daring Fireball
0:41:53goes through Mars Edit.
0:41:55And the only things that don't typically are like,
0:41:58sometimes I'll make typo corrections from my phone
0:42:01going through the web interface,
0:42:02but it's truly an essential part of my workflow.
0:42:06I don't know what I would do without it,
0:42:09But I also have and have had for years a bookmarklet that I use in Safari.
0:42:16And so if I'm reading a web page, you know, could be from Bloomberg, could be
0:42:20a New York Times, doesn't matter what website it is, I can click a button in Safari, one button,
0:42:27and then it jumps me into into Mars Edit. It pre-fills the title with the title of the page
0:42:33that I was reading. I can tweak it if I want. It pre-fills the URL that I'm linking to.
0:42:40And if I have a text selection in my browser window, it pre-fills it as a block quote in
0:42:46the window. It's a really, really nice convenient way to start the process of linking to a website.
0:42:53And at some point about two years ago, two, three years ago, when Apple changed this,
0:42:59where you had to click an extra button, it would be like, "Are you sure you want to
0:43:03I open this in Mars edit.
0:43:05I mean, I do this a lot, especially when I'm in the flow.
0:43:07You know what I mean?
0:43:08Like on a good day, when I'm really, you know,
0:43:10maybe I've got a couple of things queued up
0:43:12to start the day and then I find a couple of more links
0:43:15during the day and I might have like seven or eight links.
0:43:19The extra click really annoyed me.
0:43:20And so you and I work this out.
0:43:23And I actually have a custom version of the app,
0:43:28I have a post to Mars edit app that does it exactly the way I want to, but it's super
0:43:39technical.
0:43:40I mean, most people can never do that, right?
0:43:41I mean, I've got like a weird combination of me being half nerdy and especially being
0:43:51pals with you to get it set up just right.
0:43:55I've got this custom app on my site that the app literally doesn't do anything except offer Safari this extension, which lets me get around the confirmation because I've okayed it once.
0:44:08Whereas, and I think you're exactly right.
0:44:11I kind of the whole thing would have been unnecessary if I could just tell Safari, hey, these Mars edit colon URLs.
0:44:20I'm okay with them.
0:44:22Do whatever they say.
0:44:24or maybe being able to permit on a bookmarklet
0:44:29by bookmarklet basis, right?
0:44:31So you make a bookmarklet, you say,
0:44:33you know, I wrote this, just trust me, this is mine.
0:44:36Yeah, there's lots of ways they could have made it easier.
0:44:41It's funny, I have to admit,
0:44:43I didn't look into the Zoom thing that carefully,
0:44:44but it makes me wonder why weren't they able,
0:44:48they have a native app running, I assume.
0:44:50- Well, I think where they really cross
0:44:54the line was where they decided that they would like to be able
0:44:58to reinstall themselves after being deleted. And at that point,
0:45:04you're, you're in the dark world. You know what I mean?
0:45:07Like, that's wrong. You know what I mean? Whereas I feel like
0:45:10if they were like, as long as our app is still there, there
0:45:13were a couple of ways that they could have gotten around this
0:45:16and made this more convenient. I think the thing the the, you
0:45:22know somewhere at some point they had a meeting where somebody wrote on a white
0:45:25board reinstall after deleting the app and that's where they cross the line
0:45:29right you have to admit though it's pretty convenient when they sneak back
0:45:33into your house and make you coffee the next morning I I do I do I mean I'm very
0:45:41offended by what they did but I kind of have to salute their like leaving behind
0:45:51behind a web server that's always running on port 80, that is sort of insane. I have
0:45:58to admit that's... I condemn them for the morality of it, or the ethics of it, whatever
0:46:06you want to call it, but I kind of salute them for the balls.
0:46:12Yeah, but no, it's one of these things where it's like, "Ugh, don't ever want..." I'm not
0:46:19don't ever want like if somebody asked me now if I wanted to do a zoom
0:46:23conference call like I'm glad I'm not a position where people yeah I would
0:46:28actually say no you know yeah it's I don't trust it that makes me think of
0:46:33Dropbox but let's hold that thought I'm gonna bring up this Dropbox stuff after
0:46:37I tell you about our next sponsor and it's another one of my good friends
0:46:42longtime sponsor of the show fracture look we all take hundreds probably
0:46:49thousands. I don't know what the average is, but I probably average well over a thousand iPhone camera
0:46:54shots a year. I've already taken hundreds of shots this summer from being on vacation. I love using
0:47:02my iPhone as a camera. It is absolute every year they get better and better. But you know what?
0:47:08It's not great only ever looking at your photos on a little five inch iPhone display.
0:47:16Even if you look at them on your iPad, nice and big,
0:47:20still not as great as actually printing the photos you really love.
0:47:25The ones that are true keepers, the ones where you capture your friends,
0:47:30your kids, your spouse, your parents, whoever you love, and they really look great.
0:47:36Or maybe it's not even people, maybe it's just a sunset or something like that,
0:47:40but just a great moment. Print it out and the best way to get your
0:47:46very favorite pictures printed out is on fracture fracture. When you go there, you upload your
0:47:52pictures, they print them. They don't put them on paper and then like tape them to a piece of glass.
0:47:57They literally print the photos right on glass. I don't know how they do it. Black magic. I don't
0:48:04know, but it really looks like they're printed right on the surface of the glass and they go
0:48:11edge to edge. There is no corner. There's no frame. It's amazing. And when they ship them to you,
0:48:18they come with everything you could possibly need to hang them on the wall, to prop them up on a
0:48:24mantle or on your desk if it's smaller. Everything you need is all right there in the case. And they
0:48:32do it all right in Gainesville, Florida with US source materials. It is absolutely phenomenal
0:48:40print quality. Absolutely amazing when you look at them on your wall or on your desk. They're truly
0:48:47the best way I know of to get your photos printed. And they make amazing gifts. They're the best
0:48:54gifts I have ever given to people in my family ever. I just use them over and over and over and
0:49:00over again for gifts because that's one of the great things. I'm a terrible gift giver because
0:49:05every once in a while I'll think of a good gift for somebody and then you give them the gift and
0:49:09And then what do you do next? What do you do next year?
0:49:12If it's their birthday or it's Christmas or whatever fracture,
0:49:15you can just keep giving it to them over and over and over again.
0:49:18It never gets old because you never run out of new photos.
0:49:21It's absolutely phenomenal gift. I love their product.
0:49:25We have them all over our house. Here's where you do to find out more,
0:49:29go to fracture me.com or no, just fractured dot me.
0:49:33That's actually their domain name. Fracture dot me. And, uh,
0:49:39Just remember the code talk show.
0:49:41Uh, and when they ask you, where did you find out about fracture?
0:49:46Just remember to tell them you found out about it on this podcast.
0:49:49I love fracture.
0:49:50Go check them out.
0:49:51Absolutely a phenomenal product.
0:49:53They're another example of a company that's Gruber proof.
0:49:57They've Gruber proffed their domain names.
0:49:59You can go to either one.
0:50:01Fracture me.com fracture.me.
0:50:05It doesn't matter.
0:50:07You know my absolute favorite grouper proof company?
0:50:10- I can guess it, I bet I can guess it.
0:50:12- All right, what was it?
0:50:13- BlackBlaze.com. - Yes!
0:50:15(laughing)
0:50:18So BackBlaze, wait, what's the real company?
0:50:21BackBlaze. - BackBlaze.
0:50:23- BackBlaze, long time sponsor,
0:50:25not a sponsor of this episode,
0:50:26so this is totally unsolicited.
0:50:29Great online backup, but I said their domain
0:50:33was BlackBlaze.com. - BlackBlaze.
0:50:36And they went and rather than ask for a refund, like, "Hey, you screwed up our domain name,
0:50:43you dumb shit."
0:50:44And I would have had no excuse.
0:50:47I would have said, "Here's your money back.
0:50:48Take your money back, please.
0:50:50I'm embarrassed."
0:50:51Instead, they went and registered the domain, blackblaze.com.
0:50:56It still works.
0:50:58I just did it.
0:50:59It still works.
0:51:00It still works.
0:51:01For life, they're going to have blackblaze.com thanks to John Gruber.
0:51:04It's one of my favorite stories of all time. I screw up their domain
0:51:08They register an additional domain name. They don't need and they're like, oh no, don't worry about it. We thought it was funny
0:51:15I'm like you guys are the best. Yeah, that's a good sponsor
0:51:19Dropbox, oh my god. How about these clowns?
0:51:23Yeah, right we were talking about
0:51:26Consent, right? Oh my god. There's another one where we're for years. I forget how long
0:51:33Dropbox has been around, but it's at least 2009, 2010.
0:51:38I know that Steve Jobs is still around,
0:51:40because there's the famous story where Steve Jobs was talking
0:51:43to one of their founders.
0:51:44And there was, I guess, some sort of just putting feelers
0:51:49out about whether they would be open to being acquired.
0:51:52And Jobs' line was, hey, you're not an app, you're a feature.
0:51:58And that was his way of sort of trying to put them in their
0:52:00place, whatever. But that at least puts the timeline at 2010
0:52:07or 2009 or so. I mean, it's at least 10 years of Dropbox.
0:52:11Yep. And within the last week or two, they've issued an update
0:52:17and a couple of things. Number one, their software, their app
0:52:23on the Mac, updates itself on its own schedule. Without, you
0:52:28know you you grant it permission when you first install it and then it's there
0:52:32running in the background and it updates itself and they they've updated it to a
0:52:38version that launches an app in your dock which a lot of I I've got enough
0:52:45stuff in my dock where one more thing doesn't really annoy me but I'm totally
0:52:51totally, 100% attuned to the dock perfectionists who don't want anything in their dock that
0:53:01they don't want.
0:53:03And I totally understand how an awful lot of third party utility Mac software specifically
0:53:11has even however minimal their preferences are, they have a preference for show dock
0:53:16icon. You know that some people really don't want stuff in the dock even if
0:53:21it's running all the time they really don't want it there unless it's like an
0:53:25app that they actually look at. Right? If it's not an app with windows that you
0:53:31look at they don't want it in their dock. I totally get that. You know I don't want
0:53:36I generally don't want extra things in my dock but now Dropbox has this icon in
0:53:42the dock and you click it and it's ugly. What you do see when you click it is ugly.
0:53:49Nobody who I know wants anything other than a folder that syncs with sharing. That's what
0:54:01Dropbox is. The whole Steve Jobs, "Hey, you're a feature, not an app," or whatever, it's
0:54:09like, yeah, but you're a feature I would pay for. A folder that
0:54:13syncs with sharing, I would pay for that. I would happily pay
0:54:17for that as long as it's super robust and super reliable, which
0:54:22Dropbox syncing wise has always been. That was always the
0:54:26miracle of Dropbox, right? That in an era when there were
0:54:32multiple, I've always been multiple options of ways to try
0:54:36to have a shared folder between computers, Dropbox was like the
0:54:40first one who just said, just install this thing, give it
0:54:44permissions, and let it go. And every computer you have this on
0:54:49will have the exact same shit in the exact same folder. And that
0:54:55was amazing. It was absolutely amazing. And it didn't matter.
0:54:59Like if you like were temporarily offline, you're out
0:55:03in the middle of a prairie.
0:55:08You're 500 miles away from the nearest cell tower,
0:55:12but you open your laptop and you do a little work,
0:55:15and you hit Command-S, and you save a file,
0:55:18and you close your laptop.
0:55:19And at some point, your laptop reconnects to the internet,
0:55:23and it syncs, and everything.
0:55:26And then you go back home, and you open up your desktop iMac,
0:55:30and there it is.
0:55:31There's the file that you had saved in the middle of Kansas,
0:55:35500 miles from the nearest cell tower,
0:55:38and it's all there, right?
0:55:40It really has been, sync-wise,
0:55:44one of the great technology triumphs of the world.
0:55:46And it sounds like something that should not be celebrated,
0:55:50but anybody who's ever worked on anything that syncs, period,
0:55:55realizes what a triumph Dropbox has always been
0:55:59from the day one, technology-wise.
0:56:01- Yeah, it's reminding me of the sort of famous
0:56:05Quora question, you remember this?
0:56:08It was like this answer to a Quora question
0:56:10kind of got some traction.
0:56:12I'm looking at it right now 'cause I was reminded of it
0:56:14and it's from 2011.
0:56:17But it's an answer to a question which is basically like,
0:56:20why is Dropbox successful?
0:56:22Like why, why, why is it successful?
0:56:26And there's so many other tools
0:56:28And this great response by Michael Wolff,
0:56:32and if you don't remember it already
0:56:35off the top of your head,
0:56:36you probably remember it when I read it,
0:56:37but he says, "Well, let's take a step back
0:56:41"and think about the sync problem
0:56:42"and what the ideal solution for it would do.
0:56:45"One, there would be a folder.
0:56:47"Two, you'd put your stuff in it.
0:56:49"Three, it would sync."
0:56:52And then he says, "They built that."
0:56:54And he says, "Why didn't anyone else build that?
0:56:56"I have no idea."
0:56:57But that's the nut of what you're saying,
0:57:00is the simplicity is what we've,
0:57:04people who use Dropbox, I don't use Dropbox regularly
0:57:06anymore, I think I kinda got the whiff of something up
0:57:10a few years ago, and so I uninstalled
0:57:13the Dropbox system level integration
0:57:17a few years ago when they had, I don't remember,
0:57:19it was something, they did something kinda silly
0:57:22a few years ago.
0:57:23- No, they started, I know exactly,
0:57:24I guarantee you I know when you did it.
0:57:26It was when they started asking for permission
0:57:30that would allow them, they didn't tell you this,
0:57:33but they were asking for permission
0:57:35so that what they could do is install a kernel extension.
0:57:38Which is fucked up, right?
0:57:40I mean that is seriously, you know,
0:57:44two, three, four years ago,
0:57:45kernel extensions were already like,
0:57:49hey, we don't live in the 90s anymore.
0:57:51You don't just, apps don't get to install shit
0:57:54that runs in kernel space.
0:57:55Not for a file sync.
0:57:58Not for something that we know could work without it, right?
0:58:01That was the thing.
0:58:02We know that everything I want out of Dropbox,
0:58:06I know can run without it because I never
0:58:08let you do it before.
0:58:09And you're doing what I want you to do, which is give me
0:58:13a folder and it syncs and it's perfect.
0:58:17Why in the world should I give you kernel access?
0:58:19So you are probably smart.
0:58:21I still run it.
0:58:23But now at this point, I'm, it's like on my summer list of to do's, I've got to get out of it because
0:58:29the, I think it's coincidental timing, because I don't think I think that, you know, they're,
0:58:37they're, their aspirations are high enough that it's not tied to the fact that 10 15 Catalina
0:58:45is going to add shared folders to iCloud file sharing or file syncing, whatever. But the
0:58:52Having a shared folder is the last thing keeping me on Dropbox. And specifically, I only share it
0:58:59with one person. The only one that really matters to me. I guess I have one with my wife and we
0:59:04update it every once in a while. But for the most part with my wife, we just send stuff by iMessage.
0:59:10But the big one for me is for this show where I finish the show. I'm going to send you a link
0:59:17and you'll upload your end of the audio.
0:59:20I'm going to upload upload my end of the audio.
0:59:23And then
0:59:25Caleb Sexton, who edits the show, is also a member of the same shared folder.
0:59:30He'll get both files and then he'll be able to edit them.
0:59:33And when he's done editing,
0:59:35he will put the final version of the show in the same folder and then I'll pull it
0:59:39down so I have one shared folder that I really care about with Caleb.
0:59:44I share it with everybody who's on my show.
0:59:47once I can get rid of it, but I could do that without running Dropbox
0:59:53locally. Like one of the things that's most appealing to me about
0:59:58uninstalling Dropbox is that I could use like transit from panic and just give
1:00:05transit my Dropbox credentials and just treat it the way I treat most remote
1:00:12locations and do it through instead of through the finder and make it seem like
1:00:17like it's a local folder that's on my file system.
1:00:20I don't really need that.
1:00:21I just need the shared folder with collaborators.
1:00:25I could do that through an app and not
1:00:27have it seem like it's part of my file system.
1:00:30Right.
1:00:30That's funny.
1:00:32I know I used to run Dropbox, because I
1:00:34used to-- since you mentioned that shared folder,
1:00:37it's also evidence that I have, in fact,
1:00:39been on the show before, because I just went to Dropbox.com,
1:00:42and I'm in that shared folder for the talk show.
1:00:47And I used to get these great notifications that would let me know in advance who I could
1:00:50expect to see here on the show, because Mac OS would say, "Hey, so-and-so just uploaded
1:00:57some files to this shared Dropbox folder."
1:01:00So I guess I lost that feature when I uninstalled Dropbox.
1:01:04Maybe that's a reason enough to get back into the Dropbox culture here.
1:01:10But yeah, that's a mess.
1:01:14It's a horrible thing for a company like Dropbox, which I think you would agree, Dropbox had
1:01:19a lot of sort of, it's more than just brand equity.
1:01:23They had sort of like, because of their simplicity and the fact that it just worked, they sort
1:01:29of had like an engineering level nerd equity.
1:01:32Yes, I know exactly what you mean, right?
1:01:35Yeah.
1:01:36It's like you kind of trust some companies, not just from a branding point of view, but
1:01:40from like, they know how to do this right point of view.
1:01:43And that people who knew their shit were like, oh, yeah, I use Dropbox. Yeah, I mean, you know
1:01:48It's like back in the day when I was doing graphic design. It's like, you know
1:01:53Illustrator and freehand were arch rivals and
1:01:59People who knew their shit would have everybody had a strong preference as to which was your favorite vector
1:02:06illustration tool but
1:02:09Everybody who knew anything would acknowledge that both of them were completely credible tools
1:02:15They just did it in different ways, right? You know, it's
1:02:19You know, there's just a whole list of apps in various
1:02:24You know you name the field and people who know their shit will be like hey I use blank
1:02:31But I know that X Y & Z are also good. They're just not the ones I use but that's my shortlist
1:02:38you know, X, Y, Z, and W.
1:02:40They're the ones that I think are the ones
1:02:42you should look at.
1:02:43And Dropbox was absolutely a number one on that list of,
1:02:48hey, if you want a folder that syncs,
1:02:51you should install Dropbox.
1:02:52And it's just a shame.
1:02:55And I don't, it's like I get that their executive staff
1:03:00right now is in a tough spot
1:03:03because they raised a gazillion dollars in venture capital
1:03:07with the idea that they would eventually be valued at $10 gazillion.
1:03:12And to get from here to there,
1:03:17they have to try to do something else, you know, that,
1:03:20that just selling a utility that lets a folder sink for $5 a month,
1:03:26whatever, isn't going to get them there. But it,
1:03:31it could in theory be a good business, right?
1:03:35It just wouldn't be a, you're up there with Microsoft
1:03:40and Facebook and Apple and Google as one of the giant titans
1:03:44of the stock market type business.
1:03:47But they raised money thinking that that's what they would do
1:03:51and I get it that now they're painted in a corner
1:03:55because they've raised all this money on the idea
1:03:58that they're going to be the next Microsoft Office 365
1:04:01and so they've got to sell,
1:04:04they're turning the client software into this thing
1:04:06that does everything from document sharing
1:04:09to video conferencing to whatever the fuck else it does.
1:04:14I get that they're painted in a corner because they did it,
1:04:18but nobody forced them to paint themselves in the corner.
1:04:21And it could have been a very nice business.
1:04:24It could have just been,
1:04:26I don't know how many people it would support,
1:04:28I don't know how big the company would be,
1:04:29but in theory, with the technology they had
1:04:32and the sync algorithm they had,
1:04:33which clearly, truly, it sounds like something
1:04:38that everybody should have and that it should be
1:04:41like bubble sort, you know what I mean?
1:04:43Like here's one of these algorithms that everybody knows
1:04:46and it works with this performance
1:04:51and everybody can use this algorithm to sync between things.
1:04:55The truth is sync is incredibly hard.
1:04:58It's incredibly hard, it's incredibly prone to bugs
1:05:03And from day one, Dropbox Sync was fast and reliable.
1:05:08And that's all you could ever ask for.
1:05:12It was rare at the time.
1:05:14They should have been able to build
1:05:15some sort of business around it,
1:05:17even if it was a million dollar business
1:05:20instead of a billion dollar business.
1:05:21But instead, because they were going
1:05:23for a billion dollar business, now we've got shit.
1:05:26We've got a big, big pile of dog shit, right?
1:05:29Everybody's front door who runs Dropbox.
1:05:32So interesting, the valuation.
1:05:34As soon as you started talking about the size of the company and their ambitions, I punched
1:05:38it into Yahoo stocks thing.
1:05:41Dropbox as of today is a market cap $10 billion company, which is incredible.
1:05:47A huge number unless you compare it to all these other companies.
1:05:53So for instance, it's like half of a Lyft or one third of a Twitter.
1:06:02I mean, Twitter seems small.
1:06:04Its valuation seems small, 28.8 billion right now.
1:06:07It seems small compared to its mind share, right?
1:06:12- Right, right.
1:06:13I actually think Twitter is undervalued, in my opinion,
1:06:16just because they're, I don't wanna go too much
1:06:21on a tangent on this, but they're still so much
1:06:24in the shadow of Facebook and therefore still compared
1:06:27on Facebook's terms, and Facebook is the one
1:06:30who define monthly active users as this, like, that's the benchmark.
1:06:36Yeah.
1:06:37And it's such the wrong.
1:06:40Yardstick for Twitter, right?
1:06:43It's so, it is so inappropriate for Twitter, but it is in every single way.
1:06:49It's it defines every single bad idea.
1:06:52Twitter comes up with for the last six, seven years, because they know they're
1:06:57being measured against Facebook's definition of terms.
1:07:02And I think Facebook, I think Facebook, I hate them.
1:07:07I've never signed up for Facebook.
1:07:09I think they're genuinely a bad effect
1:07:14on humanity overall planet wise.
1:07:17But I do think that they are very,
1:07:20I think they're from Zuckerberg down,
1:07:22they're run by very smart people.
1:07:24And I think that they not only set up that as their yardstick
1:07:31because it would make them look good,
1:07:32I think they very deliberately chose it
1:07:35because they knew it would make their competitors look bad,
1:07:38that no one would be able to--
1:07:40once they took the mental real estate that they did
1:07:46in people's lives, as this is where regular people share
1:07:52photos and anecdotes about their lives, they knew that nobody else would be able to occupy
1:07:58that and no one would be able to compare with them on monthly active users and they sort
1:08:03of got this entrenched in the minds of investors as monthly active users equals a good measuring
1:08:11stick.
1:08:13It's part of the evil of Facebook is that they not only do bad things but they actually
1:08:19entrench a bad measuring stick as the measuring for other social networks.
1:08:27Yeah. 20 times. Twitter is 20 times smaller market cap than Facebook. But such a larger
1:08:37mindshare. So much larger. And I don't watch a lot of cable news. I don't care what your
1:08:47political persuasion is whether you're a conservative or liberal or in between or whatever cable news will rot your brain no matter which
1:08:54Network, yes, it's not good now, but when I do watch because you know, there's some breaking news
1:09:01I guess this week. I'll probably watch because
1:09:03Robert Miller is gonna
1:09:06You know testify before Congress, so I'll be watching some cable news this week
1:09:10But whenever I do you can't go more than six or seven minutes before you see something about it a tweet
1:09:16Yeah, whether it's right. It's family. Well, and it's not just the president, you know, it's it's people from Congress
1:09:22It's you know AOC, you know, she's absolutely amazing on Twitter
1:09:27She's you know, she's as much a master of Twitter as the president is and it's a fantastic way
1:09:33to control her message it's
1:09:35But the the the degree to which Twitter has become the platform
1:09:42For people like that, you know who are the absolute, you know, truly the leaders of our country to to communicate with us
1:09:49It's truly phenomenal and it's completely
1:09:52completely
1:09:55Non-valued in Twitter's right valuation. Absolutely and which is to me ridiculous. It's absolutely ridiculous
1:10:02Yeah, it's fascinating. So anyway, I don't want to like you say let's not get on it
1:10:07I'll sit here and look at stock prices all day and make analyses of what's valued right
1:10:13and wrong.
1:10:14But I just think that's just fascinating.
1:10:16Dropbox clearly a huge company, but it is a transition.
1:10:20Getting back to the topic at hand, Dropbox is a great example of one of these companies
1:10:26that has gone from, like I said, that kind of nerd credibility to what's left.
1:10:34Turn on any podcast.
1:10:35They're all talking about--
1:10:36Nerd warnings, right? Yeah. Yeah. It's gone from like nerd, like, hey, you should install Dropbox.
1:10:43It's awesome to Hey, do you have Dropbox installed? You should maybe yeah, installing. Yeah.
1:10:47Which is sad, very sad. Because the actual technology that made us fall in love with it
1:10:56is still there. That's that's the tragedy. And it I, again, there's far worse tragedies in the
1:11:04world. But to me, having great technology just get obfuscated with piles and piles of
1:11:12crap in front of it is sort of heartbreaking.
1:11:16Yep, sure is.
1:11:20Looks like it's going to thunderstorm here. How's the weather up there?
1:11:23I got my windows closed, and I have my AC off, so I'm moving in a little sealed vacuum
1:11:28chamber here but looking out my window I think we're I don't think we have it
1:11:33come in real soon but I think there's something on the forecast yeah are you
1:11:36are you an ocean guy I know I've been listening to the ATP and yeah our friend
1:11:43Marco Arment is right this one this summer and our other friend John
1:11:49Sirkusa big big big fan of going to the beach long time you know I love yeah
1:11:55Everybody's waiting for him to drop a camera in the ocean, right?
1:11:59That's like the annual tradition.
1:12:01He wades into the ocean with a handheld camera, takes pictures of his kids and his wife and
1:12:07whoever else he's at the shore with.
1:12:09Still hasn't lost one.
1:12:11But our friend Marco is learning to swim, going to go deeper in the ocean.
1:12:15Are you an ocean guy?
1:12:17I grew up in Santa Cruz, California, which is funny because that's not an automatic qualifier
1:12:22for being an ocean guy.
1:12:25By stark contrast to what I'm about to say, I have never actually surfed, which you're
1:12:31kind of supposed to do.
1:12:33But I did spend plenty of time in the ocean so that the kinds of things they're talking
1:12:37about on ATP I can relate to very well.
1:12:41I know how to dive under a wave.
1:12:42I know how to dive over a wave.
1:12:43I know how to swim against the tide if you need to.
1:12:49And it's fun.
1:12:50listening to that conversation in part because I love John.
1:12:55I love how much he always surprises me
1:12:58with his extracurricular interests
1:13:02that I would have never guessed.
1:13:03And so the pictures--
1:13:05- I would have never thought he was as much of a beach guy.
1:13:09- Well, right, yeah, just a beach guy in general.
1:13:11But then the particular thing that I've now got
1:13:14like a picture in my mind of,
1:13:16just enter this meditation with me everybody.
1:13:19You're looking at this beautiful blue sky, the waves are crashing on the sand, you're
1:13:25sitting cross-legged on a beach looking out at the horizon, and then a wave is coming
1:13:31in.
1:13:32What's that?
1:13:33It's John Syracuse body surfing.
1:13:34Body surfing, right.
1:13:35And he's like, "Of course you can catch a wave.
1:13:39Anybody can catch a wave.
1:13:40You just got to try a few times."
1:13:42And you're like, "Oh, okay."
1:13:45I love the picture because I could also picture.
1:13:47We've all seen, you know, John doesn't get excited about everything in this world, but
1:13:53when he gets excited, you see that great big smile.
1:13:57And I'm just picturing that great big John Syracuse smile coming in on a wave as I'm
1:14:02sitting on the beach.
1:14:04I never would have guessed that he was experienced and adept at body surfing.
1:14:10So that's my ATP insight.
1:14:12I can tell you the only time I've ever seen him happy.
1:14:16It was the WWDC where they announced APFS.
1:14:21And then afterwards, I met him, you know,
1:14:25it was like, I don't know, 15 minutes
1:14:27after the keynote ended and I was outside
1:14:31and there he was and he truly looked happy.
1:14:35- He's beaming, huh?
1:14:36- Yeah.
1:14:37Here's the thing.
1:14:40I grew up, my family,
1:14:42We used to always go to the Jersey Shore.
1:14:46My parents are not really--
1:14:49they're not world travelers.
1:14:51My dad likes to go places he can drive.
1:14:54So we were always Jersey Shore people.
1:14:56I liked it, but my thing was never the daytime at the beach.
1:15:01I was never a fan.
1:15:04You get a little chafing.
1:15:06Jersey Shore sand is a bit coarse.
1:15:10I was always a fan of the boardwalk at night.
1:15:13I like it at night when the lights are on.
1:15:16You know, I like a casino.
1:15:18I like to gamble.
1:15:20I'm a late night person.
1:15:21I was always a late night kid.
1:15:23I like the action late at night.
1:15:24I like the lights.
1:15:25I like the dark.
1:15:26I like the seediness.
1:15:27And then now that I've traveled a bit
1:15:35and I've been to the Caribbean a few times,
1:15:38It's like, that's the fucking beach.
1:15:41I mean, holy shit, man.
1:15:43The sand, I mean, even just the sand is better.
1:15:46The sand is better.
1:15:47The ocean is clear.
1:15:49You can actually see your feet at the bottom of the ocean.
1:15:52The waves, instead of knocking you over, are just gentle.
1:15:56They're just, you know, a little up, little down,
1:15:58little up, little down.
1:16:00The Atlantic Ocean in like New Jersey,
1:16:04Long Island, New York, that type of area, it's brutal.
1:16:07And it's ugly. It's, you know, it's dark brown water. You can't see six inches into it.
1:16:15It's kind of filthy. If you turn your back on a wave, it'll knock you over.
1:16:20You know what I mean? Like, you can't turn your back on a wave. You know, it's...
1:16:24So I, you know, I'm kind of anti-Atlantic ocean, to be honest.
1:16:28I like being in the ocean. I like a beach. But I'll tell you what,
1:16:34I don't like the the eastern seaboard the eastern seaboard is shit
1:16:37And I know and I'm a type of person who's biased in terms of the East Coast
1:16:42I think the East Coast is the real time zone. I
1:16:45Think you know, I have all sorts of biases in favor of the Eastern Standard time zone
1:16:51But I'll tell you what in terms of going to the beach. It's the fucking worst
1:16:56I think you can just expand that all your biases against the Eastern the Atlantic Eastern, you know coast of the US
1:17:03I think you can just expand that to include the Western coast because it's just you know, you can't see through it
1:17:11It's now cold. It's colder than the Atlantic and
1:17:14It's more forceful and more violent. So
1:17:17If it's in a way, I mean you really can't turn your back on the Pacific. I
1:17:22Enjoy that I still I enjoy the big waves. I enjoy, you know, I related I think most to
1:17:29actually John's advice to Marco because you know folks who haven't heard it you
1:17:34should go listen to it but basically Marco's like I don't know what I want I
1:17:36don't I don't know what to do in the water it doesn't doesn't seem fun to
1:17:40just like frolic around in the water and John's saying basically well you know
1:17:44it's like a video game of like you versus the waves and I relate to that
1:17:48because that was one of my fun pastimes you never know what the next wave is
1:17:53gonna be and especially on the in the Pacific Santa Cruz where I grew up you
1:17:59can get some big waves and they will really knock you out.
1:18:04One of the bits of advice also John had for Marco was to learn to hold his breath.
1:18:09And I think it's hard to have a sense of time when you're trapped underwater from a wave,
1:18:14but I think I've probably been trapped underwater for at least 30 seconds, which is terrifying
1:18:20when you don't know how long you're going to be underwater.
1:18:24But that's, you know, it's kind of one of these things, the ocean is one of these things,
1:18:29I think, at its best, can kind of wake you up to the fact that the world is so big and
1:18:33so powerful and so much bigger than any one of us.
1:18:37I think that's probably kind of the high that surfers get, is kind of being part of this
1:18:42system that's bigger than them.
1:18:45But I don't know, it's interesting.
1:18:47I definitely like the ocean, but these days,
1:18:51my family and I, we usually go to Cape Cod.
1:18:54The ocean's ruined in Cape Cod
1:18:56because of all the great white sharks.
1:18:59- That sounds exciting though.
1:19:02- It's exciting, yeah, it is exciting for sure.
1:19:05(laughing)
1:19:06I shouldn't say it's ruined,
1:19:07but I mean, it's getting more and more,
1:19:09it seems like every year there's like a more--
1:19:14- I would go in that water, I would go in.
1:19:16- I cannot even imagine convincing either my son, Jonas,
1:19:20or my wife Amy to go in the water
1:19:22if there was even a 1% chance of a great white shark.
1:19:26I can't even imagine getting them
1:19:28to going up to their ankles.
1:19:30- It's getting to the point where,
1:19:32like the part of Cape Cod we go to,
1:19:34they might as well film a Jaws sequel there
1:19:37because it's like, it's ripe.
1:19:40It's ready for blood on the beach, you know?
1:19:44I mean, I don't want to trivialize it too, but it is kind of fun and exciting.
1:19:48Obviously, it's not fun and exciting if anything happens, but it's scary.
1:19:55I remember the first time I came out, because growing up on the West Coast, I didn't get
1:19:59out to the East Coast at all until I was an adult.
1:20:02Actually, the first time on the East Coast was an iconic moment in history, Macworld
1:20:081996.
1:20:09Oh, wow.
1:20:10Yeah.
1:20:11And Apple, it was my first paid, was it '96 or '97?
1:20:16It's the one with, where Bill Gates made the announcement.
1:20:21- That's '97, that's '97.
1:20:22- '97, yeah, that makes more sense,
1:20:24'cause I was hired in '96, and then the next Macworld
1:20:27in Boston, Apple sent me out, and that was also
1:20:31my first experience going to an Atlantic beach.
1:20:35'Cause this was great, this was back when, I don't know,
1:20:38Apple gave me a rental car.
1:20:42They said take a few extra days, whatever.
1:20:45I went down to Cape Cod for the first time and I was just like, "This is like a playground
1:20:51compared to the Pacific."
1:20:53But at that time, there weren't a huge risk of sharks every day.
1:20:56Well, the thing about the Atlantic is, and I have to admit, I've never been in the Pacific
1:21:03Ocean.
1:21:04I've obviously been to California many times, but I've never gone to the beach.
1:21:07I mean, I've seen it.
1:21:08But the thing about the Atlantic Ocean, especially on on on the New Jersey,
1:21:13New York and you know, I've been to South Carolina and it's exactly the same.
1:21:19So South Carolina to me, I don't know.
1:21:21I'm just going to draw a line and say all the way from South Carolina to New York.
1:21:25It's all the same.
1:21:26It's dark water. It's dirty.
1:21:29And the waves break really close to the shore.
1:21:33So you can't surf.
1:21:35There is, I know that there are people who surf in New Jersey.
1:21:39Don't, don't, don't at me.
1:21:40I get it.
1:21:41But you have to hunt for it because for the most part, most beaches, the waves
1:21:47all break like 20 feet from the shore.
1:21:50It's, it, it, it's terrible.
1:21:52Yeah.
1:21:53I have been confused wondering where people surf because I see, I go to
1:21:57Cape Cod and there's like surf shops and they have surfboards and I wonder
1:22:01where the heck to use this.
1:22:02When I was in high school, my best friend, his mom always rented a house for a week or two on Long Beach Island in New Jersey.
1:22:13And Long Beach Island is really nice. If I were ever going to spend more than a week at the shore, that's probably where I would go.
1:22:26It's really nice.
1:22:27It's a very narrow town.
1:22:30So the furthest you can get from the beach
1:22:32is like two blocks from the beach.
1:22:34And it's a very short beach.
1:22:37So once you're on the beach, you're almost in the water.
1:22:40Very nice.
1:22:41And you could surf there.
1:22:43And I could see guys surfing there.
1:22:45But even so, it really seemed constrained.
1:22:51The guys who were surfing were clearly--
1:22:55It was hard to surf, you know what I mean?
1:22:57'Cause the waves broke too close to the shore.
1:23:00You could do it, but it didn't look anything
1:23:04like when you watch real surfers, pro surfers on ESPN
1:23:08and they're in Hawaii or somewhere cool in California.
1:23:13And they're way off the coast and they can ride this wave
1:23:17for a minute or something like that.
1:23:19No way, you get two seconds on a fucking wave in New Jersey.
1:23:22It's crazy. - Right.
1:23:23serious waves in California and Hawaii they have people like and they have
1:23:27those contests competitions they have jet skis to like shuttle the surfers out
1:23:32it's like that's how far out they have to get to actually catch those waves do
1:23:36you ever think about the stupid stuff you did as a kid did you die when I did
1:23:40a lot of stupid stuff that if I found out my kid was doing I I would want to
1:23:44strangle him did you just dumb stuff like that I did all the dumb stuff and
1:23:50It's just too sad that I'm never going to let my kids get away with it.
1:23:54Right.
1:23:55So when I was in high school, my best friend, like I said, his mom would rent a house for
1:24:00two weeks in Long Beach Island.
1:24:01And then for a couple of years, he invited me out.
1:24:06And then by my senior year, we had a couple of friends who would come out and spend a
1:24:11week there.
1:24:12And it was really cool.
1:24:13And it was a lot of fun.
1:24:17Just be on your own in a beach town.
1:24:19His mom was very cool, very nice.
1:24:22But the one year, I think it was the year
1:24:24before my senior year of high school,
1:24:26a hurricane came through and it didn't really hit
1:24:29the Jersey shore very hard.
1:24:32Somebody can Google this up.
1:24:35Summer of '91 it would have been,
1:24:38there was a hurricane and it must have hit
1:24:41one of the Carolinas real hard,
1:24:43but then it came up the eastern seaboard
1:24:45and it was just like a tropical storm
1:24:46by the time it hit New Jersey.
1:24:48But the other thing we were obsessed with at the time
1:24:51was playing poker.
1:24:52We played poker and we played all night long
1:24:56and we watched the storm just blow
1:24:59and it was just random shit.
1:25:00Just you'd look out, we were playing on the porch
1:25:03and it was like an enclosed porch.
1:25:05And it was just the most amazing thing
1:25:10'cause you would see things
1:25:11that you wouldn't think the wind could blow
1:25:13just blowing down the street.
1:25:15like a big heavy metal wrought iron bench blowing down the street.
1:25:20We stayed up all night playing poker, uh, crazy storm,
1:25:26got a couple hours of sleep, woke up and we went down to the beach and it,
1:25:31the beach, it wasn't raining, but it was overcast.
1:25:34It was the day after the storm had come through, but because it was overcast,
1:25:38like the, uh, the lifeguards were not on duty and nobody was on the beach.
1:25:43There was nobody on the beach.
1:25:44It was just like me and like three friends.
1:25:46And it was the middle of summer.
1:25:51It wasn't cold, but the water was a little cold,
1:25:53but we decided to go in.
1:25:54And the day after this storm,
1:25:57I mean, the waves were like epic.
1:26:00I mean, they were like, I mean, they were just,
1:26:02I've never ever in my life seen waves like this.
1:26:05Maybe in the Pacific, you see waves like this all the time,
1:26:08but they were just humongous.
1:26:10But my friend Todd just like went way out in the ocean.
1:26:15I mean, like so far out, it was crazy.
1:26:18- Oh boy.
1:26:19- And these waves were like 20 to 30 foot swells.
1:26:22And you would see him at the top of one
1:26:24and just see his head sticking out
1:26:26and then he would go down and then just disappear.
1:26:29And we're yelling.
1:26:30And even us as idiot 17 year old boys
1:26:34who thought we were gonna live forever,
1:26:36even we were yelling at him like,
1:26:38Hey, dude, you might want to come in.
1:26:40There's literally no lifeguards on duty, no lifeguards, nobody else.
1:26:44Of course, it's, you know, 1991. It's all pre cell phone.
1:26:48So he had like washed out to see we I mean, he'd be dead.
1:26:51And we were just vaguely concerned.
1:26:54We were just like.
1:26:55And meanwhile, we were all probably way too far out. Right.
1:26:59Like because the waves, it was just so much fun going up and down.
1:27:02If I found out my kid went in the ocean the day after a hurricane
1:27:06or tropical storm came by without lifeguards, I would strangle him.
1:27:10Oh my God.
1:27:12But at the time, I thought that was normal.
1:27:13I was like, "Well, at least I'm not Todd.
1:27:16I'm not the one who's 40 yards out."
1:27:19I keep telling my kids about my childhood experiences.
1:27:22I have to say, "Well, I'm not going to let you do this."
1:27:26It's similar to that.
1:27:28Like I said, I was up in Vermont and sitting in this river.
1:27:33It was a very calm tepid river, but I told my kids about how I used to ride the inner
1:27:39tubes down the Sacramento River in California.
1:27:43This is a river that has some rapids.
1:27:49The key though is I used to ride this inner tube down the river in the town I lived in
1:27:54as a seven-year-old with my seven-year-old friend and no adults.
1:28:01We just go get these inner tubes and we'd take a hike a mile up the river and then hop
1:28:07in the river.
1:28:09I just can't fathom it.
1:28:10My seven-year-old doesn't even walk across the street without me.
1:28:16I know exactly what you mean.
1:28:21I kind of fear that I'm going to make these kids that don't have the independence and
1:28:28adventure spirit that in some ways I have but I don't want to be like one of those people who's like
1:28:34Confirmation bias just because I survived every other kid is gonna survive the same freedom
1:28:40Like I think it's one of those things where because I did end up surviving and things turned out
1:28:45Okay, it kind of makes a great story and it makes me have some attributes that I value
1:28:51But that doesn't mean I should take the same chance with my kids. Well, here's my favorite my favorite was
1:28:58my parents house isn't right across the street from the elementary school that I
1:29:02went to literally right across the street and it it's on a hill so you
1:29:09could go down the hill and you know I used to ride a skateboard you could go
1:29:13down the hill on the skateboard right in front of the school and then you you'd
1:29:16make a right into the parking lot of the school and then you you know you could
1:29:20smooth out the downhill thing you did and they also had a pavilion now the
1:29:26The pavilion is gone now, but I think they expanded the school
1:29:31to cover it.
1:29:33But next to this covered pavilion,
1:29:36there was just a little hump, maybe like six inches,
1:29:39like where they just--
1:29:41they didn't know what to do with the end of the macadam,
1:29:43so they just curled it up.
1:29:45But if you hit it on your bike, it was a nice little jump.
1:29:49You could easily get three, four feet up in the air.
1:29:52We used to call it the hump jump.
1:29:54And the one time I was there and I had no friends with me,
1:29:57I was all by myself and I hit the hump jump
1:29:59and I really hit it fast and I was going for distance.
1:30:03Well, there happened to be a tree
1:30:05about 15 feet away from it.
1:30:07- Oh my.
1:30:10- I hit the tree like with my bike,
1:30:14it's so hard that it turned the handlebars of my bike
1:30:16completely perpendicular so that the handlebars
1:30:19were like aligned with the tire, you know what I mean?
1:30:22- Right. - Like sideways.
1:30:24And I hit my head.
1:30:26- Of course, no helmet of course.
1:30:29- No, of course.
1:30:29- Because we didn't do helmets back then.
1:30:30- Well, we didn't do helmets and I knocked myself out.
1:30:33- Oh my God.
1:30:34- So it was about 5.30 in the afternoon.
1:30:38And the next thing I know,
1:30:40there was a cleaning lady from the school
1:30:44and she was Latino, she didn't speak,
1:30:47I don't think she spoke English as her first language
1:30:49and she was shaking me.
1:30:52And she said she saw me hit it.
1:30:55She saw me hit the tree and she wanted to know if I was okay.
1:30:59And I had like a giant goose egg
1:31:01on the right side of my forehead.
1:31:02I mean, just like a big goose egg.
1:31:04But all I could think was that my parents would be mad at me
1:31:07if they found out that I was making this jump.
1:31:10And I said, "I'm okay."
1:31:12And she's like, "No, no, let me, where do you live?
1:31:16Let me take you home."
1:31:17And I'm like, "I'm okay, I'm okay."
1:31:19And then I looked at my bike
1:31:20and the steering wheel was sideways.
1:31:22And I was like, oh my God, my parents are gonna kill me.
1:31:25They're gonna know it.
1:31:25And I like put the tire between my knees
1:31:28and like I screwed up my bike enough
1:31:31that like it was easy to straighten the handlebars.
1:31:35You know what I mean?
1:31:36- Yep.
1:31:37- And I was like, I'm okay.
1:31:38And I was definitely not okay.
1:31:40I had been knocked out.
1:31:42I had been out for like five minutes.
1:31:45I had a giant goose egg on my head
1:31:47and this very, very kind, sweet cleaning lady
1:31:50was just trying to make sure I was okay.
1:31:52And I'm walking away with this bike
1:31:54with crooked handlebars, thinking like,
1:31:57I gotta get home and figure out a story.
1:32:00If I found out my kid did that, I would be furious.
1:32:02- Yep.
1:32:04Well, so did you get away with it?
1:32:05- Yeah, I totally got away with it.
1:32:06My parents have no idea.
1:32:07And they don't listen to my podcast, but they still won't.
1:32:09- So we're not gonna tell them.
1:32:11- No, don't.
1:32:11(laughing)
1:32:12Nevermind.
1:32:14Let me take a break here and thank our third and final sponsor of the episode.
1:32:19And this is a trifecta. It's a trifecta of great sponsors.
1:32:24I love this company. It's Linode. I used to call it Linode because that's what it looks like.
1:32:30But it's Linode because it's Lin like Linux.
1:32:34Linux is the operating system that most servers on the internet run.
1:32:41Linode is absolutely great hosting service for your own server.
1:32:48And they've just opened a new data center in Toronto, Canada.
1:32:52That's a big deal because in addition to wanting a server location that's closest to you,
1:33:01or maybe closest to your users for legal reasons, some people, depending on your business,
1:33:06might need for compliance a server that is hosted in a certain country.
1:33:11Well, now they have one in Toronto, Canada.
1:33:13It is absolutely as good as all of their other hosting locations.
1:33:17They have let me just start this off.
1:33:20I'll just tell you right now, they have a twenty dollar credit for all new customers.
1:33:25And they only charge at the starting point, five dollars a month,
1:33:30so you can get four months for free just by waiting until the end of this sponsor
1:33:36read and for me to tell you what to do.
1:33:38You can get four months for free on Linode
1:33:40with an absolutely world-class server.
1:33:44Anything you want to do online, you can do on Linode.
1:33:47Dedicated CPU, they have distributed applications.
1:33:50Everything they do, native SSD storage.
1:33:57They have 40 gigabit network, super fast.
1:34:01Pick from any of their 10 worldwide data centers
1:34:04where you want yours hosted and they're opening another one in Mumbai, India by the end of
1:34:122019 in case you need to be over there. Pay what you use with hourly billing across all
1:34:18of their plans and add-on services. Deploy and maintain your infrastructure simply and
1:34:24cost-effectively their tools. Make it easy to provision, secure and monitor and backup,
1:34:30which is super important, your personal cloud, your service,
1:34:35your server, really great stuff.
1:34:39They have a brand new version 4 of their API.
1:34:43It's a RESTful API.
1:34:44So anything you want to do, customize.
1:34:46If you're a super advanced user and you
1:34:48want to program stuff, you want to customize stuff,
1:34:51you want to have scripts that run,
1:34:53they have a great API for doing almost anything
1:34:56you could possibly want.
1:34:58And like I said, use this promo code.
1:35:00talk show 2019 ta lk sh o w 2019 and you get $20 credit at linode l i n o d e.com slash
1:35:13the talk show go to linode.com slash the talk show remember this promo code talk show 2019
1:35:22You save 20 bucks and amazingly you can get a great account for just 5 bucks a month.
1:35:30That's 4 months free.
1:35:32An entire third of the year.
1:35:35For God's sake it will be freezing cold by the time your period is up.
1:35:39I cannot thank them enough.
1:35:41They are a great, great hosting service.
1:35:44So go try them out at linode.com/thetalkshow.
1:35:50What do you think about this stuff with Facebook getting fined by the FTC?
1:35:54I think this is…
1:35:55Oh, this is $5 billion?
1:35:57Yeah.
1:35:58I get it because it's like a record-breaking fine and so it seems like that's significant.
1:36:04And I really do feel…
1:36:06I can't emphasize enough how good Kara Swisher's New York Times column on this was a couple
1:36:12of weeks ago where she was just like, "Add a zero and then we're talking," because
1:36:18Other than that, they've just chalked this up
1:36:20as the cost of doing business.
1:36:22And the fact that when this quote unquote record-breaking
1:36:27FTC fine was announced, Facebook stock went up,
1:36:32it tells you everything you need to know.
1:36:35Where they've managed this.
1:36:38And again, it is a record-breaking, so I get it.
1:36:41But I feel like we're in new territory on some of this.
1:36:45You know what I mean?
1:36:46Yeah, I mean that's kind of the scale problem.
1:36:49Like we were talking earlier about Dropbox's value and Twitter's value and Facebook's value.
1:36:53I don't know how to grapple with these numbers.
1:36:56So like Facebook's value, to remind folks, is $577 billion.
1:37:01So in that context, $5 billion seems kind of small.
1:37:07But if you just gave me a number, does it seem like a good idea to find Facebook $5
1:37:12billion?
1:37:13If I check my mail tomorrow and I got a $5 billion fine, I would break into a sweat.
1:37:20I would be a little nervous because I got to put this on a finance plan.
1:37:25You know what I mean?
1:37:26I'm going to have to pay this off over time.
1:37:29Or anybody who's listening, you can kind of do the rough math.
1:37:32What would you have to do to be charged a fine that is one-hundredth of your net worth?
1:37:40Right.
1:37:41Right.
1:37:42Right and all of a sudden you peg it at one one hundredth of my net worth and you know
1:37:46And right so so is what Facebook did
1:37:52Bad enough that it should be more than one one one hundredth of their net worth or you know
1:37:59I guess I just have to admit. I don't really know how these things should be
1:38:02Tabulated
1:38:06Seems like there should be a punitive
1:38:08and there should be an aspect of it
1:38:10that sort of sets an example for other companies.
1:38:13And I guess what you're saying,
1:38:16it seems compelling to me that Facebook
1:38:19is able to just sort of shrug this off,
1:38:21so it doesn't seem either that punitive
1:38:25or that sort of demonstrative of the seriousness
1:38:30that other companies will face
1:38:33if they try the same things, right?
1:38:35- Right.
1:38:38The other thing-- and again, it gets back
1:38:40to this non-consensual technology.
1:38:43I've been meaning to write about it.
1:38:44I have a blog post that is mostly written,
1:38:47but I was on vacation, so it's not completely written.
1:38:49But my friend Mike Davidson, at the beginning of July,
1:38:54wrote a post about Superhuman, which is a invitation only,
1:39:01at least for the moment, $30 a month front end to Gmail.
1:39:05So in other words, if you if you know somebody and they can get you in or you're on their list and they say you're in.
1:39:12OK, now you sign up, you pay thirty dollars a month and you get their interface to Gmail.
1:39:19So it's an email client. You do it through a Web browser.
1:39:23People seem to love it. I cannot for the life of me imagine doing my email through a Web browser, Gmail or otherwise.
1:39:32So I mean, it's not for me.
1:39:34But the thing that my friend Mike Davidson pointed out
1:39:41was that they have a red receipt feature that's on by default.
1:39:50And it uses single one by one pixel GIFs.
1:39:57And so every email you send has a little invisible GIF.
1:40:01And when anybody, whoever you send your email to,
1:40:06maybe I just send an email to my friend Daniel,
1:40:09and it just says, "Hey Daniel,
1:40:10"you wanna be on my podcast this Monday?"
1:40:14And then if you use their client,
1:40:17it'll tell you Daniel read the email
1:40:20at 11 o'clock a.m. Monday morning,
1:40:24and then he read it again at one,
1:40:26and it used to until Mike pointed this out,
1:40:31out it would even do geolocation based on your IP and would say like you know
1:40:37from Boston Massachusetts he read it at 10 a.m. but then at 2 in the afternoon
1:40:43he read it from you know the coast of Maine or wherever you are which is creepy
1:40:51And after he posted this, I get how it works.
1:40:56I get how most, if not every modern email client, the message viewer pane is effectively a web browser.
1:41:06And whether it's mail.app on Mac or iOS, certainly if you're reading your email in a web browser,
1:41:18like, you know, if you just go to gmail.com and whatever your favorite browser is, clearly
1:41:24the message renderer is part of a web browser and it loads the message and it loads this invisible pixel and then they use
1:41:33reverse geo tracking on the IP. But I asked, you know, I asked my wife,
1:41:39I asked a couple other people who are totally non-technical,
1:41:42"Do you realize that this would be possible that every time you look at a specific message,
1:41:47The person who sent it would be able to tell hey this, you know, Amy read this message at 11 a.m
1:41:54She read it at 1 and then she read it the next day again at 2 p.m
1:41:59And here's where she was and they were like every single person I asked was like no, that's not possible
1:42:04Is it and I was like, yeah, actually that that is possible and he wrote this up and then the CEO of superhuman
1:42:11Had a fairly, you know, it wasn't super defensive, you know
1:42:17It was a fairly decent response except for the fact that it didn't acknowledge that the
1:42:23fundamental idea to me is wrong.
1:42:28This is interesting because I have to admit as a business owner I have used some of these
1:42:34services like I've used in particular Campaign Monitor, one of these email services where
1:42:39one of the responses I see Mike Davidson's post, he addresses like, "Well, one of the
1:42:46Excuses is everybody does this.
1:42:48Tracking pixels in emails are a thing.
1:42:50- And MailChimp is a long time sponsor
1:42:52during Fireball and this podcast.
1:42:54MailChimp I think has the same feature.
1:42:56- It's one of these things where it forces me
1:43:00to really think carefully about my own ethical stance
1:43:03on this because frankly, so this is one of these situations
1:43:07where I'm like, I'm getting back to what we said earlier
1:43:10about maybe you and I being examples of people
1:43:12who are a little bit more tuned in
1:43:14how to protect ourselves, slash maybe a little more paranoid sometimes, I have that feature
1:43:19on in Mail on my Mac that doesn't load remote content by default.
1:43:26So I think anybody who emailed me from Superhuman would not be tracking me unless I explicitly
1:43:33click that load remote content button.
1:43:36And then back to the confessional part, I have sent out...
1:43:39How many people even know that option exists?
1:43:42Not very many.
1:43:44And I have sent emails, I'm not very good at sending emails from a company point of
1:43:48view, but the times I have sent them, like a couple times over the last 15 years, I haven't
1:43:55gone out of my way to disable that feature or anything.
1:43:58I haven't said like, "Hey, campaign monitor, cool it on the tracking."
1:44:01And then to be honest, when I see stuff like, "Well, whatever, 10% of the people have opened
1:44:07this email since you sent it five minutes ago, let's say," I find that interesting.
1:44:13So this is one of these things, again, it's like the theme, again, legitimate, bona fide
1:44:21user experience improvement, but at what cost, right?
1:44:25Right, and I get it, and I've talked to a, you know, you and I have a bunch of friends
1:44:31who run independent software companies, and it's a good idea to have a mailing list, and
1:44:37I know Ben Thompson, who runs a paid subscription mailing list for his main business, Stretecory,
1:44:48you give him X dollars per year and then four days a week you get a custom email just for
1:44:55subscribers to you.
1:44:57And I don't know if he uses campaign monitor or MailChimp, I forget what he uses, but it
1:45:02doesn't even matter.
1:45:03that he's got a tracking pixel or tracking image in there and he can see
1:45:08you know what percentage you know it's 78 percent of subscribers open this in
1:45:13the last 24 hours well that's interesting to know because it's in the
1:45:17aggregate and it's not wrong but when I send a message to my hypothetical yeah
1:45:24ex-girlfriend or girlfriend and we're estranged and then I can see when and
1:45:31where, how many times she opened it.
1:45:34That's-- it's wrong on a personal--
1:45:36I don't know that it's wrong in the aggregate for a mailing
1:45:39list, but I know that it's wrong on a personal level.
1:45:42And even if they've disabled the reverse geo-tracking,
1:45:47which they apparently have in response to Mike Davidson's
1:45:51thing, it's still wrong to let somebody
1:45:54know that they've read it.
1:45:55Like, the real read receipts, when
1:45:57you use the official email protocol read receipt,
1:46:01is opt in, right?
1:46:02It's like, same thing with iMessage, like real, like,
1:46:05and that's the thing that my in-draft post on this
1:46:10is emphasizing is how corrupt we've let email get
1:46:16over the last two decades.
1:46:19Because it clearly was never meant for this, right?
1:46:22Like email was never, ever, ever meant for something
1:46:27where when you read a message,
1:46:29the person who sent it to you could tell
1:46:31when you did it without your compliance in any way.
1:46:36That is absolutely not within the spec,
1:46:38it's not within the design,
1:46:40but it is technically possible now that we've allowed
1:46:43the message body of emails to be web browsers effectively.
1:46:47It's a total inadvertent thing.
1:46:51And that to me is sort of the bottom line of this story.
1:46:54It's like I kinda get, I'm glad that Superhuman
1:46:58acknowledged Mike's post, and they've taken some actions,
1:47:03and they disabled the geotracking.
1:47:05But my bigger takeaway is that every single major email client
1:47:10has sort of dropped the ball on even allowing this.
1:47:13It shouldn't even be possible.
1:47:15And I'm not quite sure--
1:47:17and I've been thinking about it for weeks now,
1:47:19because it's a couple of weeks old.
1:47:21I'm convinced, though, that there's
1:47:23a way that every email client could make this not possible.
1:47:28I'm not quite sure what it would be like because the traditional way of sending an email like in the old days was that email was
1:47:35Just text it was just it was just like
1:47:37You know like I message you just send a string of characters and that's the message and that's it. So there is no metadata
1:47:45but even with inline attachments and yet you could say
1:47:50You know if I sent you a picture, you know an email with two photos from my vacation and those photos are in the email
1:47:58They're on your, you get the whole email.
1:48:03It's on your device, whether it's your Mac or your phone or whatever.
1:48:07The whole email is there including the attachment so that when you
1:48:12view it, nothing on my side gets pinged.
1:48:15Even if I send you an email and I, you know, the barn doors are
1:48:22already open.
1:48:22We've lost the war on rich text email with the server side images
1:48:27and stuff like that, we're not going to be able to undo that.
1:48:31You can't make an email client today that refuses to load remote images.
1:48:38But I feel like there's got to be a way that clients can load those remote images in an
1:48:45anonymous way.
1:48:47Well, real quick, Jon, before you get a bunch of emails, I think I want to just point out
1:48:52that in case it's not obvious,
1:48:55the deal with those email companies
1:48:58like MailChimp and Campaign Monitor,
1:49:00it's not strictly aggregate.
1:49:02They do let you go in and say--
1:49:04- Yeah, yeah.
1:49:05- So the--
1:49:06- But I think that's what most people do though.
1:49:09I do think, like wouldn't you say that,
1:49:11like as you, as the red sweater software guy,
1:49:14wouldn't you say your interest is mostly in the aggregate?
1:49:17Again--
1:49:18- Yes, but that's just like,
1:49:19That just happens to be my personal attitude.
1:49:22I don't give everybody that much credit.
1:49:25In fact, I think that the mailing services,
1:49:28it's part of their business proposition
1:49:32that you can identify on a subscriber by subscriber basis.
1:49:37You go into the consoles of these services
1:49:39and they show you on a map where the person was
1:49:42when they opened the email.
1:49:43I mean, let's just not, it's just,
1:49:45we can't really dance around it, it's creepy.
1:49:49And so I think one of the interesting things about this
1:49:52mail app doing it is that it makes all of these individuals
1:49:58who use the app agents of this kind of creepiness,
1:50:02whereas what we're used to is that
1:50:03companies are creepy sometimes.
1:50:05- Right.
1:50:06- Right, and then suddenly now this app
1:50:08has made individuals creepy.
1:50:10And I think that's a good example.
1:50:11Like you say, should you be able to email your ex-girlfriend
1:50:14and then see when they open the email?
1:50:18So anyway, I just want to get that out of the way,
1:50:20make sure people know we know
1:50:22that this is not strictly aggregate.
1:50:24And I think-- - No, that's a good point.
1:50:28- I think you're right though that
1:50:29male clients could be doing something about this.
1:50:34Let's give Apple a tiny bit of credit,
1:50:37the fact that there is this feature
1:50:38that you can turn off loading the remote content is good.
1:50:43But getting back to all these things
1:50:46that have been changing over the years
1:50:47with Safari, for example,
1:50:48we talked about not being able to click on a bookmarklet
1:50:51anymore without a prompt coming up.
1:50:52- Right.
1:50:53- Where is all the attention?
1:50:55Like what if they put as much attention into email security
1:50:59as they did into Safari security?
1:51:01- That is exactly what I think they should do.
1:51:05I really do.
1:51:06And I think the Safari team literally leads the industry
1:51:11in protecting browser users' personal privacy.
1:51:15But I really think that the mail.app team
1:51:18needs either the same dose of privacy first vitamins,
1:51:26or they should borrow people from the Safari team.
1:51:29Because literally, the way that email privacy is being
1:51:33violated is through web views.
1:51:37Right.
1:51:38Yeah.
1:51:39And I really hope that it's sort of an eye opener.
1:51:43That's the gist of the post that I've mostly done writing.
1:51:47But I really, I think it's overdue and I don't blame them for overlooking it because I feel
1:51:54like they're mostly comprised of people like me who just, you just don't think of that.
1:52:02You don't think of how are people violating your privacy through email, right?
1:52:08You just, you know, you're thinking, how do I reliably and efficiently download and sync
1:52:17these IMAP mailboxes between devices?
1:52:22You're not really thinking about that because you're not a shit bird who's trying to violate
1:52:27people's privacy.
1:52:28But the truth is people are using email to violate privacy.
1:52:33And so, to me, that's the bottom line is it doesn't even matter what superhuman does
1:52:38or says they're going to do.
1:52:39The bottom line is that the major email client makers
1:52:42should make it impossible for that to happen.
1:52:45And they should just cut it off,
1:52:46just make it so that nobody can tell
1:52:50when or if you've ever opened an email.
1:52:53And I'm telling you, when I talk to people in my family,
1:52:58my wife and a couple of other people,
1:53:01and ask them if they thought it was possible
1:53:03that somebody, when they sent you an email,
1:53:05could tell when or if you read it,
1:53:08You know, they're like, no, of course not.
1:53:11And I'm like, yeah, actually, depending on how they'd said it, yeah, they could totally
1:53:14do it with an invisible tracking pixel.
1:53:16And they're appalled.
1:53:17They are absolutely shocked.
1:53:19And the other really big tell to me is that every major messaging platform in the last
1:53:2620 years after email, nobody has ever made that possible.
1:53:31Like that's not possible in iMessage.
1:53:33It's not possible in WhatsApp.
1:53:35It's not possible and these other things, you know, like iMessage has read receipts,
1:53:42but it is a total opt.
1:53:43It's off by default and you have to turn it on and therefore you're allowing people to
1:53:48say, okay, they can tell that you read it, but it doesn't say when, it doesn't say where,
1:53:54it just says read and that's and it's opt in.
1:53:58The fact that with the email that they've built this system where you have no opt in
1:54:05and it reveals all this information about you, it's absolutely appalling. And any kind
1:54:10of defense of it is, to me, dishonest because everybody knows that is not how email was
1:54:17designed. The clear design of the system from the early 90s or late 80s, whenever email,
1:54:25as we know it, was invented, clearly did not involve involuntary read receipts.
1:54:30No. I'd say it's an interesting example because you can almost imagine Apple trying to wait
1:54:35out this being an issue. Like if you imagined at one point 10 years ago that iMessage is
1:54:42going to prevail or something, people aren't going to be using email anymore, then you
1:54:47might just say, "Well, that's just a legacy technology." But it's clearly not... It doesn't
1:54:52show any sign of just disappearing. And it does seem like it would be such a great WWDC
1:55:00keynote message to be like,
1:55:03also we made mail finally respect your privacy.
1:55:07And an example that came to mind,
1:55:10it's kind of along the lines of this whole system
1:55:12they have in place where you can do things like send,
1:55:15you can send large files to people
1:55:17and Apple basically hosts it temporarily.
1:55:19So imagine if Apple had a system where
1:55:23they could securely send a hash of a URL
1:55:28to Apple servers or something, and then, I don't know,
1:55:32something, something, and they can decide,
1:55:34does this look like a unique URL or not, right?
1:55:38Like imagine if there's a feature in Mail where you say,
1:55:41like right now I have this load remote content thing
1:55:43I have to click for every Mail message,
1:55:45but if I could just say,
1:55:46Mail, it's okay for you to load any resource
1:55:50that doesn't look like it has a tracking ID in it for me,
1:55:54and then furthermore, it could like,
1:55:58it could load that resource from Apple's servers.
1:56:01You know, 'cause I kinda sorta like
1:56:02trampoline it through Apple.
1:56:04And so then I could get that,
1:56:05that satisfied the promise of email
1:56:08as a conveyance of text and images and layout information,
1:56:13but the distributor of that information
1:56:16doesn't have any idea who asked for it.
1:56:19- I've been thinking about this a lot, all month long,
1:56:23ever since Mike started writing about it.
1:56:25Because my first thought Mike wrote to me--
1:56:28and he's a longtime friend, and he sent me
1:56:30an early draft of his first post.
1:56:32And he was like, I'm not even sure I'm going to publish this.
1:56:35And I read it, and I sent him a couple of typos,
1:56:38like just copy editing things.
1:56:40But I was like, overall, I was like,
1:56:41you've got to publish this, because this is dynamite.
1:56:44This is going to blow up.
1:56:45And I don't want to say I was right, but I was right.
1:56:50It blew up, and it was huge.
1:56:54But the second thought, the first thought I had was, you know what, when you put it
1:56:59in these terms, like I always, I knew this was possible, but when you put it in these
1:57:04terms and you show me like screenshots of what superhuman shows people about like where
1:57:10and when people see these emails, I was like, this is explosive.
1:57:14People are gonna, people are gonna be irate.
1:57:16But the second thought I had was email clients should defend against this.
1:57:21It's it, this, we could beat this.
1:57:24I know that there's a way to do it.
1:57:26But the thing I've been thinking about all month
1:57:28is I'm not 100% sure whether it should be at the email client
1:57:33end or at the email provider end.
1:57:36In other words, if Apple was going to defend against this,
1:57:39should it be in mail.app or should it be on iCloud
1:57:44so that your Mac.com account does what you're saying?
1:57:49Read the email, load all of the remote resources,
1:57:54and store them on iCloud.com or Mac.com, whatever your domain is for your email,
1:58:02and then let you download them once from there, but then you're not hitting them directly,
1:58:08so they never really know whether you read it or not. And then if you read the email again,
1:58:14it's all locally cached. On the one hand, I think it would be easier to do it.
1:58:22I definitely think it would be easier to do it from the server side and have the
1:58:26the your your imap provider do it on their side but on the other hand
1:58:34if they don't do it at the client side you're not defended if you're not using their their email
1:58:42service right and so in other words if daring fireball.net isn't hosted by somebody who supports
1:58:51defending against this, should the client still help me out?
1:58:56And, you know, and that's the way that that to me is the way
1:58:59that Safari team has as tackled stuff to their credit,
1:59:03is that the Safari team is like, we don't care what websites do,
1:59:07what they comply with, if they comply with GDPR or best practices or whatever
1:59:11we're going to if you use Safari as your Web browser,
1:59:15we are going to protect your privacy.
1:59:17And I kind of feel like that's what the mail that app team should do.
1:59:21I think this is a great example of Apple having its sort of benevolent, user-focused protection
1:59:28stuff as part of their DNA come up against now this whole, like, we keep seeing it again
1:59:35and again, like, what's the next service Apple's going to provide?
1:59:38If you think about it through that sort of lens, it's a natural if Apple said, "Okay,
1:59:43now we have Mail Plus," or whatever.
1:59:44Yes.
1:59:45Yeah.
1:59:46Totally.
1:59:47It's a little bit of a situation where if Apple wasn't on this run of trying to add
1:59:51new services all the time with the...
1:59:54It plays well into the idea that your mail hosting would maybe eat into your iCloud quota
2:00:02and all that stuff.
2:00:04It definitely seems like there are some challenges to any kind of even temporary hosting of arbitrary
2:00:10users' email images or whatever.
2:00:15So I don't know, I think you're right that earlier when you were saying they should get
2:00:20the same kind of attitude as the WebKit team or Safari team, it almost just seems like
2:00:26literally the Safari team should take over the mail view component for the Web view version
2:00:35of mail.
2:00:36Right.
2:00:37And again, the argument over whether email should be a Web view or not, that we've lost
2:00:41that.
2:00:42I mean, there's no use arguing over that anymore.
2:00:44You can't ship a modern email client that only renders email as plain text.
2:00:49I think that's the way it should have been.
2:00:51I think it should have stayed that way, but that argument is decades old lost.
2:00:57Let's be practical and admit that people get email, they want it to look the way the email
2:01:02is supposed to look, which is a rich graphical view, but I think there's numerous ways that
2:01:08it could be done anonymously.
2:01:12I really think it's important.
2:01:13I think that that's the thing that this superhuman thing has exposed to me.
2:01:17It's nothing to do with superhuman in particular, but the fact that our modern view of email
2:01:24as a web view really needs to be protected and tightened up and we're sort of doing it
2:01:30open kimono style right now.
2:01:32And just thinking about that a little bit more, actually, maybe if we step back, this
2:01:37This problem applies to people who use Gmail, whatever, on the web, the web browser stuff.
2:01:42Absolutely.
2:01:43So if you look at it from that perspective, maybe it's not that mail needs to hand over
2:01:48the mail view to the WebKit team, but maybe it's that Safari, the WebKit team, need to
2:01:54solve this across the board.
2:01:57Maybe there's some kind of proxying service that protects you regardless of where you
2:02:02load your web content.
2:02:05That's the kind of thing.
2:02:06I could see Apple doing.
2:02:09And I don't know how practical it is,
2:02:10but wouldn't it be great if they could solve this,
2:02:13not just in mail.app, but in all mail apps,
2:02:17and on the web, just by some kind of clever web-based thing?
2:02:21- Well, and it's the sort of thing
2:02:23that I could definitely see Apple doing.
2:02:25I can definitely see that I know that there are people
2:02:28at Apple who would love to tackle the problem.
2:02:31That's the thing.
2:02:32Isn't that the best type of programming problem
2:02:35is one that you want to tackle.
2:02:36You know, you're like, oh, that mountain of shit,
2:02:40I would love to get rid of that, right?
2:02:42You know what I mean?
2:02:44I would love, you know that there are people at Apple
2:02:47who would love to fix this.
2:02:50And so I really hope that it's opened their eyes to it,
2:02:53like, hey, you know what?
2:02:54We've kind of had our eyes closed to this
2:02:56just because we never really thought about it,
2:02:58but this is the sort of thing we could fix.
2:03:00I can't even list.
2:03:03I mean, it's an arm's length, the number of things
2:03:07that the WebKit/Safari team has fixed over the last five years
2:03:12since they've really, really gone nose to the grindstone
2:03:17on these privacy issues.
2:03:19And they're just amazing problems.
2:03:22And they've fixed them one after another after another.
2:03:25And they just keep coming.
2:03:26And I really think, though, that this
2:03:29This is the first one that really breaks out
2:03:34of the web browser itself.
2:03:36- Well yeah, it's a good example of a problem,
2:03:39a set of problems that are technical challenges
2:03:41and they are, so they have the gratification
2:03:44of solving a technical challenge,
2:03:45but also the gratification of providing a public good.
2:03:48And that's I think-- - And doing, yeah.
2:03:50Doing the right thing, right.
2:03:51Daniel, I really appreciate your time.
2:03:55I hope you enjoy the rest of the summer.
2:03:58Everybody can hear the dulcet tones of your wonderful voice
2:04:02on your regular podcast with our mutual friend,
2:04:06Manton Reese, on Core Intuition,
2:04:09which you could probably, right?
2:04:11- Yeah, that's it, Core Intuition.
2:04:13- Oh my God, I got it right.
2:04:14- You got it right.
2:04:15- You could just search for that
2:04:16in whatever your favorite podcast app is,
2:04:19it'll be the number one hit.
2:04:20Manton is a fine individual.
2:04:23- Yes, he is.
2:04:25How often do you guys publish episodes of Core Intuition?
2:04:29- We're pretty regular pretty much every week.
2:04:31- Every week.
2:04:32- Not so regular on the exact day of the week,
2:04:34but pretty much 52, we probably do 50 episodes a year.
2:04:38- Yeah, so do I.
2:04:39- Yeah.
2:04:39(laughing)
2:04:41My give or take.
2:04:42- Give or take 20 episodes.
2:04:45Also, I mean I don't even know where to get to.
2:04:50- I don't know.
2:04:51- You got Bit Splitting.
2:04:53- Yep.
2:04:54great blog that you post with technical stuff. You've got, what's your
2:04:59Twitter? Your Twitter is Daniel Punk ass. Three things that go great together.
2:05:06Yeah, well no it's a very aptly named Twitter account. But that'll get people
2:05:13started if they want more. They want to learn more. That's a great place
2:05:16to find out. Basically as John mentioned, Red Sweater Software is my
2:05:21main jam. Mars Edit is the app I have been mostly working on over the past 10
2:05:28years and then... That's the blog editor. You've also got Black Ink, which
2:05:33is your crossword app, which is a lot of fun. I've gotten more into crosswords as
2:05:38I've gotten older, I have to say. That's good. Keeps your brain young. It does a
2:05:43little bit and you know what? I feel like the older you are, the better you are
2:05:48are at getting some obscure references. When I was young, I always found crosswords very
2:05:53frustrating because they'd give me references and I was like, "How am I supposed to know
2:05:58that? That's from the '70s."
2:06:00Well, I'll tell you what. I think we have a little cheat, which is that particularly
2:06:03if you're doing the New York Times crossword, it helps that the New York Times crossword
2:06:07editor is also old.
2:06:09Will Short.
2:06:10Yeah, Will Short. One of these days, they're going to replace Will Short's and it's going
2:06:15to be like...
2:06:16With somebody young and we're all gonna be screwed.
2:06:19- We're gonna be like, Mariah who?
2:06:21- What?
2:06:22(laughing)
2:06:24Absolutely, yeah, I think that's absolutely,
2:06:26I think that's the key to my increased
2:06:29enjoyment of crosswords in recent years is that now,
2:06:33I'm like prime demographic for all of the obscure clues.
2:06:38But anyway, thank you Daniel, I really appreciate it
2:06:42and have a good rest of your summer.
2:06:44Thanks, you too. Try to keep cool down there. It's kind of cooling off now finally here.
2:06:49It's only 80 degrees but hopefully we'll continue that trend. Thanks so much,
2:06:53John, for having me on the show. I hope you built a nice sandwich for me.