On June 18, 2024, the first round of Copilot+ PCs arrived, including offerings from Microsoft, HP, Asus Acer, Dell, and Lenovo. I was lucky enough to land a Lenovo Yoga Slim 7x on June 21^st and have been digging into its capabilities and limitations ever since.

Over the weekend, I stumbled upon a situation that is both unsurprising and disturbing — namely, that there are very, very few image backup and restore tools that work with the ARM64-based version of Windows 11 24H2 that ships on all currently available Copilot+ PCs.

Searching for working image backup packages

Indeed, a concerted series of Google and Bing searches have turned up exactly three software programs that can back up and restore ARM64 versions of Windows (all of which run only on Snapdragon X CPUs at present, though AMD64 versions on Intel and AMD CPUs are expected in the next month or two).

Two of those three options are at least mildly questionable, as I’ll explain:

1. Zinstall FullBack is a full-featured backup and restore package that performs constant incremental backups to a local or networked drive, or into the cloud. Zinstall has been active in the ARM side of Windows backup since Microsoft released early versions of Windows on ARM (WoA) for the Surface Pro X in November 2019. The vendor offers a free 30-day trial, and then charges US$14.90 per month thereafter to use the software.

A bare-metal restore to a non-booting PC will first require a clean Windows install on that machine (I’d recommend an ARM64 ISO from UUP dump), and then installing the Zinstall application. After that, you can restore a backup from your collection of prior snapshots and overwrite the temporary install with that install to pick up where it left off.

2. Microsoft’s Backup and Restore (Windows 7) Control Panel item is still available in Windows 11 24H2. As you can see in this Microsoft Learn article, Windows 7 Backup and Restore has been deprecated since the release of Windows 8 in 2012. This tool is intended to restore existing Windows 7 backups to newer Windows PCs, but it can back up and restore newer versions as well. It’s not a production-grade tool.

3. Version 6.0 of the Veeam Agent (which works with the company’s various backup and replication enterprise-grade solutions) has been force-fit to back up on ARM-based CPUs as of March 2023 (see the end of this R&D Forums note). It can be restored using a Veeam Agent running on an X64 PC. Here again, this appears to be something of a kludge.

Just for grins, I checked all of the backup packages mentioned in Tim Fisher’s November 2023 Lifewire article 32 Best Free Backup Software Tools. None of them supports ARM64 CPUs, either.

The Windows Backup option

When I asked Microsoft to comment on the situation, a spokesperson pointed me to the Microsoft support page for the Windows Backup app built into Windows 11, indicating that this tool provides a backup and recovery solution for ARM-based PCs. It does, but not completely.

As I discuss in a recent article on the new backup, recovery, and repair tools in Windows 11, the Windows Backup app is undoubtedly a useful tool for backing up files and folders, apps, settings, and credentials and restoring same. But its restore operation is not as seamless as when using dedicated image backup software, and it doesn’t easily scale up for enterprise use. Indeed, it requires one-at-a-time reinstall of all Windows apps and applications (through links in the Start menu) to fully restore a Windows 11 PC to match its backed-up installation state.

In other words, making complete image backups that can be quickly and easily restored requires third-party image backup software.

Get real about backup and restore in Copilot+ PCs

Realistically, Zinstall FullBack appears to be the only viable option for backing up and restoring Copilot+ PCs with Snapdragon X Elite and Snapdragon X Plus CPU models. (Elite models include X1E-00-1DE, X1E-84-100, X1E-80-100, and the X1E-78-100 found in the Lenovo Yoga Slim 7X; Plus models include X1P-64-100.)

Buyers considering an investment in the current crop of Copilot+ PCs should ponder this potential limitation (among others) carefully. They should also consider that the upcoming collection of Intel- and AMD-based Copilot+ PCs will work with all currently available Windows 11-compatible image backup and restore tools and platforms.

The UK’s Competition and Markets Authority (DMA) on Tuesday announced the start of an inquiry into Microsoft’s hiring of employees from Inflection for its consumer AI group, and its approximately $650 million payment to license the company’s technology.

Inflection cofounders Mustafa Suleyman and Karén Simonyan, along with a number of other colleagues, joined Microsoft in March; Suleyman became executive vice president and CEO of the newly-formed Microsoft AI, Simonyan joined as chief scientist for the group.

At issue is whether Microsoft’s actions constituted what the CMA called “a relevant merger situation,” and if so, whether the moves will substantially lessen competition in the UK.

The inquiry begins July 17, with a decision on whether to proceed with further investigation to be announced Sept. 11.

“Regulators are right to challenge these practices, as they can potentially stifle innovation and competition,” said Phil Brunkard, executive counselor at Info-Tech Research Group, UK. “Start-ups thrive on the creativity and vision of their founders and the unique ideas they bring to the table.

“Competition is essential for fostering creativity and innovation, and we should encourage start-ups to grow independently, allowing competition to develop naturally,” he said. “This ensures that investment is based on merit, rather than allowing dominant players to define the rules of competition on their own terms.”

UK regulators aren’t the only ones to call the activities into question. In June, the US Federal Trade Commission (FTC) launched an investigation to determine whether there actually was an undisclosed acquisition through the hiring of key personnel and the licensing agreement.

The European Union is also closely monitoring developments. Reuters reported in April that EU antitrust chief Margrethe Vestager was watching to see whether other companies emulate Microsoft’s strategy of a talent and technology transfer in place of a formal merger. If it becomes a trend that circumvents the rules around mergers and competition, she told Reuters, she might act.

Since the release of Apple’s iOS 18 developer beta 2, Rich Communication Suite (RCS) support has come to messaging on iPhones. That means you can look forward to a more platform-agnostic messaging experience than before, making messaging between work colleagues, partners, and friends better than before — sometimes by satellite.

What is Rich Communication Suite (RCS)?

The Global System for Mobile Communications Association (GSMA)-defined RCS standard aims to improve on standard SMS messaging with the addition of a suite of features you usually find on platforms like iMessage or WhatsApp. That means support for group chat, file transfers, typing notifications and more.

Initial work by the GSMA identified some successful customer engagement, marketing, and event communications usage scenarios for enterprise users. While Apple was highly resistant to implementing the standard on its devices, it has now changed its mind, partly as regulators began to question the decision not to offer such support. 

Apple has made one recent reference to RCS. “When messaging contacts who do not have an Apple device, the iMessages app now supports RCS for richer media and more reliable group messaging compared to SMS and MMS,” the company said in June.

What does RCS support on iPhone?

At present, RCS promises support for higher quality photos and videos, audio messages, and larger file sizes for attachments. It also provides read receipts and typing indicators, cross platform emoji reactions, and location sharing. Users can expect:

• Group chat.
• File transfers.
• Typing notifications.
• Higher resolution photos and video. 
• Audio messages.
• Read receipts.
• Typing indicators.
• Location sharing.
• Cross platform emoji.

You will know when you’re in an RCS chat with an Android user because you’ll see a small grey label that says RCS Message in the text field.

Is RCS safe to use?

RCS is not as secure as iMessage but does provide better encryption than you’ll get using SMS. It is possible that Apple will implement a more secure version of RCS in time, but as things stand, the most secure messaging option remains iMessage because it delivers end-to-end encryption.

What this means for iPhone users

The first thoughts on how RCS works between iPhones and Android devices are pretty positive. The images you share will be high-res rather than deeply compressed. Read receipts and typing indicators flow between both platforms. Standard Tapback responses also work, meaning you can send reactions to messages using that system. 

You won’t get access to text formatting or some of the other new iMessage features — and RCS messages remain encased in green bubbles with an accompanying label that tells you this was a Text Message in the RCS format.

Apple’s hierarchy of texts

There is a hierarchy to how messaging is handled. That means if two Apple devices are used to communicate, they will use Apple’s iMessage, which continues to be the best messaging experience on iPhones. 

If an Apple device is communicating with an Android device, the exchange will take place over RCS, and if the carrier doesn’t support RCS or there is no active data connection the messaging all takes place over SMS. At the risk of sounding obvious, SMS lacks the more advanced messaging features you will find in either of the other standards, and Apple’s approach still means iMessage is the best option.

What is the road map for RCS improvement?

The RCS experience will improve over time. The GSMA Association last month finalized the latest update to the standard, adding support for replies and reactions and the ability to edit, recall, and delete messages sent earlier for both parties. 

The update also includes a tool to report spam messages and additional support for Custom Reactions, which may mean that Genmoji and Photomoji will become more cross platform. Apple is working with Google and members of the GSMA to improve the standard worldwide, which implies features such as the ability to edit and delete messages should be available via RCS at some point.

How do I enable RCS on my iPhone?

If you are running the latest iOS 18 beta you can enable RCS in Settings>Apps>Messages, where you should find an RCS toggle. If you don’t see that, it’s likely your carrier doesn’t yet support RCS on iPhones. To support the feature, carriers need to update some of their own settings, which are usually bundled within iOS updates. It is likely more carriers will introduce support for this by the time the iOS 18 ships.

Where is RCS available?

Apple only enabled RCS support on iPhones in the second iOS 18 beta and only on some US networks. That support has now been extended to other nations and some networks, including those in Canada, Spain, France, Germany.

Please follow me on Mastodon, or join me in the AppleHolic’s bar & grill and Apple Discussions groups on MeWe.

Apple Intelligence isn’t entirely Apple’s intelligence; just like so many other artificial intelligence (AI) tools, it also leans into all the human experience shared on the internet because all that data informs the AI models the company builds.

That said, the company explained where it gets the information it uses when it announced Apple Intelligence last month: “We train our foundation models on licensed data, including data selected to enhance specific features, as well as publicly available data collected by our web-crawler, AppleBot,” Apple explained.

Your internet, their product

Apple isn’t alone in doing this. In using the public internet this way, it is following the same approach as others in the business. The problem: that approach is already generating arguments between copyright holders and AI firms, as both sides grapple with questions around copyright, fair use, and the extent to which data shared online is commodified to pour even more cash into the pockets of Big Tech firms. 

Getty Images last year sued Stability AI for training its AI using 12 million images from its collection without permission. Individual creatives have also taken a stance against these practices. The concern is the extent to which AI firms are unfairly profiting from the work humans do, without consent, credit, or compensation.

In a small attempt to mitigate such accusations, Apple has told web publishers what they have to do to stop their content being used for Apple product development. 

Can you unmake an AI model?

What isn’t clear is the extent to which information already scraped by Applebot for use in Apple Intelligence (or any generative AI service) can then be winnowed out of the models Apple has already made. Once the model is created using your data, to what extent can your data be subsequently removed from it? The learning — and potential for copyright abuse — has already been baked in.

But where is the compensation for those who’ve made their knowledge available online? 

In most cases, the AI firms argue that what they are doing can be seen as fair use rather than being any violation of copyright laws. But, given that what constitutes fair use differs in different nations, it seems highly probable that the evolving AI industry is heading directly toward regulatory and legal challenges around their use of content.

That certainly seems to be part of the concern coming from regulators in some jurisdictions, and we know the legal framework around these matters is subject to change. This might also be part of what has prompted Apple to say it will not introduce the service in the EU just yet.

Move fast and take things

Right now, AI companies are racing faster than government regulation. Some in the space are attempting to side-step such debates by placing constraints around how data is trained. Adobe, for example, claims to train its imaging models only using legitimately licensed data. 

In this case, that means Adobe Stock images licensed content and older content that is outside of copyright.

Adobe isn’t just being altruistic in this — it knows customers using its generative AI (genAI) tools will be creating commercial content and recognizes the need to ensure its customers don’t end up being sued for illegitimate use of images and other creative works. 

What about privacy?

But when it comes to Apple Intelligence, it looks like the data you’ve published online has now become part of the company product, with one big exception: private data.

“We never use our users’ private personal data or user interactions when training our foundation models, and we apply filters to remove personally identifiable information like social security and credit card numbers that are publicly available on the Internet,” it said. 

Apple deserves credit for its consistent attempts to maintain data privacy and security, but perhaps it should develop a stronger and more public framework toward the protection of the creative endeavors of its customer base.

Please follow me on Mastodon, or join me in the AppleHolic’s bar & grill and Apple Discussions groups on MeWe.

The AI landscape is undergoing a transformative shift as chipmakers, traditionally focused on hardware innovation, are increasingly recognizing the pivotal role of software.

This strategic shift is redefining the AI race, where software expertise is becoming as crucial as hardware prowess.

AMD’s recent acquisitions: a case study

AMD’s recent acquisition of Silo AI, Europe’s largest private AI lab, exemplifies this trend. Silo AI brings to the table a wealth of experience in developing and deploying AI models, particularly large language models (LLMs), a key area of focus for AMD.

This acquisition not only enhances AMD’s AI software capabilities but also strengthens its presence in the European market, where Silo AI has a strong reputation for developing culturally relevant AI solutions.

“Silo AI plugs important capability gap [for AMD] from software tools (Silo OS) to services (MLOps) to helping tailor sovereign and open source LLMs and at the same time expanding its footprint in the important European market,” said Neil Shah, partner & co-founder at Counterpoint Research.

AMD’s move follows its previous acquisitions of Mipsology and Nod.ai, further solidifying its commitment to building a robust AI software ecosystem. Mipsology’s expertise in AI model optimization and compiler technology, coupled with Nod.ai’s contributions to open-source AI software development, provides AMD with a comprehensive suite of tools and expertise to accelerate its AI strategy.

“These strategic moves strengthen AMD’s ability to offer open-source solutions tailored for enterprises seeking flexibility and interoperability across platforms,” said Prabhu Ram, VP of industry research group at Cybermedia Research. “By integrating Silo AI’s capabilities, AMD aims to provide a comprehensive suite for developing, deploying, and managing AI systems, appealing broadly to diverse customer needs. This aligns with AMD’s evolving market position as a provider of accessible and open AI solutions, capitalizing on industry trends towards openness and interoperability.”

Beyond AMD: A broader industry trend

This strategic shift towards software is not limited to AMD. Other chip giants like Nvidia and Intel are also actively investing in software companies and developing their own software stacks.

“If you look at the success of Nvidia, it is driven not by silicon but by software (CUDA) and services (NGC with MLOps, TAO, etc.) it offers on top of its compute platform,” Shah said. “AMD realizes this and has been investing in building software (ROCm, Ryzen Aim, etc.) and services (Vitis) capabilities to offer an end-to-end solution for its customers to accelerate AI solution development and deployment.”

Nvidia’s recent acquisition of Run:ai and Shoreline.io, both specializing in AI workload management and infrastructure optimization, also underscores the importance of software in maximizing the performance and efficiency of AI systems.

But this doesn’t mean chipmakers follow similar trajectories toward their goals. Manish Rawat, semiconductor analyst at Techinsights pointed out that for a large part, Nvidia’s AI ecosystem has been established through proprietary technologies and a robust developer community, giving it a strong foothold in AI-driven industries.

“AMD’s approach with Silo AI signifies a focused effort to expand its capabilities in AI software, positioning itself competitively against Nvidia in the evolving AI landscape,” Rawat added.

Another relevant example in this regard is Intel’s acquisition of Granulate Cloud Solutions, a provider of real-time continuous optimization software. Granulate assists cloud and data center clients in optimizing compute workload performance while lowering infrastructure and cloud expenses.

Software to drive differentiation

The convergence of chip and software expertise is not just about catching up with competitors. It’s about driving innovation and differentiation in the AI space.

Software plays a crucial role in optimizing AI models for specific hardware architectures, improving performance, and reducing costs. Eventually, software could decide who rules the AI chip market.

“The bigger picture here is that AMD is obviously competing with NVIDIA for supremacy in the AI world,” said Hyoun Park, CEO and chief analyst at Amalgam Insights. “Ultimately, this is not just a question of who makes the better hardware, but who can actually back the deployment of enterprise-grade solutions that are high-performance, well-governed, and easy to support over time. And although Lisa Su and Jensen Huang are both among the absolute brightest executives in tech, only one of them can ultimately win this war as the market leader for AI hardware.” 

The rise of full-stack AI solutions

The integration of software expertise into chip companies’ offerings is leading to the emergence of full-stack AI solutions. These solutions encompass everything from hardware accelerators and software frameworks to development tools and services.

By offering a comprehensive suite of AI capabilities, chipmakers can cater to a wider range of customers and use cases, from cloud-based AI services to edge AI applications.

For instance, Silo AI, first and foremost, brings an experienced talent pool, especially working on optimizing AI models, tailored LLMs, and more, according to Shah. Silo AI’s SIloOS particularly is a very powerful addition to AMD’s offerings allowing its customer to leverage advanced tools and modular software components to customize AI solutions to their needs. This was a big gap for AMD.

“Thirdly, Silo AI also brings in MLOps capabilities which are a critical capability for a platform player to help its enterprise customers deploy, refine and operate AI models in a scalable way,” Shah added. “This will help AMD develop a service layer on top of the software and silicon infrastructure.”

Implications for enterprise tech

The shift of chipmakers from purely hardware to also providing software toolkits and services has significant ramifications for enterprise tech companies.

Shah stressed that these developments are crucial for enabling enterprise and AI developers to fine-tune their AI models for enhanced performance on specific chips, applicable to both training and inference phases.

This advancement not only speeds up product time-to-market but also aids partners, whether they are hyperscalers or manage on-premises infrastructures, in boosting operational efficiencies and reducing total cost of ownership (TCO) by improving energy usage and optimizing code.

“Also, it’s a great way for chipmakers to lock these developers within their platform and ecosystem as well as monetize the software toolkits and services on top of it. This also drives recurring revenue, which chipmakers can reinvest and boost the bottom line, and investors love that model,” Shah said.

The future of AI: a software-driven landscape

As the AI race continues to evolve, the focus on software is set to intensify. Chipmakers will continue to invest in software companies, develop their own software stacks, and collaborate with the broader AI community to create a vibrant and innovative AI ecosystem.

The future of AI is not just about faster chips — it’s about smarter software that can unlock the full potential of AI and transform the way we live and work.

Microsoft released 132 updates in its July Patch Tuesday update while addressing four zero-days (CVE-2024-35264, CVE-2024-37985, CVE-2024-38080 and CVE-2024-38112) affecting Windows desktop, Microsoft .NET and Visual Studio. This is a very significant patch cycle for Microsoft SQL Server, but there are no updates for Microsoft browsers and a low profile set of patches for Microsoft Office. No major revisions require attention, with testing focused squarely on SQL dependent applications. 

The team at Readiness has provided a useful infographic detailing the risks with each of the updates this cycle. 

Known issues 

Each month, Microsoft publishes a list of known issues included in its latest release, including two reported minor issues:

• After you install KB5034203 (dated 01/23/2024) or later updates, some Windows devices that use the DHCP Option 235 to discover Microsoft Connected Cache (MCC) nodes in their network might be unable to use those nodes. Microsoft offered two options to mitigate the issue through setting the Cache Hostname or using group policies. Microsoft is still working on a resolution.
• Context menus and dialog buttons in some Windows apps, or parts of the Windows OS user interface (UI), might display in English when English is not set as the display language. This might also affect font size.

We fully expect to see more issues relating to how the Windows UI presented over the coming months as Microsoft works through some of the core level issues with new ARM builds. This means that even non-ARM builds will be affected (see CVE-2024-37985). Look out for input method editor, language pack, and dialog box language issues for non-English builds.

Major revisions 

This Patch Tuesday saw Microsoft publishing the following major revisions to past  security and feature updates, including:

• CVE-2024-30098 : Windows Cryptographic Services Security Feature Bypass. Microsoft has added a FAQ to explain how this vulnerability is being addressed and further actions customers must take to be protected from it. This is an informational change only; no further action is required.

Mitigations and workarounds

Microsoft published the following vulnerability-related mitigations for this month’s release cycle: 

• CVE-2024-38077, CVE-2024-38076 and CVE-2024-38074: Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability. Microsoft has (rather helpfully) offered guidance that disabling the Remote Desktop licensing feature mitigates this vulnerability. 
• CVE-2024-38030: Windows Themes Spoofing Vulnerability. If you have Windows NTLM disabled, this vulnerability will not affect your system.

Each month, the Readiness team analyses the latest Patch Tuesday updates and provides detailed, actionable testing guidance based on assessing a large application portfolio and a detailed analysis of the patches and their potential impact on the Windows platforms and app installations.

For this cycle, we have grouped the critical updates and required testing efforts into different functional areas:

Microsoft Office

• Test out your Teams logins (which shouldn’t take too long).
• Because SharePoint was updated, third-party extensions or dependencies will require testing.
• Due to the change in Outlook, Internet Calendars (ICS files) will require testing.
• With the Visio update, large CAD drawings will require a basic import and load test.

Microsoft .NET and developer tools

Microsoft has updated the Microsoft .NET, MSI Installer and Visual Studio with the following testing guidance:

• PowerShell updates will require a diagnostics test. Try the command, “import-module Microsoft.powershell.diagnostics – verbose” and validate that you are getting the correct results from your home directory.
• Due to the change in the Windows core installation technology (MSI), please validate that User Account Control (UAC) still functions as expected.

Microsoft SQL Server

This month is a big update for both Microsoft SQL Server and the local, or workstation supporting elements of OLE. The primary focus for this kind of complex effort should be your line-of-business or core applications. These are the applications that have multiple data connections and rely on complex, multiple object/session requirements. Due to the changes this month, we can’t recommend specific Windows feature testing regimes, as we are most concerned that the business logic (and resulting data) of the application in question might be affected. Only you will know what looks good; we advise a comparative testing regime across unpatched and newly patched systems looking for data disparities.

Windows

Microsoft made another update to the Win32 and GDI subsystems with a recommendation to test out a significant portion of your application portfolio. We also recommend that you test the following functional areas in the Windows platform:

• File compression has been updated, so file and archive extraction scenarios will need to be exercised.
• Due to the Microsoft codec updates, perform a system reboot and test that your audio and camera still work together.
• Security updates will require the testing of the creation of new Windows certificates.
• Networking changes will require a test of DNS and DHCP, specifically the DHCP R_DhcpAddSubnetElement API. As part of these changes, testing VPN authentication will be required. Try to include your Network Policy Server (NPS) as part of the connection creation and deletion effort.
• This month’s update to Remote Desktop Services (RDS) will require the creation and revocation of license requests.
• A significant update to the Network Driver Interface Specification (NDIS) will require testing of network traffic involving repeated bursts of large files. Try using Teams while this networking burst testing is in progress.
• Backup and printing have been updated, so test your volumes and ensure that when you print out a test page, your OS does not crash (yes, really). Try printing out TIFF files. (Hey, you might like it.)

As part of the ongoing effort to support the new ARM architecture, Microsoft released the first patch for this new platform, CVE-2024-37985. This is an Intel assigned processor-level vulnerability that has been mitigated by a Microsoft OS level patch. The Readiness team has provided guidance on potential ARM-related compatibility and testing issues. 

Specifically, the Readiness team was concerned with Input Method Editors (IMEs). We suggest a full test cycle of Windows input related features such as keyboard, mouse, touch, pen, gesture and dictation. Some internet shortcuts might be affected as well as wallpapers.

Windows lifecycle update 

This section contains important changes to servicing (and most security updates) to Windows desktop and server platforms.

• Home and Pro editions of Windows 11, version 22H2 will reach end of service on Oct. 8, 2024. Until then, these editions will only receive security updates. They will no longer receive non-security, preview updates.

Each month, we break down the update cycle into product families (as defined by Microsoft) with the following basic groupings: 

• Browsers (Microsoft IE and Edge);
• Microsoft Windows (both desktop and server); 
• Microsoft Office;
• Microsoft Exchange Server ;
• Microsoft Development platforms (ASP.NET Core, .NET Core and Chakra Core)
• Adobe (if you get this far).

Browsers

Microsoft did not release any updates for its non-Chromium browsers. Following the stable channel release of Chrome (applicable until July 25, 2024) we have not seen any changes, deprecations or testing profile updates to this browser. No further action required.
 

Windows

Microsoft released four critical and 83 updates rated as important with two zero-day patches (CVE-2024-38080 and CVE-2024-38112) affecting the Microsoft Hyper-V and MSHTML feature groups, respectively. In addition to these critical updates, Microsoft patches for July affect the following Windows feature groups:

• Windows NTLM, Kernel, GDI and Graphics;
• Windows Backup;
• Windows Codecs;
• Microsoft Hyper-V;
• Windows (Line) Print and Fax ;
• Windows Remote Desktop and Gateway;
• Windows Secure Boot and Enrolment Manager.

Add these Windows updates to your Patch Now release cycle.

Microsoft Office 

Microsoft returns to form with a critical update for Office this month (CVE-2024-38023) for the SharePoint platform. We have another update for Outlook related to spoofing (CVE-2024-38020), but this vulnerability is not wormable and requires user interaction. There are four more, lower rated updates; please add all of these updates to your standard release schedule.

Microsoft SQL (nee Exchange) Server 

There were no updates for Microsoft Exchange Server this month. However, we have seen the largest release of Microsoft SQL updates in the past few years. These SQL-related updates cover 37 separate reported vulnerabilities (CVEs) and the following main product features

• SQL Server Native Client OLE DB Provider;
• Microsoft OLE DB Driver for SQL.

We covered the testing requirements for this SQL update in our testing guidance section above. This month’s SQL updates will require some preparation and dedicated testing before adding to your standard release schedule.

Microsoft development platforms 

Microsoft released four, low-profile updates to the Microsoft .NET and Visual Studio platforms. We do not expect serious testing requirements for these vulnerabilities. However, CVE-2024-35264 has been reported as publicly disclosed by Microsoft. This makes this an unusually urgent patch for Microsoft Visual Studio attracting a “Patch Now” rating this month.

Adobe Reader (and other third-party updates) 

Very much as our Microsoft Exchange section has been “hijacked” by SQL Server updates this month, we’re using the Adobe section for third-party updates. (There are no updates to Adobe Reader.) 

• CVE-2024-3596: NPS RADIUS Server. A vulnerability exists in the RADIUS protocol that potentially affects many products and implementations of the RFC 2865 in the UDP version of the RADIUS protocol. 
• CVE-2024-38517 and CVE-2024-39684: GitHub Active Directory Management Rights. The  vulnerability assigned to this CVE is in the RapidJSON library which is consumed by the Microsoft Active Directory Rights Management Services Client, hence the inclusion of this CVE with this update.
• CVE-2024-37985: This memory related update from Intel relates to its prefetcher technology. Affected: Core Windows OS memory related components — particularly the new ARM builds, which I find both confusing and ironic.

The European Commission has released the preliminary findings from an investigation launched last year into X (formerly Twitter), and said it believes the company is in breach of the Digital Services Act (DSA), which applies to marketplaces, social networks, content-sharing platforms, app stores, and online travel and accommodation platforms.

Non-compliance in three areas

In a statement, the Commission said X was found non-compliant in three areas: 

• The “verified account” mechanism is designed and implemented in a way that deceives users and does not correspond to industry practice. “Since anyone can subscribe to obtain such a ‘verified’ status, it negatively affects users’ ability to make free and informed decisions about the authenticity of the accounts and the content they interact with,” the Commission said, adding there is “evidence of motivated malicious actors abusing the ‘verified account’ to deceive users.”
• X does not comply with requirements around transparency in advertising. “In particular, the design does not allow for the required supervision and research into emerging risks brought about by the distribution of advertising online,” the Commission  argued.
• X does not provide access to its public data to researchers, as specified by conditions in the DSA. Its terms of service prohibit researchers from independently accessing public data, and its process for granting researchers access via its application programming interfaces (APIs) “appears to dissuade researchers from carrying out their research projects or leave them with no other choice than to pay disproportionally high fees.”

X now has the right to examine the commission’s documentation and prepare a defense. 

If the preliminary findings are confirmed, the company faces a non-compliance decision that could result in fines of up to 6% of its global annual revenue, an order to address the issues detailed in the decision, and the potential for a period of enhanced supervision. The commission  can also impose periodic penalty payments.

The move could be seen as a warning shot to other companies.

“While the ruling may not have a direct impact on enterprise CIOs, it emphasizes learning from broader implications and the mistakes of others,” said Phil Brunkard, executive counselor at Info-Tech Research Group, UK. “It sets a precedent for public trust in online marketplaces or social media, highlighting the importance of integrity and transparency in data privacy. Regulation is not just about ticking the compliance box — it’s crucial for customer trust. CIOs must ensure strong governance to protect their brands and maintain customer trust, as trust is the foundation for successful organizations.”

Investigations continue

Investigations continue into X’s risk management around the dissemination of illegal content and the effectiveness of how it combats information manipulation.

To assist in its investigations, the Commission released a whistleblower tool that allows people to contact it anonymously with information contributing to compliance monitoring of X and other entities designated Very Large Online Platforms (VLOP) under the DSA.

X is not the only organization under scrutiny. The Commission has also initiated formal proceedings against TikTok, Meta (in separate proceedings launched in April and May 2024, respectively), and AliExpress.

Unified endpoint management (UEM) describes a set of technologies used to secure and manage a wide range of employee devices and operating systems — all from a single console.

Seen as the next generation of mobility software, UEM tools incorporate several existing enterprise mobility management (EMM) technologies — including mobile device management (MDM) and mobile application management (MAM) — with some of the tools used to secure desktop PCs and laptops.

“UEM in theory ties this all together and gives you that proverbial one pane of glass, so you can see the state of all of your endpoints,” said Phil Hochmuth, program vice president at IDC. “It gives you visibility into what people are doing with corporate data, corporate apps, on any conceivable type of device.”

The ability to manage various device types in one place is increasingly important as businesses face a growing cybersecurity threat, said Tom Cipolla, senior director analyst at Gartner. “We need to patch faster; everybody acknowledges that,” he said. “UEM gives people a consolidated view into their environment and a consolidated patching and configuration management approach.”

The evolution of mobile management – MDM, MAM, and more

At its core, UEM consists of several device management technologies that emerged to help businesses control employee mobile devices. The first iteration of such tools was MDM, which arrived about a decade ago.

Introduced in response to the initial wave of smartphones used in the workplace, MDM was designed to help IT centrally provision, configure, and manage mobile devices that had access to corporate systems and data. Common MDM features included security configuration and policy enforcement, data encryption, remote device wipe and lock, and location tracking.

However, as employee bring-your-own-device (BYOD) schemes became more prevalent in the office — driven first by the iPhone’s popularity, later by the growth of Android — vendors began to offer more targeted management of apps and data. MAM capabilities delivered more granular controls, focusing on software rather than the device itself; features include app wrapping and containerization, and the ability to block copy/paste or restrict which apps can open certain files.

MAM features were soon packaged with MDM and other tools, such as mobile identity management and mobile information management, and sold as comprehensive enterprise mobility management (EMM) product suites. Those suites led to the next stage in the evolution of device management: UEM.

What is UEM?

UEM merges the various facets of EMM suites with functionality typically found in client management tools (CMT) used to manage desktop PCs and laptops on a corporate network. One example is Microsoft’s Intune, which combined its MDM/MAM platform with Configuration Manager (formerly System Center Configuration Manager) in 2019.

UEM platforms tend to have comprehensive operating system support, including mobile (Android, iOS) and desktop OSes (Windows 11, macOS, ChromeOS, and, in some cases, Linux). Some UEM products support more esoteric categories too, including IoT devices, AR/VR headsets, and smartwatches.

Unlike traditional CMT products, UEM tends to be available as a software-as-a-service, cloud-based tool, allowing management and updates of devices such as desktop PCs without connection to a corporate network. 

The emergence of UEM has been partly driven by the inclusion of API-based configuration and management protocols within Windows and macOS, enabling the same level of device management that was already possible with iOS and Android devices.

It speaks to a wider development, too, of the convergence of mobile and traditional computing devices, with high-end tablets often on par with laptops in terms of processing power. “You have a real blurring of the lines between what is mobile computing and what is traditional endpoint computing,” said Hochmuth.

Why invest in UEM tools?

All of these devices — mobile, desktop, Windows, Mac, in the office and remote — require a unified approach to end user device management, an approach that can provide a variety of benefits, say analysts.

Among these is the opportunity for simplified and centralized management. In short, it’s more efficient for one team to provision and manage all devices from a single tool, rather than have separate support teams and tools that were traditionally divided between mobile and Windows or macOS computers. 

“If you have a separate software product or management platform for four different operating systems, that can be cumbersome and expensive,” said IDC’s Hochmuth. “Converging down to one or two is a goal for a lot of organizations.”

UEM products can reduce manual work for IT, with the ability to create a single policy — such as requiring device encryption — that can be deployed to many devices and operating systems. The same goes for patching.  

By ensuring consistent policies across apps, devices and data, UEM tools can reduce risk, with less complexity and fewer opportunities to misconfigure policies. 

There are cost benefits in replacing separate PC and mobile management applications too. “Getting rid of one software platform and all the licensing associated with that is a cost saving. That’s not the primary driver, but it’s definitely a reason to explore UEM,” said Hochmuth. 

The UEM vendor market

The global market for unified endpoint management software is forecast to grow from $5.9 billion in 2023 to $8.9 billion in 2028, according to IDC data. The rate of yearly growth is set to slow, however, from around 16% to 6% during this period. 

There are a variety of vendors, from big-name firms to smaller, more targeted companies. Microsoft (Intune) and VMware/Broadcom (Workspace One) are often considered the UEM market leaders with the broadest offerings and largest market share by revenue. BlackBerry UEM, Citrix Meraki Systems Manager, IBM MaaS360, ManageEngine, Cisco, and Ivanti UEM are also popular products.

“All these companies have roles or verticals or use cases that they address specifically,” said Hochmuth. For instance, BlackBerry is often viewed as strong in regulated markets, such as finance or healthcare, due its focus on encryption, while Microsoft has a more of a “horizontal” product with general business use cases.  

Among the vendors that have taken a more specialized approach is Jamf, which is focused purely on Apple devices running everything from macOS to tvOS, and SOTI, whose products are tailored to certain industries, such as warehouse workers with ruggedized mobile devices.

UEM reaches mainstream adoption

Gartner defines UEM as being “a late-stage maturity market,” meaning “widespread adoption has already occurred,” said Cipolla. 

IDC data indicates that around two-thirds of US businesses have now deployed a UEM tool. That doesn’t mean most organizations will use a single UEM platform, however. 

Among those that have deployed UEM, around 70% have two or more  management products in place, said Hochmuth.   For example, an organization might have one tool to manage certain Windows devices, another for both mobile and macOS devices, and then a legacy PC management tool still in use for another set of Windows devices. “The norm is more the mixed type of organizations that have different tools and multiple UEMs,” said Hochmuth, though the trend in recent years has been towards consolidation of these tools.

What’s on the horizon for UEM? AI and autonomous endpoint management 

An ongoing trend related to UEM is the rise of digital employee experience (DEX) software. DEX tools can provide IT with data and insights into how employees interact with devices and applications, with the ability to measure usage and highlight performance problems. “That’s a growth area that all the UEM vendors are pushing into,” said Hochmuth.

Also coming to UEM tools: the integration of artificial intelligence (AI). “This space in particular, is incredibly ripe for help from an AI product,” said Hochmuth. 

AI could help manage a longtime challenge for endpoint management — scale. That’s because the wide range of devices, vulnerabilities, and configurations that have to be managed.

“The pure amount of data given off by thousands of devices running different operating systems, it’s super chaotic,” said Hochmuth. “That’s a perfect use case for an AI tool that could sift through data, help you find information you need, or even more importantly, automate a lot of the manual patching, updating, configuration – the reactionary type things that people in IT ops do. Anticipating when someone might need a fix before something breaks: AI could really help with that.”

Gartner’s Cipolla points to the emergence of autonomous endpoint management (AEM), a term that describes the combination of UEM and DEX, with additional automation and AI-assistance capabilities. “The idea is to take the human out of the middle doing the research and the leg work, and put them in control of the automation,” said Cipolla.

Several UEM vendors have already begun to incorporate AEM-like functionality into their software, said Cipolla. But it’s still early for the technology, meaning it will likely be at least a couple of years before AEM tools become more fully developed and more widely used by organizations. “It’s not a product yet, it’s a future idea, it’s a concept. As the vendors work on their ideas, it becomes a market,” he said. 

As Apple faces continued waves of regulation, Apple Pay is about to open up in Europe, allowing rival payment services to gain access to the NFC chips inside iPhones to enable one-click payments.

The motivation behind forcing Apple to open up is to stimulate competition in the mobile payments space. It should enable rival services to offer mobile payments and settles a long-running dispute between Apple and the European Commission. 

What this means to Apple Pay

Under the arrangements, Apple will allow third-party wallet providers access to the NFC chip inside iOS devices without requiring them to use Apple Pay or Apple Wallet. It means rivals can now compete directly with the Apple service, and in theory means customers can choose a payment system they prefer. This relies on an extensive number of commitments, captured in a 36-page document published today.

What Europe says

“From now on, competitors will be able to effectively compete with Apple Pay for mobile payments with the iPhone in shops,” Margrethe Vestager, executive vice president in charge of competition policy, said in a statement. “So, consumers will have a wider range of safe and innovative mobile wallets to choose from.”

EC authorities have put some steel around the agreements. They will by law remain in force for 10 years and apply throughout the EEA. “Their implementation will be monitored by a monitoring trustee appointed by Apple who will report to the Commission for the same time period,” the European Commission said.

In the event Apple fails to keep its commitments, it faces a fine of up to 10% of its total annual turnover without having to find an infringement of EU antitrust rules, or a “periodic penalty” payment of 5% per day of its daily turnover for every day of non-compliance.

How will it work?

A look at the 36-page agreement suggests how the new system will work. First, developers of payment systems will need to obtain entitlements to access a series of APIs Apple will make available to support rival payment systems, but only those operating in the European Economic Area. 

The company will also work to support evolving standards; developers will be subject to developer fees, but no fees related to the use of the NFC system. That sounds like Apple will not receive a cut of payments made.

For consumers, it will be possible to choose a preferred payment system (including Apple Pay) with a new section in Settings. The iPhone will also maintain a register of installed payment apps that want NFC access, and you’ll be able to select which one to use, rather like rifling through payment cards in your real wallet.

You’ll also be able to use Apple Pay on Apple Watch and choose another system for your phone.

What about disputes?

If a developer/payment provider thinks they aren’t getting fair treatment from Apple, they will be able to submit a written complaint to the monitoring trustee. Appointed and reimbursed by Apple and approved by the European Commission, the trustee will be an independent party who monitors the company’s compliance to the agreement.

The trustee may recruit a support team of up to three advisors, and there are strict controls in place to prevent trustees running off to work for Apple or its competitors within a certain time frame. There will also be an Appeal Board to adjudicate in the event a dispute requires independent oversight. 

What about the DMA?

Apple’s decision to reach a constructive settlement concerning Apple Pay in Europe could yet turn out to be a harbinger of similar future détente regarding Europe’s Digital Markets Act. While recent statements from Vestager suggest she has little empathy for Apple’s arguments, the company has already revised some of the arrangements it proposed to bring its business practises into line with the DMA or similar rules looming in other nations.

There’s no reason to think it won’t continue to reach a constructive, if unenthusiastic, dialogue. It does remain open to question whether the agreements will go far enough for Europe or for some of the company’s loudest critics. 

But for the next decade, at least, you’ll be able to use whatever payment system you like across the European bloc as easily as you may already use Apple Pay.

Please follow me on Mastodon, or join me in the AppleHolic’s bar & grill and Apple Discussions groups on MeWe.