Extended attributes (xattr) contain a wide range of metadata, some of which are intended to persist with the file they’re attached to, others to be more transient. Depending on the type of file operation performed, macOS has an elaborate mechanism for determining which are preserved, and which are not. This article tries to explain how this works in macOS Tahoe 26.0.

Xattr flags

When first introduced in Mac OS X, no provision was made for xattrs to have type-specific preservation, and that was added later using flags suffixed to the xattr’s name. For example, the com.apple.lastuseddate xattr found commonly on edited files is shown with a full name of com.apple.lastuseddate#PS to assign the two flags P and S to it, and the most recent xattr com.apple.fileprovider.pinned, used to mark files in iCloud Drive that have been pinned, has the two flags P and X assigned to it for a the full name of com.apple.fileprovider.pinned#PX.

This is a kludge, because you normally have to refer to the xattr name including its flags, although the flags aren’t really part of its name. This can catch the unwary.

It’s further complicated by a set of system tables for some standard xattr types that don’t have flags suffixed, but are treated as if they do. One notable example of those is the quarantine xattr com.apple.quarantine, which is handled by macOS as if it has the PCS flags attached, although those are never used when referring to it by name.

There are also lower case flags that can be used to override those set in system tables, although those appear to be used exceedingly rarely, and I don’t recall ever coming across them. In theory, if you were using a new type based on the standard com.apple.metadata: family, com.apple.metadata:kMDItemNew, you could alter its behaviour to some similar types with the flags psB, as in com.apple.metadata:kMDItemNew#psB. I have no idea whether that would be respected in practice. For the rest of this article, I will ignore the existence of those lower case flags.

Intents

File operations involving decisions about the preservation of xattrs are simplified into the following intents:

• copy – simply copying a file from a source to a destination and preserving its data, such as using cp, is labelled XATTR_OPERATION_INTENT_COPY
• save – saving a file when probably changing its content, including performing a ‘safe save’; this may over-write or replace the source with the saved file. Some xattrs shouldn’t be preserved in this process of XATTR_OPERATION_INTENT_SAVE
• share – sharing or exporting this file, perhaps as an attachment to email, or placing the file in a public folder. Some sensitive metadata shouldn’t be preserved in XATTR_OPERATION_INTENT_SHARE
• sync – syncing the file to a service such as iCloud Drive, in XATTR_OPERATION_INTENT_SYNC
• backup – backing the file up, perhaps using Time Machine, in XATTR_OPERATION_INTENT_BACKUP.

Flags

As of macOS 15.0 (including 26.0), the following flags are supported:

• C: XATTR_FLAG_CONTENT_DEPENDENT ties the flag with the file contents, so the xattr has to be recreated when the file data changes. This may be appropriate for checksums and hashes, text encoding, and position information. The xattr is then preserved for copy and share, but not in a safe save.
• P: XATTR_FLAG_NO_EXPORT doesn’t export or share the xattr, but preserves it during copying.
• N: XATTR_FLAG_NEVER_PRESERVE ensures the xattr is never preserved, even when copying the file.
• S: XATTR_FLAG_SYNCABLE ensures the xattr is preserved during syncing with services such as iCloud Drive. Default behaviour is for xattrs to be stripped during syncing, to minimise the amount of data to be transferred, but this flag overrides that.
• B: XATTR_FLAG_ONLY_BACKUP keeps the xattr only in backups, including Time Machine, where there’s no desire to minimise what’s backed up.
• X: XATTR_FLAG_ONLY_SAVING keeps the xattr only when saving and in backups, including Time Machine (macOS 15.0 and later only).

There’s another system limit that must be adhered to: total length of the xattr name including any # and flags cannot exceed a maximum of 127 UTF-8 characters.

System tables

These are hard-coded in source, where * represents a ‘wild card’:

• com.apple.quarantine – PCS preserved in copy, sync, backup
• com.apple.TextEncoding – CS copy, share, sync, backup
• com.apple.metadata:kMDItemCollaborationIdentifier – B backup
• com.apple.metadata:kMDItemIsShared – B backup
• com.apple.metadata:kMDItemSharedItemCurrentUserRole – B backup
• com.apple.metadata:kMDItemOwnerName – B backup
• com.apple.metadata:kMDItemFavoriteRank – B backup
• com.apple.metadata:* (except those above) – PS copy, save, sync, backup
• com.apple.security.* – S or N depending on sandboxing, see below
• com.apple.ResourceFork – PCS copy, sync, backup
• com.apple.FinderInfo – PCS copy, sync, backup
• com.apple.root.installed – PC copy, backup.

System defaults for com.apple.security.* depend on whether the app performing the file operation is running in an app sandbox. Non-sandboxed apps apply S to preserve the xattr for copy, save, share, sync, backup; for sandboxed apps N is applied so the xattr is never preserved, even when copying the file.

Flags and intents

We can now revisit the list of intents, and establish the effects of xattr flags on each, as:

• XATTR_OPERATION_INTENT_COPY preserves xattrs that don’t have flag N or B or X
• XATTR_OPERATION_INTENT_SAVE preserves xattrs that don’t have flag C or N or B
• XATTR_OPERATION_INTENT_SHARE preserves xattrs that don’t have flag P or N or B or X
• XATTR_OPERATION_INTENT_SYNC preserves xattrs if they have flag S, or have neither N nor B
• XATTR_OPERATION_INTENT_BACKUP preserves xattrs that don’t have flag N.

Finally, Apple provides separate information on how xattrs are synced by FileProvider, for iCloud Drive and third-party cloud services using that API. This confirms that the S flag should sync a xattr, but is vague on other flags, simply stating “some older attributes are also synced”. However, a cap is applied on the maximum size of xattrs that are syncable, at “about 32KiB total for each item”. If the xattrs exceed that limit “the system automatically makes some of the attributes nonsyncable.” More puzzlingly, it states “the resource fork is content and isn’t included in the extended attributes dictionary.”

Conclusions

• Controls over the preservation of xattrs are appended as tags to their name, following a hash #. In most circumstances, they should be treated as part of that xattr’s name, and are required for commands and actions on that xattr, for example when using the xattr command. They should also be left intact and not removed, unless you want to change the behaviour of that xattr in file operations.
• Most xattrs commonly used by macOS don’t explicitly use tags, but are governed by a hard-coded system table that can’t be changed.
• When using standard commands such as cp, macOS will automatically apply these rules when deciding whether to preserve xattrs. However, using a command for a different intent, such as cp for backing up, won’t normally invoke the behaviour you might want.
• Code using standard macOS file operations should follow the behaviour expected for its intent, and shouldn’t require any special handling of xattrs. Lower-level operations are likely to differ, though, and may require implementation of equivalent behaviours.
• Those implementing their own xattr types should incorporate flags explicitly to ensure they’re preserved as intended.
• In cases of uncertainty, for example when working with files stored in iCloud Drive, you’ll need to step carefully through the rules above.

Sources

xattr_flags.h, xattr_flags.c, xattr_properties.h in copyfile source, e.g. at Apple’s OSS Distributions Github
man xattr_name_with_flags(3), included in copyfile source
FileProvider (Apple).

Apple has just released an update to XProtect, bringing it to version 5325. As usual, it doesn’t release information about what security issues this update might add or change.

This version adds five new Yara rules, four for the Soma/Amos family – MACOS.SOMA.DEENA, MACOS.SOMA.DEPEA, MACOS.SOMA.DETRA, and MACOS.SOMA.DELEA – and MACOS.ODYSSEY.DEENA for the Odyssey family.

You can check whether this update has been installed by opening System Information via About This Mac, and selecting the Installations item under Software.

A full listing of security data file versions is given by SilentKnight and SystHist for El Capitan to Tahoe available from their product page. If your Mac hasn’t yet installed this update, you can force it using SilentKnight or at the command line.

If you want to install this as a named update in SilentKnight, its label is XProtectPlistConfigData_10_15-5325

Sequoia and Tahoe systems only

This update has not yet been released for Sequoia and Tahoe via iCloud, but should be shortly. If you want to check it manually, use the Terminal command
sudo xprotect check
then enter your admin password. If that returns version 5325 but your Mac still reports an older version is installed, you should be able to force the update using
sudo xprotect update

Paulus Bor (1601-1669) was born in the city of Amersfoort, to the north-east of Utrecht, and seems to have started his training locally before going to Rome, where he was one of the founders of a ‘secret’ society of Netherlandish expatriates, the Bentvueghels (‘birds of a feather’). He returned to Amersfoort to perform some decorative painting, then pursued a successful career there until his death in 1669. Apart from a Caravaggist tendency during his early career, he might seem a run-of-the-mill painter of the Golden Age.

What distinguishes Bor are his little-known portraits of women in trouble, images that dig deep into the psyche, long before the Age of Enlightenment.

The first of these is Ariadne, painted in the period 1630-35, which is reminiscent of Caravaggio, and a little mysterious. When Theseus came to Crete to kill the Minotaur, Ariadne helped him by giving him a ball of golden thread that he used to retrace his route out of the labyrinth after he had killed the Minotaur (her half-brother). Ariadne fell in love with Theseus, and the couple eloped to Naxos, where he abandoned her.

Bor’s portrait can only show Ariadne on Naxos, immediately after she has been abandoned, still clutching the thread by which she thought she had tethered Theseus, now hanging at a loose end. On the wall above her are sketches she has made of her lover. She looks deeply lost in thought and gloom. This may refer to Ovid’s imaginary letter from her to Theseus in his Heroides.

Then, in about 1635, Bor painted The Magdalen, clutching her bottle of myrrh and looking straight at the viewer. She too is troubled, and has clearly been crying.

At about the same time, he painted this Allegorical Figure, also known as an Allegory of Logic. Coiled around her right wrist is a snake, but she too looks straight at you. The reptile appears venomous, and could easily be a European adder (or viper), or even an asp of the type Cleopatra used to kill herself.

Bor’s last two portraits of women in trouble have clearer narrative bases.

The Disillusioned Medea (The Enchantress) from about 1640 appears unique among the images of the enchantress who used her magic to support Jason in his quest for the Golden Fleece. She fell in love with Jason, married him on his voyage home, and bore him two children. Ten years later, Jason divorced her for the King of Corinth’s daughter Glauce.

This was too much for Medea, who sent Glauce a poisoned wedding dress that killed her and her father horribly. She then killed her two children, and fled to Athens, where she had a child by King Aegeus. Ovid includes an imaginary letter from her to Jason in his Heroides.

Medea sits, her face flushed, resting her head on the heel of her right hand. In her left, she holds a wand made from bamboo or rattan. The wand is poised ready for use as soon as she has worked out what to do next. Behind her is a small altar, similar to Diana’s in Bor’s painting of Cydippe below, and the statue at the left is of Diana.

The last of these portraits is undated, but it has been proposed it was painted as a pendant to The Disillusioned Medea, thus in about 1640. This is also based upon two letters in Ovid’s Heroides, and his Art of Love.

Acontius was a young man from the lovely Greek island of Keos, who fell hopelessly in love with the beautiful young Cydippe. Sadly, she was of higher social standing than he was, and such a marriage was unthinkable to her family. He came up with an ingenious plan to trick her into making a commitment to him: he wrote the words I swear before Diana that I will marry only Acontius on an apple.

He then approached Cydippe when she was in the temple of Diana, and threw the inscribed apple in front of her. Her nurse picked it up, and handed it to Cydippe to read his words aloud before the altar, so binding her to the vow. She then seemingly overlooked this inadvertent commitment that she had made.

Her family had other ideas, and found her a prospective husband of appropriate status. Shortly before the couple were due to marry, Cydippe fell ill with a severe fever, and the proceedings were postponed. After she recovered, another attempt was made to marry the couple, but she again fell ill just before the ceremonies, so the wedding had to be called off yet again.

Unsure of what to do next, Cydippe’s parents consulted the oracle at Delphi, who told them the whole story. Recognising the strength of the vow that she had made, Cydippe and her parents finally accepted the match, and Acontius and Cydippe married with their blessing.

Bor’s Cydippe with Acontius’s Apple puts a different slant on the story: here, Cydippe leans on the altar, alone, the inscribed apple held up in her right hand. But she isn’t reading Acontius’ words: she has clearly already said those out aloud, and now seems to be thinking through the vow she has just made.

Bor paints the details of the altar exquisitely. Cydippe’s dress may be anachronistic, but the artist brings in the skull of a sacrificed goat and festoons of flowers.

Although Cydippe’s story is alluded to in Spenser’s Faerie Queene, appears in verse by Edward Bulwer Lytton and the artist and designer William Morris, and is told in six operas, including Hoffman’s Acontius and Cydippe, first performed in 1709, this appears to be its only significant depiction until the late eighteenth century.

Bor’s cycle of paintings of troubled women is unusual, and stands comparison with explorations of the mind in Rembrandt’s Bathsheba with King David’s Letter (1654) and Lucretia (1666), also far in advance of their time.

Several of those who have already updated to macOS Tahoe 26.2 have remarked how much larger their download was than the 3.78 GB expected for Apple silicon Macs, with some reporting over 10 GB. Here I ponder how that could happen.

How is macOS now updated?

My understanding of the broad processes involved in current macOS updates is that the total downloaded for Macs of the same architecture starting from the same version should be identical.

Major components required for each update include:

• contents of the System volume that have changed from the starting version for that update;
• standard cryptexes containing Safari and its supporting components, and dyld caches. The latter differ between Intel Macs, which only receive Intel versions, and Apple silicon Macs, which receive Intel versions to support Rosetta 2 as well as their own Arm versions. Those probably account for much of the difference in size between Intel and Apple silicon updates. Note that Apple silicon Macs may also require updates to cryptexes used in AI, but those are most likely obtained outside the macOS update;
• architecture-specific firmware;
• new Recovery system;
• the ‘update brain’ to run the update, including creation of the new SSV with its hash tree.

Those contrast with what’s required for a full installer upgrade (or reinstall), which consists of a single Universal app containing the whole contents of the SSV, cryptexes and firmware for both architectures, Recovery and the update brain.

Following decompression of the download, changed components are installed in the System volume, a snapshot made of that, and its hash tree is constructed. Updated cryptexes replace those from the previous version, the new Recovery system and firmware updates are installed.

For all Macs of both architectures being updated from the previous public release of macOS, creation of the new SSV should be identical, as their old SSVs are all signed with the same signature, as their contents are identical.

Combo updates

In any update, changed contents of the System volume depend greatly on the starting version of macOS installed. Updating from a previous beta can require different files to be replaced, compared with those from the last public release. In some cases, Apple may be able to provide a single updater that will convert both a Release Candidate and the last public release into the new version.

If that’s not feasible, Macs that are updating from a beta, or a public release before the last, will require what we used to call a Combo update, consisting of all changed contents since the last major version, in this case 26.0. Combo updates are inevitably significantly larger than single-step Delta updates from the last public release, but should remain smaller than a full installer.

Recent upgrades between major versions of macOS, such as 15.6 to 26.0, have tried to avoid full installers where possible, by adopting what’s effectively a Combo-style update, but slightly larger as a Combo+.

Thus, updates to 26.2 most probably consist of:

• a Delta update from the last public release, 26.1, which might also be suitable for some beta releases;
• a Combo update from 26.0, 26.0.1 or some beta releases.
• a Combo+ update or full installer from earlier major versions of macOS.

As later minor versions are released, the size of the Combo update rises, as it’s required to incorporate more changes than for previous updates.

What would be surprising would be for two Macs of the same architecture updating from the same starting version of macOS to be provided with updates of significantly different size. I look forward to hearing from you if you consider that happened with the 26.2 update.

No BSI/RSR

What is puzzling about the 26.2 update is that it wasn’t preceded by a Background Security Improvement (BSI) or Rapid Security Response (RSR). Two of the top security vulnerabilities fixed in 26.2 (and in the Safari updates for 15.7.3 and 14.8.3) are both in WebKit, which is supplied in the Safari cryptex. These are for CVEs 2025-43529 and 2025-14174. Both were documented as already being exploited in older versions of macOS, in sophisticated attacks on targeted individuals. Both would appear to have been suitable for distribution prior to 26.2 in updated cryptexes, either by the existing RSR system or its replacement in Tahoe 26.1 of the BSI.

This appears to have been another missed opportunity for an RSR/BSI to have proved its value.

On the fifth day of the Decameron’s stories, Fiammetta chose the theme of the adventures of lovers who survived calamities or misfortunes and reached a state of happiness. The first of those concerns Cimon (or Cymon) and Iphigenia, and was told by Panfilo. This has been painted more than any other story in the whole of the Decameron, by masters from Rubens to Frederic, Lord Leighton, none of whom attempts to tell any more than its opening. Also note that Iphigenia here isn’t the daughter of Agamemnon who had to be sacrificed to bring favourable winds for the Greek fleet to sail against Troy.

Cimon’s father was a wealthy Cypriot, but Cimon, a nickname given in honour of his apparent simplicity and uncouthness, was his problem child. He was exceedingly handsome and had a fine physique, but behaved like a complete imbecile. He appeared unable to learn anything, even basic manners, so was sent to live with the farm-workers on his father’s large estates.

One afternoon in May, Cimon was out walking when he reached a fountain in a clearing surrounded by tall trees. Lying asleep on the grass by that fountain was a beautiful young woman, Iphigenia, wearing a flimsy dress that left nothing to the imagination. Sleeping by her were attendants, two women and a man. Cimon was immediately enraptured, leaned on his stick, and stared at her. As he did so, his simple mind started to change.

As with many of Boccaccio’s stories, this is shown on a wedding cassone, here from about 1525. It’s relatively simple: there’s no sign of the attendants, but there is a second image of Cimon walking along a path at the far right.

In about 1617, Peter Paul Rubens joined with Frans Snyders (who painted the still life with monkeys at the lower right) and Jan Wildens (who painted the landscape background) in their marvellous Cymon and Iphigenia. This is accurate in its details too, with the correct quota of attendants, and a splendid fountain at the left. Cimon really looks like Boccaccio’s uncouth simpleton.

Willem Van Mieris’ Cymon and Iphigenia from 1698 treats the scene more in the vein of Poussin or Claude, and again remains faithful to Boccaccio’s details.

Benjamin West was more coy in both of his depictions of this scene. His earlier Cymon and Iphigenia from about 1766 (above) was well-received at the time. Six years later, in 1773, he reversed the composition, and was even more restrained in the display of flesh, as shown below.

A few years later, in about 1780, Angelica Kauffman painted this delightful tondo of Cymon and Iphigenia, another variation on the same theme. The cultural contrast between the young man and woman is not so stark.

When he was only eighteen, John Everett Millais painted what was to be his last work before he embraced Pre-Raphaelite style: Cymon and Iphigenia (1848). At first sight this bears little resemblance to Boccaccio’s story, which is to be expected, as Millais didn’t use the Decameron as his literary reference, but a later re-telling by the English poet John Dryden, to which this is more faithful.

In 1884, Frederic, Lord Leighton painted what must be the most luxuriant and sensuous version of this scene. This study shows Leighton confirming his composition and use of colour.

The finished painting, Cymon and Iphigenia from 1884, shows Iphigenia stretched out languidly in her sleep, in the warmth of the last light of the day; behind her the full moon is just starting to rise. Leighton has changed the season to autumn, with the leaves already brown but the days still hot. Cymon stands in shadow on the right, idly scratching his left knee, gazing intently at Iphigenia.

The story that follows those painted idylls is very different.

When Iphigenia finally awoke, she was surprised to see Cimon there, and recognised him immediately. He insisted on accompanying her to her house, then went to his family home, where he turned a new leaf, and over the following four years transformed himself into the best-dressed, most cultured and refined young man on Cyprus. Despite this transformation, Cimon was unable to persuade Iphigenia’s father to allow him to marry the young woman, but was told she was betrothed to a noble on the island of Rhodes.

When the time came for her marriage, Cimon took an armed vessel and gave chase to the ship carrying Iphigenia to Rhodes. He boarded her ship and abducted her.

With Iphigenia on board, Cimon headed for the island of Crete, where he and his crew had relatives and friends. But shortly after they had altered course, a storm blew up, so violent that it threatened to sink the ship. Unable to tell where they were heading, they ended up taking shelter off the coast of Rhodes, where they were caught up by the ship from which they had just abducted Iphigenia.

When their vessel ran aground, Cimon and his crew were forced ashore, where they were quickly rounded up and thrown into prison, and Iphigenia was returned to her family ready for her wedding. Iphigenia’s fiancé implored the chief magistrate of Rhodes, Lysimachus, to put Cimon to death, but he was held in custody with the rest of his crew.

It happened that Lysimachus was deeply in love with a young woman of Rhodes, who was betrothed to Iphigenia’s future brother-in-law. To Lysimachus’ relief, that marriage had been postponed several times, but it was then decided to hold both weddings in the same ceremony. Lysimachus was aggrieved by this, and decided the only way he could marry the Rhodian woman that he loved was to abduct her. In order to do so, he needed the help of Cimon and his crew, who would undoubtedly be delighted to be able to abduct Iphigenia again.

Lysimachus offered Cimon a deal whereby they would together make off with their partners from the scene of the joint wedding, and they agreed to proceed with that.

Two days later, at dusk, as the weddings were just getting under way, Lysimachus, Cimon and his crew entered the house of the two bridegrooms and seized their brides. Unfortunately, it turned out that both grooms were armed and mounted a determined resistance. Cimon killed Iphigenia’s fiancé with a single blow to the head, and the other woman’s intended husband fell dead following a blow by Lysimachus.

Lysimachus, Cimon, their crew and the two abducted brides then fled to a ship which they sailed to exile in Crete, where the two couples were married, amid great and joyous celebrations. In time, the people of Cyprus and Rhodes forgave them for the violent way they had stolen their brides; Lysimachus and his wife were able to return to Rhodes, and Cimon and Iphigenia returned to live happily ever after on Cyprus.

Sadly, none of the masters who had painted Cimon and Iphigenia seems to have been tempted to depict any of the rest of Panfilo’s story.

I hope that you enjoyed Saturday’s Mac Riddles, episode 338. Here are my solutions to them.

1: The first macOS from the mountains around Tahoe.

2: The eighth came from the App Store with Mission Control and a mane.

3: The sixth came with a time machine and spots.

The common factor

I look forward to your putting alternative cases.

Several of my utilities rely on being able to read log entries from your Mac. For most, this is the only way that you’re ever going to try to access the log. For a few this draws attention to potential problems, when the app discovers it can’t access the log and reports that as an error. This article explains what those errors mean, and what you can do to address them.

Log file layout

Files containing log entries are stored in two main locations in your Mac’s Data volume. The majority of them are in /var/db/diagnostics/, while additional and lengthier log data is stored in files named by UUID in /var/db/uuidtext/.

Those in /var/db/diagnostics/ are grouped into standard folders:

• Persist holds tracev3 files that contain regular entries, the most important;
• Special has similar files for shorter-life entries;
• timesync contains files that enable the entries in tracev3 files to be matched with clock time;
• Signpost holds tracev3 files for special entries for measuring performance;
• HighVolume is normally empty, but might contain entries during periods when they’re particularly frequent.

Unlike traditional Unix log files, macOS doesn’t keep logs for a fixed period such as five days, but the logd process maintains them constantly to keep their total size within set limits that can’t be altered. Thus the period covered by log entries depends on how frequently entries are written to the log. In extreme cases, that can fall to just a few hours, or could extend to many days, although typically it should be at least 24 hours.

SilentKnight

My most popular app that’s also most frequently run, SilentKnight runs a single check that relies on being able to access the log, to look for XProtect Remediator scan reports.

Each time you run SilentKnight, as it prepares to display its window, it runs four checks on the log, those detailed below for LogUI and XProCheck. If any of those fail, rather than warning you in an alert, it simply disables its check for XProtect Remediator scans, and reports XPR scans not checked. If those pass correctly but it can’t find log entries for the scans, it reports no scans in the last 36 hours instead.

There are complications, though. SilentKnight will only check those scans once a day. If you run it more often than that, it won’t repeat those log checks on the XPR scans, and simply informs you XPR scans not checked. It’s only if you see that for the first check of the day that message suggests there may be a problem with the log. You can also disable checking for XProtect malware scans in the app’s settings.

If you see the message XPR scans not checked when you first run the app, and you haven’t disabled that check, then it’s worth running one of the other log utilities to discover why.

XProCheck, Mints, LogUI

Because these apps are all about inspecting log entries, they incorporate more extensive checks and report errors in more detail. To fetch entries from the log, Mints uses the log show command, while XProCheck and LogUI access them directly through macOS. They all run the following checks when the app is starting up, before its main window is displayed, and will warn you in an alert. When you dismiss that alert, the app will quit to allow you to fix the problem before running it again.

Tests used are:
Is the current user an admin user? If not, the alert below is displayed.

Are there any log files in the Persist folder? If not, report that it can’t find any log files.

Are there any timesync files? If not, report that it can’t find any log timesync files.

Can log show retrieve at least 1 log entry from the last 2 seconds? If it can’t, report that it can’t find any log entries on your Mac.

Mints runs another as well:
Can log show get times in the correct format? If it can’t, report the log time format is incorrect and advise the user to set time to 24-hour format.

Fixes

First, ensure that your Mac isn’t deleting log files in /var/db/diagnostics/ or /var/db/uuidtext/. Some ‘housekeeping’ utilities have taken to doing that, but it saves little space, usually well under 2 GB, and removes a mine of invaluable diagnostic information.

You can get fuller information about what’s in those folders with the Logs button in Mints, which also tells you the date of the oldest log entry. The same information is available in LogUI’s Diagnostics Tool.

The usual recommendation for Macs that aren’t writing any files into the Persist or timesync folders is to perform a clean reinstall of macOS or, for Apple silicon Macs, to restore the Mac in DFU mode. However, you’d be wise to contact Apple Support in the first instance, as this problem has occurred before.

If your log records only go back a few hours, there’s no simple way to reduce the rate at which new entries are written to the log. This article suggests some general approaches, and this article explains how to use custom logging profiles.

I wish you success.

In the first of these two articles tracing the history of depictions of the temptation of Saint Anthony, I had reached 1650, when the bizarre composite creatures that flourished in Hieronymus Bosch’s triptych of about 1500-10 were becoming common.

The prolific David Teniers the Younger painted several versions of the Temptation of Saint Anthony after about 1650. Most, like this painting now in Lille, show an ordinary landscape with the saint, with the addition of his own species of daemons. Some of these re-use ideas first seen in Bosch’s triptych, such as that of a single figure on the back of a flying narwhal; that figure is wearing an inverted funnel on its head.

Another of Teniers’ paintings, currently in the Prado, shows three fairly normal humans in a menagerie of daemons, some of which clearly have their origins in Bosch’s work. The figure flying on a fish has changed from the previous painting, but still wears its distinctive inverted funnel.

This third version, now in Tokyo, repeats many of the same daemons in a different setting, retaining the figure wearing the inverted funnel in close aerial combat.

Almost two centuries after Bosch’s triptych, more radically different and inventive approaches appear, here in Domenicus van Wijnen’s painting of about 1685. Its daemons are much more human in form, and have proliferated in a way more common in the ‘fairie paintings’ seen around 1840, including some by Richard Dadd. Van Wijnen was a prolific painter of scenes of witchcraft and the ‘dark arts’.

Southern European painters were more likely to keep to more traditional figurative compositions, as used by Tiepolo in about 1740. This is surprising, given the presence of Bosch’s paintings in major collections in both Madrid and Venice.

Depictions of the Temptation of Saint Anthony remained popular even through the 1800s, although by this time Bosch’s triptych seems to have become long forgotten, and painters seemed no longer to need such excuses to exercise their imagination and inventiveness. The long-awaited publication of Gustave Flaubert’s book The Temptation of Saint Anthony, written in 1874 as a script for a play, brought renewed interest, and a succession of paintings from Henri Fantin-Latour (c 1875, above), Paul Cézanne (c 1875, below), Gustave Moreau (a watercolour), and Fernand Khnopff (1883).

Cézanne shows the shadowy figure of Saint Anthony slumped against a bush at the left, his arms held out to shield himself from the temptations. The devil is shown in stereotypical form, wearing red robes, with an animal head and horns, behind the saint. In front of them is the naked Queen of Sheba, her right arm held high to accentuate her form. Around her are naked children. In front of Saint Anthony is a black bag presumably containing money, and a book.

The influential Neapolitan realist Domenico Morelli painted this stark work in 1878, perhaps the exact antithesis of the rich imagery that had developed since the Renaissance.

That same year, Félicien Rops painted his satirical and irreverent version with more subtle details. Bound to the cross in Saint Anthony’s tempting vision is a visibly voluptuous woman, the word EROS replacing the normal initialism of INRI (Iēsūs/Iēsus Nazarēnus, Rēx Iūdaeōrum, meaning Jesus of Nazareth, the King of the Jews) shown above Christ’s head. Christ himself, with full stigmata, has been knocked sideways to accommodate the woman’s naked body. Behind the cross the horned devil wears scarlet robes and pulls faces. Behind him is a pig, Anthony’s attribute. The two daemonic putti are most definitely not references to Bosch.

Lovis Corinth painted two versions of the Temptation. The earlier, from 1897, shows Anthony surrounded by beautiful and naked women, offering him fruit, other food, and their bodies. The daemons have faded into the background, and are caricatures based on humans.

His later canvas, explicitly painted after Gustave Flaubert, in 1908, brings in the Queen of Sheba, an elephant and monkey, but is also notable for depicting Anthony as a young man. Even Salvador Dalí’s 1946 painting of the Temptation steers clear of Bosch’s imagery, although it does at least return to the concept of an individualistic and inventive vision.

I suppose it had to happen that search engines and AI were exploited to deliver malware to the unsuspecting. As that article prompted a brief discussion of the usefulness and reliability of AI-based troubleshooting, I’ve been doing a little checking.

To examine this, I’ve posed Google’s AI some test questions. Rather than run through a long list, I’ve focussed on five that are reasonably frequent but have catches in them. Some are embedded in the question itself, others are inherent in the solution. My aim here isn’t to focus on the strengths of AI, but to understand its weaknesses better, just as you might with a human expert. After all, it doesn’t take much expertise to get the straightforward answers right.

1. How to reduce system data on mac

This question is framed carefully to reveal that the questioner has already used Storage settings, and has been confronted with a great deal of space being used by System Data, an unhelpful category and a situation that’s all too common, as I’ve considered here and elsewhere.

Google’s overview started well, telling me that “System Data includes caches, logs, and temporary files that build up over time and aren’t easily removable like regular documents.” Once it progressed to suggesting actions, though, it repeated a formula it seems to like, but is sadly well out of date: “Use Built-in Storage Management. Click the Apple menu () > About This Mac > Storage > Manage. Use recommendations like ‘Store in iCloud,’ ‘Optimize Storage,’ and ‘Empty Trash Automatically’.” If you try to follow those, you’ll immediately discover that Storage has moved elsewhere. Furthermore, those recommendations won’t tackle the problem framed in the question.

It continues on safer ground, with procedures to clear caches and logs, but those are conducted in Terminal, and there’s no mention of booting in Safe mode. It also directs the user to Terminal to remove snapshots using tmutil rather than Disk Utility. After that, it loses the direction in the question, recommending the user to “remove unused applications and files”, despite the fact that they aren’t included in System Data. Finally, and still off the subject, it mentions using DaisyDisk.

This demonstrates how Google’s AI can’t maintain a logical sequence in troubleshooting, and prefers to direct the user to command tools rather than familiar bundled utilities like Disk Utility, or one of the primary purposes of Safe mode.

2. How to reset home permissions on mac

This has long been a contentious issue, but for the last few years has been fairly settled, as explained here. We no longer reset or repair permissions.

This was Google’s most obvious disaster, as it advised: “To reset home folder permissions on a Mac, boot into Recovery Mode (Command-R), open Terminal, type resetpassword , and use the ‘Reset Home Directory Permissions and ACLs’ button in the utility to fix ownership and permissions for your user account, then restart. For newer macOS versions, Apple also suggests using the repairHomePermissions tool in Recovery, followed by a macOS reinstallation for a full fix, but the resetpassword utility is the primary way to reset the main permissions.”

Of course, Apple silicon Macs don’t use Command-R to enter Recovery Mode, and as you might expect, the resetpassword command opens Recovery Assistant where you can reset your password in the event that you forgot it. That has absolutely nothing to do with permissions, and demonstrates that Google hasn’t understood the question. There’s no such button in that utility, so it’s making things up. It’s also worth nothing that it later recommends that after running repairHomePermissions, you reinstall macOS.

Perhaps the fundamental problem here is the linked support content dating back to 2011, and a failure to recognise how this has changed in the years since. This suggests that its LLM doesn’t take time and change into account, which is deeply concerning when deriving advice on macOS.

3. How to identify clone files in macos

This has been a longstanding problem since the introduction of APFS. Note, though, that question isn’t posed to test whether two or more files are clones of one another, simply how to identify whether files are clones.

Google’s AI Overview is pretty good, and points out that “you need specialized tools or command-line tricks because Finder just sees copies”. However, the next section is titled “Using Finder (for general duplicates)” and gives a facile answer that’s completely inappropriate to that question. This demonstrates how AI always tries to answer, even when it doesn’t know an answer. After that it offers a Terminal solution that again finds duplicates but not clone files, as it doesn’t even check whether the files found have been cloned. It then suggests using specialised apps, including Precize and Sparsity, but lacks useful detail. It ends with pointing out the differences between hard links and clone files, but clearly hasn’t understood a word.

Humans are far more willing to admit they don’t know, and to ask follow-up questions to help them understand exactly what you’re asking.

4. How to run an unsigned app in macos

One of the well-known features of Apple silicon Macs is that, from their first release five years ago, they have only ever run code that has been signed, even if using just an ad-hoc signature, while Intel Macs remain able to run apps and code that has no signature at all. There’s also an important distinction between unsigned code, and code that has been signed by an ad-hoc signature rather than a developer signature.

Those are missed entirely by Google’s AI, as a result of which its answer is riddled with misunderstandings. It recommends what it terms ‘The Standard “Open Anyway”‘ method, which still can’t run unsigned code on Apple silicon. Its final recommendation is to use sudo spctl --master-disable, which disables Gatekeeper and XProtect checks but still doesn’t allow unsigned code to run on Apple silicon.

Given that LLMs are all about language rather than facts or knowledge, it’s surprising that it failed to see the distinction here. This topic was also widely discussed when Apple silicon Macs were introduced, so it’s puzzling that Google was unable to recall any discussion from that time.

5. How to remove com.apple.macl in macos

I’ve only recently revisited this topic, although it dates back to Catalina. This particular extended attribute is frequently added to files, and can have unpleasant consequences when opening or saving them is blocked. Unlike the ordinary quarantine xattr, when macOS applies this one it’s usually protected by SIP, which makes its removal fraught unless you know the trick.

Google AI’s answer made a promising start, writing that “you can use the xattr command in the Terminal, but you might need to use a specific approach depending on your macOS version and file location, as this attribute is often protected by System Integrity Protection (SIP) or file access permissions.” It then ignores the problems posed by SIP protection, and recommends trying the xattr command. As an alternative for “stubborn cases”, it recommends booting into Recovery, and using xattr from there, which should work if you can locate and access the file, which can be quite an achievement in Recovery.

In a bid to remain helpful, it next suggests granting the Terminal app Full Disk Access, although that’s irrelevant. It tries again with: “A common workaround involves moving the file using an application that doesn’t propagate the com.apple.macl attribute, or transferring it to a non-Mac file system.” It finally gets lost when trying to use iCloud Sync.

In common with other answers, Google’s AI started off well, as if it understood the heart of the problem, but quickly demonstrated that it was unable to recall a solution, and stopped making any sense.

Reproducibility

Before you rush off and try the same questions in your favourite AI, a word of warning: the answers you’ll be given will be different from mine, even if you use exactly the same words with Google. This is because randomisation is at the heart of AI, and each time you elicit a response from an LLM, it will differ. Sometimes those differences can be subtle and linguistic, others can manipulate different ‘facts’, or fabricate conflicting answers. This is, apparently, intentional, and hopefully never affects any human expert you consult.

Conclusions

These five questions have demonstrated that Google’s AI can produce some surprisingly accurate information that appears insightful and can match human expertise. In some cases, recommended solutions are sound and well-explained, but in others they appear based on outdated information that may conflict with the opening Overview. Where there aren’t readymade solutions it can quote, it will always try to be helpful in providing an answer, no matter how illogical or flawed that might be. In some cases those could lead an unsuspecting user into danger, and often ignore what was seeded in the original question.

The only way to use Google AI safely is to double-check everything carefully with authoritative sources before trying any of its suggestions, which surely removes much or all of its value.

Paintings of scenes from the hagiographies of Christian saints have been enduring favourites, particularly for churches dedicated to that saint, and for sponsors named after them. The lives of some saints are sufficiently complicated as to offer the artist a choice of different scenes, but in the case of Saint Anthony the Great (of Egypt, the Abbot, etc.), paintings are almost confined to his temptation by the devil.

Saint Anthony was born in 251 CE to wealthy parents in Lower Egypt. His parents died when he was 18. He then became an evangelical Christian, and gave his inheritance away to follow an ascetic life. For fifteen years he lived as a hermit. During this time the devil fought with him, afflicting him with boredom, laziness, and dreams of lustful women, before beating him unconscious.

Friends found him and brought him back to health, so he returned to the desert for another twenty years. This time the devil afflicted him with visions of wild beasts, snakes and scorpions, but again he fought back, eventually emerging serene and healthy. He went to Alexandria during the persecution of Christians there, to comfort those in prison. He returned to the desert, where he built a monastic system with his followers.

His attributes are a bell, a pig, a book, the Tau cross (like a capital T), sometimes with a bell pendant. He is commonly shown being tempted in a wilderness, often by naked women, and is associated with fire (“Saint Anthony’s Fire”).

The visionary nature of his temptation, and the temptations offered him, give a painter a wonderful opportunity to exercise their imagination, and to include content that might otherwise be excluded from places of worship. This weekend I show a selection of paintings of this unique story. This article covers paintings before 1650, and the next will cover the period from 1660 to the early twentieth century.

Painted in 1430-32, Stefano di Giovanni’s St Antony Beaten by the Devils identifies the saint by his Tau crucifix. Three devils, clearly fallen angels by their wings, are beating him with clubs. Those devils are fairly conventional figures, part animal and part man, with horns.

Michelangelo’s The Torment of Saint Anthony (c 1487–88) continues the theme. Saint Anthony is now being held aloft by ten or so devils, including a weird fish with many spines and a trunk-like snout. The devil at the lower left of the group has breasts and a face in its perineum, which almost makes it double-ended.

We then reach a watershed in the unique paintings of Hieronymus Bosch. Records make it clear that he painted several different versions of the Temptation of Saint Anthony, of which it appears that the Lisbon triptych from about 1500-10 is the sole complete survivor, and there’s also the remains of another in a fragment in Kansas City.

Inside the triptych now in Lisbon, the left panel shows Saint Anthony being assisted by three others, as he crosses a small wooden bridge, in a state of complete exhaustion, perhaps after being beaten unconscious by the devil. In the countryside around that group are weird human and portmanteau animal figures. In the sky above, Saint Anthony is seen again, being flown around on the back of another invented animal.

The centre panel shows Saint Anthony in the middle, kneeling in prayer and surrounded by bizarre figures, creatures, and objects, as if in a vision of temptation. In the background a town is burning.

The foreground shows more scenes involving bizarre figures, creatures, and objects. At the left, a jumble of them emerges from the huge shell of a strawberry-like fruit. One of those figures is astride a goose, and playing a harp. In the middle is a small pond, in which a hybrid between a fish and a boat is floating, and a man is seen inside another strange creature.

The right panel shows Saint Anthony seated, with a book open in front of him. He is again surrounded by strange figures and creatures from a vision of temptation. The background shows a prominent windmill and towers, behind which is a wintry landscape with snow on the ground.

In the foreground, in front of the saint, is a circular table, half-covered with a white tablecloth. The table is supported by naked human figures, one of whom has his left foot in a large pot. Another wears an armoured glove brandishing a heavy scimitar, but a creature has passed a thin-bladed sword through its neck. At the left edge of the table, another naked human is blowing a curiously curved trumpet. To the right an abdomen with ears and legs, wrapped in a red cloth hat, has a sword stuck into it.

Matthias Grünewald’s slightly later diptych provides useful contrast between the conventional Visit of St Anthony to St Paul on the left, and his Temptation of St Anthony (c 1515) on the right. These daemons are different from Bosch’s, but are nevertheless highly imaginative in their appearance.

The outside of the left panel of Niklaus Manuel’s Antonius altar shows Demons Tormenting St. Anthony (1520). Its daemons, and the wooden clubs with which they attack the saint, are inventive, but still rooted in Stefano di Giovanni’s of a century before.

Lucas van Leyden’s painting of about 1530 appears to have been directly influenced by Bosch. Leading its small procession of strange creatures is a man with a bird’s head, and a long bill, wearing ice-skates, clearly derived from the creature bearing a note in the foreground of the left wing of Bosch’s triptych. There are several other familiar features in those creatures, but the rest of the painting is more conventional.

By about 1540, Cornelis Massijs was still content to paint an almost completely realist image, showing Saint Anthony with two naked women, and another who may be their procuress. But once again there are some small decorations – a pot-bellied man, a creature with an inverted funnel on its head, and a little group at the right – that seem to have invaded from the mind of Bosch.

When we reach Pieter Coecke van Aelst in 1543-1550, the emphasis has changed completely. There are still three normal human figures, of the saint, a tempting nude, and her procuress behind, but the rest of the painting is filled with Bosch derivatives, such as the nun with wings biting someone’s leg, in the foreground. The burning town also makes an appearance in the left distance.

Paolo Veronese’s interpretation from 1552-53 is difficult to read, but the saint is almost completely obscured under a well-muscled devil and a woman whose left breast is exposed. Anthony is sprawled on his back, in his brown habit, his left hand fending off the woman’s hand, his right clutching a book. The devil is holding him down with his left hand, and about to strike him with a club held in his right.

Pieter Huys’s painting of 1577 is more obviously a derivative from Bosch. Saint Anthony could almost have been copied from one of the earlier paintings, and most of the strange figures and creatures have been borrowed and re-interpreted. Musical instruments such as the lute and harp make an appearance, but many of the symbols have been changed. For example, where Bosch’s triptych features round tables with a white cloth, Huys opts for a rectangular table, and the background has a town burning even more violently.

Maerten de Vos’s vision of 1591-4 follows a more traditional line again, although it contains some strange elements that appear more personal. He shows one Saint Anthony apparently carrying another, unconscious Saint Anthony in his arms, rather than the saint supported by friends. There’s a third version of the saint flying in the air, surrounded by daemons, too. That unconscious saint points to a pig, a recognised attribute, but nearby is a pair of lions. One of the more Bosch-like creatures in the right foreground is a portmanteau of human and bird, wears an inverted funnel on its head, and is reading sheet music.

Just a century after Bosch painted his triptych, Jan Brueghel the Elder combines a cavalcade of more traditional figures with a foreground of more bizarre ones derived from Bosch, including an old person’s head with four human legs, and a bird with two heads, one of a cockerel and the other a duck with a clarinet-like bill. A second image of the saint appears in the sky, surrounded by daemons, and a church is on fire in the background.

By about 1650, Joos van Craesbeeck was using some of Bosch’s iconography with his own developments. The use of a human head as a container is probably derived from Bosch’s tree-man and similar devices, but here has become even more realistic. To the right of that, a naked man sits facing backwards on a duck-horse: he is playing a stringed musical instrument, and wearing an inverted funnel on his head. Van Craesbeeck’s humans seem to have grown small red tails too. Oddly, van Craesbeeck doesn’t place the Greek letter Tau on the saint’s robes, but the Roman letter A, perhaps monogrammed with Tau. That appears unique to this painting.

Here are this weekend’s Mac riddles to entertain you through family time, shopping and recreation.

1: The first macOS from the mountains around Tahoe.

2: The eighth came from the App Store with Mission Control and a mane.

3: The sixth came with a time machine and spots.

To help you cross-check your solutions, or confuse you further, there’s a common factor between them.

I’ll post my solutions first thing on Monday morning.

Please don’t post your solutions as comments here: it spoils it for others.

macOS apps manage the contents of their own windows, drawing and refreshing them as needed. To assemble all those into what you see on the display requires the services of the master compositor, WindowServer. From the moment the login window appears during startup, WindowServer is hard at work, and remains so until you shut your Mac down. Without WindowServer there could be no GUI.

Open Activity Monitor, and you’ll see WindowServer close to the top of the lists of CPU, Memory and Energy users, and when it’s getting into trouble that’s always a good place to check what’s going on. You may also notice that it’s one of a pair of processes including distnoted with their own user, _windowserver. They’re part of a group of interconnected services that handle window management, compositing of windows into the display image, and event-routing for apps, with distnoted responsible for system message notification. In the log, WindowServer is often associated with the com.apple.SkyLight subsystem.

Compositing

You can get a good idea of what WindowServer does using screenshots. Using Command-Shift-4, then pressing the Space Bar and selecting a window, you’ll get a shot of an individual window, as shown in the examples below.

WindowServer then positions them according to their current locations on the whole display, and produces a layered composite, as you’ll see in a screenshot taken with Command-Shift-3.

That composite is then sent through the graphics driver to graphics output hardware.

With its central position in managing windows and compositing them, WindowServer is also responsible for handling Spaces (introduced in Mac OS X 10.5 Leopard), window tabs, multiple displays, and behaviours that stream or extract parts or all of a display image, such as taking screenshots. Because WindowServer knows which app’s windows are where, and which are at the front, it also routes events to each app. For example, when you click on a window it’s WindowServer that determines which app owns it, and passes the event to that app to handle.

Increasing demands

This has become more involved since the introduction of Catalyst apps from macOS 10.14 to 11, and more so since Apple silicon Macs have brought the ability to run iOS and iPadOS apps. iOS uses a series of -board services in its GUI, including SpringBoard as the Home Screen manager instead of the Finder, FrontBoard to manage the app’s scenes, and FuseBoard its menus, which are now run in macOS as well. RunningBoard, which manages the resources available to apps and processes, has been incorporated into macOS for some years.

The introduction of Stage Manager in macOS Ventura in 2022 has also been stretching WindowServer, and can substantially increase its demands on CPU and memory.

Troubleshooting

You can reduce WindowServer’s workload by closing tabs and windows, turning Stage Manager off, reducing the number of Spaces, and quitting non-essential apps. Even when window or tab contents aren’t visible, they still have to be managed.

If WindowServer stops working, for instance when it crashes, not only does everything on the display(s) freeze, but routing of input events such as clicks or taps also stops. Although in the past macOS has sometimes been able to log the current user out and restart WindowServer, fatal WindowServer problems are now most likely to result in a kernel panic or a complete freeze. If your Mac freezes rather than restarts, a forced shutdown may be your only way forward. Recurrent WindowServer crashes suggest a problem with the graphics driver or graphics hardware, and should always be reported to Apple via Feedback.

Summary

• WindowServer works between app window management and display drivers to composite windows and on-screen items, producing the image to be displayed.
• With distnoted it also routes events to apps, and manages system message notification.
• Demands on its services are increased with Spaces and Stage Manager, and it works with the different expectations of Catalyst and iOS/iPadOS apps running in macOS.
• When it fails, displays freeze and input responses cease. If those don’t precipitate a kernel panic and restart, a forced shutdown may be the only solution.
• Report recurrent problems to Apple in Feedback.

The update from macOS Tahoe 26.1 to 26.2 is fairly large, but appears to be largely routine maintenance, together with some important security updates.

At last, Apple has provided more detail of some of the improvements and changes in this summary. These include a new Edge Light feature to light your face during low-light video calls, Podcasts gaining automatic chapter generation, filters added to the Games library, AirDrop codes providing an additional means of verification with unknown contacts, and enhancements to Freeform tables.

Security release notes report a total of 46 vulnerabilities addressed. Among those are multiple WebKit vulnerabilities, including two that Apple believes have been exploited already “in an extremely sophisticated attack against specific targeted individuals” in earlier versions of iOS. Those alone make 26.2 a compelling early update.

The build number of macOS 26.2 is 25C56, it updates iBoot firmware to version 13822.61.10 on Apple silicon Macs and Intel firmware to 2094.40.1.0.0 (iBridge 23.16.12048.0.0,0). Note that Intel Macs only have an update to iBridge, and not their EFI firmware this time.

Significant changes seen in bundled apps include:

• Freeform, to version 4.2
• Music, to version 1.6.2
• Passwords, to version 2.2
• Safari, to version 26.2 (21623.1.14.11.9)
• TV, to version 1.6.2.

Significant changes seen in /System/Library are relatively few, with many minor increments to build numbers. Notable changes include:

• All AGX kernel extensions are updated
• AppleDockConnect is a new kernel extension to accompany AppleDockChannel
• AppleThunderboltRDMA is another new kernel extension
• APFS is updated to version 2632.40.17, a tiny increment
• the webcontentfilter kext has been removed
• there is no change in the RichText.mdimporter for Spotlight indexing, implying that no bugs have been fixed in it.

The total number of bundles in that folder has only increased slightly, from 9785 to 9832.

One common criticism of the new Liquid Glass option added to Appearance settings in 26.1 is that Reduce transparency in Accessibility settings no longer reduces some transparency effects. There has been no change in that behaviour in 26.2, which continues to apply Liquid Glass effects in locations such as sidebars despite Reduce transparency being turned on. Our cries have clearly fallen on deaf ears.

I have also confirmed, as I suspected from the lack of change in the RichText.mdimporter, that the ‘LG bug’ in Spotlight remains, and still hasn’t been fixed.

Apple has just released the update to bring macOS Tahoe to version 26.2, and security updates to Sequoia and Sonoma to bring them to 15.7.3 and 14.8.3 respectively. The latter two should also have associated Safari updates.

The update to 26.2 is about 3.78 GB to download to an Apple silicon Mac, and 2.5 GB for an Intel Mac. Some Macs may require larger downloads, though, with some in excess of 10 GB.

Tahoe 26.2 introduces Edge Light to light your face during low-light video calls, improves Podcasts with automatic chapter generation, adds filters to the Games library, adds AirDrop codes as an additional verification with unknown contacts, enhances Freeform tables, and more. Fuller release notes are available here, and are a significant improvement in themselves.

Security release notes for Tahoe report a total of 46 vulnerabilities addressed. Among them are multiple WebKit vulnerabilities, including two that Apple believes have been exploited already “in an extremely sophisticated attack against specific targeted individuals” in earlier versions of iOS. Notes for Sequoia list 25, and those for Sonoma 21. The Safari update for Sequoia and Sonoma does address those critical vulnerabilities.

Its macOS build number is 25C56, it updates iBoot firmware to version 13822.61.10 on Apple silicon Macs and Intel firmware to 2094.40.1.0.0 (iBridge 23.16.12048.0.0,0), and brings Safari to version 26.2 (21623.1.14.11.9).

Last updated at 23:10 GMT 12 December 2025.

During the first few years of the twentieth century, the former Nabi painter and print-maker Félix Vallotton had concentrated on painting mysterious interiors, as well as portraits and other figurative works.

By 1907, when he painted this Orientalist Turkish Bath, his figures had become modern in appearance. With their tied-up hair, it would be easy to mistake this as a painting from fifty years later.

That same year, he started painting scenes from classical myth, here Andromeda Standing with Perseus (1907). This shows the sea monster Cetus heading for a defenceless Andromeda, as hero Perseus charges to her aid through a cleft in the black sky. He has lost his classical attribute of the head of Medusa, and here rides the winged horse Pegasus while holding a knight’s lance. The horse’s wings form an edge to the black sky as it carves through the air. Each figure is colour coded: green for the sea monster, pink for the near-victim, and blue for the hero, against a straw-coloured sea.

The following year, he again broke with convention in his painting of The Rape of Europa (1908). In this clean and simplified account, we look out to sea as the naked Europa clambers onto the back of Jupiter disguised as a brown bull. Given the long-established literary and artistic tradition of the bull being white, this can only have been a deliberate choice on his part.

In addition to mythological narratives, Vallotton started painting more landscapes, some of which are unusual and innovative, like La Mare, Honfleur (1909), showing a pond at night near the north coastal town of Honfleur. The black plane of the water has ripples travelling from a point at the right edge. In the left foreground is a stand of long grass and weeds bowed over in an arc, and behind the blossom on a tree glows in the dark.

Vallotton returned to the story of Perseus and Andromeda in 1910, in his Perseus Killing the Dragon, which is no sequel to his earlier work. Here he catches the height of peripateia and action, as Perseus is slaying Cetus. Andromeda, long freed from her chains, squats, her back towards the action, at the far left. Her face shows a grimace of slightly anxious disgust towards the monster. Perseus is also completely naked, with no sign of winged sandals, helmet of Hades, or any bag containing Medusa’s head. He is braced in a diagonal, his arms reaching up to exert maximum thrust through the shaft of a spear impaling Cetus through the head. The monster is shown as an alligator, its fangs bared from an open mouth.

In Sauciness from 1911, we see a young woman still undressed in her white chemise, her unmade bed behind. She looks at herself in the mirror of a small dressing table, wondering what to wear.

His Honfleur in Fog from 1911 isn’t a conventional view of this small port on the north French coast, as it looks down from Mont-Joli to the west of the town centre. It captures exactly the sort of transient effects that had been the concern of Impressionism, but in Vallotton’s distinctive style.

In 1913, Vallotton returned to transient atmospheric effects in Night With Light Fog. Influenced by his print-making, he distils this scene into simple geometry, with almost two-thirds of his canvas the vague purple forms of the town and sky, and three simple bands below it. The lone lamppost and figure at the extreme left restore context.

He painted this Self-portrait in a Dressing Gown at a turning point in 1914, just as the world was about to enter the Great War, and he was to enter his fifties, the start of the next and final article in this account of his career and art.

The Messages app is a wonderful way to keep in touch with friends and relatives no matter where they are, and share photos and videos. This article tries to answer the seemingly simple question as to where those are stored, and what this has to do with syndication. I’m grateful to Jack for asking.

Sharing in Messages

If you have more than one Mac or Apple device connected to iMessage, and share that via Messages in iCloud, you’ll no doubt have discovered that shared photos and videos sync across them reasonably well. Delete an image on one, and it should be removed on all the others so long as they’re running, awake and can sync with iCloud.

Those shared photos and videos don’t appear in your System Photo Library, though, unless you save them there. That System Photo Library can share its contents using iCloud Photos, Shared Albums and iCloud Shared Photo Library, but those are separate from sharing in Messages. Turn all Photos sharing off and that doesn’t affect those shared in Messages.

Unfortunately, information about those shared images and videos, and control over them, is primitive in macOS compared with iOS. On an iPhone, you can manage storage for Messages in iCloud in much greater detail, and can view those that are taking up most space. That isn’t offered in macOS 26 Tahoe, only the total space used by Messages in iCloud. Nor is there any Photos library or other location obvious on your Mac that appears to store them.

Syndication Photos Library

Jack isn’t the first to discover this, but if you care to look in ~/Library/Photos/Libraries you’ll find a hidden Photos library named Syndication.photoslibrary that has a similar if not identical structure to a regular photoslibrary. If you look inside that, in the path scopes/syndication/originals you’ll see folders numbered with a single hexadecimal digit, and inside those are many of the shared photos and videos from Messages.

Try copying or duplicating Syndication.photoslibrary into your Picture folder, then launch the Photos app with the Option key held so you’re asked to select a Photos library to open. There pick Syndication.photoslibrary and browse its contents. Although that should look similar to the images and videos still stored in your local Messages, you may well notice there are differences, with the Syndication Photos Library containing more, sometimes a great deal more, than Messages.

But there’s more

Checking on my iPhone, Settings there reports that Messages is currently using 523 MB for photos, 14.7 MB for videos, and 1.1 MB for GIFs and Stickers, making a total of just under 540 MB. Yet on my iMac Pro Syndication.photoslibrary is only 394.1 MB, nearly 150 MB smaller, and on my Mac mini M4 Pro it’s a huge 1.14 GB, although each of them should be storing the same photos and videos. Some users have reported Syndication.photoslibrary of huge size, sometimes tens of GB, suggesting that they either never perform housekeeping on shared images and video in Messages, or theirs have accumulated many orphaned items.

Those Syndication Photos Libraries are the location of photos and videos for Messages, though. Try deleting a photo or two in Messages, and you’ll see each of them update in synchrony.

There’s another puzzle too: if you have some older Photos Libraries, look inside them and you may well see photos and videos in folders in the path scopes/syndication/originals, just as you do in Syndication.photoslibrary. This suggests that the separate Syndication Photos Library may have originally been saved in the current System Photo Library rather than in ~/Library/Photos/Libraries/Syndication.photoslibrary.

My last mystery comes from the list of open files provided by Activity Monitor. With both Messages and Photos apps running, guess which has the database inside Syndication.photoslibrary open? No, not Messages, but Photos.

Conclusions

• ~/Library/Photos/Libraries/Syndication.photoslibrary is the Photos Library now used to store shared photos, videos, GIFs and Stickers for the Messages app.
• Although it syncs changes promptly, some local copies appear to accumulate contents that aren’t removed by Messages.
• As a result, some Syndication Photos Libraries grow far larger than required, but there’s no way to force them to purge unused contents.

Throughout much of Europe, bread has been a staple food for the whole of recorded history, and has become a symbol of life in both language and visual art.

For the classical civilisations of the Mediterranean, this was embodied in the goddess of Jean-François Millet’s Ceres (The Summer) from about 1864-65. She stands, her breasts swollen and ready for lactation, her hair adorned with ripe ears of wheat, a sickle in her right hand to cut the harvest, and a traditional winnow to separate grain from chaff in her left hand. At her feet is a basketful of bread, with ground flour and cut sheaves of wheat behind. The background shows the wheat harvest in full swing, right back to a group of grain- or hay-stacks and an attendant wagon in the distance.

Bread and its sharing is one of the central symbols of Christian beliefs, most notably in the Last Supper, the meal shared by Christ with his disciples before his crucifixion.

The most famous painting of The Last Supper, and one of the best-known works in the European canon, is of course Leonardo da Vinci’s. Giampietrino’s copy from about 1520 gives the closest impression today of what the original must have looked like. Even this copy has been horribly mutilated: the upper third was cut off, and its width reduced, but at least what remains gives a better idea of the original’s appearance.

Leonardo’s composition wasn’t entirely revolutionary for the time. Previous paintings of The Last Supper had spread the apostles along the length of a table, with Christ at its centre. However, Judas Iscariot was usually placed alone on the near side, his back to the viewer, and sometimes with his bag of silver visible behind his back.

Leonardo shows the moment of surprise and denial when Christ announces that one of those sat around the table would betray him. In this, he was perhaps the first artist to assemble the apostles into small groups, a feature that has been repeated in innumerable images following this. Arrayed along the front of the table is a series of round bread rolls and small glasses of red wine.

After his crucifixion and resurrection, Christ appeared several times to his disciples. In The Supper at Emmaus, painted here by Paolo Veronese, two disciples had travelled on the road from Jerusalem to Emmaus as pilgrims, and recognised Christ as he “sat at meat with them, he took bread, and blessed it, and brake, and gave it to them.”

The painting contains separate passages to cue this narrative: on the far left is an asynchronous ‘flashback’ referring to the journey to Emmaus. Christ is in the centre of the painting, identified by his halo, and in the midst of breaking bread. With him at the table are the two bearded figures of the disciples, dressed as pilgrims and bearing staves. On Christ’s right is a servant, acting as waiter to the group. The onlookers dressed in contemporary costume are an aristocratic Italian family of the day, whose portraits are combined.

Christian rites reiterate the Last Supper in Eucharist, and the blessing of bread plays other roles in its religious ceremonies.

Mykola Pymonenko’s Waiting for the Blessing (1891) shows the scene at a country church in Ukraine at dawn on Easter Sunday. The local population is crowding inside, while the women gather with their Paska, traditional ornamental bread that must be blessed before it can be eaten as a brunch.

Bread appears elsewhere as a symbol of life, particularly in the context of poverty and charity.

Edmund Blair Leighton’s Charity of Saint Elizabeth of Hungary from about 1895 shows a famous woman who built a hospital where she personally served the sick. Born in 1207, she died in 1231 at the age of only twenty-four. Leighton doesn’t show her in a nursing role, though, but handing out loaves to feed the poor.

Elizabeth Nourse painted some social realist works looking at the lives of the rural poor. Among these is The Family Meal from 1891, which was awarded a medal at the World’s Columbian Exposition in Chicago in 1893, and is seen here as an engraving in its catalogue. Parents sit with their two young children at an almost bare table. Their meal consists of a pot of soup and the remains of a loaf of what appears to be stale bread. The older child looks expectantly at her mother, who stares despondently at the table. Her husband stares down at his empty bowl.

The wonderfully named Philip Hermogenes Calderon painted his “Lord, Thy Will Be Done” in 1855. This quotation is derived from the Gospel account of what became the Lord’s Prayer, and has subsequently been used on many Christian religious occasions.

A young mother cradles her baby on her lap, looking up to the left. She’s living in difficult circumstances, but isn’t destitute, and wears a wedding ring on her left hand. The carpet is badly worn, and the coal scuttle empty, but there’s a loaf of bread on the table: she has her ‘daily bread’, another reference to the Lord’s Prayer. A portrait of a fine young man hangs above the mantlepiece, indicating her husband and the baby’s father is currently absent on military service. Several issues of The Times newspaper are scattered on the floor at the right, as if the woman has been following news of a military campaign overseas. Under the table is a letter, most probably from her husband.

Christian Krohg’s The Struggle for Existence, also translated as The Struggle for Survival from 1889 shows Karl Johan Street in Oslo in the depths of winter, almost deserted except for a tight-packed crowd of poor women and children queuing for free bread. These people are wrapped up in patched and tatty clothing, clutching baskets and other containers in which to put the food. A disembodied hand is passing a single bread roll out to them, from within the pillars at the left edge. That was yesterday’s bread; now stale, the baker is giving it away only because he cannot sell it.

Next week I will show paintings of bread as food.

Google is so helpful now when you ask it to solve a problem, such as how to free up space on your Mac. Not only can it make its own suggestions, but it can tap into those from AIs like ChatGPT and Grok. This article shows how that can bring you malware, thanks to the recent research of Stuart Ashenbrenner and Jonathan Semon at Huntress.

Please don’t try anything you see in this article, unless you want AMOS stealer malware on your Mac.

I started by entering a common search request, clear disk space on macOS, the sort of thing many Mac users might ask.

At the top of Google’s sponsored results is an answer from ChatGPT, giving its trusted web address. When I clicked on that, it took me to ChatGPT, where there’s a nice clear set of instructions, described impeccably just as you’d expect from AI.

This helpfully tells me how to open Terminal using Spotlight, very professional.

It then provides me with a command I can copy with a single click, and paste straight into Terminal. It even explains what that does.

When I press Return, I’m prompted for my password, which I enter.

Although I was a bit surprised to see this prompt, it looks genuine, so I allowed it.

Far from clearing space on my Mac, the malware, an AMOS stealer, has gone to work, saving a copy of the password I gave it, in the /tmp folder, and installing its payload named update.

Scripts like .agent are installed in my Home folder, and my (virtual) Mac is now well and truly owned by its attacker.

Full technical details are given in this post from Huntress.

As Ashenbrenner and Semon point out, this marks a new and deeply disturbing change, that we’re going to see much more of. We have learned to trust many of the steps that here turn out to lead us into trouble, and there’s precious little that macOS can do to protect us. This exploit relies almost entirely on our human weakness to put trust in what’s inherently dangerous.

First, distrust everything you see in search engines. Assess what they return critically, particularly anything that’s promoted. It’s promoted for a reason, and that’s money, so before you click on any link ask how that’s trying to make money from you. If that’s associated with AI, then be even more suspicious, and disbelieve everything it tells you or offers. Assume that it’s a hallucination (more bluntly, a lie), or has been manipulated to trap you.

Next, check the provenance and authenticity of where that click takes you. In this case, it was to a ChatGPT conversation that had been poisoned to trick you. When you’re looking for advice, look for a URL that’s part of a site you recognise as a reputable Mac specialist. Never follow a shortened link without unshortening it using a utility like Link Unshortener from the App Store, rather than one of the potentially malicious sites that claims to perform that service.

When you think you’ve found a solution, don’t follow it blindly, be critical. Never run any command in Terminal unless it comes from a reputable source that explains it fully, and you have satisfied yourself that you understand exactly what it does. In this case the command provided was obfuscated to hide its true action, and should have rung alarm bells as soon as you saw it. If you were to spare a few moments to read what it contains, you would have seen the command curl, which is commonly used by malware to fetch their payloads without any quarantine xattr being attached to them. Even though the rest of the script had been concealed by base-64 encoding, that stands out.

If you did get as far as running the malicious script, then there was another good clue that it wasn’t up to anything good: it prompted you for a System Password:. The correct prompt should just be Password:, and immediately following that should be a distinctive key character that’s generated by macOS for this purpose. Then as you typed your password in, no characters should appear, whereas this malware showed them in plain text as you entered them, because it was actually running a script to steal your password.

Why can’t macOS protect you from this? Because at each step you have been tricked into bypassing its protections. Terminal isn’t intended to be a place for the innocent to paste obfuscated commands inviting you to surrender your password and download executable code to exploit your Mac. curl isn’t intended to allow malware to arrive without being put into quarantine. And ad hoc signatures aren’t intended to allow that malicious code to be executed.

As I was preparing this article Google search ceased offering the malicious sponsored links, but I expect they’ll be back another time.

AI is certainly transforming our Macs, in this case by luring us to give away our most precious secrets. This isn’t a one-off, and we should expect to see more, and more sophisticated, attacks in the future. Now is the time to replace trust with suspicion, and be determined not to fall victim.

Apple has just released an update to XProtect, bringing it to version 5324. As usual, it doesn’t release information about what security issues this update might add or change.

This version adds another new Yara rule in its TIMELYTURTLE series, for MACOS.TIMELYTURTLE.SWNOA, and amends the recent rules for MACOS.SOMA.AUENB and MACOS.DUBROBBER.CHBI. In the new XPScripts.yr file introduced in XProtect 5322, it reverses the order of the two rules and amends MACOS.OSASCRIPT.COTABR.

You can check whether this update has been installed by opening System Information via About This Mac, and selecting the Installations item under Software.

A full listing of security data file versions is given by SilentKnight and SystHist for El Capitan to Tahoe available from their product page. If your Mac hasn’t yet installed this update, you can force it using SilentKnight or at the command line.

If you want to install this as a named update in SilentKnight, its label is XProtectPlistConfigData_10_15-5324

Sequoia and Tahoe systems only

This update has already been released for Sequoia and Tahoe via iCloud. If you want to check it manually, use the Terminal command
sudo xprotect check
then enter your admin password. If that returns version 5324 but your Mac still reports an older version is installed, you should be able to force the update using
sudo xprotect update

Painting in the Dutch Republic during the Golden Age was rich in landscapes, interiors and images of everyday life, but didn’t abandon storytelling. Many of Rembrandt’s finest works are religious narratives and tales drawn from classical mythology and history. This article shows a selection of paintings by the less famous, and how their stories extended beyond those that had been most popular in the Renaissance.

The Annunciation (1667) is a large canvas, and among the few religious paintings that Adriaen van de Velde made following his marriage to a Catholic woman, and his conversion to Catholicism. Although the angel is a little awkward, it seems hard to believe that this was painted by a landscape specialist.

Three years later, van de Velde painted a classical myth in his superb Vertumnus and Pomona (1670). Vertumnus was the Roman god of seasons and change, who could assume whatever form he wished. Book fourteen of Ovid’s Metamorphoses tells the story of his transformation into the form of an old woman, seen here on the left, so that he could gain entry to Pomona’s orchard and seduce her. Sadly, the yellow he used to mix greens has faded in parts, leaving some of his vegetation blue.

Jan Lievens’ painting of Quintus Fabius Maximus from 1656 may refer to this Roman’s victory at Tarentum, as told in Plutarch’s Lives. The great Carthaginian general Hannibal was only five miles away at the time of the Roman repossession of Tarentum, and this made Hannibal realise the impossibility of mastering Italy.

Paintings of fables, that had already started to become popular among Flemish artists at this time, appeared in the Republic to the north. Among them was the story of the Satyr and the Traveller, or the Man and the Satyr. A man made friends with a satyr; when the man’s hands were cold, he blew on them to warm them up. When the two were eating together, the man blew on his hot food in order to cool it down. The satyr decided that he couldn’t trust a creature whose breath blew both hot and cold, so broke off their friendship.

In 1653, Constantijn à Renesse, a former pupil of Rembrandt, painted his version of this fable in Satyr at the Peasant’s House. This shows one of the family blowing on the hot food in their spoon, although at this stage the satyr hasn’t reacted to the contradiction.

Jan Steen, in his telling of The Satyr and the Peasant “Who Blows Hot and Cold” from about 1660, gives a clearer account, with the satyr looking worried at the viewer, as a man (still wearing his hat) blows on a bowl of hot stew. He also pays attention to delightful details such as the cat skulking under the table, and a rich supporting cast.

Steen went on to paint two unusual accounts of what happened in schools across country districts in the Republic.

His The Village School from about 1665 shows physical punishment in a contemporary school. The child at the right holds out a hand for teacher to strike it with a wooden spoon, and is already wiping tears from his eyes. A girl in the middle of the canvas is grimacing in sympathy.

A few years later, Steen painted a scene in a larger and more chaotic classroom, in The Village School from about 1670. Although there are two staff sat at the teachers’ desk, the man is distracted, perhaps in cutting himself a fresh quill. The woman teacher sat next to him is engaged in explaining something to a pupil. Around them, all hell is breaking loose. In the distance, a boy is stood on one of the trestle tables. Older children are teaching younger ones, and a small group at a table at the right are trying to write while others get up to mischief. One younger child in the middle of the foreground has fallen asleep against a hat.

Gerrit Dou approaches social realism in his detailed account of The Young Mother from 1658. As she sits at her needlework, her child is attended in their wickerwork crib by a young nurse. Around them is an eclectic collection of objects, from a large cabbage, hanging game and a bundle of carrots at the right, to a bird cage and an upholstered chair at the left. Suspended above them is a chandelier, and a wooden spiral staircase ascends to the next floor. This family appears to be living in affluent squalor.

There was even an anthropomorphic fad for paintings showing gatherings of birds ‘singing’ together, and I think Melchior d’Hondecoeter’s Concert of the Birds from 1670 is probably the best example of those entertaining paintings.

The first thing I discovered when I started hunting provenance extended attributes (xattr) was a bug in my free utility xattred. This can result in the app crashing when using its Crawler to explore xattrs on items in a folder. I have fixed that in this new version 1.7, available below.

My hunt was by and large successful, with a great many com.apple.provenance xattrs caught. There are some interesting problems, though.

Looking through the contents of the main Applications folder, there are three groups of apps:

• Those with Apple certificates, including bundled apps and those delivered through the App Store (which are all signed by Apple, not their developer), which have no provenance xattr as they don’t register with provenance tracking.
• Apps with third-party certificates that have been installed simply, which have a single provenance xattr on the app bundle containing that app’s provenance ID.
• Apps with third-party certificates that have been installed or updated using a third-party app such as their Sparkle update mechanism, whose entire contents have provenance xattrs attached by the installer/updater, so not bearing the app’s provenance ID.

Examining files in the ~/Documents folder, there are plenty with provenance xattrs, and a great many with quarantine xattrs bearing information about their history including origin. Although some of the provenance IDs on them don’t match with those of apps, there’s sufficient to provide useful information about many without accessing the ExecPolicy database’s Provenance Tracking table. Therefore I will proceed to code up Providable over the next couple of weeks.

This new version of xattred should fix that crashing bug in its Crawler feature, that enables you to scan folders for information about their xattrs.

I have also looked at an issue that I’ve experienced when editing some xattrs such as the new com.apple.icon.folder type used in Tahoe to customise the appearance of folders. When editing them, some of the double-quotation marks used in text content can become changed to ‘smart’ quotes, which isn’t in the least bit smart, as it prevents that xattr from functioning correctly. Although that feature is disabled for that text view, macOS seems to be ignoring its setting and substituting smart quotes regardless. Provided that you’re aware of this danger and take care to ensure that all quotation marks are non-smart, you can edit xattrs successfully. Hopefully this will be improved in the future.

xattred version 1.7 for macOS 11.5 or later is available from here: xattred17
from Downloads above, from its Product Page, and via its auto-update mechanism.

Enjoy!

Centuries of experience with painting using oil paints have proved the importance of a robust support and a ground that isolates the paint layer from its support. Older use of wood panels with a gesso ground consisting largely of gypsum or chalk ensured the paint layer wouldn’t be subjected to mechanical stress, and would remain isolated from the underlying wood. Canvases became popular because of their relative lightness particularly in larger sizes, but still require an isolating ground layer both to protect the canvas from damage by the paint, and to prevent discolouration of the paint.

When sketching in oils in front of the motif became increasingly popular in the late eighteenth century, those paintings weren’t intended for public view, but as an aid for the artist when composing finished paintings in the studio. Rather than gather hundreds of small oil sketched on canvas or panels, the first plein air painters usually used paper or cardboard as support and ground. Subsequently, when their studios were sold off following their death, surviving oil sketches were usually laid on canvas for preservation and display.

Although he probably wasn’t the first to compile a library of oil sketches, those gathered by Pierre-Henri de Valenciennes when he was painting in the Roman Campagna in the 1780s are among the most brilliant. This untitled view of the countryside near Rome is thought to have been painted in about 1783.

At about the same time, the Welsh painter Thomas Jones was doing the same thing in and around Naples as well. This tiny view of A Wall in Naples was painted in about 1782, and is now one of the gems in London’s National Gallery. Below is a detail.

Jones was taught by the Welsh artist Richard Wilson, but none of his oil sketches have survived. Jones’ Capella Nuova outside the Porta di Chiaja, Naples is another example that’s significantly larger, and now in the Tate Gallery.

Valenciennes went on to assemble a large library of his oil sketches that he used for his studio paintings following his return to Paris. He was admitted to the Academy in 1787, published an influential manual of perspective and painting in 1799, and became Professor of Perspective at l’École des Beaux-Arts in Paris in 1812.

Among the aspiring young landscape painters who followed in the footsteps of Valenciennes was Camille Corot, who was taught by Achille Etna Michallon, who in turn had been taught by Valenciennes. Corot painted in the Roman Campagna between 1825-28, using the same techniques of applying his oil paint direct to sheets of paper.

Corot painted this View of Rome: The Bridge and Castel Sant’Angelo with the Cupola of St. Peter’s in 1826-27. This is one of the best-known bridges over the River Tiber, and not far from the centre of the city. The view is taken from the north-east of the bridge, on the ‘left’ bank, probably close to the Piazza di Ponte Umberto I, looking towards the south-west (‘right’ bank). The painting is sketchy rather than finely finished, and appears to have been painted en plein air onto a sheet of paper that has subsequently been laid on canvas.

This View of the Convent of S. Onofrio on the Janiculum, Rome is another from Corot’s first campaign in Rome.

Corot’s years in Italy were formative in his own development, and one of the key elements he put in place to hand on to Camille Pissarro and other Impressionists. The Bridge at Narni is one of his finest oil sketches.

Others followed Valenciennes’ instructions, among them Carl Blechen, a brilliant German landscape painter who sketched the Tiberius Rocks, Capri during a visit in 1828-29, again on paper.

Blechen’s late oil sketch of A Scaffold in a Storm was painted in about 1835, shortly before he succumbed to severe depression. This anticipates many elements of Impressionism: it appears to have been executed rapidly in front of the motif (although a view from his studio over Berlin and Brandenburg), with many brush-strokes plainly visible; details are composed of stylised marks; it is an everyday if not banal subject, with an informal composition.

However, the French Impressionists seldom if ever sketched in oils on paper, as their paintings made in front of the motif were intended to be sold to and viewed by the public, for which paper wasn’t considered suitable. Times had changed.

The Achilles heel of T2 Macs is booting from external storage. Although it’s simple to create a bootable external disk for a T2 Mac, to boot from it you have to allow the Mac to boot from any external disk, removing much of its boot security. Apple silicon Macs were designed to boot almost as securely from external disks as they do from the internal SSD, and that makes setting up a bootable external disk more complicated. This article explains how you can do that for macOS 26 Tahoe.

In this respect, Apple silicon Macs have two central principles:

• They always start the boot process from their internal SSD. If that’s not functioning correctly, then they can’t boot at all.
• They will only transfer the boot process to an external system when the user has access to a private key making them an Owner of that system, through the Mac’s LocalPolicy system. That’s the part that can cause problems.

Planning

There are alternatives to booting from external storage. If there’s sufficient space, you can install multiple versions of macOS on the internal SSD, or you can run macOS as a guest operating system in a virtual machine (VM). VMs are limited in some important respects, though, as they can’t run most apps from the App Store or use AI, although they can now access iCloud and iCloud Drive.

Like any other Mac, Apple silicon models can only boot from versions of macOS they’re compatible with. You can check which your Mac can run using Mactracker. A VM is the only solution for running older and incompatible versions of macOS, and it gets messy installing versions that are compatible but older than the currently installed major version of macOS. This is because its installer may be blocked by the more recent macOS, for which you’ll need to create a bootable installer disk and run the installation from that. Apple describes how to do that in this support article. For the remainder of this article, I assume that you’re installing a second or subsequent copy of the current version of macOS to an external disk.

Connect and prepare the external disk

First catch your disk, and connect it to one of the non-DFU ports on your Mac. For example, on my Mac mini M4, that’s either the left or right Thunderbolt port, as the middle one is its DFU port. On all other Apple silicon Mac minis, that’s either the centre or right port as you look from the rear, as their DFU port is the one on the left. If you try to install macOS to a drive connected to an Apple silicon Mac’s DFU port, then it’s doomed to fail, and that’s the most common cause of failure. More information on the DFU port is here.

Reformat that disk as you want to use it, with at least one APFS container containing a single APFS volume in regular APFS format, not encrypted.

Download and run the installer

Next catch your installer. Oddly, Apple seems to have stopped providing the current release of macOS through the App Store, so the simplest way to download it in the GUI is from the links provided by Mr. Macintosh, and there are many alternatives. You want a regular installer, not an IPSW image file that you might use to create virtual machines.

Run the installer app from your main Applications folder.

When it asks you whether you want to install macOS on your current system, click on Show All Disks…

Select your external disk from the list and click Continue. If your disk isn’t recognised or listed there, reformat it and start again.

Ownership

This is the important part of the installation; if it fails, the external disk won’t be bootable.

For the macOS system on your external disk to be bootable, it needs a LocalPolicy created for it on your Mac’s internal SSD. To ensure that only fully authorised users can configure and change LocalPolicy, those Image4 files are signed, and an Owner Identity Certificate (OIC) is attached to them. Creating and maintaining LocalPolicies requires a user to have access to the private Owner Identity Key (OIK) in the Secure Enclave, making that user an Owner.

Any user with access to the Volume Encryption Key for the internal storage also has access to the OIK, and has Ownership. By default, that includes all users added after FileVault encryption is enabled on a Data volume, for example. To be able to boot from that second OS, it requires a LocalPolicy with an OIC attached, and Ownership has to be handed off to an Install User created when that OS is installed.

Handing off Ownership to the Install User is more of a problem, as users are only created when the installation is complete. To accommodate that, macOS offers to copy a user from the current boot system as the Install User, and the primary admin user, on the second OS. Provided that you agree to that, the Install User created is actually a Key Encryption Key (KEK) for your password and hardware keys, which is then used to encrypt the OIK as it’s handed over to the new copy of macOS on the external disk. Thus, the installer requests that user’s password to gain access to the OIK for the new macOS in the Secure Enclave.

Following these steps should ensure that works correctly.

When prompted to select the user to be owner of the new boot volume group, pick the current admin user, and tick to copy their account settings.

You’ll then be prompted to enter that user’s password to authenticate as the owner.

Completing installation

Installation follows, and is (as ever) highly non-linear, and may even appear to stall. Persevere, and it will then close apps and restart to complete.

When you’re eventually prompted to Create a Computer Account, it’s simplest to create a local admin account for the owner. The new copy of macOS will then take you through personalising your new system, and, if you’ve added support for your Apple Account, it will do the 2FA dance for iCloud and Apple Account, and so on.

Once configured, you can share that external disk between Macs, but each time you boot from it on a different Mac, you can expect to repeat the 2FA dance for iCloud and Apple Account.

Updates

Once installed, you’ll almost certainly want to keep that external system up to date. To do that, start up from that disk, and use Software Update as normal. Although you could download that latest macOS installer and run that, that’s a much larger download and there’s always the risk it might run a clean install, forcing you to restore from your latest backup. Apple no longer provides downloadable updaters for macOS.

When you update macOS on that Mac, the firmware in it will be updated by the most recent version of macOS you have installed or updated it to, whether that’s on the internal or external disk. To update firmware, you have to install the appropriate macOS update on that Mac. If you update your external disk using another Mac, then that won’t update the firmware in your Mac. That can only be done by performing that update on that Mac.

Key steps

• Consider alternatives, including an additional system on the internal SSD, or using a VM instead.
• Connect the external storage to a non-DFU port and format it in APFS, not encrypted.
• Download and run the appropriate full macOS installer. macOS Tahoe isn’t currently available from the App Store, though.
• Select the external disk as the installation target.
• Select the current admin user to be Owner of the new system, copy their account settings, and authenticate with that user’s password.
• Create a local admin account for that user, if possible.
• Complete 2FA to connect to the Apple Account, as necessary.
• Update the external system when booted from it, using Software Update.

Some stories in Boccaccio’s Decameron attained fame less in the original, more in their later retelling. A good example is the tragic tale of Lisabetta related by Filomena on the fourth day, when it was the fifth about those whose love ended unhappily.

In 1818, the British poet John Keats (1795-1821) wrote his version, titled Isabella, or the Pot of Basil, which was published two years later, shortly after the poet’s untimely death at the age of just twenty-five, and it quickly became one of his most popular works. Here I will tell Boccaccio’s original, using his version of the names, being mindful that Keats called his leading lady Isabella rather than Boccaccio’s Lisabetta. Her lover’s name, common to both accounts, is Lorenzo.

Following the death of a rich merchant of Messina, his three sons inherited his riches, while their sister remained unmarried despite her beauty and grace. Lisabetta and Lorenzo, a Pisan who directed operations in one of the family’s trading establishments, fell in love with one another, and their relationship was consummated.

The couple tried to keep their affair secret, but one night one of her brothers saw her making her way to Lorenzo’s bedroom, and Lisabetta remained unaware of her discovery. Her brother was distressed, but decided to keep quiet, and to discuss it with his brothers next morning.

The following day, the brothers decided that they would also keep quiet until the opportunity arose to end their sister’s relationship. Some time later they pretended they were going to the country for pleasure, and took Lorenzo with them. When they reached an isolated location, they murdered Lorenzo and buried his body. They then told their sister that they had sent him away on a trading mission.

Lisabetta was anxious for her lover’s return, and persistently asked her brothers for news of him. Eventually, one of them rebuked her for this nagging, so she stopped mentioning him altogether, but each night kept repeating his name and pining for him. One night, having finally fallen asleep in tears, she saw him in a dream, in which he said that her brothers had murdered him, and revealed where his body was buried.

In her grief, Lisabetta obtained the permission of her brothers to go to the country for pleasure. Once she had located where she thought Lorenzo was buried, she quickly found his corpse, which remarkably showed no signs of decay. As she couldn’t move his whole body for more appropriate burial, she cut off his head and concealed it in a towel.

When she returned home, Lisabetta cried greatly over Lorenzo’s head, washing it with her tears, then wrapped it in cloth and put it in a large pot. She covered it with soil and in that planted some sprigs of basil. These she watered daily with her tears, as she sat constantly beside the pot in between bouts of crying over it. As a result, the basil grew strong and lush, and richly fragrant.

William Holman Hunt’s Isabella and the Pot of Basil from 1867 is intricately detailed, with several references to the story, such as the relief of a skull on the side of the pot, a red rose on a tray by Lisabetta’s left foot, and a silver watering can at the bottom right. Behind her is the image of a bedroom, possibly showing Lorenzo coming to her in a flashback to their affair.

Joseph Severn’s Isabella, or the Pot of Basil from 1877 appears remarkably high in chroma, and shows Lisabetta fondly embracing the pot and crying over the basil. Severn had been a personal friend of John Keats, and painted this just a couple of years before his own death.

Edward Reginald Frampton’s Isabella, or the Pot of Basil was probably painted towards the end of the nineteenth century, or possibly in the early twentieth. Lisabetta is kneeling before her pot of basil at an altar, with a crucifix behind.

Ricciardo Meacci’s watercolour of Isabella and the Pot of Basil from 1890 shows Lisabetta embracing her pot of basil, as her three brothers watch with growing anger at her behaviour.

Her brothers began to suspect something, so had the pot removed from her room. This deepened their sister’s grief, and she kept asking after the pot.

John Melhuish Strudwick’s Isabella from about 1886 shows Lisabetta staring in grief at the stand on which her pot of basil had stood. Through the window, two of her brothers are seen making off with the pot, and looking back at her.

The brothers examined its contents and discovered Lorenzo’s head. Scared that his murder might cause them problems, they reburied the head, wound up their business, and left Messina for Naples. Lisabetta’s grief only grew deeper, and destroyed her health completely. Still asking for her pot of basil, she finally cried herself to death. Although the brothers had done everything to keep these events secret, eventually they became widely known, and were celebrated in folk verse.

The first and still greatest depiction of Keats’ retelling is John Everett Millais’ Isabella (Lorenzo and Isabella) from 1848-49, completed before he was twenty, and one of the earliest examples of Pre-Raphaelite art. This is a composite of references to Keats’ poem and Boccaccio’s story, set at an imaginary family meal which the three brothers, Lisabetta and Lorenzo are taking together.

Lorenzo is sharing a blood orange with Lisabetta, white roses and passion flowers climbing from behind their heads. The dog, acting as a surrogate for Lorenzo, is being petted by Lisabetta, but one of her brothers aims a kick at it. Other symbols are shown of the plot to kill Lorenzo: a brother staring at a glass of red wine, spilt salt on the table, and a hawk pecking at a white feather. The pot of basil is already on the balcony, awaiting Lorenzo’s head. When exhibited at the Royal Academy in 1849, it was accompanied by verses 1 and 21 of Keats’ poem.

I hope that you enjoyed Saturday’s Mac Riddles, episode 337. Here are my solutions to them.

1: Passing time at the far right.

2: Winks at you when toggling extensions.

3: A pair of contradictory toggles for more settings.

The common factor

I look forward to your putting alternative cases.

Quarantine extended attributes, xattrs named com.apple.quarantine, aren’t attached to all files downloaded to Macs. Although once described as a voluntary scheme, putting files into quarantine is determined by a set of rules. This article explains how those rules work in macOS 26 Tahoe.

The default rule for apps that don’t run in a sandbox is that all new files they create don’t have a quarantine xattr attached to them. This is simple to verify by creating a new file using an app that hasn’t been obtained from the App Store, and isn’t one of Apple’s. Although it’s likely to get a MACL xattr attached, no quarantine xattr should accompany that. The same should also apply to files created by sandboxed apps, including TextEdit.

Info.plist

Although some processes and apps may explicitly attach quarantine xattrs, for example in AirDrop, this is a behaviour normally delegated to macOS by a setting in the app’s Info.plist, LSFileQuarantineEnabled. When that’s set to true, all files created by that app should bear the xattr. You can verify that by inspecting the Info.plist file in apps that download items from the internet, such as Safari, where it’s normally listed immediately below the app’s LSApplicationCategoryType.

No changes can be made to the Info.plist in a signed app, as those would break its signature.

CoreTypes.bundle

If that setting in Info.plist is false, or it doesn’t appear in the Info.plist, then there are additional and overriding settings contained in Exceptions.plist in the CoreTypes bundle, at /System/Library/CoreServices/CoreTypes.bundle/Contents/Resources. That long list contains five dictionaries:

• Additions, which assigns a lot of app categories, sets Java version requirements, and determines default settings for quarantine on files created by apps.
• AppNapOverrides, which sets App Nap behaviours.
• HighResolutionOverrides, which overrides High Res options for apps.
• LaunchOverrides, which can disable specific version ranges of apps from being launched; these prevent older apps from being run.
• MergeDocumentTypes, which merges some document types such as doc and docx for specific apps.
• Overrides, which can override other settings.

Included in the Additions dictionary you should find overriding settings for the popular BitTorrent client Transmission, reading:
<key>org.m0k.transmission</key>
<dict>
<key>LSApplicationCategoryType</key>
<string>public-category.internet</string>
<key>LSFileQuarantineEnabled</key>
<true/>
</dict>

Referring to the app by its ID of org.m0k.transmission, the first of those assigns the app to an app category of public-category.internet, then sets the app to attach the quarantine xattr to all documents that it creates, including everything that it downloads.

Among the existing overrides in Tahoe, for example, are org.pythonmac.unspecified.BitTorrent and org.xlife.Xtorrent, to ensure that Transmission, Xtorrent and PythonMac BitTorrent clients should write quarantine xattrs to all their downloaded files. Although this Exceptions property list doesn’t cover every client, it should ensure that most do protect their downloads by attaching a quarantine xattr.

The CoreTypes bundle isn’t in the Signed System Volume of macOS, but is protected from change. Thus, there’s no way the user can alter which apps add the quarantine xattr to new files they create.

Mach-O binaries

I don’t know how this system works with command tools, which are single file executables. They can have an Info.plist embedded in the executable, but this is rare unless they need to be notarized. The most popular tool for downloading files from the internet must be curl, used in commands of the form
curl [URL] -o [localfile]
to download the file named in the URL to a local file named localfile. It’s simple to demonstrate that the download then doesn’t have any quarantine xattr attached to it, and those don’t gain the xattr when extracted from archives either.

While this does offer the user a way to download files that don’t have any quarantine xattr attached, it’s also almost universally used for the same purpose by malicious software.

Summary

• By default, apps don’t normally attach the quarantine xattr to files they create.
• Most apps that can download files from the internet opt to attach the xattr by setting LSFileQuarantineEnabled to true in their Info.plist.
• Some of those that don’t, have that overridden in the Additions dictionary of Exceptions.plist in CoreTypes.bundle.
• One notable exemption is the command tool curl, which is also used by malware to escape quarantine.

Claude Monet had first visited London as he sought refuge from the Franco-Prussian War in 1870-71, when he painted one of the early impressions of the River Thames in mist, shown in yesterday’s article. He was to return just before the end of the century, when his fortunes had changed and he could afford to travel in search of motifs. Where better than the River Thames for the optical effects of mist, fog and smog?

Monet had started painting formal series during the 1880s, when he was enjoying commercial success at last. From about 1896, almost all his works were part of a series. He started travelling through Europe in search of suitable motifs for these, visiting Norway in 1895, and later Venice. When he returned to London in 1899, and in the following two years, Monet chose a different view of the Palace of Westminster, from a location at the opposite end of Westminster Bridge, for his series of 19 paintings. These were all started from the second floor of the Administrative Block at the northern end of the old Saint Thomas’s Hospital on the ‘south’ bank, and completed over the following three or four years.

His The Houses of Parliament, Sunlight Effect (1903) is more radical than his painting of thirty years earlier, showing little more than the Palace in silhouette, the sun low in the sky, and its broken reflections in the water.

The Houses of Parliament, Sunset (1903) shows the same view in better visibility, but with the sun setting and a small boat on the move in front of the Palace.

Monet’s Waterloo Bridge from 1903 is the ultimate conclusion of his paintings of fog, in which only the softest of forms resolve in its pale purple and blue vagueness, his common destination with the paintings of Turner over fifty years earlier.

In The Houses of Parliament, Stormy Sky (1904) the sun is higher and further to the south, allowing Monet to balance the silhouette of the Palace with its shadow cast on the water, and the brightness in the sky with its fragmented reflections.

Henri Le Sidaner also visited Britain on several occasions, and in 1906-07 painted this view of St. Paul’s from the River: Morning Sun in Winter, which may have been inspired by Monet’s series paintings of Rouen Cathedral, here expressed using his own distinctive marks.

Emile Claus’s Sunset over Waterloo Bridge (1916) was painted from a location on the north bank of the Thames slightly to the east of Waterloo Bridge, the north end of which is prominent, and looks south-west into the setting sun, up river. Claus painted several views of Waterloo Bridge while he was in London, but doesn’t appear to have attempted any formal series, such as Monet’s.

Claus isn’t formulaic in his treatment. He uses billowing clouds of steam and smoke to great effect, and his inclusion of the road, trees and terraces in the foreground, on the Embankment, provides useful contrast with the crisp arches of the bridge, and the vaguer silhouettes in the distance. Like Monet’s series, this was probably painted from a temporary studio inside a building.

Claus’s Morning Reflection on the Thames in London, from 1918, is a view over the Embankment and river that’s desaturated and made vaguer by fog.

My last example is another view over the River Thames, this time by Lesser Ury. London in Fog from 1926 doesn’t appear to be a nocturne, but looks at the effects of fog on both lights and their reflections.

On 4 December 1952, a high pressure system settled over London. The wind fell away, and fog and smoke were trapped under a temperature inversion. The following day the whole of the city and an area totalling over one thousand square miles were blanketed in smog that remained until 9 December. It’s estimated that directly caused over ten thousand deaths. A succession of laws and a major campaign to eliminate open coal fires in London resulted in great improvement, although a decade later there was another lesser smog, perhaps the event I remember from my childhood. The beauty of those paintings can also be deadly.

This week brought a timely revisit to remind myself just how common the three security extended attributes (xattr) have become, and to see whether we can make use of any of them for our own purposes.

How common?

Checking through one of my ~/Documents folders containing a modest 57,884 files, nearly 60% of them have at least one xattr. By far the most common is com.apple.quarantine on 48%, followed by com.apple.provenance at 14%. Some way behind those, but still one of the most frequent, is com.apple.macl on 2.8%.

Having explained what I think macOS does with all those xattrs, the next step is to ask whether we can use them for our direct benefit. Of the three, quarantine seems least useful to anything beyond Gatekeeper. MACL is like a boil on the bum, and the only time you’ll notice it is when it gets in your way. I can’t make sense from its contents either, but as it’s protected by SIP, there’s little a utility could do to alleviate our suffering, so we just have to learn to live with it. I’m surprised how uncommon it is in comparison with the nuisance it can cause.

Promising provenance

It’s the provenance xattr that looks most promising, and Koh M. Nakagawa has followed up his recent research into its function with an open-source command tool ShowProvenanceInfo that can look up provenance IDs found on files, in the ExecPolicy database’s Provenance Tracking table, although that requires root privileges for access.

Apps and executable code signed by third-parties rather than Apple are added to that table when they’ve successfully completed their first run. Each is given a unique provenance ID number that is attached to them in a com.apple.provenance xattr. When they then perform any of 11 types of file operation, such as creating a file or opening one in write mode, that app’s provenance ID is attached to the file in its own provenance xattr.

As apps and other executables that have been entered into that table have their own provenance xattrs, it shouldn’t be too much of a burden to build an independent database from those, together with other information about the executable with that provenance ID. That can then be used to examine provenance xattrs on arbitrary files, to identify which app last worked with that file, the primary task of a new GUI utility I’ve already dubbed Providable.

In addition to telling you which app with a provenance ID last changed a document, there are other functions that Providable could perform. Those property lists forming the basis for Background Items listed in Login Items & Extensions settings are normally created and changed by their owning app. When a third-party app with a provenance ID does that, the property list gains a provenance xattr that can be used to identify the app responsible. That can in turn provide information that’s often sadly lacking from the list of extensions, including the location of the app rather than that of the property list.

One obvious hole in this plan is the fact that apps that are signed by Apple, including those bundled in macOS and everything installed from the App Store, don’t get assigned provenance IDs. They therefore can’t be traced and identified from the files they create or change, as they operate outside the provenance tracking system.

Providable

My outline design for Providable is therefore to inspect provenance IDs saved as xattrs to the apps in the Data volume, and to display their details in a list you can refer to. Alongside that, a window lets you drop files on it for checking. Each will be examined for a provenance xattr, and those that have one will then be associated with the app in the list, providing its path and other details.

Provenance IDs can also be assigned to command tools and other executables, and a later version will allow you to check those in popular locations, and add them to the database so files can be matched to them as well. I don’t currently know how useful that might be, but we should get a better idea once the first version of Providable is in use.

I invite your ideas and comments, please, before I start coding.

One of the enduring memories of my childhood, spent partly in London, is walking in smog, then commonly known as a pea-souper. The combination of dense fog and smoke was so thick I could barely make out street lights, and the streets were for once almost empty, as vehicles could only proceed at walking pace.

This weekend I present a selection of paintings of mist, fog and maybe even a touch of smog on the River Thames, in and near London. Today’s paintings come from the pioneers of the nineteenth century, and tomorrow’s from the twentieth.

Many of JMW Turner’s greatest paintings take advantage of the optical effects of mist and fog. Being a Londoner, he must have experienced these all too frequently.

These peaked in Turner’s famous painting of a Great Western Railway train crossing the River Thames at Maidenhead: Rain, Steam, and Speed, exhibited at the Royal Academy in 1844. The whole image is fogbound and vague, and proved a precursor to the approach of the Impressionists after his death.

Less than thirty years later, when he was taking refuge from the Franco-Prussian War, Claude Monet’s The Thames below Westminster (1871) is less Impressionist. Painted from the Embankment to the north of Westminster Bridge, near what is now Whitehall, the three towers to the south are almost superimposed, and aerial perspective is exaggerated by the mist. The river is bustling with small paddleboat steamers. In the foreground a pier under construction is shown almost in silhouette. Small waves and reflections on the river are indicated with coarse brushstrokes, suggesting this is a rapid and spontaneous work.

A decade later, The Houses of Parliament is Winslow Homer’s faithful representation of the Palace of Westminster when viewed from the opposite bank of the Thames, to the north (downstream) of the end of Westminster Bridge. The tide is high under the arches of Westminster Bridge, and small boats are on the river. This classic watercolour makes an interesting contrast with Monet’s later oil paintings I show tomorrow: Homer provides little more detail, the Palace being shown largely in silhouette, but works with the texture of the paper and careful choice of pigment to add granularity. He provides just sufficient visual cues to fine detail, in the lamps and people on Westminster Bridge, and in the boats, to make this a masterly watercolour.

The following year, Jules Bastien-Lepage paid a return visit to the city, when he painted The Thames, London. This view of industrial docklands further downstream maintains detail into the far distance, except where it’s affected by the smoky and hazy atmosphere typical of the city at that time. It was this section of the river that was also painted on several occasions by James Abbott McNeill Whistler.

Tom Roberts’ Fog, Thames Embankment (1884) is painted from a similar location to Monet’s The Thames below Westminster above, on the Embankment to the north of Westminster Bridge, but is cropped more tightly, cutting off the tops of the Victoria and Elizabeth Towers. The Palace and first couple of arches of Westminster Bridge appear in misty silhouette, with moored barges and buildings on a pier shown closer and crisper. He renders the ruffled surface of the river with coarse brushstrokes, different from those of Monet.

Among six paintings that Camille Pissarro started work on during his visit to England in 1890 was this view of Charing Cross Bridge, London from Waterloo Bridge. For this he made a sketch in front of the motif, then following his return to his studio in Éragny he painted this in oils. This looks south-west, towards a skyline broken by the Palace of Westminster and the familiar tower of Big Ben.

In Frederick Childe Hassam’s Houses of Parliament, Early Evening (1898), the sun has already set, and he is viewing the Palace in the gathering dusk from a point on the opposite (‘south’) bank, perhaps not as far south as Lambeth Palace. The Victoria Tower is prominent in the left of the painting, the Central Tower is in the centre, and the most distant Elizabeth Tower is distinctive with its illuminated clock face. Moored boats in the foreground provide the only other detail. His rough facture gives a textured surface to the water.