Bartender change of ownership—potential security issue?

An automated response from bartender:

Thank you for your email. We implemented Amplitude in the latest version (5.0.52) for product analytics purposes. If you want to learn more about Amplitude, you can do so here: https://amplitude.com/.

That said, we heard many complaints from users about this and are removing it in v5.0.53 which was just pushed as a Test Build.

+1 Trust point. They’re still several in the hole, it is however an improvement.

and another support email:

Agreed that communication could have been better so we have been taking steps to address the concerns raised & will be more proactive about communication moving forward. Yesterday, Ben, the original developer, published an update about the change in ownership. You can read this here.

Today, we pushed a Test Build for V5.0.53 which removes Amplitude, a product analytics tool we implemented in the previous version to help us understand the count of users that were getting stuck on the Permissions Page of our onboarding flow.

We do not store or transmit any data from users - Bartender does not have a backend. We will be laying this out more clearly so users can better understand this topic as there have been quite a few rumors about this.

The support person I’ve been corresponding with seems genuinely sorry. That is a start.

3 Likes

How did you discover it was installed?

Something was contacting an IP that belonged to Amplitude. I could see the traffic on my router. I tried a couple of different tools to confirm, including Little Snitch, I then uninstalled Bartender to confirm. SettApp said it wasn’t anything they had done. Then a colleague confirmed the traffic pattern, and a mutual friend found a Reddit thread mentioning it.

1 Like

I’ve come to the same conclusion despite using Hidden Bar. There are 12 icons in the menu bar and I never interact with them. There are perhaps two or three I’d keep for quick access like Control Centre…

Now I’m curious how people use the menu bar. If you use launcher apps, keyboard shortcuts, or desktop widgets, how are you using menu bar icons?

[Note: I use Alfred and keyboard shortcuts. No widgets.]

This event has caused me to review my menu bar, and I got rid of a lot of lurkers. What remains are divided into 2 camps: “essential” and “nice to have”.

My essentials are Tot, Time Machine, Backblaze and Next Meeting. I want the latter 3 there so I can easily check the status, and the first one lives in the menu bar because that’s how it’s designed.

Probably the weirdest thing I have is the Keyboard icon which allows me to switch to the Swedish keyboard without digging through settings. Maybe there’s a way to do this via Alfred, but I haven’t found it. (And I probably wouldn’t learn it because I don’t do it often enough.) It also lets me get to Character Viewer, which I sometimes need when I’m fighting with fonts in Adobe.

Next up is doing the same thing with my MacBook Air, which is where I really needed Bartender.

I’m not at my Mac right now, but I have too many to fit even on an older MacBook without a notch. I like the quick access and don’t want to be forced to pick and choose which ones to completely eliminate.

Plus I like using the Fantastical feature that always shows my next upcoming event in the menubar, which uses up a lot of space. There are other apps like One Thing that similarly display information in the menubar but reduce the space available for icons.

2 Likes

Available here (under the ‘Test Builds’ tab) - with the following release notes:

Bartender is now part of the Applause family! We’re a small team of indie devs based in NYC that has been using Bartender for years. We’re excited to continue delivering updates and improvements to make Bartender better than ever.

We are enhancing privacy in this update by removing Amplitude product analytics, which was added in version 5.0.52. This was originally included to count the number of users encountering issues with permissions outlined here: Bartender 5 - macOS Permissions Issues.

1 Like

Same here. I’m not going to make any knee jerk reactions. Bartender 4 meets my needs. I’ll look for a replacement when that changes

2 Likes

Lots of software collects user data but more often than not you can opt in or out. So Bartender just didn’t communicate re this nor offer a opt out function. If you search around you might find other stuff like this. My version of PDF Expert sends stuff to amplitude and nowhere where you can turn this off within the app. The other issue is that I recently scanned an article that said a typical user would need 4 months a year reading to keep up with software terms of use and privacy standards. :rofl:

3 Likes

Just to add to what I said above:

launcher apps: They open the full app instead of a compact, handy pulldown menu.

keyboard shortcuts: If I don’t use them frequently enough I too easily forget them—and the icons I keep hidden but readily available with an app like Bartender tend to fall into that category. And there are just so many hotkeys to go around.

desktop widgets: I don’t use them.

2 Likes

When I read about this I told Bartender not to start at login and quit it. Like David, I’ll wait a little while before uninstalling, though on balance so far, I don’t think it’s going to last.

Like others, I’ve had a bit of a “spring” clean (it’s winter here) to remove some apps I don’t really use any more, plus turned off some where I can (including several macOS ones). There are others I wish I could turn off (like Dropbox) but oh well.

For now, I’m making do with BTT’s feature, having carefully positioned its icon in the right spot for “left of me” toggling.

What do I have up there that I want there at all?

  • A few macOS ones — battery, Time Machine, wifi.
  • SoundSource, ProtonVPN, HomeControl are there for frequent actions.
  • iStat (disk, network, CPU), my “stand reminder” app, BusyCal for info.
2 Likes

This is an outright lie, which is unsurprising, given that they are in damage-control mode now. They never would have told anyone about the change in ownership had the story not erupted on reddit the other day and had it not been covered across all of Apple-focused media. Now, of course, they are a small team of indie devs and huge fans of Bartender to make them likeable (awww!); in reality, they are a venture capitalist fund focused on monetising the hell out of existing apps.

They did not need the tracking, analytics, and telemetry to count the number of users encountering permissions issues because, with the very same release, they silently and sneakily updated the developer certificate, requiring everyone to approve permissions again.

So, without any tracking spyware, we can confidently say that about 100% of users had issues with permissions following their update. And they are now enhancing privacy by removing the tracking spyware they themselves introduced to begin with.

4 Likes

The sad side of this point is that those “issues” with permissions and how they are spinning the “permission issue” even right now gives me pause. They have been caught pants down and they still are unable to be transparent.

As far as I am concerned: the update to Bartender .52 was the first time MacOS actively has pointed me to a potential security issue. I failed to judge it properly. I will explain why. Bartender does need permissions by design that are very far reaching. MacOS has detected that somebody has changed the certificate. This can mean a security breach or something like a new developer. MacOS gave me the chance to think about this. Which I did after not being able to give Bartender the needed permissions after the update. After a web search I found this:

I was pleased to find information about my issue on “my trusted developer’s website” (little did I know).

If you’re using Bartender via Direct Download (not SetApp), run the commands below:
tccutil reset All com.surteesstudios.Bartender;

After issuing this terminal command eliminating the old developer’s permissions, I was able to enable the permissions needed for the new version.

Issue resolved? Well, from the developer’s point of view: for sure. From my point of view? No. Even today they do not disclose on the aforementioned website what the cause is for this permissions dance: the owner has silently changed and he has decided to basically convert Bartender to a potential data grabber by implementing Amplitude, without disclosing it to the user. I have no idea about the US, but I have doubts about this being legal in Europe. Which may be one of the reasons why they have released the next update removing Amplitude. To say that they implemented Amplitude in order to deal with the “permissions issue” is cheeky or naive. I have no idea.

Like I said, even as of today the new developer does not really communicate what he has done and why. Even as of today the support page dealing with permissions says:

Fortunately, there are a few ways to get around this Mac issue.

Mac issue?

What Mac issue?

To a certain extent, I am grateful to the new developer. I will be more careful in the future to think about granting permissions and to ask myself, if a little tool like Bartender should have them in the first place, no matter how convenient it is. I also have done a little spring cleaning to get rid of some stuff sitting in my menu bar without me ever interacting with it via the menu bar.

And no, no Bartender for me. And nothing else from this developer.

5 Likes

I’ve actually found this incident very useful, because I have gone through my menu bar and brutally analysed what I actually use in it and removed what I don’t need. For example, I never click on the Drafts menu bar icon so it’s silly having it up there. Likewise Popclip, etc. Actually sitting down and asking myself what I actually use (not what I aspire to use!) has really stripped my menu bar. I basically just want Shortcuts, screen brightness (Lunar app), NordVPN, Moom, Toggl Track and my calendar showing. Everything else can go in the bin!

3 Likes

The keyboard icon can also be removed if it’s just about switching input languages and keyboards. In Settings > Keyboard > Keyboard Shortcuts > Input Sources, there are two shortcuts for cycling through all the installed languages.

I believe the defaults are Ctrl+Option+Space to cycle through all of them (watch the keyboard icon as you do this) and Ctrl+Space for a language picker. The Globe key can also be assigned to switching the input source.

1 Like

Also on the roadmap for BTT, apparently.

Coming soon!

6 Likes

Neat! BTT’s reaction to this news cycle has been a compliment to his software architecture and knowledge.

The free market is a wonderful thing!

Hopefully BTT is not bought up by venture capital too

For now, I’ve downgrade to Bartender 5.0.49. It costs me nothing to do so, and I can keep running that reliably for as long as it doesn’t break. I’m sure we’ll all be kept abreast of changes to the app at this point.