VioletPixel

šŸ‘‚ Features that Shouldn't Exist: Live Rewind and Siri Recap

Apple recently announced Audio Intelligence on Apple Watch, an umbrella term for several audio- and AI-related features. Some of these features provide clear benefits, utility, and have little to no downside, like Sound Recognition:

Sound Recognition detects important sounds like sirens, alarms, and doorbells, and notifies you ā€” even when your iPhone is not with you. This is especially useful for people who are deaf or hard of hearing.

Sound Recognition is new to Apple Watch, but has been available on iPhone since iOS 14. HomePods also have the ability to send an alert when they hear smoke and carbon monoxide alarms go off. Great, useful stuff that even has the potential to save lives.

Music Recognition is another nice feature:

Music Recognition with Shazam automatically detects the song playing in the background and displays the title and artist name in the Smart Stack, all without tapping the widget.

It's not going to save lives, but it's nice to have. Shazam has existed in various forms for many years, both before and after Apple bought it, and the new implementation on Apple Watch sounds handy and convenient.

The new Live Rewind and Siri Recap features, on the other hand, aren't clear-cut wins. These features do provide clear benefits and utility, but they also come with significant downsides.

Here's Apple overview of Live Rewind:

Live RewindĀ¹ recalls what was just said in the last 15 seconds by showing a text snippet on your Apple Watch when you double-press the Digital Crown, so you can catch something you missed or are less familiar with. You can ask Siri about the content of the snippet or simply save it to the Siri app.

And Siri Recap:

Siri RecapĀ¹ ambiently takes notes on your conversations throughout your day and creates high-level Apple Intelligenceā€“generated summaries that you can use later to jog your memory, so you can stay present in the moment. Your summaries auto-delete after 7 days if you choose not to save them.

The Ā¹ in both of those overviews points to this footnote:

  1. Siri Recap summaries and Live Rewind text snippets are generated using Apple Intelligence and may be incomplete or inaccurate. Important details may be omitted, misunderstood, or summarized incorrectly. When accuracy matters, confirm important information with the people involved or another reliable source. Siri Recap is designed to limit certain potentially sensitive content, such as financial information, government-assigned identifiers, and more, but automated filtering may not remove all sensitive information.

When you look at the more detailed privacy overview Apple provides for Audio Intelligence, it's clear they put a lot of effort into making these features very secure and private. They even created special hardware for it: the Secure Exclave. Audio captured by Apple Watch is only processed in the Secure Exclaves on Apple Watch and its paired iPhone, and that audio is not accessible to other parts of the system on either device. For Siri Recap, full transcriptions are condensed on-device, and only the condensed version is sent to Apple's Private Cloud Compute for summarization. Everything is end-to-end encrypted, including on-device encryption with periodically rotating encryption keys.

That's all great, and demonstrates a level of effort around privacy that no other company I'm aware of would even come close to if they implemented something similar. Unfortunately, it's not enough.

Apple Watch is a very popular product. Apple sells millions of them every year, and if you're looking for them when you're out and about you'll probably see several being worn by those around you. That kind of ubiquity imparts a certain social and civil responsibility on Apple, including the responsibility to not turn these devices into surveillance equipment.

It doesn't matter that everything is encrypted, secure, and only accessible by the Apple Watch's owner. What matters is that this kind of surveillance, at this scale, shouldn't be something the only big privacy-focused company in the tech industry should be offering to its users. Apple should be setting a better example for their peers and the world at large.

To put it another way: a device commonly worn by a significant fraction of the population should not be able to listen with the intent to create a recordā€”be it a verbatim or summarized recordā€”without providing the following:

  1. Clear indications to everyone in listening range that they're being listened to
  2. A reasonable way for them to opt-out of being listened to

Neither of these features are provided by Live Rewind or Siri Recap. Live Rewind comes closest; it emits an audible and visual indicator, but only when it's used:

How Live Rewind respects those around you
When activated, an audible chime plays from the speaker on your Apple Watch, even if your Apple Watch is on silent or you have headphones connected. A full-display animation and microphone indicator appear on the Apple Watch display, and a distinct double-press gesture is required to activate Live Rewind. This is to alert those nearby that the feature has been activated.

This only lets people know what they said was transcribed after the fact. It doesn't provide a way to opt-out of the transcription happening in the first place.

Letting people know it happened after the fact is better than nothing, but Siri Recap doesn't even do that:

How Siri Recap respects those around you
By design, Siri Recap does not create a recording, does not produce a verbatim transcript, and does not identify and attribute speakers. The output is a brief, high-level summary, comparable to notes a person might write after a conversation. There is no audible signal because no raw audio is retained, and there is no way to reconstruct the original audio from a Siri Recap or share raw audio with anyone.

While Siri Recap doesn't create a recording, it does create a record. It's a condensed, summarized record, but a record nonetheless. There's no way for those being listened to to know when that record is being made, how accurate that record is, and that's no way for them to opt-out.

The socially responsible way to implement Live Rewind and Siri Recap would include continuous visual and audible indicators when a device is listening. Those indicators would explain, via text on the screen and a clear speaking voice, that the device is listening. These indicators would also provide a way for everyone who sees or hears them to easily opt-out of being recorded.

For example, when Apple Watch is listening, the display could pulse red and have a, "I'm listening. If you don't want me to listen, say 'stop listening' at any time." And, because Apple Watch is often concealed by a sleeve, body, table, or other object, it should also audibly announce the same message periodically while it's listening.

The counterargument, of course, is that constant visual and repeating audible indicators as described above would be too annoying and impractical to implement. And that's true, they would.

The problem is that when Apple realized that impractical measuresā€”like those described aboveā€”are the only way to responsibly implement features like Live Rewind and Siri Recap, they didn't abort. Instead, Apple built those features anyway, and decided or figured out a way to justify too many social and ethical compromises. Apple decided it was okay to compromise on consent. Apple decided it was okay to limit opt-in and opt-out privileges to the owner of the device that's listening. Apple decided it's okay for the people being listened to by its device to not have opt-out or opt-in privileges (many of whom are, ironically, probably also Apple users).

They key difference between Live Rewind and Siri Recap versus other listening features like Sound Recognition, Music Recognition, and devices listening for wake words or phrases like, "Siri," or "Hey, Siri," is the intent to create a record of what happened, of what was said. Knowing a fire alarm went off, that a particular song was played, or that a wake word was used when no other details are recorded are very different applications of listening technology than writing full transcripts or producing detailed summaries.

Again, it doesn't matter if what's produced and saved is a verbatim recording, full transcript, or a summary. A detailed record of some kind is still being made, and it's being made surreptitiously by design.

If you're thinking that your own memory, in its own way, records and summarizes everything you experience, how is that different than Siri Recap? Apple is thinking along the same lines in the quote I shared above. Here it is again with emphasis added:

How Siri Recap respects those around you
By design, Siri Recap does not create a recording, does not produce a verbatim transcript, and does not identify and attribute speakers. The output is a brief, high-level summary, comparable to notes a person might write after a conversation. There is no audible signal because no raw audio is retained, and there is no way to reconstruct the original audio from a Siri Recap or share raw audio with anyone.

The implied reasoning is that Live Rewind and Siri Recap are nothing more than technological extensions meant to augment our inherent human functionality. They're designed in a way that lets them go just a little bit further than what we'd be capable of on our own. Live Rewind lets you peek back at the last 15 seconds if you were distracted. Siri Recap lets you stay focused instead of trying to manually take notes at the same time. So what's wrong with that?

There are two problems: the lack of disclosure and the precedent these features set.

It's one thing to know you're being listened to by a person, but it's another thing to have a device listening. People inherently know how other people work. We have millions of years of evolution to draw on when dealing with other people. It's also obvious when someone is or isn't taking notes about what's being said.

On the other hand, not everyone knows how Apple Watch works, or what its capabilities are. How much better or worse can Apple Watch microphones hear than a human? How will that change in the next model, or the one after that? Is the person sitting at the next table wearing the Apple Watch that listens all the time or an older model? How much of what was said will be dropped when the audio is condensed, or what will be incorrectly represented in the transcript or summary that's produced? What happens if Private Cloud Compute isn't as secure and impenetrable as Apple claims it is?

The lack of disclosure of the device's capabilities, and when it's listening, are huge omissions. By making these features available, Apple is essentially putting the onus on the owner of every Apple Watch with these capabilities to use them responsibly, let everyone around them know their device is listening, and provide them the option to opt-out. That's irresponsible because doing those things is impractical for the same reason the persistent visual and audible alerts Apple could have built are impractical. If you have Siri Recap enabled you're not going to announce it to the crowd every time you do things like enter a store or step on an airplane.

Then there's the precedent these features set. Appleā€”who again is the only big privacy-focused company in techā€”is setting a really bad precedent at a really bad time by creating and releasing always-listening-to-everyone features like these. The existence of these features helps normalize persistent surveillance at exactly the point in our history when we should be doing the exact opposite.

Other tech companies certainly don't need permission or approval from Apple to build always-listening-or-watching features, but the existence of Live Rewind and Siri Recap make it easier for them to build and sell similar features. The potential customers of those companies will be more accustomed to and accepting of these kinds of features if Apple has them, too. This goes double for surveillance-focused companies and other surveillance apparatuses, like governments. Many of those entities want as many people as possible to be as comfortable as possible with constant surveillance, to the detriment of the public at large. A world where most people are used to and accepting of persistent surveillance is a very dangerous world to live in. By releasing Live Rewind and Siri Recap, Apple is helping us all take one big collective step closer to that world.

The other surprising thing about these features are the risks Apple is willing to take to implement them. One scenario is that there's a security issue or data breach surrounding these features, where sensitive transcripts or summaries end up in nefarious hands. I don't think that's very likely, but it's certainly possible.

A more likely scenario is that these features, once more people become aware of their existence, tarnish the reputation of Apple Watch and Apple itself. Today, most people who take note of someone wearing an Apple Watch probably do nothing more than think things like, "that's a cool band," or, "I see those everywhere, maybe I should learn more about them." In a world where a news story explains that new Apple Watches are listening to and summarizing everything they hear, people will start thinking, "I wonder if that thing is recording me right now?" Yes, they'll technically be wrong about it "recording" them, but that won't matter. What matters is their perception, and what they'll perceive is that they're being surveilled, and that Apple Watch is creepy. And they'll be right on both counts.

Sometimes risks are worth taking, but it surprises me that Apple is willing to risk so much potential reputational harmā€”both for a specific product line and for their privacy-focused image as a wholeā€”because they've decided that 15-second transcripts and LLM-generated summaries of your day that "may be incomplete or inaccurate" are somehow worth it.

šŸ„ Clarus is Back!

Benjamin Mayo at 9to5 Mac:

Many have complained that Apple design has been sapped of some of its trademark whimsy in recent years. Well, hereā€™s the latest example of how the tides seem to be changing.

Buried in the Settings app on iOS 27, Apple has hidden an easter egg that hails back from classic Mac OS; Clarus the Dogcow. Hereā€™s how to trigger it ā€¦

This also works in macOS 27, and presumably iPadOS 27.

Moof!

šŸ“± iPhone Duo: Initial Thoughts

Even though I keep an eye on Apple rumors, a lot about the iPhone Duo announcement surprised me. It has fewer compromises than I though it would, it's more compelling than expected, and it stands out as a joyful and thoughtfully-crafted product against the dreary backdrop of the tech industry and world in general right now.

Compromises

Compromises are non-negotiable in the world of folding phones, and while iPhone Duo is no exception, it concedes very little. While watching the event I was disappointed, but not surprised, when they didn't mention MagSafe. I figured dropping MagSafe was one of the inevitable compromises, but it turns out MagSafe is alive and well on iPhone Duo. I also thought the displays might suffer in areas like resolution, refresh rate, or color depth, but both the interior and exterior displays seem to be top-notch. They both have 120Hz refresh rates, P3 color, and pixel density at 430 DPI and 460 DPI, respectively.

So what compromises were made?

There's no Face ID, but there is Touch ID and unlock with Apple Watch. That's not a problem for me, and in fact it might be a boon. Face ID requires me to hold my iPhone up high and at a slightly awkward angle when I'm wearing a mask (my partner and I have been masking since the pandemic began), but Touch ID won't have that issue.

Compared to the iPhone Pro lineup the main cameras aren't as good, but I can't complain about the two-lens system on iPhone Duo. If you need to choose just two primary cameras, a 26mm main and 13mm ultra-wide are the ones I'd pick. Not having a telephoto means you have to zoom with your feet, but that's better than not having the ability to take macro and wide-angle shots due to a lack of an ultra-wide camera (which is one of the main reasons I returned my iPhone Air in favor of the iPhone 17 Pro).

The two selfie cameras on iPhone Duo are a mixed bag. The 12MP Center Stage camera on the exterior display is solid. I love that camera on my iPhone 17 Pro, and I'm happy to see the same camera included on iPhone Duo. The camera under the internal display is, on the other hand, not that great. It looks like it will do in a pinch, but the video I've seen from it looks muddy and very webcam-like. Apple hasn't provided a lot of technical details about this under-display camera beyond the ʒ/1.8 aperture and that it will record 1080p video, and I'm guessing the reason why is that those specs just aren't that great.

My biggest concern with the under-display camera isn't the quality of the images it captures, though, but the combination of how visible it will be when not in use and its physical location. In a lot of the hands-on videos it looks pretty visible in a lot of shots, but that doesn't match up with people at the event saying it's almost completely invisible. I'm guessing (hoping) the camera is just more visible in video than it is to the naked eye, but time will tell. If the camera is visible when not in use, I'm worried it will be a constant and awkward annoyance due to its physical location right at the top of, and slightly overlapping(!), the first row of icons on the Home Screen.

The other minor compromise that stands out for me is the lack of a LiDAR sensor. I use my current iPhone 17 Pro to measure the length of things all the time, and without the LiDAR sensor those measurements probably won't be as accurate.

Joy and thoughtfulness

The software for iPhone Duo looks surprisingly polished, and feels more like a mature 2.0 than an initial release for a new form factor. There are so many thoughtful details and nice touches, from the animation when opening and closing the device to the numerous new ways you can use the camera and everything in between. It clearly has more utility than a traditional iPhone, but it also looks like a lot more fun, too.

Camera features like Duo Preview (where you can see what's being captured on the outer display when the device is open) and Duo FaceTime (where people can see multiple camera feeds on a call) are great, but Kid Cue (where Snoopy and friends entertain kids to get their attention) is the one that makes you smile no matter how old you are.

The way Apple implemented split screen with two apps side-by-side feels exactly right. The gestures look intuitive and natural, and it feels right that each app takes up exactly half the display; being able to adjust the split ratio seems too fiddly on a device this size (but take that with a big grain of salt; I have yet to see or handle an iPhone Duo in person).

Some other thoughtful software touches that stand out to me are the new combined battery, signal strength, and connectivity icon and the expansion of Standby mode (which now finally works even when you're not charging). Standby goes beyond just the software, though, given how it interacts with the hinge of the device, with different modes depending on how far iPhone Duo is open and what orientation it's in.

The hinge and the Pencil

I'm really glad Apple is taking full advantage of the hinge at every angle. Tent mode for Standby is great. The tiny book and laptop modes are delightful and look genuinely useful. The fact that you can place the hinge at any angle to act as a stand, get the right camera angle, or hold it in a way that's most comfortable for you is a welcome treat.

Diving deeper into the hardware, I'm shocked iPhone Duo has an IP68 rating for water and dust resistance. I'm also surprised to see Apple Pencil compatibility; Apple seems really confident about the durability of this device in all kinds of wet, dusty, and stabing-the-screen-with-a-Pencil conditions.

Regarding Apple Pencil support, I feel like we don't have the full story yet. Currently, Apple says iPhone Duo is compatible with only the USB-C Apple Pencil which has very few features compared to the Apple Pencil Pro. That's out of necessity; without the magnetic connection hardware, there's no way for the Apple Pencil Pro to pair or charge with iPhone Duo.

But why is Apple Pencil support for iPhone Duo coming later this year? And why weren't there any Apple Pencils at the hands-on event? Even if the feature is coming later this year, why not let at least some of the press use an early beta version?

Here's my wild theory: there's a new Apple Pencil coming in October alongside the rumored OLED iPad mini, and that new Apple Pencil will not just work with the iPhone Duo, but will clearly be the one best suited for it. What I'm hoping for is a slightly smaller (shorter, more pocketable) Apple Pencil with pressure sensitivity that works with some kind of inkwell-like USB-C charging/pairing base.

Wishful thinking? Maybe, but the iPhone Duo Apple Pencil vibes are off. This device would be a killer sketchbook with apps like Linea Sketch and Procreate, or even just Apple's Notes app, but it can only really excel with additional Pencil hardware features like pressure sensitivity. The USB-C Apple Pencil only supports tilt, and while that's better than nothing, but my gut tells me there's another shoe that hasn't dropped yet.

Cases

With the exception of the original iPhone and iPhone 3G, I've almost always used a case with my iPhones, but I don't think I would want a case for the iPhone Duo. There might be some interesting and innovative third-party options, but Apple's cases don't look appealing to me.

The iPhone Duo Folio is the most appealingā€”especially the way it expands to cover the hinge when closedā€”but I don't think I want something to cover the outer display. That display has so much utility regardless of the phone being open or closed it seems like a cover would get in the way more often than not. Maybe if your primary use case is tiny laptop mode it makes sense, but it's not for me. I also don't think the kickstand is of much utility given the iPhone Duo can already stand on its own in multiple ways.

The iPhone Duo Case (which could use a better name) looks too bulky, and it doesn't cover or protect the hinge in any way. It sounds like it's made of a lightweight polycarbonate material and will probably be a fine choice for a lot of people, but Ceramic Shield 2 has proven to be pretty amazing, and Apple hasn't exaggerated the durability claims of their devices, so I don't feel a need to add a case for protection.

The main reason I'd want a case on the iPhone Duo is to make it more comfortable to hold, but I don't see a case helping much in that regard. On top of that, the iPhone Duo gives me the strongest "don't put a case on me" vibes I've had since the iPhone 5c.

Unanswered questions

There are, of course, many open questions. How does the display look and feel in person? How will the hinge and display hold up over time? How practical is one-handed use given this slightly-smaller-than-a-passport-when-closed form factor? How long will it take to get used to the volume buttons being on the top?

One big question I had was around battery life, but I'm not too worried after seeing the battery life of the iPhone 18 Pro lineup relative to their battery capacity. It seems like there are significant efficiency gains with the 2nm A20 Pro and C2 modem chips, so I don't think battery life in the iPhone Duo will be anything outside of what Apple claims, and what they claim sounds fine to me. That said, it will be interesting to see how open vs. closed usage impacts battery life, especially when all of those displays are used simultaneously.

Miscellaneous thoughts

I'm really glad they went with the iPhone Duo name and not iPhone Ultra.

$1,999 is an expensive base price, but I thought it would be higher given... waves hands vaguely at everything. If it's as good, fun, and useful as it appearsā€”and if there's more to the Apple Pencil side of thingsā€”I think it's actually a decent value if you'll get real utility from the form factor and the additional functionality if provides.

This isn't specific to the iPhone Duo, but I was sad to find out that several of the new pro camera controls in iOS 27 are exclusive to the iPhone 18 Pro lineup. I was really looking forward to being able to lock white balance on my iPhone 17 Pro and the iPhone Duo, but no such luck. I can understand controls that require new hardware being absent, like the new aperture control for the iPhone 18 Pro, but existing devices have the ability to lock white balance as demonstrated by third-party camera apps, so why not give us the option in the built-in Camera app?

Overall I'm far more interested in iPhone Duo than I expected to be. If my theory about the Apple Pencil pans out I'll almost certainly get one. If not, I'll have a lot of thinking to do. In any case, the real decision will be made only after I get one in hand and spend a little time with it. One thing I'll need to keep firmly in mind when that happens: no matter how satisfying the hinge feels, and no matter how satisfying a snap it makes when I close it, it does not make sense to spend two grand on a fidget toy.

But, also, while it's not exactly Penny's computer bookā€”an object I've coveted since I first watched Inspector Gadget decades agoā€”it's not not that, either, if you know what I mean.

Finally, if I do end up getting an iPhone Duo, I hereby reserve the right to use the title "Don't Mind if I Duo" for a future blog post about it.

If you'd like to see and hear more about iPhone Duo I've found these videos to be especially interesting:

šŸ–¼ļø CleanShot 5.0

Version 5.0 of CleanShot, my favorite screen capture tool by a mile, has a new studio mode for capturing and editing screen recordings:

The new Studio Mode is all you need to turn a simple screen recording into a polished, professional video - all with the quality you expect from CleanShot.

There's a short teaser video and a longer seven-minute walkthrough that shows some thoughtful attention to detail.

I'm excited about this release, but I'm even more excited to see how they iterate and improve on this over time.

šŸ”¤ Modern Day Typographer

Elle Cordova is an absolute treasure. Her latest video is exceptionally delightful, even for her high standard.

šŸ“š Books Unbanned

Books Unbanned provides free library cards to teens in the United States so they can access ebooks and other digital resources:

Across the U.S., books are being removed from school and public library shelves at an unprecedented rateā€”especially titles that explore race, gender, history, identity, and lived experience. This censorship limits what teens can learn, question, and explore.

Books Unbanned responds to book censorship by making sure teens can read freely, even when access is restricted locally. The program supports teensā€™ rights to read what they choose, think critically, and engage with peers across the country who care about intellectual freedom.

šŸ“µ How to Turn Off Write with Siri

Short version

Go to Settings > Screen Time > Content & Privacy > Siri and turn off Writing Assistance.

Rambly version

I've been using the Mac and iOS 27 public betas for a while. They've been quite stable (though your mileage may vary) and there are many welcome improvements and refinements.

I have also, somewhat reluctantly, been using the new version of Siri. Functionally, it's a vast improvement over the previous version I was usingā€”I skipped the version that shipped with the '26 operating systemsā€”but that's not a significant accomplishment given how bad Siri was (and still is on my HomePods).

The big general downside of the new Siri is that it's heavily entangled with generative AI, and I want to keep my use of generative AI as close to zero as possible. Thankfully, I don't use Siri for much, and a lot of what I ask of it doesn't involve generative AI (home automation tasks, setting timers, simple math, etc.).

However, one specific downside of the new Siri is that there are now places on my iPhone and Mac where I see prompts to use aspects of Siri I'm not interested in. The most frequent and most visible of these are the "Write with Siri" prompts hovering around text fields and the onscreen keyboard.

The good news: you can turn off Siri's writing assistance features entirely. The setting probably isn't where you'd expect it to be, and I couldn't easily find it by searching inside Settings, but if you go to Settings > Screen Time > Content & Privacy > Siri you'll find a Writing Assistance setting you can turn off. This setting is in the same place on both iOS and macOS, and once it's off, all of those annoying "Write with Siri" prompts and UI elements will never bother you again.

There are some other adjacent settings in there that might also be of interest, such as Broad World Knowledge, Image Creation, and more.

Enjoy!

šŸ” Goodbye 1Password

Violet Blue at Threat Model:

Popular password manager 1Password has pledged $300,000 over three years in support of David Heinemeier Hansson's Linux distribution known as Omarchy, and is now a ā€œdistinguished corporate patronā€ of Omacom. What a nice brand partnership. As reported in Tuesday's Threat Model newsletter, DHH has called for the ethnic cleansing of Europe; he is also an antivaxer, a Covid "truther," a proponent of the "lab leak" conspiracy theory, an 'anti woke' weirdo, and is virulently anti-DEI on the grounds of diversity and equity initiatives being discriminatory against, well, you know.

In an internal Slack message leaked to press today 1Passwordā€™s Roustem Karimov defended DHH as being attacked for his views, while 1Password's CEO issued a blanket assurance to staff saying that the company doesn't "endorse hateful, dehumanizing, or exclusionary views, including those shared publicly by DHH.ā€ Ah, okay. That makes it better.

It's a great time to migrate to a new password manager, such as Proton Pass, Bitwarden, Keeper, Nord Pass, or even Apple's Password[s]. It's not an overly technical process so the good news is that you'll be able to move your family members off the service as well šŸ™ƒ

Violet provides links to various migration guides and additional details. Some things to note:

My original plan was to do a methodical export, but I realized there's no real need for that. Here's what I ended up doing:

  1. I checked my 1Password account and saw that it was paid for through June of next year, which seems like plenty of time for me to fall back to 1Password and retrieve any info if needed.
  2. I canceled by 1Password subscription.
  3. I exported a 1PUX file into an encrypted disk image as a just-in-case backup of everything that I don't actually plan to use unless I really need it.
  4. I exported a CSV file into the same encrypted disk image and imported that into Apple's Passwords.
  5. I uninstalled my 1Password browser extensions and removed the app from my dock and phone's home screen, but kept the app installed just in case.

Remember: the 1PUX and CSV exports aren't encrypted, so you'll need to be very careful with them. That's why I created an encrypted disk image for them.

My plan now is to go about my daily life and handle any issues that come up on an ad-hoc basis. Chances are most of what wasn't imported into Apple Passwords can be retrieved or reset via email-based recovery methods. If there is something that only exists in 1Password I can always yank it out using 1Password itself or by importing the 1PUX file into another app that supports what I need.

šŸ¤– Perils of Living In the Future

Stephanie K. Baer at The San Francisco Standard:

Glasses and dishes had been removed from kitchen cabinets and left elsewhere. The dishwasher, refrigerator, and washing machine were scratched. Dishwasher racks were bent and removed. Wooden furniture was scratched and stained. Bathroom tiles were chipped. A shoe rack and several pairs of shoes were missing from a locked bedroom closet.

[...]

In a lawsuit filed in San Francisco Superior Court Tuesday, Donovan alleges that employees of the Bot Company rented his home ā€œunder false pretensesā€ to conduct prototype testing on robots theyā€™re training to do household chores.

There are several other Airbnb hosts with similar experiences.

No flying cars, but we've got robots who come inside and ruin your stuff. What a timeline.

šŸ’¾ Backblaze, You Had One Job

Turns out Backblaze no longer backs up cloud filesā€”not even cloud files that are already downloaded and stored locally on your computer. Worse, they quietly shipped this change in a minor point update and hoped no one would notice:

Release Version 9.2.2.877

[...]

  • The Backup Client now excludes popular cloud storage providers from backup, including both mount points and cache directories. This prevents performance issues, excessive data usage, and unintended uploads from services like OneDrive, Google Drive, Dropbox, Box, iDrive, and others. This change aligns with Backblazeā€™s policy to back up only local and directly connected storage.

That "others" includes iCloud Drive, which is where I happen to keep most of my stuff. My important stuff. The stuff I trusted Backblaze to back up.

Backblaze also has a new banner on their old instructions that explain how to back up cloud files before this change, like the one on their instructions for iCloud Drive:

NOTE:
iCloud's most recent update prevents Backblaze from backing up files that iCloud synced.

To back up these files, download them to another local location where Backblaze can read them.

First, that's a baldfaced lie. There's no iCloud update that prevents Backblaze from backing up iCloud files. There's similar wording on their page for Google Drive:

Google Drive's most recent update prevents Backblaze from backing up files that Google Drive synced.

And their page for OneDrive:

OneDrive's most recent update prevents Backblaze from backing up files that OneDrive synced.

Bullshit. Apple, Google, and Microsoft didn't release updates at the same time across multiple operating systems that stopped Backblaze from backing up their cloud files. Backblaze made the choice to not back these files up. Backblaze made the choice to not tell their users about it outside the third bullet point in a minor point release. Backblaze made the choice to put these banners on their support articles and knew they were lying through their teeth by doing so. Other backup software has the ability to back up iCloud Drive and other cloud files just fine; there's nothing preventing Backblaze from doing the same.

Second, the content of the original instructions remains below these warnings, but none of it applies anymore. It would be easy for someone to skip over one of these warnings, read the instructions below, and think their cloud files are backed up when they're not. That's shameful and irresponsible.

When I learned about all this I checked Backblaze's file restore tool and confirmed all of my iCloud Drive files were no longer available to restore even though I explicitly configured iCloud Drive on my Mac to keep a full local copy of every file.

It's really important to have my iCloud Drive files backed up because sync is not a backup, as Backblaze's own blog explains:

While cloud sync is great for giving you 24/7 access to your files and enabling collaboration, it is not a trustworthy backup solution. Hereā€™s why:

  1. Tiered pricing discourages usage: Typically, these services have tiered pricing, meaning you pay for the amount of data you store with the service, or for tiers of data that you are allowed to use. Odds are, if you are using the free tier of a syncing service, you have a lot of data on your computer thatā€™s not syncing because youā€™re trying to manage your usage to avoid paying more.
  2. Data outside the service is vulnerable: Only the files, folders, or directories you put into the sync service are synced. The rest of the data on the computer is not.
  3. Data within the service can be deleted and lost forever: If there is data loss (letā€™s say you share a file with someone and they simply delete it), it may be lost forever. Sometimes these services have a version history feature, meaning youā€™re able to recover an earlier version of your work (before your friend or coworker deleted it).
  4. Data in sync services is vulnerable to ransomware and malware: If your computer is attacked by a bad actor and your sync service automatically synchronizes after the attack, your synced files are also corrupted. With a backup solution (discussed below) with longer version history, you can simply roll back to an earlier backup before the attack occurred.

We often hear people say, ā€œI donā€™t need backup. I use Dropbox.ā€ But, thatā€™s an assumption to leave in the past. Where sync services ensure that a certain set of data is the same across multiple devices, backup ensures that all or most of the data on one device is backed up elsewhere.

It's a huge problem when the backup service you trust to back up your files stops backing up your files. It's an even bigger problem when they make that change as quietly as possible, without letting you know, and lie about the reason why.

These changesā€”both the decision making process that led to it and the way it was implementedā€”have completely shattered my trust in Backblaze. Beyond their computer backup, we also used their B2 storage service to backup our NAS, but now I wouldn't trust them or any of their products or services with a single byte of my data or anyone else's.

I just finished removing Backblaze from all of our devices and deleting our Backblaze accounts. If you use Backblaze I strongly recommend you seek an alternative.

Our new backup solution

Our household has the following devices that need to be backed up:

The iPhones and iPads use the only practical backup solution for iOS and iPadOS devices: iCloud Backup.

Our five Macs back themselves up to our Synology NAS using Time Machine for local backups. After some extensive research, I decided on Arq backup software for our Macs and rsync.net for offsite backups.

Note that this approach isn't as easy to set up or maintain as Backblaze. If you're looking for a more-or-less drop in Backblaze replacement, I recommend you give the Arq Premium trial a try. I'm not affiliated with them in any way, but I used the trial quite a bit during my research and found it to be a solid option when I tested it.

Arq is available in two flavors. You can pay once for the backup software itself and use it with the cloud provider/server of your choice (including a a five-computer family pack license), or you can choose Arq Premium: a subscription service that includes the Arq software and Arq's own cloud backup storage bundled together (at time of writing Arq uses Google Cloud Storage behind the scenes and offers 1TB of storage for up to five computers).

Arq Premium was tempting, but ultimately I wanted a unified and more flexible offsite backup destination than Arq Premium or S3-compatible storage providers could offer (shout out to S3compare.io as a very useful tool during my research, though!). If I went with Arq Premium I wouldn't be able to backup our Synology to it, and would have had to find a separate offsite storage provider for it. That's more complexity and accounts than I want to juggle.

Regarding cloud files (the ones Backblaze says they can't back up), Arq backs them up just fine. On a Mac, cloud files that haven't been downloaded to your computer show up with a cloud icon next to them in the Finder. If you try to open or access a cloud file, the OS automatically downloads the file and, when the download is complete, the cloud icon is removed and the file opens normally.

Arq lets you decide how cloud files should be handled on each computer with a, 'When a dataless ("cloud-only") file is encountered,' setting that has three options:

The first two are self-explanatory. The third, "materialize," tells Arq to trigger a download of any cloud file it comes across so it can then back it up.

I, personally, have two Macs signed in to my iCloud account:

I keep a local copy of everything in iCloud Drive on my MacBook Air by keeping the "Optimize Mac Storage" setting in iCloud Drive's settings turned off. I also keep my entire photo library stored locally by setting the "Download Originals to this Mac" option enabled in Photos. Finally, Arq's "cloud-only" setting is set to "materialize" on my MacBook Air to make sure all of my cloud files are present and available for offsite backups.

On my MacBook Neo I have the opposite setup. That Mac has a smaller internal drive and is often offline, so I have iCloud Drive and Photos set to optimize my Neo's storage, which means things will only be downloaded locally when I need them. Likewise, in Arq, I have the "cloud-only" setting set to "ignore" because I know those cloud files are being backed up via my MacBook Air, so I don't need to worry about them on my Neo.

Beyond Macs, our Synology used to back up to Backblaze B2, but it now uses Hyper Backup to back up to our rsync.net server. One annoying thing about Hyper Backup when using it with an rsync server is that it doesn't support SSH key authentication. I was hoping to turn password authentication off on our rsync.net server for security reasons, but until Hyper Backup gets its act together I'm forced to leave it on (with an absurdly long password).

I chose rsync.net because they have an experts-only plan that works well for our needs. In exchange for cheaper storage, they provide a fully-functional rsync.net server with the following caveats:

That's all fine by me, but anyone who isn't technically inclined will probably consider some or all of that a dealbreaker.

One other important consideration when choosing our cloud backup provider was the physical location of the data. There were a few options that looked promising until I realized the only practical server location was in Seattle. We live in Portland, and if the big one hits I want our data to be a good distance away from the Pacific Northwest. rsync.net's Denver location is an excellent balance between geographical distance/safety and latency.

Another important thing to note about backup solutions in general is how they handle backup history and retention. For example, if a file accidentally gets deleted today, but you don't notice it's missing until three months from now, you want the ability to go back to a backup from three months ago and retrieve the file. That's one of the big reasons sync is not a backup; changes and deletions are synced immediately. Some cloud sync providers offer version history, but it's usually limited or restricted (e.g., only 30 days, costs extra, etc.).

With a normal rsync.net account, the idea is that you get the files you want backed up onto your rsync.net server and backup history is handled by ZFS snapshots. However, with an experts-only account you don't get free ZFS snapshots, which means you either need to configure ZFS snapshots yourself or make sure historical backups and retention are handled in another way.

I chose the latter approach. Both Arq on the Macs and Hyper Backup on our Synology can be configured to keep historical backups and prune old versions as they age. This provides fine-grained client-side control instead of a one-size-fits-all solution on the server, which works best for us. We can, for example, keep more granular history for our Macs but less granular history for our Synology. Thus, I have not configured ZFS snapshots on our rsync.net server and don't plan to in the future.

That backup history distinction is important to keep in mind if you get an experts-only rsync.net account, because most of the tutorials and guides for rsync.net assume you have snapshots enabled. For example, rsync.net provides instructions for backing up Synology devices using Hyper Backup, and tell you to use the "rsync copy (single-version)" option, assuming the ZFS snapshots will handle historical backup needs. Without snapshots you should choose the option that keeps multiple versions and configure retention for those versions in Hyper Backup.

I would also be remiss if I didn't mention encryption, especially for offsite backups stored on infrastructure you don't own. Arq and Hyper Backup allow you encrypt your data before it leaves your device, so all of the data on rsync.net's server is fully encrypted and we're the only ones with the keys. We also have our Macs encrypted with FileVault, and our Time Machine backups to the Synology are encrypted as well. Your specific encryption needs may vary, but encrypting your data when possible is generally recommended.

One last thing: keep the 3-2-1 rule in mind:

The idea that a minimal backup solution should involve three copies of the data (one primary copy and two backup copies), where two different media types are involved in storing the copies, and one of the copies is stored offsite in a remote location.

Unfortunately, following the 3-2-1 backup rule is inconvenient for iOS and iPadOS devices. You can do it, it just requires you to plug your iPhone or iPad into a computer and make a local backup which, combined with iCloud Backup, gives you three copies across two media and one offsite. What you end up doing is up to you and how valuable the data on your iOS and iPadOS devices is, but I really wish Apple had a local Time Machine-like solution for iPhones and iPads that allowed wireless backups to a NAS.

For our Macs we're set: three copies (the Macs themselves, Time Machine, and rsync.net) across two media (SSDs in the Macs and magnetic hard drives in the Synology and, I assume, at rsync.net) with one offsite (rsync.net).

For our Synology, we keep less vital data on it, so we only have the one local copy and the copy on rsync.net. That's an intentional choice based on a considered risk analysis.

That's the important thing to keep in mind: the 3-2-1 rule is called a rule, but it's more of a guideline. More than three is better, for example. Sometimes less than three is okay. The real rule is to use the 3-2-1 approach as a starting point and make thoughtful choices about your own situation and your data security needs. Mostly this boils down to asking yourself questions about what data would be lost forever in different scenarios:

Having a good backup strategy means having good answers to those questions that you're comfortable with. The answers and comfort levels are different for everyone, and that's fine. The important part is giving this some thought and putting together an intentional plan to keep your data safe.

In other words, do the opposite of what Backblaze chose to do.