HN user
AFAIK it's mostly in the US that using cards don't always require PINs. Here in Canada I have to enter my PIN whether it's my credit or debit card, for every purchase at a CC terminal. The only exception is if I'm using contactless payment. This was also true in Europe last I checked.
If I understand correctly, what's described in the article indeed uses a collision attack. The "trusted app" is one the hacker manufactures himself.
If you're paranoid enough to think someone you don't trust can have physical access to your Mac, it is possible to prevent this by setting up firmware password though.
That's a pretty boring way of preventing someone from using the API. You could easily swizzle the _popoversDisabled method and get away with it.
I remember trying to use a private API on Mac OS X and having my app receive a SIGKILL prompty after calling the function. It took me a while to find the fix: my app had to be signed. Mind you, it could be codesigned by a self-signed certificate and the system would be fine with it... these were fun times :)
I'm actually rather happy with the Apple philosophy of not opening APIs early and supporting them as long as possible when they've been made public, rather than having to check my app against 6 levels of API stability... thank you very much.
Not to mention bandwidth which can in some cases be pretty expensive.
I'm pretty sure they definitely don't count, as DOF is a ratio of focusing distance IIRC. Also the DOF would be far more shallow with a DSLR and a fast lens in the same conditions (close focus).
There are a number of other drafting sites running around. The current stance of WOTC seems to be that sites that don't let you play but only let you simulate drafts or help you in deckbuilding are ok...
Objective-C is from 1983, do you? It's not exactly new
The dot-syntax for accessing object properties is much more recent though (2009?).