Tech Brew Ride Home - Tue. 07/09 - Apple Culls The MacBook Herd

Episode Date: July 9, 2019

Apple culls the MacBook herd, YouTube returns to FireTV, a weird zero day exploit in Zoom’s video conferencing app, Elon Musk shakes up his autopilot team, and Stranger Things 3 breaks records for Netflix. Sponsors: SVB.com/next Metalab.co YouTube.com/jacksontaylortv Links: Apple stops selling 12-inch MacBook and previous generation MacBook Air (9to5Mac) YouTube is back on the Fire TV, and Prime Video launches on Chromecast starting today (The Verge) Instagram will test a feature that allows users to shadow ban their bullies (The Verge) Inside Instagram's War on Bullying (Time) Zoom Zero Day: 4+ Million Webcams & maybe an RCE? Just get them to visit your website! (InfoSec Write-Ups) More than 1,000 Android apps harvest data even after you deny permissions (CNET) Frustrated Musk Shakes Up Autopilot Team (The Information) If you'll pay more, new Uber Comfort offers Quiet Rides (TechCrunch) Spotify Lite is now officially out for 36 markets around the world (Engadget) ‘Stranger Things 3’ Breaks Netflix Four-Day Viewing Record, Streamer Says (Deadline) 'Stranger Things 3' has been seen by over 40 million Netflix accounts (Engadget) Learn more about your ad choices. Visit megaphone.fm/adchoices

Welcome to the TechBeam ride home for Tuesday, July 9th, 2019. I'm Brian McCullough today. Apple calls the MacBook heard. YouTube returns to Fire TV. A weird zero-day exploit in Zoom's video conferencing app. Elon Musk shakes up his autopilot team and Stranger Things 3 breaks records for Netflix. Here's what you miss today in the world of tech. Apple quietly updated its MacBook lineup today. And the notable additions are the MacBook Air gets Apple's true tone display. and a $100 price drop. The air now starts at $1,99 or $999 for students, but it's still got Intel's dual-core 8th-gen I-5 chips. No upgrade there. The base model MacBook Pro gets the biggest overhaul, quote, instead of the 2.3 gigahertz dual-core 7th-gen core I-5 chip set that Apple has offered for over two years,

the new entry-level MacBook Pro now offers a 1.4 gigahertz quad-core 8th gen core i5 chip which can boost up to 3.9 gigahertz. Sadly, the biggest flaw of the original MacBook escape remains. Unlike the priceier 13 inch MacBook Pro, it still only offers two USBC ports, not four, end quote. Pricing begins at $1,299 for the 128 gigabyte SSD model and $1,49 for the 256 gigabyte model. But the real news is what's been taken away, actually. The 12-inch non-pro MacBook, gone. The original MacBook Air, which had hung around despite the air updates, gone. And the MacBook Escape also gone, which means if you want a MacBook Pro without the touchbar,

you are now officially out of luck. And YouTube has officially returned to the Fire TV, and Amazon's Prime Video is launching today with support for Chromecast and other Android TV devices. So, as Hyam Gartenberg says in The Verge, Amazon and Google have basically made up. You might recall that Google pulled the YouTube app almost a year and a half ago and Amazon retaliated, quote, notably absent from the announcement is Amazon's Echo Show devices, which were excluded when Amazon and Google first announced the deal earlier this year and still no official YouTube app. Google's own smart displays like the Home Hub and recently released Nest Hub Max do,

have YouTube support. On the Google half of things, Amazon's Prime Video app for iOS and Android, now will work with Chromecast devices allowing users to stream videos from those apps directly to their TVs. And the Prime Video app for Android TV, which was previously limited to only a few devices like the Nvidia Shield, is getting much wider rollout with the new app set to be available to download on compatible hardware today, end quote. Instagram is rolling out warnings to users who are about to post an affiliate. offensive comment, leveraging AI to flag comments on their platform and ask the commenter if they really want to go ahead with posting what they were about to post.

Quoting the Verge, users will be given the opportunity to undo their comment, and Instagram says that during tests, it encouraged, quote, some people to reflect and undo what they were writing. Clearly that some stat isn't concrete, and presumably people posting offensive content know that they're doing so, but maybe they'll take a second to reconsider what they're saying, end quote. But at the same time, Instagram is testing a feature that will essentially empower you to shadow ban someone from commenting on your posts. In the test, you as an account holder can restrict another user so that when they comment on something you post, it will only be visible to them, not to you or to others. It will also essentially make you invisible to that restricted user, hiding you when you're online so they can't actively harass you.

Instagram head Adam Maseri admitted to time that the new features will try to walk a delicate, tightrope between combating bullying and possibly infringing on free speech. I do worry that if we're not careful, we might overstep, Maseri says. But he says nothing, including growth, trumps the need to keep the platform civil. Quote, we will make decisions that mean people use Instagram less, he tells time, if it keeps people more safe, end quote. A researcher discovered a zero-day day. exploit in Zoom's Mac client, and this is a wild one. It lets any malicious site force a user onto a Zoom call with video enabled without the user's permission, including Jonathan Leitzuch, who discovered the vulnerability. This vulnerability leverages the amazingly simple Zoom feature where you can just

send anyone a meeting link, and when they open that link in their browser, their Zoom client is magically opened on their local machine. It was curious about how this amazing bit of functionality was implemented and how it had been implemented securely. Come to find out, it really hadn't been implemented securely. Nor can I figure out a good way to do this that doesn't require an additional bit of user interaction to be secure, end quote. It's actually sort of jaw-dropping how they implemented this, quoting Owen Williams. Perhaps the most dastardly part of this discovery, however, is that the web server zoom drops on a Mac is not removed when uninstalling. It stays active in the background secretly. That server magically reinstalls the software without user interaction

if you ever click on a Zoom link, which in my mind is the definition of a virus. Removing that backdoor is non-trivial, requiring a terminal command to get rid of it, which is beyond most users' capabilities. Even scarier, it's still unclear what the server actually does and whether or not it's collecting other data behind the scenes, a concern the researcher mentions as well. Zoom has millions of users, So dropping a quiet, undocumented back door on their computers is unacceptable and a massive liability in the long term. I'd be surprised if we don't see Apple reprimand them or revoke their security certificate in the coming weeks. This is the first time we're learning about the existence of this secret server and Zoom continues to stand by the fact that they use this method. If I were them, I'd be afraid of the next researcher not being as friendly, but rather exploiting it at scale.

Sounds like the perfect way into a few million business devices if you ask me, end quote. and a follow-up, quoting ZDNet. Zoom now signs the request to the server, but Leitzsch maintains this is not enough to be secure. Thanks to the report, Leesuch said, Zoom also removed the ability for a call host to automatically have participants join with video enabled. Zoom did end up patching this vulnerability,

but all they did was prevent the attacker from turning on the user's video camera. They did not disable the ability for an attacker to forcibly joined to a call anyone visiting a malicious site, the security researcher wrote. Zoom has defended its use of a local web server on Macs as a, quote, workaround to changes that were introduced in Safari 12. The company said in a statement that it felt running a local server in the background was

a, quote, legitimate solution to a poor user experience enabling our users to have seamless, one-click to join meetings, which is our key product differentiator, end quote. And researchers have discovered more than 1,300 Android apps that were gouted. gathering location data even when location permissions were denied. Google says it will address this issue in Android Q later this year. Quote, the study looked at more than 88,000 apps from the Google Play Store tracking how data transferred from the apps when they were denied permissions.

The 1,325 apps that violated permissions on Android used workarounds hidden in its code that would take personal data from sources like Wi-Fi connections and metadata stored in photos. Some apps were relying on other apps that were granted permission to look at personal data, piggybacking off their access to gather phone identifiers like your IMEI number. These apps would read through unprotected files on a device's SD card and harvest data they didn't have permission to access.

So if you let other apps access personal data and they stored it in a folder on the SD card, those spying apps would be able to take that information. Other apps were gathering location data by connecting to your Wi-Fi network and figuring out the router's Mac address. They found this on apps that functioned as smart remote controls. which didn't need your location information to function, end quote. Apparently, Elon Musk is frustrated with the progress, or perhaps lack thereof, of Tesla's autopilot semi-autonomous driving feature,

because several key Tesla engineering managers working on the feature have left the company, quoting the information. Musk told some employees he was unhappy with the progress in developing fully automated driving capabilities, according to one current and one former Tesla employee who have been involved in the effort. He is also upset that some team members have told him they can't meet the timelines he is set for developing the technology, they said. At least 11 members of the software team are close to 10% of the total group, including some longtime members, departed in the past few months, according to multiple people with knowledge of the situation.

Several of the remaining managers are now working directly with Mr. Musk. These departures follow Mr. Musk's removal of the autopilot group's leader Stuart Bowers around the start of May, a move first reported by the website Electrek, which also reported on some of the other exits. Mr. Musk also elevated other people within the autopilot team as a part of a broader shakeup, end quote. Uber today launched the Uber comfort tier in 43 cities and smaller states in the U.S. Basically, pay a little more,

and you can ride in a newer, mid-sized car with more leg room, higher-rated drivers, and the ability to tweak rider preferences, like requesting a specific climate temperature, and also no talking from the driver, quoting Josh Constine. Before users hail an Uber comfort car, they can request quiet preferred, happy to chat, or leave the default of no preference, as well as warmer or colder temperature settings.

These rider preferences launched in May as part of Uber's Pricier-Blacken SUV cars, alongside a way to request help with luggage, but now they're becoming more affordable. The move allows Uber to charge slightly more for better vehicles, and higher-rated drivers that used to be lumped in with its budget Uber X tier. This also lets Uber compensate drivers better if they're willing to forego the small talk or crank the air conditioning. Quote, Uber comfort should result in fares for drivers that are at least 20% higher than Uber X, not including surge or promotions, for a tip with the same time and distance, an Uber spokesperson told Constine.

Some critics consider the quiet ride button an affront to the dignity of Uber's contractors, saying it makes them act like robots when their job will soon be threatened by self-driving vehicles. But others just see it as an enhanced customer service that's reasonable to request, given writers are paying for a driver's professional services, end quote. Spotify Light, which requires only 10 megabytes of storage, is now available on Android in 35 countries across Asia, Latin America, the Middle East, Africa, and Canada. Quoting, Engadgett, Spotify has been testing a smaller, lighter version of its app since mid-2018 in hopes of expanding its reach to regions where internet connections are slow,

and people tend to use low-to-mid-range devices. Now that app is finally ready for primetime. Spotify Lite is now officially available on Google Play for 36 markets with more to follow. The Light app is pretty, well, light on features, though it will still give users a way to search for artists and songs, save and share them, discover new music and enjoy playlists. They'll also be able to use it with either a free or premium account, and they can use it alongside the main app for times when their mobile internet is spotty.

Perhaps, more importantly, for those who don't have unlimited data plans, the app allows users to set a limit for how much data it can consume. It will then notify users when they've reached that limit, end quote. Finally today, Netflix says, Stranger Things Season 3 has been viewed by 4.7 million households since its July 4th launch, a new record for a Netflix film or series. Stranger Things 3 is breaking Netflix records, the official Netflix account tweeted Monday. 40.7 million household accounts have been watching the show since its July 4th global launch,

more than any other film or series in its first four days, and 18.2 million have already finished the entire season, end quote. Quoting from deadline, when season two of Stranger Things debuted in October 2017, Nielsen, which had said two weeks earlier that it would start measuring Netflix viewership on TVs, said the first episode average 15.8 million U.S. viewers and nearly 11 million in the demo viewing on the TV. The Measurement Service also said all of the nine new episodes average 4 million viewers and 3 million in the demo saying a, quote, significant viewing event occurred, end quote. And quoting in Gadget, the company treats a view as anyone having watched at least 70% of an episode or movie. It didn't break down the audience by region. The view count isn't completely surprising, giving the sheer amount.

of hype involved, but it's still a major feat. Netflix broke its movie record in June when murder mystery garnered nearly 30.9 million views in three days. Stranger Things is well past that. And makes earlier TV shows seem downright modest. It took Umbrella Academy, one of Netflix's bigger series, a month to reach 45 million account views, end quote. That's all for today.

I've been Brian McCullough, as always. You might have heard that Ross Perrault died today at the age of 89. Apparently, the last public interview he ever gave was with the Dallas Morning News, and he ended that interview saying this, quote, Texas born, Texas bread, when I die, I'll be Texas dead. Ha! RIP, Mr. Perrault, I can't think of a more on-brand final statement for the man. You did it.

You must be a huge tech fan because you made it all the way to the end of this tech podcast. If you are a tech fan and you're looking to check, out even more tech content, be sure to search for Jackson Taylor Tech videos on YouTube, or visit YouTube.com forward slash Jackson Taylor TV. For technology videos a little shorter than this podcast, but with a big focus on one topic each video. Videos on the channel discuss consumer tech products as well as rumors of upcoming products, roundups of big tech news events like Johnny Ives' departure or the release of Tesla vehicles, and even some content that may fall a little outside of the tech categories, such as questioning why some products fail and others succeed.

New videos air Monday, Wednesday and Friday at 5.30 p.m. Eastern Time. So, right after the tech meme right home, remember to search for Jackson Taylor Tech videos or visit YouTube.com forward slash Jackson Taylor TV. And hit the subscribe button as well as the notification bell to get even more tech content every single week.