News+ privacy on Big Sur

August 11 2020 by Jeff Johnson

A tweet by Tony Haile, CEO of Scroll, received widespread attention yesterday. Haile said,

Woah, I wonder how many publishers in Apple News+ realize that the new iOS14 and MacOS Big Sur are by default intercepting traffic to their sites and sending it to the Apple News app instead.

On The Verge, Dieter Bohn raised some questions about this new behavior:

If you click a link in Safari, it opens Apple News. If you click a link in Chrome, it stays in Chrome. If you click a link in some other app like Slack, it opens in Apple News — even if your default browser is Chrome. That’s odd simply because it’s not clear how Big Sur knows that it should redirect some websites but not others. Is it checking in with a pre-approve list of participating publisher sites? Is that list stored locally or is it checking in with Apple?

From a privacy perspective, it would be very disturbing if Apple's operating system were "phoning home" to Cupertino when you opened a URL to a non-Apple web site. Fortunately, this is not the case, at least on macOS Big Sur. (I haven't installed or tested the iOS 14 beta, but I would assume it behaves the same as Big Sur in this respect.) This is easy to test yourself, if you think about it. Today I signed up for a free 1 month trial of Apple News+ (note to self: cancel in 4 weeks). Then I got the URL of an article from The Wall Street Journal, a publisher who participates in News+. I disconnected my internet by turning off my MacBook Pro's Wi-Fi. Finally, I opened the Terminal app and entered the following command:

open "https://www.wsj.com/articles/commercial-properties-ability-to-repay-mortgages-was-overstated-study-finds-11597152211"

Sure enough, it opened the News app. Of course the article failed to open in News, since my internet was off, and then as a fallback the News app opened Safari, which failed to load the article for the same reason. As a further test, I also tried a fake, nonexistent article URL:

open "https://www.wsj.com/articles/blahblah"

Same result, opens the News app! So I think we can say with confidence that Big Sur is checking an offline list of URL domains rather than checking online with Apple. Your privacy is still protected here.

For those who are interested in more technical details, it's the LaunchServices framework, located on disk at /System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework, that determines which app should open any given URL. The open command in Terminal uses LaunchServices. Safari also checks with LaunchServices when you click a link, even when the link has an http or https URL scheme. Google Chrome, however, does not check with LaunchServices for http and https links, which is why Chrome doesn't open the News app. Chrome will only check with LaunchServices if the URL has a scheme that Chrome doesn't recognize or handle, such as applenews or macappstore.

For the programmers in the audience, I did a little bit of debugging by creating a test app that calls -[NSWorkspace openURL:] with an article link. Ultimately this calls -[_LSRemoteOpenCall invokeWithError:] in LaunchServices, which calls xpc_connection_send_message_with_reply_sync, sending a message with the URL to the com.apple.coreservices.quarantine-resolver XPC service. I didn't try to reverse engineer the XPC service, because that's a bit of a pain on Big Sur. It would be interesting if someone else could continue this investigation.

If I may indulge in a personal sidebar, I wrote a free open source Mac app called StopTheNews that stops Safari from opening Apple News articles in the News app, instead opening them in Safari. (StopTheNews also allows you to stop Safari from automatically opening the App Store app.) Unfortunately, at the moment StopTheNews no longer works for Apple News on Big Sur (though it does still work for the Mac App Store). Fortunately, I have a workaround for this, and I plan to ship a new version of StopTheNews to the public when Big Sur is released to the public. So stay tuned!

Addendum

I've discovered exactly how this works with LaunchServices: Universal Links. I wrote about Universal Links previously with regard to the Twitter Mac app. This case is a little different, though, because usually Universal Links are controlled on the web side, whereas for News+ on Big Sur they're controlled on the Mac side. If you look at the Wall Street Journal Apple App Site Association File on the web, there's no reference to the Apple News app, only the Dow Jones iPad app. The Apple App Site Associate Files for News+ are stored in the folder ~/Library/News/AlternateUniversalLinks/ on Big Sur. If you delete the contents of this folder — and then lock the folder in Finder! — then the news articles will no longer open by default in the News app, they'll open in Safari. You have to lock the folder, otherwise Big Sur will recreate the contents, because Big Sur wants to go Big or go home.

That's it. Mystery solved. Case closed. Book 'em, Danno!

Jeff Johnson (My apps, PayPal.Me)