Threatpost reports on "another vast software supply-chain attack" that was "found lurking in the npm open-source code repository...a credentials-stealing code bomb" that used the password-recovery tools in Google's Chrome web browser. Researchers caught the malware filching credentials from Chrome on Windows systems. The password-stealer is multifunctional: It also listens for incoming commands from the attacker's command-and-control (C2) server and can upload files, record from a victim's screen and camera, and execute shell commands...

ReversingLabs researchers, who published their findings in a Wednesday post, said that during an analysis of the code repository, they found an interesting embedded Windows executable file: a credential-stealing threat. Labeled "Win32.Infostealer.Heuristics", it showed up in two packages: nodejs_net_server and temptesttempfile. At least for now, the first, main threat is nodejs_net_server. Some details:

nodejs_net_server: A package with 12 published versions and a total of more than 1,300 downloads since it was first published in February 2019...finally upgrading it last December with a script to download the password-stealer, which the developer hosts on a personal website. It was subsequently tweaked to run TeamViewer.exe instead, "probably because the author didn't want to have such an obvious connection between the malware and their website," researchers theorized...

ReversingLabs contacted the npm security team on July 2 to give them a heads-up about the nodejs_net_server and tempdownloadtempfile packages and circled back once again last week, on Thursday, since the team still hadn't removed the packages from the repository. When Threatpost reached out to npm Inc., which maintains the repository, a GitHub spokesperson sent this statement: "Both packages were removed following our investigation...."

An anonymous reader quotes a report from Ars Technica: Muse Group -- owner of the popular audio-editing app Audacity -- is in hot water with the open source community again. This time, the controversy isn't over Audacity -- it's about MuseScore, an open source application that allows musicians to create, share, and download musical scores (especially, but not only, in the form of sheet music). The MuseScore app itself is licensed GPLv3, which gives developers the right to fork its source and modify it. One such developer, Wenzheng Tang ("Xmader" on GitHub) went considerably further than modifying the app -- he also created separate apps designed to bypass MuseScore Pro subscription fees. After thoroughly reviewing the public comments made by both sides at GitHub, Ars spoke at length with Muse Group Head of Strategy Daniel Ray -- known on GitHub by the moniker "workedintheory" -- to get to the bottom of the controversy.

While Xmader did, in fact, fork MuseScore, that's not the root of the controversy. Xmader forked MuseScore in November 2020 and appears to have abandoned that fork entirely; it only has six commits total -- all trivial, and all made the same week that the fork was created. Xmader is also currently 21,710 commits behind the original MuseScore project repository. Muse Group's beef with Xmader comes from two other repositories, created specifically to bypass subscription fees. Those repositories are musescore-downloader (created November 2019) and musescore-dataset (created March 2020). Musescore-downloader describes itself succinctly: "download sheet music from musescore.com for free, no login or MuseScore Pro required." Musescore-dataset is nearly as straightforward: it declares itself "the unofficial dataset of all music sheets and users on musescore.com." In simpler terms: musescore-downloader lets you download things from musescore.com that you shouldn't be able to; musescore-dataset is those files themselves, already downloaded. For scores that are in the public domain or that users have uploaded under Creative Commons licenses, this isn't necessarily a problem. But many of the scores are only available by arrangement between the score owner and Muse Group itself -- and this has several important implications.

Just because you can access the score via the app or website doesn't mean you're free to access it anywhere, anyhow, or redistribute that score yourself. The distribution agreement between Muse Group and the rightsholder allows legitimate downloads, but only when using the site or app as intended. Those agreements do not give users carte blanche to bypass controls imposed on those downloads. Further, those downloads can often cost the distributor real money -- a free download of a score licensed to Muse Group by a commercial rightsholder (e.g., Disney) is generally not "free" to Muse Group itself. The site has to pay for the right to distribute that score -- in many cases, based on the number of downloads made. Bypassing those controls leaves Muse Group on the hook either for costs it has no way to monetize (e.g., by ads for free users) or for violating its own distribution agreements with rightsholders (by failing to properly track downloads).

Long-time Slashdot reader RoccamOccam shares "an interesting take on SQL and its issues from Jamie Brandon (who describes himself as an independent researcher who's built database engines, query planners, compilers, developer tools and interfaces).

It's title? "Against SQL." The relational model is great... But SQL is the only widely-used implementation of the relational model, and it is: Inexpressive, Incompressible, Non-porous. This isn't just a matter of some constant programmer overhead, like SQL queries taking 20% longer to write. The fact that these issues exist in our dominant model for accessing data has dramatic downstream effects for the entire industry:

- Complexity is a massive drag on quality and innovation in runtime and tooling
- The need for an application layer with hand-written coordination between database and client renders useless most of the best features of relational databases

The core message that I want people to take away is that there is potentially a huge amount of value to be unlocked by replacing SQL, and more generally in rethinking where and how we draw the lines between databases, query languages and programming languages...

I'd like to finish with this quote from Michael Stonebraker, one of the most prominent figures in the history of relational databases:

"My biggest complaint about System R is that the team never stopped to clean up SQL... All the annoying features of the language have endured to this day. SQL will be the COBOL of 2020..."
It's been interesting to follow the discussion on Twitter, where the post's author tweeted screenshots of actual SQL code to illustrate various shortcomings. But he also notes that "The SQL spec (part 2 = 1732) pages is more than twice the length of the Javascript 2021 spec (879 pages), almost matches the C++ 2020 spec (1853) pages and contains 411 occurrences of 'implementation-defined', occurrences which include type inference and error propagation."

His Twitter feed also includes a supportive retweet from Rust creator Graydon Hoare, and from a Tetrane developer who says "The Rust of SQL remains to be invented. I would like to see it come."

Slashdot reader Beeftopia writes: Rust has two modes: its default, safe mode, and an unsafe mode. In its default, safe mode, Rust prevents memory errors, such as "use-after-free" errors. It also prevents "data races" which is unsynchronized access to shared memory. In its unsafe mode (via use of the "unsafe" block), in which some of its APIs are written, it allows the use of potentially unsafe C-style features. The key challenge in verifying Rust's safety claims is accounting for the interaction between its safe and unsafe code. This article from April's issue of Communications of the ACM provides an overview of Rust and investigates its safety claims.
The article is co-authored by Ralf Jung, a prominent postdoctoral researcher in the 'Foundations of Programming' research group at the Max Planck Institute for Software Systems. And (spoiler alert) Jung has just received one of two 'Honorable Mentions' for the 'Dissertation Award' of the 'Association for Computing Machinery' (ACM), reports a nonprofit site operated by the American Association for the Advancement of Science: In his dissertation, Ralf Jung now provides the first formal proof that the safety promises of Rust actually hold. "We were able to verify the safety of Rust's type system and thus show how Rust automatically and reliably prevents entire classes of programming errors," says Ralf Jung.

In doing so, he also successfully addressed a special aspect of the programming language: "The so-called 'type safety' goes hand in hand with the fact that Rust imposes restrictions on the programmer and does not allow everything that the programmer wants to do. Sometimes, however, it is necessary to write an operation into the code that Rust would not accept because of its type safety," the computer scientist continues. "This is where a special feature of Rust comes into play: programmers can mark their code as 'unsafe' if they want to achieve something that contradicts the programming language's safety precautions. Together with international collaborators, including my thesis advisor Derek Dreyer, we developed a theoretical framework that allows us to prove that Rust's safety claims hold despite the possibility of writing 'unsafe' code," Jung says.

This proof, called RustBelt, is complemented by Ralf Jung with a tool called Miri, with which 'unsafe' Rust code can be automatically tested for compliance with important rules of the Rust specification - a basic requirement for correctness and safety of this code. "While RustBelt was a great success, especially in academic circles, Miri is already established in industry as a tool for security testing of programs written in Rust," explains Ralf Jung.... The ACM states: "Through Jung's leadership and active engagement with the Rust Unsafe Code Guidelines working group, his work has already had profound impact on the design of Rust and laid essential foundations for its future."

AmiMoJo shares a report from VentureBeat: Apple critics such as Epic Games CEO Tim Sweeney have complained about Apple's alleged anticompetitive behavior with the App Store. But Consumer Acquisition's Brian Bowman has frequently sounded the alarm on Apple's decision to favor user privacy over targeted ads by changing access to its Identifier for Advertisers (IDFA). Based on Consumer Acquisition's analysis of $300 million in paid social ad spending, IDFA has had a devastating impact, Bowman said in an interview with GamesBeat. In a report issued today, Bowman said that iOS advertisers are experiencing a 15% to 20% revenue drop and inflation in unattributed organic traffic.

Starting in April, Apple began releasing iOS 14.5, which prompted users to answer whether they would allow their data to be tracked for advertising purposes. Apple believes this puts privacy front and center. But Consumer Acquisition and many of its game developer advertisers worry it will break personalized advertising. Only 20% of consumers are saying yes to Apple's App Tracking Transparency prompt, which means they will enable apps to personalize ads by tracking their personal data. For the traffic Bowman's company evaluated, performance has faded. Across paid social platforms, downstream event optimization and "lookalike audience performance" is also eroding. [...] Bowman believes -- or at least holds out hope -- that Apple will roll back or soften the IDFA changes by Black Friday.

CoinDesk reports that "A project is in the works to make the Tor Client more adaptable and easier for third parties to use, with some help from Zcash Open Major Grants (ZOMG)." ZOMG announced on Tuesday that it is awarding the privacy-focused Tor Project a $670,000 grant to continue to develop Arti, a Rust coding language implementation of the Tor Client... Arti should make it simpler for third parties to embed and customize the Tor Client than the current implementation in the C coding language... "Arti is a project to make an improved version of Tor that will be more reliable, more secure, and easier for other software to use," said Nick Mathewson, chief network architect and co-founder of the Tor Project. "We hope that within the next several years, Arti will become the preferred implementation of the Tor protocols...."

"Onion routing has just had its 25th anniversary in May, and although Tor is a great set of privacy tools, the C program 'tor' itself (note the lowercase t) is beginning to show its age," Mathewson said. "We've found over the recent years that the complexity of the existing C code, and the fragility of the C language, make it unnecessarily difficult to improve the code while maintaining our security and privacy guarantees....

"Roughly half of Tor's security issues since 2016 would have been impossible in Rust, and many of the other issues would have been much less likely, based on our informal audit," he said...

The funding will go toward developer salaries as they develop Arti. Mathewson said the goal with this round of funding is to advance Arti to the point where it is ready for general use, testing and embedding.

SD Times takes another look at the uptake of Java 11 Previous reports of the Java community found that developers were still mainly using Java 8 and didn't adopt newer versions, but according to Snyk's JVM Ecosystem Report 2021, that is starting to change. This year, 61.5% of respondents are using Java 11 somewhere in production, and almost 12% are using the latest release, which was Java 15 during the survey. "This is huge, because it shows that developers do upgrade their Java version beyond Java 8 to some extent. The mantra that most Java developers are comfortable staying on Java 8 seems to be slowly breaking apart," Snyk stated in the report.

However, half of the Java 11 users — which is currently the most used version — still use Java 8 in their production stack...

In addition, almost half of developers (44%) use the free AdoptOpenJDK distribution in production as one of their JDKs and 48% use it in development.
"Other findings are that Java is still by far the most popular language by a long shot and Snyk stated it will probably remain that way in the foreseeable future and that JetBrains IntellIJ IDEA still remains dominant as an IDE in the Java ecosystem."

The TIOBE index of programming language popularity celebrates 20 years of continuous publishing this month. Started as a hobbyist project back in 2001, the site estimates each programming language's popularity by counting search engine results for the phrase <language> programming (indirectly counting each listing for developers, courses, and third-party vendors).

When it was started 20 years ago, the top languages were Java, C, and C++.

20 years later, the top languages are now C, Java, Python, and C++

And "The difference between position 1 and position 3 is only 0.67%." This means that the next few months will be exciting. What language is going to win this battle? Python seems to have the best chances to become number 1, thanks to its market leadership in the booming field of data mining and artificial intelligence.
ZDNet also noted the trends: Searches for C were down 4.83 percentage points compared to last July. Java searches were down 3.93% over the period, while Python gained 1.86%.

The top 10 languages behind C, Java and Python are C++, C#, Visual Basic, Javascript, PHP, Assembly Language, and SQL.
But they also have this to say about TIOBE's calculations: It's a different methodology to developer analyst RedMonk, which looks at language usage on software projects hosted on GitHub and discussions on the developer Q&A site, Stack Overflow.

RedMonk's Q1 2021 rankings place JavaScript in top place, followed by Python and Java.

Other interesting moves this month:

• C++ gained more than 0.5% getting closer to the top 3
• Rust rose from #30 to #27
• Go rose from #20 to #13
• TypeScript rose from #45 to #37
• Haskellrose rose from #49 to #39

Reactions are starting to come in for GitHub's new Copilot coding tool, which one site calls "a product of the partnership between Microsoft and AI research and deployment company OpenAI — which Microsoft invested $1 billion into two years ago." According to the tech preview page: GitHub Copilot is currently only available as a Visual Studio Code extension. It works wherever Visual Studio Code works — on your machine or in the cloud on GitHub Codespaces. And it's fast enough to use as you type. "Copilot looks like a potentially fantastic learning tool — for developers of all abilities," said James Governor, an analyst at RedMonk. "It can remove barriers to entry. It can help with learning new languages, and for folks working on polyglot codebases. It arguably continues GitHub's rich heritage as a world-class learning tool. It's early days but AI-assisted programming is going to be a thing, and where better to start experiencing it than GitHub...?"

The issue of scale is a concern for GitHub, according to the tech preview FAQ: "If the technical preview is successful, our plan is to build a commercial version of GitHub Copilot in the future. We want to use the preview to learn how people use GitHub Copilot and what it takes to operate it at scale." GitHub spent the last year working closely with OpenAI to build Copilot. GitHub developers, along with some users inside Microsoft, have been using it every day internally for months.

[Guillermo Rauch, CEO of developer software provider Vercel, who also is founder of Vercel and creator of Next.js], cited in a tweet a statement from the Copilot tech preview FAQ page, "GitHub Copilot is a code synthesizer, not a search engine: the vast majority of the code that it suggests is uniquely generated and has never been seen before."

To that, Rauch simply typed: "The future."

Rauch's post is relevant in that one of the knocks against Copilot is that some folks seem to be concerned that it will generate code that is identical to code that has been generated under open source licenses that don't allow derivative works, but which will then be used by a developer unknowingly...
GitHub CEO Nat Friedman has responded to those concerns, according to another article, arguing that training an AI system constitutes fair use: Friedman is not alone — a couple of actual lawyers and experts in intellectual property law took up the issue and, at least in their preliminary analysis, tended to agree with Friedman... [U.K. solicitor] Neil Brown examines the idea from an English law perspective and, while he's not so sure about the idea of "fair use" if the idea is taken outside of the U.S., he points simply to GitHub's terms of service as evidence enough that the company can likely do what it's doing. Brown points to passage D4, which grants GitHub "the right to store, archive, parse, and display Your Content, and make incidental copies, as necessary to provide the Service, including improving the Service over time." "The license is broadly worded, and I'm confident that there is scope for argument, but if it turns out that Github does not require a license for its activities then, in respect of the code hosted on Github, I suspect it could make a reasonable case that the mandatory license grant in its terms covers this as against the uploader," writes Brown. Overall, though, Brown says that he has "more questions than answers."
Armin Ronacher, the creator of the Flask web framework for Python, shared an interesting example on Twitter (which apparently came from the game Quake III Arena) in which Copilot apparently reproduces a chunk of code including not only its original comment ("what the fuck?") but also its original copyright notice.

After yesterday's industry-wide discussion of the cost of being visible on Sony's PlayStation Store, Kotaku has heard from multiple independent developers and publishers expressing similar frustrations and fury. From a report: There were two main responses to our article yesterday highlighting one independent developer's frustrations with working with Sony to sell games on the PlayStation store. The first was a confusing number of people convinced that this was somehow part of an underground conspiracy to destroy Sony. The second was many indie game developers and publishers getting in touch to say that, yes, wow, Sony are far harder to work with and sell games through than anywhere else.

It's not possible to rationalize with the former group. We had confirmed hard figures on Sony's fees for getting any visibility on the PlayStation's in-built store, so we reported them. The conspiracy, disappointingly, ends there. However, the information about just how much worse it is for indies to work with Sony than Microsoft or Nintendo keeps piling in. "Oh yeah, so there's Nintendo who supports you," one such response begins. "[Then] Microsoft who supports you and [then] there is Sony who supports its own AAA machine and gives a fuck about everyone else."

As Bloomberg reported in April, Sony shows extraordinary caution even with the games it makes itself, with an obsessive focus on blockbuster success. According to that article, the Japanese corporation is moving away from developing smaller in-house games, so fixated are they on only the largest games. It seems this lack of interest in smaller titles extends to third-party developers attempting to sell their games on the system. "Sony does not understand what indie means," an independent publisher tells me under the condition of anonymity, via Twitter DMs. "Not at all. For them indie is something in the lower million budgets."

An anonymous reader shares a report: When Kevin Modzelewski and his colleagues at Dropbox set out to create Pyston in 2014, they had a very simple objective: to lower the costs of running Python code on Dropbox's servers, by making the code itself faster. "We were growing exponentially, so our server cost was growing exponentially," Modzelewski tells TechRepublic. "If we could get Python running faster, we would spend less money running Python." The original cost reduction initiative at Dropbox snowballed into a bigger project for Modzelewski when the company moved away from Python in 2017 and cancelled the Pyston project. He had realized while working on the language that there was a strong demand for faster Python among the developer community, and while there were plenty of tools around for improving the performance in smaller applications, there were none designed for big, business logic-type applications such as Dropbox.

"There's a lot of tools out there for helping you run Python faster, but there weren't any that were a good fit for Dropbox's use case," says Modzelewski. "This was an area of the Python market where a lot of money was being spent, but not very many tools were being developed for helping. It was under served." Fast forward to today and Pyston is now in version 2.2, and has been open-sourced, with Modzelewski and fellow developer Marius Wachtler now leading the project as co-founders. The latest implementation promises a 30% performance improvement over Python 3.8.8, with a key benefit being that developers can simply drop their Python applications into Pyston and get going, without having to rewrite their code. It's also a "completely separate thing" to what Modzelewski and fellow developers built for Dropbox some seven years ago.

Microsoft on Tuesday announced an artificial intelligence system that can recommend code for software developers to use as they write code. From a report: Microsoft is looking to simplify the process of programming, the area where the company got its start in 1975. That could keep programmers who already use the company's tools satisfied and also attract new ones. The system, called GitHub Copilot, draws on source code uploaded to code-sharing service GitHub, which Microsoft acquired in 2018, as well as other websites. Microsoft and GitHub developed it with help from OpenAI, an AI research start-up that Microsoft backed in 2019.

Researchers at Microsoft and other institutions have been trying to teach computers to write code for decades. The concept has yet to go mainstream, at times because programs to write programs have not been versatile enough. The GitHub Copilot effort is a notable attempt in the field, relying as it does on a large volume of code in many programming languages and vast Azure cloud computing power. Nat Friedman, CEO of GitHub, describes GitHub Copilot as a virtual version of what software creators call a pair programmer -- that's when two developers work side by side collaboratively on the same project. The tool looks at existing code and comments in the current file and the location of the cursor, and it offers up one or more lines to add. As programmers accept or reject suggestions, the model learns and becomes more sophisticated over time. The new software makes coding faster, Friedman said in an interview last week. Hundreds of developers at GitHub have been using the Copilot feature all day while coding, and the majority of them are accepting suggestions and not turning the feature off, Friedman said.

An anonymous reader quotes a report from The Guardian: From espresso to instant, coffee is part of the daily routine for millions. Now research suggests the brew could be linked to a lower chance of developing or dying from chronic liver disease. Chronic liver disease is a major health problem around the world. According to the British Liver Trust, liver disease is the third leading cause of premature death in the UK, with deaths having risen 400% since 1970. Writing in the journal BMC Public Health, Roderick and colleagues report how they analyzed data from 494,585 participants in the UK Biobank -- a project designed to help unpick the genetic and environmental factors associated with particular conditions. All participants were aged 40 to 69 when they signed up to the project, with 384,818 saying they were coffee drinkers at the outset compared with 109,767 who did not consume the beverage.

The team looked at the liver health of the participants over a median period of almost 11 years, finding 3,600 cases of chronic liver disease, with 301 deaths, and 1,839 cases of simple fatty liver disease. The analysis revealed that after taking into account factors such as body mass index, alcohol consumption, and smoking status, those who drank any amount of coffee, and of any sort, had a 20% lower risk of developing chronic liver disease or fatty liver disease (taken together) than those who did not consume the brew. The coffee drinkers also had a 49% lower risk of dying from chronic liver disease. The team said the magnitude of the effect increased with the amount of coffee consumed, up to about three to four cups a day, "beyond which further increases in consumption provided no additional benefit." A reduction in risk was also found when instant, decaffeinated and ground coffee were considered separately -- although the latter linked to the largest effect.

"Google said Thursday it's funding a project to increase Linux security by writing parts of the operating system's core in the Rust programming language, a modernization effort that could bolster the security of the internet and smartphones," reports CNET: If the project succeeds, it'll be possible to add new elements written in Rust into the heart of Linux, called the kernel. Such a change would mark a major technological and cultural shift for an open-source software project that's become foundational to Google's Android and Chrome operating systems as well as vast swaths of the internet. Miguel Ojeda, who's written software used by the Large Hadron Collider particle accelerator and worked on programming language security, is being contracted to write software in Rust for the Linux kernel. Google is paying for the contract, which is being extended through the Internet Security Research Group, a nonprofit that's also made it easier to secure website communications through the Let's Encrypt effort.

Adding Rust modules to the Linux kernel would improve security by closing some avenues for hackers can use to attack phones, computers or servers. Since it was launched in 1991, Linux has been written solely in the powerful but old C programming language. The language was developed in 1972 and is more vulnerable to hacks than contemporary programming languages...

Google credits the Linux community programmers who began the Rust for Linux project. "The community had already done and continues to do great work toward adding Rust support to the Linux kernel build system," Google said in a blog post...

[Rust] has been the most loved programming language for five years running in Stack Overflow's annual developer survey. "Rust represents the best alternative to C and C++ currently available," Microsoft's security team concluded in 2019. The team said Rust would have prevented memory problems at fault in 70% of its significant security issues. And because Rust's checks happen while software is being built, the safety doesn't come at the expense of performance when the software is running.

The goal of the Linux on Rust project isn't to replace all of Linux's C code but rather to improve selective and new parts.

A new extension for Microsoft's code-editing tool, Visual Studio Code, "allows you to open, edit, and commit back to source-control repos without having to clone them on your local machine," explains a new video.

A Microsoft blog post calls it "a new experience that we've been building in partnership with our friends at GitHub to enable working with source code repositories quickly and safely inside VS Code." In VS Code, we've offered integrated support for Git from the very beginning, and we've been supporting many other source control management (SCM) providers through extensions. This has allowed developers to clone and work with repositories directly within VS Code.

However, a large part of what developers do every day involves reading other people's code: reviewing pull requests, browsing open-source repositories, experimenting with new technologies or projects, inspecting upstream dependencies to debug applications, etc. What all of these have in common is that as a first step, you usually clone the repository locally and then open the code in your favorite code editor (which we hope is VS Code!). Yet, cloning a repository takes time, may lead you to review an outdated version of the repo if you forget to pull, and can sometimes be a security risk if you're unfamiliar with the code. The new Remote Repositories extension, published by GitHub, makes the experience of opening source code repositories in VS Code instant and safe. With this, you can quickly browse, search, edit, and commit to any remote GitHub repository (and soon, Azure Repos) directly from within VS Code, no clone necessary!

You can work on as many repos as you like without having to save any source code on your machine. Remote Repositories saves you time and local disk space and empowers you to stay entirely within VS Code for all your source control tasks.

For the first time, you can code, iterate and build apps on the iPad itself. 9to5Mac reports: Using Swift Playgrounds on iPadOS 15, customers will be able to create iPhone and iPad apps from scratch and then deploy them to the App Store. It remains to be seen how limited or not the development experience will be. It is probably notable that Apple chose not to rebrand this as "Xcode," signifying that you aren't going to be able to do everything you can do with Xcode on the Mac. TechCrunch highlights some of the other new features available in iPadOS 15: iPadOS 15 retains the overall look and feel of the current iPad operating system. The updates in the new OS are mostly centered around multitasking. The iPad's widget support gets a big update with iPadOS 15. The widgets are larger, more immersive and dynamic. And, iOS's App Library is finally available on the iPad, where it tweaks the overall user experience. The feature, added to the iPhone in 2020, presents the user with an organized view of the apps on the iPad.

Also added to iPadOS 15 is a new multitasking system. Called Split View, a drop-down menu at the top of the screen unlocks several multitasking, multiwindow options. The system seems much smoother than the current multiscreen option on iPad OS, which is clunky and hidden. With Split View a feature called Shelf makes it easy to switch between different screens and screen grouping.

A new column in Inc. argues that 14 years ago, Steve Jobs sent the most important email in the history of business — a one-sentence email to Bertrand Serlet, the company's senior vice president of Software Engineering, that's just recently been made public (through Apple's trial with Epic): It reveals a conversation about the things Apple needs to be able to accomplish in order to allow third-party apps on the iPhone. Until that point, the iPhone only ran 16 apps pre-installed on every device. Jobs had famously said told developers that if they wanted to create apps for the iPhone, they could make web apps that ran in Safari... Except web apps aren't the same as native apps, and users immediately set about finding ways to jailbreak their devices in order to get apps on them.

Apple had really no choice but to find a way to make it possible to develop apps through some kind of official SDK. Serlet lays out a series of considerations about protecting users, creating a development platform, and ensuring that the APIs needed are sustainable and documented. The list only has 4 things, but the point Serlet is trying to make is that it is important to Apple to "do it right this time, rather than rush a half-cooked story with no real support."

Steve Jobs' reply was only one sentence long: "Sure, as long as we can roll it all out at Macworld on Jan 15, 2008."

That's it. That's the entire response.

Serlet's email is dated October 2, 2007. That means Jobs was giving him just over three months... Three months to do what the software engineer no doubt believed were critical steps if Apple was going to support apps on a platform that would eventually grow to over 1 billion devices worldwide and become one of the most valuable businesses of all time. As if that wasn't enough pressure, two weeks later, on October 17, Jobs publicly told developers that there would be an SDK available by February of 2008. It turns out it would actually be made available in March, and the App Store would launch later in July of that year.

At the time, Apple's market cap was around $150 billion. Today, it's more than $2 trillion, largely based on the success of the iPhone, which is based — at least in part — on the success of the App Store. For that reason alone, I think it's fair to say — in hindsight — that one-sentence reply has no doubt proven to be the most important email in the history of business.

An anonymous reader writes: This week the GitHub Yearbook went live, with 6794 "graduates" featured on a special web page showcasing "any student who has graduated, or plans to graduate, in 2021... This includes bootcamps, code camps, high school graduates, Master's graduates, Ph. D. Graduates, etc." (Students were added by submitting a pull request — as long as they'd also signed up for the GitHub Student Developer Pack.) The first 5,000 graduates received "swag," including a custom holographic card with their GitHub stats.

But Saturday sees a special ceremony where these students will "walk" the stage at GitHub Graduation (starting at 9 a.m. PST). "We'll be hearing from special guests, giving out exclusive swag, and highlighting student stories and projects from around the world," explains the event's web page.

Calling it "a day to celebrate our craft, our community, and how technology moves the world forward," a post on GitHub's blog invites viewers "to welcome them to a global community of innovative thinkers and impactful builders." It acknowledges the special challenges of 2021, saying "This year, thousands of students from around the world came together and redefined the world we live in, how we learn, and how we move forward," adding "We are honored to be part of the experience and eager to celebrate this milestone...."

"During a devastating year, these graduates shined a light on what is possible. We saw project after project showcasing not only their skills, but also their passion and perseverance. This class is unstoppable!"

Marco Arment, a widely respected programmer, app developer and commentator on Apple, has analyzed Apple's arguments and its thinking as officially portrayed in its lawsuit against Epic. He writes: Apple's leaders continue to deny developers deny developers of two obvious truths: 1. That our apps provide substantial value to iOS beyond the purchase commissions collected by Apple.
2. That any portion of our customers came to our apps from our own marketing or reputation, rather than the App Store.

For Apple to continue to deny these is dishonest, factually wrong, and extremely insulting -- not only to our efforts, but to the intelligence of all Apple developers and customers. This isn't about the 30%, or the 15%, or the prohibition of other payment systems, or the rules against telling our customers about our websites, or Apple's many other restrictions. (Not today, at least.) It's about what Apple's leadership thinks of us and our work. It isn't the App Store's responsibility to the rest of Apple to "pay its way" by leveraging hefty fees on certain types of transactions. Modern society has come to rely so heavily on mobile apps that any phone manufacturer must ensure that such a healthy ecosystem exists as table stakes for anyone to buy their phones. Without our apps, the iPhone has little value to most of its customers today.

If Apple wishes to continue advancing bizarre corporate-accounting arguments, the massive profits from the hardware business are what therefore truly "pay the way" of the App Store, public APIs, developer tools, and other app-development resources, just as the hardware profits must fund the development of Apple's own hardware, software, and services that make the iPhone appeal to customers. The forced App Store commissions, annual developer fees, and App Store Search Ads income are all just gravy. The "way" is already paid by the hardware -- but Apple uses their position of power to double-dip. And that's just business. Apple's a lot of things, and "generous" isn't one. But to bully and gaslight developers into thinking that we need to be kissing Apple's feet for permitting us to add billions of dollars of value to their platform is not only greedy, stingy, and morally reprehensible, but deeply insulting.

Google says it will scan the extensions users install in their Chrome browsers and warn users if they are adding an extension from a new or untrusted developer. From a report: The new extension scanning feature will be part of a Google security feature called Enhanced Safe Browsing, which Google added to Chrome in May last year. Google says trusted developers are those who adhere to the Chrome Web Store Developer Program Policies. "For new developers, it will take at least a few months of respecting these conditions to become trusted," the browser maker said in a blog post today. Currently, Google said that almost 75% of all extensions hosted on the Chrome Web Store were developed by "trusted developers." For the rest, the browser will show an alert like the one below if users had enabled Enhanced Safe Browsing in their Chrome settings page.