However, that was the last flight of the day and the item in question was out of sight of other passengers, but my newspaper was sticking out, which meant that it was likely that the seat pocket would be examined in cleaning. It’s extremely likely that my property was picked up by one of your employees either after the flight or in the morning before the next one. I immediately registered with your web site for the item in question, identifying not only the flight, but the seat (thanks for not posting a phone number, but only an impersonal web page. It really shows how much you care). So, given that this kind of thing happens all the time, I did hope that there was a chance I would get it back. It was a long shot, to be sure, but not a non-zero one.

Now you Apple, thank you for creating the mechanism so that I could track my device, send a message to it, lock it and wipe it. In this case, I can’t locate it or send a message to it as it was on airplane mode. So, most likely, whoever has it has either wiped it, failed the login and had it wipe itself, or is trying to hack it (or fence it). Since, by your own definition, the device is now stolen property, maybe you could let me know when someone else tries to use it after it has been reset? No, of course, you can’t do that. Doing that would mean that you might be liable in all sorts of ways, right? There are so many ways that some mechanism could go wrong like that, that your corporate council decided it was best not to get involved. Even though you could actually immediately notify me the minute that the device registered to me with the unique ID you use to track your customer’s devices popped up again. This actually works out better for you, because now you’ll have sold me the same device twice.

So, yup, I can now troll the net looking for the device myself in a time-consuming, frustrating and fruitless attempt while constantly reminding myself of my own mistake. I wasn’t that fond of it in the first place, but I actually need it for a project, so I’m not left with much choice. I’ll need to file this as just another case of crappy customer service.

Thanks for nothing guys!

Is Apple jumping on the crazy train?

I liked this article on Newsweek: Apple vs. Everybody: The company’s epic battle over a missing iPhone is only the latest in series of contretemps.

It’s the kind of attention that Apple, long a media darling, isn’t used to. Apple’s control-freak nature didn’t matter as much when it was a plucky underdog. Yes, Jobs was a demanding boss and a finicky perfectionist—but he created great products. We rooted for Apple, and wanted it to survive. Apple seemed like the anti-Microsoft, a company that was on our side. But this year Apple will do nearly $60 billion in sales, and its market value stands at $240 billion—the third-largest in the United States, bigger than Coca-Cola and Pepsi combined. Any company that big can seem a little scary. So when police start breaking down doors over a lost phone, it’s a PR disaster, especially for Apple. The company works hard to cultivate a counterculture image, with ads that have featured Gandhi and John Lennon, not to mention the “I’m a Mac” hipster. Yet lately Apple has started to look like the big bully of the tech industry, the kid who doesn’t play well others. Over the long haul, that can put customers off.

It definitely can put developers off (including this one), and when your platform has a lot of competitors gunning for it and a slim percentage of the desktop market, putting off developers is not really a very good idea. Apple is betting the company on their new strategy of a tightly controlled ecosystem where they make a small amount off of every transaction and act as intermediaries between content producers and developers and their customers. It will either be fantastically successful or Apple will crash and burn in a spectacular fashion. Only time will tell.

Like the rest of the software industry, I’ve been pondering what the effect section 3.3.1 of the iPhone 4.0 SDK will have. I had fully been planning to make an iPhone application at some point. I had planned to do the initial version with Flex to prototype, but then also spend time doing a Cocoa version to better learn that SDK for myself. This iPhone 4.0 SDK announcement honestly has me questioning if I do really want to develop for the iPhone. Not just because of a higher-minded sense of indignity at Apple’s lack of openness of their platform, but rather because of that combined with their somewhat arbitrary and opaque app store approval process. Could I spend months of my spare time learning ObjectiveC and working on an iPhone application only to have that time be a complete waste if the App store reviewers decide that they don’t want that app in the store?

Thinking about it this morning, I realized that not only was Apple’s move to lock in developers nothing new, but that I’d already written about it before (in fact, I’ve been blogging about it since almost the day I started doing professional development for the Macintosh): iPhone SDK: The carrot for Cocoa, the stick for Flash, The difference between being an Apple developer and a Microsoft developer, Developers Developers Developers Developers.

Gruber had the motivation right, I think, but I also think he got the ramifications wrong. Since Steve returned to Apple, they have been applying the screws tighter and tighter to their developers, trying to get them to lock in. It was somewhat indirect at first, but the long term implication was clear: “We’ll tell you how to develop for our platform, if you do as we say, then you’ll be fine. If you don’t do it the way we tell you, your life will be a never-ending stream of headaches.” The move to Intel (forcing all developers onto X-Code and a big rewrite of any PPC-assembly) was step one, the move to 64-bit (dropping support for Carbon after promising it) was step two. The iPhone 4.0 SDK is just the most obvious move in this process because it basically spells it out. You no longer have a choice: it is Apple’s way or the highway. The problem is the App store. On the Mac, I control my own distribution. On the iPhone platform, Apple does. That means that they no longer have to negotiate with their developers, they can now finally dictate to them.

As a developer, this makes the iPhone platform a lot less attractive because I also can’t be sure that they won’t change the terms again. Once I’m locked in, I’m locked in. Apple can do whatever they want and I’m forced to rewrite my apps or get forced out. As someone who writes software for a living, this scares the crap outta me.

Here are some other blog posts that I thought were good reading around this:
The iPad isn’t a computer, it’s a distribution channel (O’Reilly Radar)
Five rational arguments against Apple’s 3.3.1 policy (37 Signals blog)

I’ve been using this iPad for less than a day, so maybe my opinions will change, but I don’t know how. My primary complaints so far are not about the software or the lack of features. My primary complaint is about the form factor. It is really bad, almost unusable on it’s own.

The iPad is too heavy to be held in one hand for too long. Even if you could hold it in one hand, the keyboard is then too wide to type with and difficult to type with more than one finger at a time. If held with two hands, it is too wide to type with your thumbs (phone-style) even vertically.

Since it is too heavy to hold in your hands for too long, you need to brace it on something. If you are sitting, you have to slouch or sit in an awkward position to brace it on your knee. Right now, I am having to sit cross-legged on the couch with two pillows on my lap to prop the iPad up in a semi-comfortable position. If you are sitting at a table, the rounded back of the iPad makes it difficult to use on a flat surface.

The iPad screen itself is wonderful, but the nature of the device itself means that it will be continually covered in fingerprint smudges that have to be wiped off.

Watching a movie makes the screen quality really shine, but also showcases the poor design. If you are holding the device in landscape mode (which is the logical way for video watching), you have a problem. If you hold the device so that the home button is to the right, your hands are either resting on top of the on/off button and the speaker grill or your left hand is blocking the headphone port. If you are holding the screen with the home button on your left, you are resting the bottom of the device on the volume rocker.

I hope that Apple addresses these flaws in future version, but I really have to say that so far, the iPad is really inferior in usability to the iPhone in my experience.

Watch out for these signs (Apple support didn’t even consider that I had been hacked when I contacted them):
The hackers changed my account ID and my e-mail address to something similar to what they had been before but different. This allowed them to charge two $50 iTunes gift certificates to my card without me being notified (because they had changed the e-mail address on the account).

When I tried to log into my account on iTunes, I got weird errors about my account id or password being incorrect. When I tried to recover my password on Apple.com, I got an error saying that my account ID was not in the system. When I tried to get my account ID, they couldn’t find it (since the hackers changed my e-mail address). Of course, I could not log into the support site to try to report the issue since it requires my Apple ID. Luckily I found the iTunes store form that let me contact support via the web without logging in and they were able to tell me that I had changed my account ID and e-mail address. I was able to log into the new ID that the hackers made with my old password, which was really lucky since Apple support was clueless about what had happened.

Why didn’t Apple notify my previous e-mail address when the change was made? That is a basic security process that many other sites use. There is a pretty clear pattern of fraud here as well, account information is changed and then large purchases are immediately made. Shouldn’t Apple be looking for this kind of thing?

I have contacted support to find out if they have a process for dealing with fraud, but I can’t help but feel that Apple’s security is somewhat to blame here. I’ll let you know what Apple suggests I do.

I also posted the above on the Apple support site here. Please spread the word so that others aren’t ripped off.

On a side note, I can’t help but wonder how my account got hacked. I’m pretty wary of phishing scams, and that kind of thing. I’m always extremely careful with this kind of stuff. The only thing that occurs to me is that the same day my iTunes account got hacked, I created an account on artaculous.com. I used the same e-mail address (of course) and in this case I was lazy and used the same password as my iTunes account. I generally try to avoid using the same password twice, but it does get hard to remember them all without reusing them sometimes. I have since gone and changed every password on every site that I have accounts on, just in case. I’m not saying that artaculous.com is some phishing scam, but the coincidence is rather odd…

I’ll update this post as I get more info from Apple. Please add a comment if you have heard about this scam or have more information or suggestions.

[Update: 6/29/09, 11:26pm]
Of course, I changed all my passwords on every site I could find an account on today. My e-mail is full of account update notices from a zillion large and tiny companies… Except Apple. I changed my Apple ID (Twice!), my password (Twice!), my security question, my mailing address. Exactly zero messages from Apple letting me know in case it wasn’t me. This really is pretty weak security on Apple’s part.

[Update: 6/30/09 9:09am]
One of the iTunes gifts certificates had been sent to a gmail address. I tried to find a way on the gmail site to let them know that an account was being used or involved in a crime, but couldn’t find a way to do it. Seems weird because I don’t think you need the certificates mailed to you to use them, just the code. The second certificate had not been mailed or had the e-mail addy cleared. Can’t Apple track the IP address of whomever uses the gift certificates to track back to the people who hacked my account? Will they bother? Still waiting to hear back from Apple on letting them know that my account was hacked. Would call their number or try to see a genius, but I’m in jury duty right now.

[Update: 6/30/09 2:04pm]
Apple has responded (excerpt):
I understand you are concerned about purchases that were made with your iTunes Store account without your permission or knowledge.

I know it can be discouraging when fraudulent charges are made on any type account whether it’s your bank or iTunes.

I urge you to contact your financial institution as soon as possible to inquire about canceling the card or account and removing the unauthorized transactions. You should also ask them to launch an investigation into the security of your account. Your bank or credit card company’s fraud department should then contact the iTunes
Store to resolve this issue. The iTunes Store cannot reverse the charges.

Basically, they are pushing this back onto me to deal with my credit card company on. Not overjoyed with this, but fair enough, most people thought that was what they would do. I am a bit concerned that they believe that my credit card could also have been compromised because of this. I thought that my credit card info wasn’t exposed. If credit card info is exposed through iTunes and their security is so lax, I’m going to be wary of giving them any info in the future. I’m also concerned that they aren’t saying that they will do anything to pursue the person who did this. I would like to feel that Apple actually cares about this instead of just blowing it off.

[Update 6/30/09 10:36pm]
Found these links with more info about iTunes account hacks:

• Article from The Register on Apple accounts being hacked
• Article from dropsafe – great suggestions in the comments
• Really important article from dropsafe, see the part at the end – Even changing your Apple ID doesn’t protect you because Apple has made it easy to get that info again, so once you are hacked it is easy to hack you again unless you change everything (and it still isn’t really very secure).
• Apple’s security is so bad, there was a class action lawsuit about it

[Update 7/2/2009 9:43am]
Apple (correctly) disabled my iTunes account when I reported that it was hacked. They didn’t actually tell me this though, so I didn’t find out until I tried to use it to update my iPhone apps. What did they need to re-enable it? My billing address. Where was my billing address info stored? In my iTunes account. Since that was pretty unlikely to change after a hack, it seems a pretty weak way to verify my identity. I pointed that out in my return mail, but so far iTunes support has ignored all my questions and comments in my messages to them. I guess that is policy, but also a bit lame. I also may have figured out why the hackers didn’t change my iTunes password. I did find a message from Apple in my spam folder notifying me that my password had changed (from when I changed it after getting my account back).

There was enough info in my account that I’ve had to cancel my credit card, and I’m going to need to be extra vigilant for identity theft moving forward. Since then, I’ve changed my payment method to none in the iTunes store. I may have to enter credit card info each time, but that now seems like a minor inconvenience. I have also changed all my other info to be completely bogus so that if someone does hack it again, they won’t have any useful info on me. Why does Apple need by birthday (not birth date for age verification, but birthday)? I’m going to do the same with my other accounts and would suggest it to anyone else concerned about this kind of stuff.

[Update 7/6/2010]
A year later, tons of reports of other accounts being hacked, including several on this blog. Thanks for adding your voices. Meanwhile, Apple has changed NOTHING on their iTunes security processes. They continue to push the blame and responsibility on their customers and the credit card companies. Now, there are reports that iTunes store and account hacking is not only more widespread than has been thought, but also very well organized. When will Apple take some responsibility?

Seriously, set your payment method to None now if you want to avoid having to deal with this pain. It sucks to have to enter in the data every time you make an iTunes purchase, but it sucks a lot less that having to get a new credit card because someone hacked your iTunes account. Trust me on this one.

[Update 12/26/2010]
I was buying some apps on iTunes today. I still keep my payment info set to none and my address set to my non-billing address as a rule and change them when I want to actually buy anything. It is still a massive PITA, but probably helps me avoid dumb impulse purchases

I noticed something different today, when I changed my payment and address info, I immediately got a message from Apple about the change, and then another one when I changed it back. This is new, and this is good. A trivial change from Apple, and certainly long overdue, but a very positive step.

When I first learned about the DRM mechanism where the player would “phone home” periodically to make sure that you were still licensed to the content, I immediately realized that this was a really fragile way to license media. I’m not talking about subscription content (like Rhapsody), streaming media (like Hulu/YouTube/Flash Media Server) or rentals (like Amazon/iTunes rental), I’m talking about content that is purchased by the consumer. The issue is that there are 1000 ways that the user can lose access to their content without any ill intent on their part. This isn’t an issue if the licenser of their content is still in business and supporting the licensing mechanism. However, even large companies sunset their DRM technology support, screwing over their customers (see Google Video and Microsoft Plays For Sure for example). Depending on how onerous the original licensing scheme is and how it was implemented, buying a new computer, changing the hardware configuration, upgrading system software, the company dropping support for the DRM, the licensing company’s servers going down or just the user being without the internet can cause a user to lose access to the content that they paid for and legally own.

Maybe the user got some warning and could back up their content to some other format (if allowed by the licensing scheme, it often isn’t); but maybe they didn’t see or understand the warning. Then it is too late. Is it the consumer’s fault? No, it is never the consumer’s fault. They purchased digital content with the expectation of owning it forever, just like when they purchased their media as hard goods.

Onerous DRM has been put in place by media companies desperate to avoid piracy, but as it has been written about in so many other places, DRM makes more pirates than it avoids. It makes it more difficult for the people who want to get their content legally by adding roadblocks between them and their purchases and it doesn’t stop the pirates who avoid the whole thing. I wonder how many Plays For Sure customers went to an illegal site to re-download the content that they had already purchased when they lost access to it. I wonder if any of them felt like they were breaking the law at that point. I doubt it. They had paid for something and had been denied access to it. Maybe they were mad at Microsoft, but they were probably more mad at the record labels, because that was the product they purchased. Microsoft was just the store.

I was thinking about this again today when I went to purchase a song off of iTunes and found that Apple had lost my Apple ID. This was the Apple ID that I had spent years buying content from iTunes with. Sure, Apple has moved to make their music DRM free, but I haven’t completely updated my catalog yet, and there is a lot of video that I have paid money for as well that is still subject to Apple’s DRM. While their mechanism still allows me to play my content on my authorized computers (as far as I can tell so far), it will not permit me to authorize a new computer. If Apple isn’t able to fix this problem, what happens to the content I purchased over time? If I can’t access it anymore through no fault of my own, am I in the wrong legally to download it off a file-sharing site?

DRM models have continued to evolve over the years, but I think that the audio model has shown the way for purchased content. It is high time for media owners to allow the people that pay for a full copy of their content to own that content outright, with nothing that could prevent the consumer from having access to the content that they paid for, including transcoding as media formats change over time. Otherwise, they will alientate their consumers as they find they cannot have what they paid for.

note: I avoided mentioning the new licensing models that have sprung up, where when you “buy” a copy of a song or movie the license agreement says that you don’t really own it, which is becoming more common as a way to avoid legal issues when user’s circumvent DRM to make fair-use copies or so that they cannot sue if they cannot access their content. I avoided mentioning it because:
A) it muddies the discussion.
B) I think it is evil.

It seems the the iPhone UI designers decided that the iPhone was a significantly new device that they could change the user expectations about how the user interface should work. That is a classic blunder in UI design that Apple above all other companies should not have made. Maybe they need their designers to go back and re-read the Apple human interface guidelines where this rule was made very clear.

This choice was bad on other HCI levels as well. What is my expectation when manipulating controls on a song while it is playing? Would it be that I’m making a global settings change when there is another location where the global settings are edited? I doubt it. Did Apple do any user trials? Because of their secrecy, I somewhat doubt it, but it would have been dumb of them to do none.

Since this paradigm was established in the iPhone 1.0 software and has obviously not changed since that time, let’s hope that Apple at least has the sense to add setting switches for shuffle and repeat in the settings menu if they don’t want to get rid of the ones they currently have. That would save a lot of frustration from their customer base as we get iPhones.

I just watched the final on the CBC, don’t show me video of the team getting off the bus and say that they just arrived and competition should get started in about an hour.

Morons.

Yer pal,

Kevin

[update 11:21PM PST]
NBC is now claiming to be broadcasting something “live” that the New York Times has already reported the outcome of and the CBC actually did broadcast live a few hours ago. I can understand tape delay for the west coast, but three hours ago was prime time on the west coast. You could have shown it then. And don’t freaking call it live when it isn’t.

An App that scans the barcode using the built-in camera and then allows you to look it up on your choice of site: froogle, Amazon, whatever… To see if you want to buy it on-line instead.

I’d write this one myself, but it isn’t anything I’d be that jazzed about writing and supporting for a long time… It should be something that Amazon would jump right on if they weren’t worried about getting sued…

I want an iPhone app version of your websites.

Obvious:

• Get me details on the houses presented for the iPhone screen size
• Show me houses for sale near my current location

Less Obvious

• Let me pick a bunch of houses to view on the website: give me a tour, in-order, with turn-by-turn directions
• Show me how far and the way to get to the nearest: school, park, etc.

Go for it, I’ll use it, and if you want to toss me a commission or make me VP of product development, I’m cool with that.