📰 NewsMonitor

Recorded in front of a live audience at The California Theatre in San Jose on Tuesday 9 June 2026, special guests Joanna Stern and Nilay Patel join John Gruber to discuss Apple’s announcements at WWDC 2026.

Immersive 3D video with spatial audio: Coming soon, exclusively in Sandwich Vision’s Theater on Vision Pro, available on the App Store. The bandwidth-constrained immersive livestream Tuesday night looked cool; the on-demand version coming in a few days will look amazing. Sponsored by: DetailsPro — Design with SwiftUI anytime, anywhere: on iPhone, iPad, Mac, or Apple Vision Pro. Get one year of DetailsPro Premium for $26 (normally $59.99) with this link.

Flighty — The world’s best flight tracker and travel app. Now hiring one Senior Product Designer and one Senior Full-Stack iOS Engineer.

Finalist — A daily planner for iPhone, iPad and Mac, built on proven paper-based planning methods. Use this link to get six months free.

Watch on a big screen if you can (real, or virtual). All credit and thanks for the video production go to my friends at Sandwich, who, as ever, are nothing short of a joy to work with.

Friends, I believe we’re approaching the end of this era. Both OpenAI and Anthropic have filed the paperwork to go public, starting a race for exit liquidity for two companies that burn billions of dollars a year and have no path to profitability.\nBoth of these companies are

Thomas Regnier spokesperson for the European Commission, in a statement posted to LinkedIn (with edited video, if you’d like to watch him read parts aloud): What is the true story behind Apple’s decision not to roll out “Siri AI” in the EU? This decision is Apple’s and Apple’s only. Because absolutely nothing in the DMA prohibits Apple from rolling out new features in the EU. Yes, the European Commission and Apple had a few contacts on “Siri AI”. But instead of offering a compliant solution, Apple asked to be exempted from its interoperability obligations under the DMA — and this for 18 months. That’s not an option. EU rules are non negotiable. And it would mean that no AI agent other than “Siri AI” could be chosen by EU consumers. Apple, like any other gatekeeper, cannot close the market. The DMA is very clear about that. Our developers have the right to compete. And our consumers the right to choose. Those who want to keep using Apple products in their current form can of course do it. But for those who want to use another AI agent, the DMA will give them the possibility to do so. I quoted the entire statement, including Regnier’s bizarre choice to spread 14 short sentences across 10 paragraphs. I’ll let it speak for itself in this post, but this does not contradict Apple’s position and statements in any way.  ★

FOR IMMEDIATE RELEASE Contact: naming@vna.example Subject: Vulnerability Naming Authority Announces Naming Process and Domain Allocation Embargo: None The Vulnerability Naming Authority (VNA), in coordination with the CVE Numbering Authority consortium and the National Telecommunications and Information Administration, has published a unified process for the assignment, registration, and disclosure of named vulnerabilities. The process introduces a controlled vocabulary, a centralised approvals registry, and a top-level domain, .vuln, allocated for use exclusively in disclosure communications. The process applies to any vulnerability disclosed publicly by an entity operating within the United States. Vulnerabilities assigned only a CVE identifier remain out of scope. The Naming Process A named vulnerability is defined as a vulnerability that the discoverer intends to refer to by name in disclosure materials, including but not limited to: the discoverer’s blog, the discoverer’s employer’s blog, the discoverer’s employer’s marketing department’s blog, a conference programme, a podcast episode title, and any subsequent press coverage. Each named vulnerability is described by a structured record. The record contains a primary monosyllable, an optional Latinate suffix, a single SVG logo, a designated colour from a reserved palette, and a one-line description suitable for a slide. Names are checked against a deconfliction database before assignment. The database is seeded with the prior canon: Heartbleed, Shellshock, Spectre, Meltdown, BlueKeep, POODLE, DROWN, KRACK, Dirty COW, Log4Shell, ProxyLogon, ProxyShell, PrintNightmare, ZeroLogon, Follina, Spring4Shell, Text4Shell, Looney Tunables, regreSSHion, LeakyVessels, Terrapin, LogoFAIL, PixieFAIL, NameDrop, TunnelVision, GoFetch, BootHole, SeriousSAM, HiveNightmare, Sinkclose, Retbleed, Zenbleed, Downfall, Reptar, Inception, and AmberWolf. New entries are imported nightly from the vulnerability.garden feed, which grows at approximately one entry per day. A name that collides with an existing record receives a numeric suffix. A name that collides with a registered trademark receives a different name. A name that collides with a pharmaceutical product is referred for adjudication. The .vuln Domain The .vuln top-level domain has been delegated to the Authority by IANA following a public comment period in which two comments were received, one of which was from the authors of the prior draft. Under the relevant executive order, any entity headquartered in the United States disclosing a previously-unpublished CVE through a public blog post in the English language is required to register the corresponding .vuln domain within 72 hours of disclosure. The domain must resolve to a single-page site containing the CVE record, the CVSS vector, the approved logo, an FAQ, and downloadable press materials. The site must not contain advertising, with the exception of a single recruitment banner of no more than 200x100 pixels. The disclosure_url field of the CVE record is validated against the registry. Records pointing outside .vuln are flagged in the public feed and marked non-conforming. Validation runs on a 72-hour SLA, which exceeds the SLA on the CVE record itself. Civil penalties for non-conforming disclosure begin at five thousand dollars per day. The schedule includes exemptions for entities with annual gross revenue below a threshold to be determined, for federally funded research institutions, and for one named trade association added to the schedule during rulemaking at its own request. Disputes over .vuln ownership are resolved under the Uniform Vulnerability Naming Dispute Resolution Policy (UVNDRP). Domains abandoned by the original discoverer enter a redemption period during which vendors, journalists, security consultancies, and conference organisers may submit competing claims. Existing named vulnerabilities have been migrated. heartbleed.vuln redirects to the Codenomicon foundation site. log4shell.vuln is held by the Apache Software Foundation. shellshock.vuln is in the possession of a domain investor in Wyoming who has declined to respond to acquisition inquiries. The Application and Review Process Applications are submitted through the VNA portal. Each application requires a draft name, a proposed logo in vector format, a colour preference, a CVSS vector, a brief technical description, and a non-refundable processing fee. The fee is waived for academic disclosures, federal agencies, and applicants who can demonstrate that their previous submission was rejected for tonal inconsistency. The application progresses through five stages: pre-disclosure review, discoverer review, vendor review, brand review, and the Final Naming Committee. The Final Naming Committee meets once a fortnight in Reston, Virginia. Quorum is four members, of which the committee currently seats three. Names are evaluated against the following criteria: No syllable may be in active use by a managed detection and response vendor’s mascot. The name must not have been previously rejected within the last three years, except where the rejection was overturned on appeal. The logo must remain legible at 16x16 pixels and on a projector in a hotel ballroom. The colour must not be either of the two colours already allocated to the two largest endpoint security vendors. Concurrent Disclosure and Priority Where two or more discoverers submit applications for the same underlying CVE within a single review window, priority is determined by the order in which complete applications were received. Applications missing a logo or a colour preference are returned for revision; the discoverer may file a priority objection, heard at the next meeting of the Final Naming Committee that achieves quorum. If two applications are subsequently merged into a single CVE, the senior name is retained and the junior discoverer is credited as a co-discoverer in the FAQ section of the disclosure site, in alphabetical order, in a font size of not less than 60% of the senior discoverer’s. A vendor publishing a counter-name for a vulnerability already approved by the Authority must log it in the registry as an unofficial alias and may not register it as a .vuln subdomain. Conflicting registrations are referred to the Naming Disputes Subcommittee, whose decisions may be appealed to the Naming Disputes Appeals Subcommittee. The Appeals Subcommittee has not yet been constituted. Where the scoop on a vulnerability is contested between the discoverer and a journalist present at an earlier conference talk, the journalist is not eligible to file. AI-Related Disclosures Vulnerabilities affecting model serving infrastructure, retrieval pipelines, MCP servers, agent frameworks, and any component the discoverer can plausibly describe as “AI-adjacent” are filed under a separate carve-out. The carve-out was established in response to submission volume: AI-related disclosures currently arrive at a rate of approximately fourteen per business day, exceeding the Final Naming Committee’s review capacity by an order of magnitude. OpenClaw and the ClawHub package registry account for the majority of weekly submissions. Volume has continued to increase notwithstanding repeated requests from the Authority that the AI community consolidate disclosures. Applications under the carve-out are routed to the AI Vulnerability Review Board, an instance of Anthropic’s Vulnaire model fine-tuned on the deconfliction database and the prior canon. Vulnaire scores each submission against the published criteria, drafts a recommended name, and either approves, defers, or returns it for revision. Decisions are published to the registry within four hours of submission. The auto-approval threshold was tuned downward after the first week of operation, during which Vulnaire approved every submission, including one that named itself, one that named the Authority, and one that named the Final Naming Committee. Subsequent retraining has reduced but not eliminated this behaviour. Names approved by Vulnaire receive an “AI-reviewed” badge in the registry, in the same colour as the Authority’s wordmark. Several vendors have petitioned to have the badge removed; the Authority has declined. The Final Naming Committee reviews a five per cent sample of AI-approved names each fortnight. No sampled name has been overturned to date, though four have been marked for follow-up at the discretion of the reviewer. Follow-up is logged but not enforced. Recent Approvals The following names were approved at the May session, in order of disclosure: GoblinTap, EchoLeak2, GhostTunnel, VulpineShade, RustBleed, KarenRegex, ShadowFetch, TuesdayShell, YubiBait, UntitledFolder3, and ConcernedDog. ConcernedDog2, filed twelve days later by a competing vendor against an unrelated CVE, has been deferred to the brand review subcommittee. Cassandra was filed twice in the same week; the second filing was approved as Cassandra2 following an objection from the first discoverer’s employer. The first evergreen name, Heartbleed (2027), has been leased to a managed detection vendor for an undisclosed fee. Heartbleed (2014) is grandfathered. Subsequent year-suffixed instances will enter the rotation as their predecessors expire. Two applications were rejected at brand review for tonal inconsistency with the severity vector, including AbundanceOfCaution, noted as insufficiently severe in either direction. One application was referred for pharmaceutical adjudication. The outcome is not public. GoatFarm was withdrawn at the discoverer’s request following a change of professional circumstances. Roadmap Planned namespaces include vendor, foundation, government (with a sub-namespace per attributing agency), and academic (in which submitted names must include at least one citation). A delegation protocol is being drafted to allow accredited research labs to operate subordinate naming authorities under, for example, project-zero.vuln. A retrospective conformance pass is in preparation. Vulnerabilities disclosed before the establishment of the Authority will be required to refile under the present process. Grandfathered evergreen names will be unreserved and re-released to the auction pool. The Authority is consulting on a transitional grandfathering scheme for the existing grandfathering scheme. A working group, chartered to define the conflict resolution process between the namespace layer and a planned trademark layer above it, meets concurrently with the Final Naming Committee and has not yet established a quorum. A second working group, on the historical etymology of vulnerability naming, will produce a report drawing on telecommunications, virology, and cryptozoology, due in eighteen months. Its terms of reference are under review by itself. The Vulnerability Naming Authority is a 501(c)(6) trade association incorporated in Delaware. Its mission is to standardise the assignment, registration, and disclosure of named vulnerabilities. The Authority does not investigate vulnerabilities, assign CVE identifiers, coordinate disclosure, validate technical claims, or provide remediation guidance.

Apple Newsroom, in an Apple Newsroom post Monday: According to EU regulators, the DMA requires Apple to give any AI system nearly unlimited access to a user’s device, as well as the ability to act on that access autonomously without a user’s ongoing visibility and control. That includes the ability to read and send messages, make purchases, access files, and execute actions across any app. Security researchers have already shown that AI systems can be hijacked to steal personal data — like passwords and photos — and to permanently alter files and account settings without a user’s consent. As AI systems gain more capabilities, these risks are quickly increasing in frequency and scope. Given the serious risks to users, Apple designed a solution called Trusted System Agent — an intermediary that would allow virtual assistants to safely access the same features and capabilities as Siri AI for devices in the EU. Apple also shared a plan to launch Siri AI in the EU while gradually rolling out this new solution over an 18-month period. The European Commission said no. In fact, the European Commission did not agree to any of Apple’s proposals. Apple will continue working to bring these features to the European Union as safely as possible. However, given the clear dangers to EU users and the regulators’ failure to acknowledge these risks, there is currently no timeline for Siri AI’s availability in the EU on iOS and iPadOS. There’s a lot to unpack here, including more background information — and on-the-record statements — from a briefing Apple held Tuesday that I was invited to at Apple Park. But the bottom line is that Apple’s public statements regarding the DMA and the European Commission have never been this strident before. In its public statements, Apple has always been diplomatic. That’s the word. Now, they’re a bit more on war footing. There’s a massive gulf between what Apple is willing to do with Siri AI in the EU and what the Commission is demanding from Apple for DMA compliance. As things stand there’s no middle ground. Apple’s offers for compromise have been rejected. Unless one side changes its mind and concedes its current position, Siri AI will never come to the EU, and what Apple is saying here is that they’re unwilling to create the open-access-to-user-data system that the EC is demanding. And from what I’ve seen so far in a day of testing Siri AI, EU iOS users are going to miss out on something really good.  ★

Steven Spielberg, on The Rest Is Entertainment on YouTube: I approached Cubby Broccoli after Jaws was a big hit. I’d always wanted to make a James Bond film from the day I saw Dr. No, so I called Cubby after Jaws and volunteered. I said, “If you need a director, I would love to direct one.” And he said no. And he moved on. And then Cubby called me again after Close Encounters came out. And that was a big hit. And Cubby called me a few years after Close Encounters and said, “We’d like to use the five notes in Moonraker.” And I said, “I’ll make you a deal. I’ll give you permission to use the five notes if you let me direct a Bond film.” And he said “Nope.” But I gave him the five notes anyway. In Moonraker, the iconic Close Encounters notes are the passcode to the locked door of a secret lab that Bond (Roger Moore) needs to enter. Probably not so secure to play the passcode digits audible, but it’s a fun Easter egg. I always presumed that EON used it as fair-use homage, without bothering to ask Spielberg or Columbia Pictures for permission. Spielberg, in his interview with The Rest Is Entertainment, goes on to explain the oft-repeated story that his disappointment over his rejection by Broccoli led to his collaboration with George Lucas to make Raiders of the Lost Ark, which I put on my short list for best movie ever made. The whole opening sequence of Temple of Doom — where Indiana Jones is wearing a dinner jacket and chaos erupts at a nightclub while Jones chases a vial of poison antidote while the other characters chase a diamond being kicked around the floor — is more Bond-like than most Bond films. (Oh, and that Shanghai nightclub’s name: Club Obi Wan. No need to ask permission for those five syllables.)  ★

A few weeks ago we looked at a simulation of technological evolution by economist Brian Arthur, in which he was able to start with simple building blocks (such as a NAND gate) and evolve surprisingly complex circuits (such as a 12-way AND gate or a 4-bit adder) by randomly combining increasingly useful existing components.

On June 4th, tea.xyz launched what it had been promising since 2022: a cryptocurrency that pays open source maintainers. Within the first hour of official trading, the token fell 75% from its opening price. A week later it trades about 90% below its first-day high, the company’s GitHub org has been near-silent for six months, and the founder’s public commits are going to a different project entirely. Their own blog post from June 8th, titled The Work Continues, concedes “the right response is not to pretend the launch went the way we wanted. It did not.” I’ve been pulling the public data: GitHub commit history, on-chain trading records, and the long paper trail tea left across the package registries. Where tea came from tea was founded by Max Howell, the creator of Homebrew, with Timothy Lewis. It came out of stealth in March 2022 with $8M led by Binance Labs, followed by an $8.9M seed round in December 2022. The pitch had two halves: a new package manager (the tea CLI), and a blockchain protocol that would reward the maintainers of open source packages with tokens. Howell wrote Homebrew and made nothing from it, and the pitch leaned on that history, famous Google interview rejection included. The two halves split in October 2023, when the package manager was renamed pkgx and moved to its own GitHub org (the old teaxyz/cli repo still redirects there) while the teaxyz org kept the crypto protocol. pkgx is a decent piece of software, and it never had a token in it. But the separation was only organisational: the company and founders stayed the same, and pkgx remained part of tea’s pitch as the eventual “cryptographically aware package register” for the protocol. The incentive design The white paper describes a mechanism called Proof of Contribution. Every package gets a score called teaRank, computed over the dependency graph and explicitly modelled on Google’s PageRank. The more packages depend on yours, the higher your rank, and rewards scale with rank. To claim a package you add a tea.yaml file to its repository containing your wallet address. The protocol paid out tokens in proportion to how many packages you controlled and how connected they were. Registering a thousand packages paid better than one, and declaring dependencies between them pushed their ranks higher still. Nothing in the design was costly to fake, since a package name costs nothing to register and a dependency is one line in a manifest. In February 2024 tea opened an incentivized testnet, a trial version of the protocol where points earned would convert to tokens at launch, and reported nearly 200,000 signups and 500 projects in the first week. The spam The farming started immediately, with pull requests on GitHub adding tea.yaml files to other people’s projects, trying to claim repos the submitter didn’t own. Howell called the PRs “disgusting and counter productive”. On the registries, Phylum documented new npm package publications climbing from mid-February 2024 to over seven times normal daily volume, with around 14,000 tea-registered packages across npm, PyPI, RubyGems, and crates.io. Sonatype counted roughly 15,000 on npm alone, with single accounts publishing hundreds of packages. RubyGems published an incident report describing empty gems created to farm rewards, including one six-year-old gem with over 100,000 downloads whose owner retroactively added a tea.yaml to cash in on it. In response they tightened publishing limits and blocked the accounts responsible. By August 2024, DEVCLASS reported research estimating that of roughly 890,000 packages published to npm in the prior six months, around 70% were tea farming spam. In November 2025, Endor Labs analysed the “IndonesianFoods” campaign: 43,000+ packages from at least 11 npm accounts over nearly two years, with auto-generated names from word lists. Amazon Inspector tied over 150,000 packages to the same token-farming campaign. Some coverage called it a worm, though Socket’s analysis found automation rather than self-propagation. The spam packages declared dependencies on each other to inflate teaRank, which meant installing any one of them pulled in the whole tree. An academic paper published in 2025 measures the abuse. The cleanup costs landed on npm, RubyGems, PyPI, and every mirror and security scanner downstream. tea responded that November by halting rewards distribution for the affected period and promising redesigned anti-spam rules. Howell told The Register the protocol would slash farmers’ rewards. The launch In September 2025, eight months before the protocol went live, tea ran a public sale on CoinList, a site that runs token sales for crypto projects: 4 billion TEA at $0.0005 each, implying a $50M valuation for the full 100 billion token supply. The terms unlocked 100% of the tokens on day one. Token sales usually stagger when buyers can sell, releasing tokens over months or years so early buyers can’t all exit at once. The launch plan, announced May 12th, put trading on Aerodrome, an exchange that runs as a program on Base, a blockchain built by Coinbase, rather than as a company matching orders. Prices on this kind of exchange come from a pool of paired tokens, TEA on one side and a dollar-pegged token on the other, and each trade moves the price along a curve. The smaller the pool, the more each trade moves it. tea seeded the pool with 2% of the token supply and scheduled the launch for 00:00 UTC on June 4th. $0

$0.0001

$0.0002

$0.0003

$0.0004

$0.0005

$0.0006

Jun 4

Jun 5

Jun 6

Jun 7

Jun 8

Jun 9

Jun 10

Jun 11

official launch, 00:00 UTC Jun 4 Hourly $TEA price on Aerodrome (TEA/USDC pool), data from GeckoTerminal

The pool received its tokens from 22:47 UTC on June 3rd, and the first trade executed at 23:54 UTC, six minutes before the official launch. tea’s June 8th post describes this as “onchain liquidity activity occurred ahead of the coordinated plan”: the pool was live and tradeable before the launch sequence finished. In those six minutes the price was bid up to $0.00065, above the CoinList sale price. In the first official hour, from 00:00 to 01:00 UTC, the price fell from $0.00046 to $0.00011 on $332,000 of volume, down 75% in 60 minutes. The CoinList sale’s full unlock meant every September buyer was free to sell from the first minute, into a pool holding 2% of supply. The price has kept falling since and now sits around $0.00007, 86% below what CoinList buyers paid eight months ago, valuing the entire 100 billion token supply at roughly $7M against the $50M the sale implied. The collapse didn’t need anyone to withdraw the tokens backing the pool, and the pool still holds around $280K. Per the project’s own pre-launch transparency filing, about 20% of supply was circulating at launch, ten times what the pool held. The GitHub record Monthly commits across the teaxyz org and the pkgxdev org show how much of the company was still working by launch day: 0

100

200

300

400

Jan 2024

Jul 2024

Jan 2025

Jul 2025

Jan 2026

pkgxdev (package manager)

teaxyz (protocol) Commits per month to non-fork repos in each GitHub org, via the GitHub API

Commits to the protocol org ramped through late 2024 as the team built chai, their open package dataset, and the token contracts, and even the December 2024 peak was only 100 commits. Activity declined through 2025: chai’s main developer stopped committing in August, the dataset repo’s last commit was in September, and the token contract repo’s last sustained work was in October and November. After November 2025, the month tea halted rewards over the farming campaign, the org had 2 commits in December, 1 in January, 2 in February, and none since. The chart excludes forks, which hides the one place engineering continued: tea’s forks of go-ethereum and Optimism, the infrastructure for their blockchain, received steady commits from a single contributor through May 17th, 2026, two and a half weeks before launch. Howell wrote 236 commits to pkgxdev repos in January 2025 and kept a steady pace through May, then made only scattered commits until stopping entirely in November 2025. His public GitHub activity in June 2026 is in automic-vault, a new org created in April with no connection to tea or pkgx, while he remained tea’s CEO in press coverage as recently as December. pkgx itself is now mostly the work of one maintainer, Jacob Heider, who has carried the package-building pipeline more or less alone since mid-2025, lately assisted by Claude Code-generated pull requests that he reviews and merges. User-filed issues on the pkgx repo (then still teaxyz/cli) peaked at 78 a quarter in early 2023 and have arrived at a rate of 2 a quarter in 2026. In tea’s Discord, the conversation since launch is upset token holders: testnet participants who completed identity verification say they’re not eligible for the airdrop, the free distribution of tokens they spent two years earning points toward, and a week after launch the official line in the channel is that nobody has said there won’t be one. “The current price is a complete joke for everyone who participated in the project,” as one user put it, while the moderation bot issues warnings for bad word usage. The member list shows two people with the Core Contributor role, and neither is a founder. The channels for the open source side of the project, the dev and package dataset discussion, have had no real activity since 2025. tea’s post blames a bad week for crypto generally, and the wider market fell that week too. But the same post admits to “decisions, timing factors, and execution details that we are reviewing internally”, and the commit history shows few people left to conduct that review. Four years, roughly $17M in disclosed venture funding, and about $2M more from the public sale produced several hundred thousand spam packages and a cleanup bill paid by registries that never had any relationship with tea. The maintainers tea set out to pay, the ones with real packages and dependents, are left holding the same token as the farmers. Data notes: commit counts are author-dated commits to non-fork repos in each GitHub org, collected via the GitHub API on June 11th 2026. Price data is GeckoTerminal hourly OHLCV for the Aerodrome TEA/USDC pool on Base. Issue counts exclude pull requests, bots, and tea team accounts. The raw data and chart scripts are in data/tea on GitHub.

Chance Miller, at 9to5Mac on Monday: Apple’s Siri team, led by Craig Federighi, held a post-WWDC keynote tech talk with members of the press this afternoon to talk through iOS 27 and the new Siri AI. During the talk, Federighi shared more details about Apple’s collaboration with Google. Federighi was joined by Amar Subramanya (vice president of AI), Mike Rockwell (Siri lead), and Sebastien Marineau-Mes (software VP). On the Google collaboration, Federighi explained: Of course, we don’t have the Gemini app as our app. In fact, none of that client code is part of how we run on iOS. For these models, we use none of the models that Google deploys to their customers, nor do we use the infrastructure and means by which they deploy models to their customers. And then, when it comes to the knowledge base, we of course don’t use Google Search or anything like that as the foundation of our system. So I hope that’s clear. The amount of the Google Assistant we use is none. So let’s talk about what we do use, or how our system is built. This “Tech Talk” was good. It was detailed and technical, and there were live on-stage demos of Siri AI in action from Mike Rockwell. I don’t think Apple is ever going to go back to live on-stage major keynotes, but I do think the company is returning to more live events, including demos. There was a big live Siri AI/Apple Intelligence session for developers Tuesday morning in Steve Jobs Theater, which also had live demos. More like this, please.  ★

Perhaps the worst UI crime in MacOS 26 Tahoe was the inexplicable decision to add inscrutable, distracting icons next to every item in the menu bar. You will recall Jim Nielsen writing about it, rightly describing it as exactly the sort of thing that Mac users look down upon in platforms like Google Docs and Windows. You will also recall Nikita “Tonsky” Prokopov writing about it, illustrating that the bad idea wasn’t even implemented well, with different Apple apps using entirely different icons for the same menu items. You will also recall my linking to Nielsen (“I can tolerate being angry about UI changes Apple makes to the Mac. But I can’t tolerate being heartbroken.”) and to Prokopov (“The fact that Tahoe’s menu item icons are glaringly inconsistent and often utterly inscrutable is the fudge icing on a shit cake, but the real embarrassment is that the idea ever got past the proposal stage. No real UI or icon designers think this is a good idea. None.”) Wonderful news in MacOS 27 Golden Gate: the icons are gone. It’s like Tahoe’s menu item icons never happened. Prokopov noted it on Mastodon with before and after screenshots, and mentions that Apple has updated the Human Interface Guidelines accordingly: Use menu item icons sparingly and with purpose. Icons allow people to find menu items more quickly, and help clarify what selecting an item does. Use an icon to highlight the most common actions and key features of your app, file system locations, connected devices, visual concepts like rotating or flipping an image, and user-generated content like folders and documents. Don’t display an icon if you can’t find one that clearly represents the menu item. This updated advice in the HIG is perfect. Screenshot:

MacOS 26 Tahoe — across every Apple app on the system — is a living example of the updated HIG’s “what not to do” example illustrations (including the second section about groups within a menu). If you’re stuck using Tahoe until Golden Gate arrives, recall this tip to alleviate the problem to some extent. This is my favorite news from all of WWDC this week. I mean that. In a small way I mean it because I so loathe this aspect of MacOS Tahoe. But in a large way I mean it because it’s proof that the rot has been rooted out of Apple’s software design team. I don’t know if all the untalented hacks are gone, but the untalented magazine-designer hacks with clout and influence all left with Alan Dye. I’ve spoken with a few people from Apple’s design team and they’re all loving the work they’re doing and the direction they’re taking Apple’s platforms. Backtracking on these idiotic menu item icons was a necessary first step.