BBEdit 14 is out and has added a new “Notes” feature, which provides a large variety of ways to create notes that automatically save themselves, and, perhaps more important, automatically title themselves so that you don’t end up wondering which of your 305 “untitled text” documents is the one you’re looking for.

BBEdit 14 enables several new features and significant improvements to its built-in coding aids for developers, including:

• Enhanced language-specific text completions;
• Improved Find Definition;
• Assistance for specifying function parameters;
• New code-navigation features;
• In-window highlighting of syntax and semantic issues;
• Language-specific document reformatting.

These feature improvements are the result of new built-in support for the Language Server Protocol (“LSP”) by which user-installed local “language servers” implement key language-sensitive behaviors.

My thanks to Unite for sponsoring The Loop this week. Unite 4 for macOS allows you to turn any website into an app on your Mac. Using a lightweight, WebKit powered browser as a backend, you can easily create isolated, customizable apps from any site.

Unite 4 includes dozens of new features, including support for native notifications, new customization options, M1 support, and much more. Unite apps also serve as a great alternative for resource hogging Electron apps or half-baked Catalyst apps.

Some examples of apps you could create in mere minutes with Unite:

• A Gmail web client that behaves like a native mail client.
• A status bar app for Apple Music or Overcast
• An isolated workspace for apps that may track you like Facebook
• A lightweight and power efficient version of Slack, Discord, or Whatsapp with full notification support
• A fully featured Instagram app that has a resizable window, unlike the M1 version.
• A Robinhood, Figma, or Roam Research app for your desktop.

The Loop readers get 20% off this week when you purchase Unite 4 or when you use the promo code ‘LOOPINSIGHT’ at checkout.

You can also try Unite for 14 days absolutely free or use it as part of your subscription if you’re a Setapp subscriber!

Google Project Zero blog:

> We want to thank Citizen Lab for sharing a sample of the FORCEDENTRY exploit with us, and Apple’s Security Engineering and Architecture (SEAR) group for collaborating with us on the technical analysis.

And:

> Recently, however, it has been documented that NSO is offering their clients zero-click exploitation technology, where even very technically savvy targets who might not click a phishing link are completely unaware they are being targeted. In the zero-click scenario no user interaction is required. Meaning, the attacker doesn’t need to send phishing messages; the exploit just works silently in the background. Short of not using a device, there is no way to prevent exploitation by a zero-click exploit; it’s a weapon against which there is no defense.

And:

> The ImageIO library, as detailed in a previous Project Zero blogpost, is used to guess the correct format of the source file and parse it, completely ignoring the file extension. Using this “fake gif” trick, over 20 image codecs are suddenly part of the iMessage zero-click attack surface, including some very obscure and complex formats, remotely exposing probably hundreds of thousands of lines of code.

There’s a lot of detail here, fascinating if understanding exploits is your thing. But bottom line, a fake GIF is used to Trojan horse image processing code into life, and that code does the bad work, no clicks required.

Most importantly:

> Apple inform us that they have restricted the available ImageIO formats reachable from IMTranscoderAgent starting in iOS 14.8.1 (26 October 2021), and completely removed the GIF code path from IMTranscoderAgent starting in iOS 15.0 (20 September 2021), with GIF decoding taking place entirely within BlastDoor.

Make sure you (and the folks you support) update to the latest and greatest.

See also: After US ban and Apple action, Pegasus spyware maker NSO running out of cash.