Normal view

There are new articles available, click to refresh the page.
Yesterday — 21 August 2025The Eclectic Light Company

Reading Visual Art: 222 Armour A

By: hoakley
21 August 2025 at 19:30

Armour, either in the form of plates of metal or chain mail with its many interlocked rings, is the primary attribute and symbol of the warrior. As such, several of the classical deities are often depicted wearing armour.

rubenstriumphofvictory
Peter Paul Rubens (1577–1640), The Triumph of Victory (c 1614), oil on oak panel, 161 x 236 cm, Gemäldegalerie Alte Meister, Kassel, Germany. Wikimedia Commons.

Peter Paul Rubens painted The Triumph of Victory in about 1614 for the Antwerp Guild of St George, its organisation of archers. Mars in his short suit of black armour dominates, his bloody sword resting on the thigh of Victoria, the personification of victory. She reaches over to place a wreath of oak or laurel on Mars, and holds a staff in her left hand. At the right, Mars is being passed the bundle of crossbow bolts that make up the attribute of Concord. Under the feet of Mars are the bodies of Rebellion, in the foreground, who still holds his torch, and Discord, on whose cheek a snake is crawling. The bound figure resting against the left knee of Mars is Barbarism.

jordaensgoldenapplediscord
Jacob Jordaens (1593–1678), The Golden Apple of Discord (1633), oil on canvas, 181 × 288 cm, Museo Nacional del Prado, Madrid, Spain. Wikimedia Commons.

Jacob Jordaens’ finished version of an original sketch by Rubens now known as The Golden Apple of Discord (1633) shows the wedding feast of the deities where Eris (Discord) makes her gift of the golden apple to set up the Judgement of Paris, leading to the Trojan War. At the left, Athena/Minerva, wearing her plumed helmet and a suit of ornate plate armour, reaches forward for that apple.

Just to confuse, the Roman goddess of war, Bellona (Greek Enyo), is also shown in or with armour by convention.

rubensmariedemedicibellona
Peter Paul Rubens (1577–1640), Portrait of Marie de’ Medici as Bellona (date not known), oil on canvas, 276 x 149 cm, Musée du Louvre, Paris. Wikimedia Commons.

Peter Paul Rubens’ undated Portrait of Marie de’ Medici as Bellona shows her in the midst of cannon, arms and armour, with an exuberantly decorated helmet, a sceptre and a statue of a winged woman.

Armour inevitably plays a role in some of the events reported during the war against Troy. After his close friend Patroclus had been killed while wearing the armour of Achilles, he demanded a fresh suit made by Vulcan/Hephaestus before he would return to engage in battle.

vandyckthetisreceivingarmour
Anthony van Dyck (1599–1641), Thetis Receiving the Weapons of Achilles from Hephaestus (c 1630-32), oil on canvas, 112 x 142 cm, Kunsthistorisches Museum, Vienna, Austria. Wikimedia Commons.

Anthony van Dyck’s Thetis Receiving the Weapons of Achilles from Hephaestus from about 1630-32 shows the scene when Thetis is collecting her son’s new armour from Hephaestus, at the left.

westthetisbringingarmor1804
Benjamin West (1738–1820), Thetis Bringing the Armour to Achilles (1804), oil on canvas, 68.6 x 50.8 cm, Los Angeles County Museum of Art, Los Angeles, CA. Wikimedia Commons.

Benjamin West’s Thetis Bringing the Armour to Achilles from 1804 shows the Greek warrior being presented with the armour and helmet by his mother Thetis.

When Achilles is killed in battle, in accordance with warrior tradition, his armour was handed on to the next in line, who could have been either Ajax or Odysseus.

bramequarrelajaxodysseus
Leonaert Bramer (1596–1674), The Quarrel between Ajax and Odysseus (c 1625-30), oil on copper, 30.5 × 40 cm, Museum Prinsenhof Delft, Delft, The Netherlands. Wikimedia Commons.

Leonaert Bramer’s small painting on copper of The Quarrel between Ajax and Odysseus was made between about 1625-30. The pair stand in their armour, next to tents pitched at the foot of Troy’s mighty walls. At their feet is the armour of Achilles, and all around them are Greek warriors, some in exotic dress to suggest more distant origins.

Armour also leaked through into Christian religious paintings.

cranachconvstpaul
Lucas Cranach the Younger (1515–1586), The Conversion of Saul (1549), painting on lime, 115 × 167.2 cm, Germanisches Nationalmuseum, Nürnberg, Germany. Wikimedia Commons.

Lucas Cranach the Younger sets The Conversion of Saul (1549) in mediaeval northern Europe, with Paul and his party riding knightly chargers in their armour. Paul’s horse has fallen to the ground, with Paul still in the saddle rather than prostrate on the ground. Paul holds his hands up and looks to the heavens, where the figure of Christ is seen in a break in the clouds at the top left corner.

It was the young French martyr Joan of Arc, though, who is most often depicted wearing armour.

ingrescoronationcharlesvii
Jean Auguste Dominique Ingres (1780–1867), Joan of Arc at the Coronation of Charles VII, in Rheims Cathedral (1854), oil on canvas, 240 x 178 cm, Musée du Louvre, Paris. Wikimedia Commons.

JAD Ingres painted Joan of Arc at the Coronation of Charles VII, in Reims Cathedral (1854). She stands close to the crown, resplendent in full armour and holding a standard, the two-pointed oriflamme embroidered for her by the women of Orléans, in her right hand.

lenepveujoanofarc2
Jules Eugène Lenepveu (1819-1898), Joan of Arc Murals 2 (1886-90), mural, Panthéon de Paris, Paris. Image by Tijmen Stam, via Wikimedia Commons.

The second scene in Jules Eugène Lenepveu’s Joan of Arc Murals (1886-90) shows Joan leading the French forces against the English, who were laying siege to the French city of Orléans. There had been controversy in Joan’s trial as to whether she had used weapons against the English; Lenepveu hedges here, showing her holding a sword in her right hand, but brandishing the Dauphin’s standard to rally the French, in the role that she described of herself. She’s wearing a suit of plate armour, which she was provided with in preparation for this operation. As this would have been designed to fit a man, this was part of the case against her for ‘cross-dressing’ in men’s clothes.

Lovis Corinth is one of several major painters who acquired themselves a suit of armour. This featured in two symbolic paintings made before and after the First World War.

corinthindefenceofweapons
Lovis Corinth (1858–1925), Im Schutze der Waffen (In Defence of Weapons) (1915), oil on canvas, 200 × 120 cm, Private collection. Wikimedia Commons.

When war broke out on 28 July 1914, Lovis Corinth and most of the other artists in Berlin shared an enthusiastic patriotism that initially gave them a buoyant optimism. He expressed this openly in his In Defence of Weapons from 1915.

corintharmourpartsinstudio
Lovis Corinth (1858–1925), Armour Parts in the Studio (1918), oil on canvas, 97 × 82 cm, Staatliche Museen Berlin, Berlin. Wikimedia Commons.

Armour Parts in the Studio is Corinth’s summary of Germany’s defeat in 1918. The suit of armour is now empty, broken apart, and cast on the floor of his studio.

How to check if your Apple silicon Mac is booting securely

By: hoakley
21 August 2025 at 14:30

There are so many controls in macOS that sometimes you can’t see the wood for the trees. This can leave uncertainty over essentials, such as whether your Apple silicon Mac really is properly secure, or maybe there’s something sinister going on with it? This is a question I’m asked not infrequently, usually when someone has been spreading disinformation or FUD (fear, uncertainty, doubt). So how can you check that your Mac is properly locked down and boots securely?

Quick checks

There are two quick checks that cover the essentials. First, open System Information and select the Controller section in Hardware.

This provides a brief summary of your Mac’s boot security, which should read as shown above. If you still need to use a kernel extension or similar, your Mac might show Reduced Security with Allow All Kernel Extensions enabled, but you should do everything you can to avoid that.

Secure Boot is controlled using Startup Security Utility in Recovery mode, and if you care to start up in that mode, you can confirm or correct its settings there.

bootsec2

Back in normal user mode, open Privacy & Security settings and ensure you have FileVault enabled there.

filevault3

SilentKnight also checks that XProtect/Gatekeeper checks are enabled, and that security data are up to date, giving you complete confidence.

Details

Although those should be sufficient for most, some want to go further and verify that their Mac’s boot process and security systems are also working correctly. To do that, shut your Mac down, wait ten seconds or so, and start up normally with the startup chime sounding at a known time. Enter your password, wait a few seconds for the Finder to get set up and running, and open LogUI. Set its time to that of the startup chime, and get the first 10 seconds or 10,000 log entries. You may need to adjust the seconds to capture the full boot sequence. When you have, look through the log and identify the following waypoints.

In each of these log entries, I have emboldened a word or two that you can copy from here and paste into LogUI’s Search box, then press Return. That will display the log entry, and sometimes others you might find relevant. Times are given here in seconds, with the startup chime occurring at about 37 seconds. Version numbers shown are those for macOS 15.6.

The start of boot is recorded as
37.562774 === system boot: [UUID]
and a little while after that, the kernel declares its version details
42.759300 Darwin Kernel Version 24.6.0: Mon Jul 14 11:30:40 PDT 2025; root:xnu-11417.140.69~1/RELEASE_ARM64_T6041
for macOS 15.6.

Further down you’ll come across more information about key security components, including the Trusted Execution Monitor
43.060422 [Log]: Code Signing Monitor Image4 Module Version 7.0.0: Fri Jul 11 16:51:29 PDT 2025; root:AppleImage4_txm-320.100.22~1090
43.060447 [Log]: build variant: txm.macosx.release.TrustedExecutionMonitor_Guarded-135.100.37

Then the iBoot firmware version
43.061758 iBoot version: iBoot-11881.140.96
43.061760 iBoot Stage 2 version: iBoot-11881.140.96

CoreCrypto support is vital, and another Image4 extension
43.137635 FIPSPOST_KEXT [133796636] fipspost_post:154: [FIPSPOST][Module-ID] Apple corecrypto Module v18.3 [Apple silicon, Kernel, Software, SL1]
43.242334 Darwin Image4 Extension Version 7.0.0: Mon Jul 14 11:23:46 PDT 2025; root:AppleImage4-320.100.22~2585/AppleImage4/RELEASE_ARM64E

You should see entries reporting the loading of security policy components
43.242343 Security policy loaded: AppleImage4 hooks (AppleImage4)
43.242961 Security policy loaded: Apple Mobile File Integrity (AMFI)
43.243092 Security policy loaded: Seatbelt sandbox policy (Sandbox)

The Secure Enclave Processor or SEP is another key component that has to be started up
43.264594 "AppleSEPKeyStore":326:0: starting (BUILT: Jul 14 2025 23:34:10) ("normal" variant 🌽 , 1827.120.2)
43.264639 "AppleSEPKeyStore":471:0: _sep_enabled = 1

Apple System Policy should follow a bit later
43.760156 Security policy loaded: Apple System Policy (ASP)
43.760188 AppleSystemPolicy has been successfully started

The root of the file system is then identified in two entries whose origins go right back to the start of Mac OS X
43.940643 BSD root: disk3s1
43.940644 , major 1, minor 13

And APFS mounts the root file system, using the SSV snapshot
43.941048 apfs_vfsop_mountroot:2984: apfs: mountroot called!
44.034685 apfs_vfsop_mount:2763: disk3s1 Rooting from snapshot with xid 1724240.

One of the most important entries comes shortly after that, where successful validation of the SSV’s root hash is reported
44.038830 authenticate_root_hash:642: disk3s1 successfully validated on-disk root hash

It’s now time to start user space processes, and for that launchd must be loaded so it can launch everything else
44.103761 load_init_program: attempting to load /sbin/launchd

How Secure Boot works

Apple silicon Macs have a small ROM to support DFU mode in case a full Restore is required, and to check and load the first stage of the ‘firmware’, the Low-Level Bootloader or LLB. Only if that matches its signature will the ROM firmware hand over to it and proceed with the boot process. The LLB in turn performs the same checks on the second stage ‘firmware’, iBoot proper. That goes on to check the kernel, before loading that and handing over for kernel boot to take over.

iBoot ‘firmware’ doesn’t write anything in the log, but once the kernel takes over its log entries provide a detailed account of its progress. The great majority of its log entries are unintelligible to anyone outside Apple, but the waypoints I have given above identify some of the most important steps it takes. When it’s ready, the kernel validates the root hash for the SSV snapshot, as noted above, enabling the boot process to proceed to load and run other parts of macOS. The remaining hash checking of the SSV, to confirm that it’s exactly as Apple intends, proceeds in a ‘lazy’ fashion, as access is needed to its contents.

This chain of validation before loading the next stage ensures that nothing in the boot process can be tampered with or changed, and the boot is secure throughout. Apple provides further details in its Platform Security Guide.

Apple has just released security updates to macOS 15.6.1, 14.7.8 and 13.7.8

By: hoakley
21 August 2025 at 02:39

Apple has just released urgent security updates to bring macOS Sequoia to 15.6.1, Sonoma to 14.7.8, and Ventura to 13.7.8.

Security release notes for these are already available, for 15.6.1, 14.7.8 and 13.7.8 Each refers to the same single vulnerability in ImageIO, which is apparently being exploited “in an extremely sophisticated attack against specific targeted individuals” using a crafted image file.

The download for 15.6.1 is about 1.56 GB for an Apple silicon Mac, and should be well under 1 GB for Intel. Time to update!

Before yesterdayThe Eclectic Light Company

The Dutch Golden Age: Still Life

By: hoakley
20 August 2025 at 19:30

Although there are a few still life paintings from classical Roman times, the first known in modern painting was made by Hans Memling in about 1485, and Caravaggio painting one in about 1599. There were precious few until after 1610, and it wasn’t until the Dutch Golden Age that they appeared in any quantity. Once they started, they quickly became popular, and may have accounted for as much as 10% of all paintings sold in Leiden, for instance. Their success was the result of religious intolerance.

Unlike the Italian Renaissance, the Flemish Renaissance revelled in the faithful depiction of surface textures and adventures in optics. Centres such as Antwerp trained painters in the skills needed, but Flanders and Brabant formed the Catholic Spanish Netherlands, where religious paintings were expected. Artists who followed the Reformed tradition rather than Catholicism or who wanted to paint secular works found themselves oppressed, and many migrated to the north, to paint in the Dutch Republic.

One of the most successful of the pioneer still life painters of the early seventeenth century was also a woman, Clara Peeters, and one of the finest still life painters of any age. We don’t even know when she was born, but she seems to have trained in Antwerp, then pursued her career successfully in the Dutch Republic. She’s thought to have been internationally successful by 1611, when at least four of her paintings were sold to Spain. Her last reliably-dated works are from 1621, although there are a few attributed to her from later.

peetersvenetianglassroemercandlestick
Clara Peeters (fl 1607-1621), Still Life with Venetian Glass, Roemer and a Candlestick (1607), oil on panel, 23.7 x 36.7 cm, location not known. Wikimedia Commons.

Venetian Glass, Roemer and a Candlestick (1607) is one of Peeters’ earliest known works, which shows an extraordinary skill in rendering the varied surfaces and their optical properties. It is also one of the first still lifes in which the artist has included their own image reflected in the motif, here the base of the candlestick holder.

As in many still lifes, its contents have interesting symbolic meaning. The confectionery shown is sweet and ephemeral, the ring a sign of earthly riches and temporal relationships, the fly an indicator of earthly decay, and the burning candle combines remembrance with the strict limits on lifespan in this world. This is not just a still life, but an expression of vanitas, the futility and limits of our earthly existence, a theme for a separate article in this series.

Her paintings from 1611 that ended up in the Spanish Royal Collection, and are now in the Prado, move on from that impressive start.

peetersmesa
Clara Peeters (c 1594-1640), Mesa (Table) (c 1611), oil on panel, 55 x 73 cm, Museo Nacional del Prado, Madrid. Wikimedia Commons.

This Table is laid out for a meal, with its range of food and surfaces with different optical properties. Settings for meals, particularly that of breakfast, were later to become a sub-genre in their own right.

peetersgamepiecepoultry
Clara Peeters (fl 1607-1621), Still Life with Game Piece and Poultry (1611), oil on panel, 52 × 71 cm, Museo Nacional del Prado, Madrid. Wikimedia Commons.

Over the coming centuries, still life paintings featuring game were to become popular throughout Europe. Peeters’ Still Life with Game Piece and Poultry is their ancestor. Shells are another vanitas association.

peetersfishcandlestick
Clara Peeters (fl 1607-1621), Still Life of Fish and a Candlestick (1611), oil on panel, 50 x 72 cm, Museo Nacional del Prado, Madrid. Wikimedia Commons.

Her Still Life of Fish and a Candlestick is one of the earliest and most accomplished paintings of the fruits de mer, which were to find favour with William Merritt Chase nearly three centuries later.

peetersflowersgobletdainties
Clara Peeters (fl 1607-1621), Still Life with Flowers, Goblet and Dainties (1611), oil on panel, 52 x 73 cm, Museo Nacional del Prado, Madrid. Wikimedia Commons.

In the last of these from the Spanish collection, Clara Peeters makes another cameo appearance in its reflections, providing tantalising glimpses of herself.

peetersflowersgoldcups
Clara Peeters (fl 1607-1621), Still Life with Flowers and Gold Cups of Honour (1612), oil on oak, 59.5 x 49 cm, Staatliche Kunsthalle Karlsruhe, Karlsruhe, Germany. Wikimedia Commons.

The following year, her still life with Flowers and Gold Cups of Honour (1612) reveals multiple miniature self-portraits reflected in the gold cup at the right.

peeterscheesesalmondspretzels
Clara Peeters (fl 1607-1621), Still Life with Cheeses, Almonds and Pretzels (c 1615), oil on panel, 34.5 x 49.5 cm, Koninklijk Kabinet van Schilderijen Mauritshuis, The Hague, The Netherlands. Wikimedia Commons.

In her still life with Cheeses, Almonds and Pretzels from about 1615, her surface and optical rendering is breathtaking, and all thoughts of vanitas have gone. This is a celebration of the thoroughly earthly and sensuous pleasures of food. These are sustained in several of her other later paintings.

peetersflowersinroemer
Clara Peeters (fl 1607-1621), Still Life Of Flowers In a Roemer With a Field Mouse And An Ear Of Wheat (date not known), oil on panel, 27 x 21 cm, location not known. Wikimedia Commons.

She hadn’t entirely forgotten the spiritual dimension, though. Another of her most interesting paintings returns to the concept of vanitas and the ephemeral.

Peeters established herself an international reputation, sold her paintings into major art collections, and pioneered what was to come in the rest of the century, yet is omitted from many accounts of painting in the Dutch Golden Age.

Ambrosius Bosschaert (1573–1621), Flower Still Life (1614), oil on copper, 30.5 x 38.9 cm, J. Paul Getty Museum, Los Angeles, CA. Wikimedia Commons.

By this time, still life paintings were enjoying growing popularity in the buoyant market of the Dutch Golden Age. Ambrosius Bosschaert (1573–1621) painted this Flower Still Life in oil on copper in 1614, during the early years. He had been born in Antwerp, but because of the threat of religious persecution moved to Middelburg in the Dutch Republic, where he founded a school of floral painting.

At first its eclectic mixture of different flowers and flying insects appears haphazard. These merit a deeper reading, though: the flowers include carnation, rose, tulip, forget-me-nots, lilies of the valley, cyclamen, violet and hyacinth. These could never, at that time, have bloomed at the same time. The butterflies, bee and dragonfly are as ephemeral as the flowers around them. This too has more than a touch of vanitas.

By 1620, still life paintings were much in demand in northern Europe, and had ceased being occasional curiosities. Bosschaert’s career and family business was founded on the still life, which had come of age at last.

claeszstilllifemusicalinstruments
Pieter Claesz (1597/1598-1660), Still Life with Musical Instruments (1623), oil on canvas, 69 x 122 cm, Musée du Louvre, Paris. Wikimedia Commons.

Collations of food grew ever more inventive, with Pieter Claesz combining a table of bread and delights in his Still Life with Musical Instruments from 1623. His underlying themes here are the rich browns of the food, wood and tortoise, and their curved forms. Claesz had been born near Antwerp, trained in that city and became a master there in 1620, when he too migrated to the Dutch Republic, where he established his studio in Haarlem.

kalfewervesselspomegranate
Willem Kalf (1619–1693), Still Life with Ewer, Vessels and Pomegranate (c 1645), oil on canvas, 103.5 x 81.3 cm, J. Paul Getty Museum, Los Angeles, CA. Wikimedia Commons.

Other artists developed the still life in the direction of food, as shown in Willem Kalf’s Still Life with Ewer, Vessels and Pomegranate from about 1645. He brings together an impressive variety of surface optical effects too, in this bravura display of technique.

Still life paintings pressed on into culinary exhibitions, usually centred on the breakfast table (ontbijtjes), which in Spain developed into bodegone, populated by caterers and their customers at roadside stalls.

claeszsalttub
Pieter Claesz (1597/1598–1660), Still Life with Salt Tub (c 1644), oil on panel, 52.8 x 44 cm, Rijksmuseum Amsterdam, Amsterdam, The Netherlands. Wikimedia Commons.

Another fine example is Pieter Claesz’s Still Life with Salt Tub from about 1644, with its combination of bread, fish, sea salt, and an ornate glass goblet with its optical effects.

I’ve already shown some still life paintings including living creatures. Those developed into another sub-genre of dead game, which in turn linked to hunting and the depiction of wildlife.

weenixdeadharepartridges
Jan Weenix (c 1642-1719), Still Life of a Dead Hare, Partridges, and Other Birds in a Niche (c 1675), oil on canvas, 105.5 x 88.5 cm, Museum of Fine Arts, Houston, TX. Wikimedia Commons.

Jan Weenix specialised in this sub-genre. His Still Life of a Dead Hare, Partridges, and Other Birds in a Niche from about 1675 is one of a large number of finely detailed and realistic paintings which he made. Weenix was born in Amsterdam, where he lived and worked for much of his life, but was a Catholic who worshipped in ‘hidden’ churches that were tolerated in the Dutch Republic.

weenixgamehare
Jan Weenix (c 1642-1719), Still Life of Game including a Hare, Black Grouse and Partridge, a Spaniel looking on with a Pigeon in Flight (c 1680), oil on canvas, 157.2 x 182.2 cm, Museum of Fine Arts, Houston, TX. Wikimedia Commons.

These piles of animal corpses spilled out into a strangely dark countryside, in paintings such as his Still Life of Game including a Hare, Black Grouse and Partridge, a Spaniel looking on with a Pigeon in Flight from about 1680. These became popular at the time, and Weenix was commissioned to decorate the houses of the rich with large murals on canvas, and to paint series for European royal courts. The more ostentatious paintings were known as pronkstilleven.

Others used the still life as a link to what later became natural history painting.

devreeforestfloor
Nicolaes de Vree (1645–1702), A Forest Floor Still Life with Flowering Plants and Butterflies (date not known), oil on canvas, 112 x 88.5 cm, location not known. Wikimedia Commons.

For their familiarity, bright colours, and natural beauty, butterflies were popular in the Dutch Golden Age, particularly in smaller paintings such as still lifes destined for the collector’s cabinet. Nicolaes de Vree’s undated Forest Floor Still Life with Flowering Plants and Butterflies from the latter half of the seventeenth century is a fine example of a painting that goes beyond the normal still life and depicts a more natural scene.

Still life painting during the Dutch Golden Age flourished and brought commercial success to many artists. It also laid the foundations for several sub-genres which were to be developed later. Far from being the lowest of the genres, for around a century in the Dutch Republic they were among the most innovative and exciting.

Explainer: Yara rules

By: hoakley
20 August 2025 at 14:30

Security utilities that detect known malicious software do so using sets of detection rules. Since their introduction by Victor Alvarez of VirusTotal 12 years ago, the most common method of expressing these rules is in a text file with the extension .yara. Apparently YARA stands for either YARA: Another Recursive Acronym, or Yet Another Ridiculous Acronym.

Yara rules are used extensively in macOS by both the original XProtect and its sibling XProtect Remediator. Those of XProtect are found in the XProtect.yara file in XProtect.bundle, in /Library/Apple/System/Library/CoreServices and its additional location in /private/var/protected/xprotect in Sequoia and later. Further Yara rules are also encrypted and embedded in XProtect Remediator’s scanning modules, as detailed by Koh M. Nakagawa in the FFRI Security GitHub.

As used by Apple, each rule can consist of up to three sections:

  • meta, containing the rule’s metadata including a description and in more recent cases a UUID for the rule.
  • strings, specifying some of the content of the file, typically in the form of hexadecimal strings such as { A0 6B }.
  • condition, a logical expression that, when satisfied, meets the requirements of that rule, so identifying it as malicious.

I’ll exemplify these using Yara rules used in XProtect version 5310.

Private rules

At the start of the Yara file are any private rules. These are a bit like macros, in that they define properties that are then used in multiple rules later. Laid out in compact form, an example reads:

private rule Shebang
{ meta:
description = "private rule to match shell scripts by shebang (!#)"
condition:
uint16(0) == 0x2123
}

This starts with description metadata for this private rule, then states the condition for satisfying this rule, that the first 16-bit unsigned integer in the file contains the hex 0x2123, the UTF-8 characters 0x21 or ! and 0x23 or #. In the reverse order of #! they’re known as the shebang, and the opening characters of many shell scripts, but in this rule they are given the other way around because of the byte order used in the 16-bit integer.

This defines what’s required of a Shebang, and can be included in the conditions of other Yara rules. Instead of having to redefine the same feature in every rule, they can simply include that Shebang rule in their condition.

Regular rules

After 3-5 private rules, the XProtect Yara file goes on to enumerate 372 normal rules, including this one:

rule XProtect_MACOS_SOMA_JLEN
{meta:
description = "MACOS.SOMA.JLEN"
uuid = "4215C9D4-57D5-4D30-82E1-96477493E8D5"
strings:
$a0 = { 4c 8d 3d ?? 74 0b 00 4c 8d 25 ?? ?? 0b 00 4c 8d 2d ?? ?? 0b 00 48 8d 5d c0 }
$a1 = { 73 62 06 91 d4 03 00 f0 94 42 21 91 }
condition:
Macho and ( ( $a0 ) or ( $a1 ) ) and filesize < 5MB
}

This rule has its internal code name as its description, and has been assigned the UUID shown. It then defines two binary strings, a0 and a1, the former containing ‘wild’ values expressed using the question mark ?. The condition for satisfying the rule is that the file must:

  • be a Mach-O binary, and
  • contain either a0 or a1, and
  • its size must be less than 5 MB.

Further details about Yara rules are given here.

Implementation

There are standard implementations that can check files against custom sets of Yara rules. Rules are normally compiled into binary form from their text originals before use. Full details are given on VirusTotal.

Apple’s use of Yara files is mysterious, as for some years all the descriptions used arbitrary code names as obfuscation. When the source of all the rules is given in plain text, it’s hard to see what purpose that served, and it meant that users were told that MACOS.0e32a32 had been detected in an XProtect scan, for instance. Thankfully, Apple has more recently replaced most of those with more meaningful names.

I’m grateful to Duncan for asking me to explain this, and hope I have been successful. I’m also grateful to isometry and an anonymous commenter for straightening out the confusion over the Shebang.

Apple has just released an update to XProtect for all macOS

By: hoakley
20 August 2025 at 02:00

Apple has just released an update to XProtect for all supported versions of macOS, bringing it to version 5311. As usual, Apple doesn’t release information about what security issues this update might add or change.

This version adds eight new detection rules, for MACOS.BANSHEE.MA, MACOS.BANSHEE.MA2, MACOS.SOMA.GEGO, MACOS.POSEIDON.B, MACOS.TIMELYTURTLE.FUNA, MACOS.TIMELYTURTLE, MACOS.TIMELYTURTLE.INDRBYSE and MACOS.TIMELYTURTLE.INDR. Banshee, Poseidon and TimelyTurtle are new names in XProtect’s Yara rules.

You can check whether this update has been installed by opening System Information via About This Mac, and selecting the Installations item under Software.

A full listing of security data file versions is given by SilentKnight and SystHist for El Capitan to Tahoe available from their product page. If your Mac hasn’t yet installed this update, you can force it using SilentKnight or at the command line.

If you want to install this as a named update in SilentKnight, its label is XProtectPlistConfigData_10_15-5311

Sequoia and Tahoe systems only

This update has already been released for Sequoia via iCloud. If you want to check it manually, use the Terminal command
sudo xprotect check
then enter your admin password. If that returns version 5311 but your Mac still reports an older version is installed, you may be able to force the update using
sudo xprotect update

Medium and Message: Sketch or studio?

By: hoakley
19 August 2025 at 19:30

Unlike watercolour, oil paint ‘dries’ by an irreversible process of chemical polymerisation. Once ‘dried’ it resists solvents and can be painted over without any risk of its pigments mixing between layers. Unlike modern acrylic paints, oil paint usually takes at least a week or two before its surface is dry, so allows the painter to control mixing of an existing layer with fresh paint. Skilful control of paint viscosity and drying rate thus gives fine control over the softness of edges and their blurring or sharpness.

cranachsalome
Lucas Cranach the Elder (1472–1553), Salome with the Head of Saint John the Baptist (c 1530), oil on poplar wood, 87 x 58 cm, Szépművészeti Múzeum, Budapest, Hungary. Wikimedia Commons.

This is illustrated well in Lucas Cranach the Elder’s portrait of Salome with the Head of Saint John the Baptist from about 1530. Crisp edges appear where you expect, for example between skin and clothing. In some places, he also outlined edges with thin lines of dark shadow for emphasis. Where skin tone changes more subtly, and in Salome’s eyebrows, there are soft transitions achieved by painting wet on wet and blurring the edge, a technique often known as sfumato, as seen in the detail below.

cranachsalomed1
Lucas Cranach the Elder (1472–1553), Salome with the Head of Saint John the Baptist (detail) (c 1530), oil on poplar wood, 87 x 58 cm, Szépművészeti Múzeum, Budapest, Hungary. Wikimedia Commons.

Cranach and the staff of his workshop would have worked on that painting over a period of many weeks to achieve those effects. In contrast, sketching with oil paints in front of the motif is far simpler, and on a more modest scale. Because of constantly changing light and shadow, most proficient landscape artists aim to complete their oil sketches in under two hours, and an hour is ideal.

henriescorial
Robert Henri (1865–1929), Landscape Sketch at Escorial (1906), oil on panel, 19.1 x 24.1 cm, Portland Museum of Art, Portland, ME. The Athenaeum.

Robert Henri’s Landscape Sketch at Escorial (1906) was painted on a wooden pochade panel, almost certainly in a single short session outside the city of Madrid, in the hills near the Escorial. Although he used the viscosity of different paints to make its skyline sharp, you can see where his coarse brushstrokes have been applied and colours mixed and laid in streaks.

thomsonthunderhead
Tom Thomson (1877–1917), Thunderhead (1912-13), oil on canvasboard, 17.5 x 25.2 cm, National Gallery of Canada / Musée des beaux-arts du Canada, Ottawa, ON. The Athenaeum.

The young Canadian artist Tom Thomson excelled in rapid sketching in oils, with several witnessed accounts of him dashing off a painting in little more than fifteen minutes. As a result he was able to capture many transient effects, such as the passing thunderstorm in Thunderhead from 1912-13. He has found it harder to keep a crisp skyline, and clearest separation of paint is in the white masts of the boats at the edge of the water. Those were painted last, in single strokes with as little diluent as possible.

Before the nineteenth century, quick oil sketches were almost never shown to the public, but used by masters including Valenciennes and Constable purely as preparative studies. When fashions changed, it became acceptable if not desirable for paintings to look sketchy and rushed, although appearances can sometimes be deceptive.

Some masters of fast painting used these skills in multiple sessions, to increase the amount of detail they could incorporate into a landscape. When Pissarro suffered from eye problems late in his career, he painted from rooms with views over the streets of Paris, and produced some of his finest cityscapes.

pissarrobdmontmartrespringa
Camille Pissarro (1830–1903), Boulevard Montmartre, Spring Morning (1897), oil on canvas, 65 x 81 cm, the Israel Museum, Jerusalem, Israel. Wikimedia Commons.

Boulevard Montmartre, Spring Morning (1897) is composed primarily of buildings and streets, a plethora of figures, and countless carriages to move those people around, the ingredients for so many of his late paintings.

pissarrobdmontmartrespringd1
Camille Pissarro (1830–1903), Boulevard Montmartre, Spring Morning (detail) (1897), oil on canvas, 65 x 81 cm, the Israel Museum, Jerusalem, Israel. Wikimedia Commons.

In the foreground, Pissarro may have formed each quite roughly, but he has painted in sufficient detail. Three white horses range in tone and colour, with highlights on the front of each head. You can see which people are wearing hats, and spot ladies in their fashionable clothing.

pissarrobdmontmartrespringd2
Camille Pissarro (1830–1903), Boulevard Montmartre, Spring Morning (detail) (1897), oil on canvas, 65 x 81 cm, the Israel Museum, Jerusalem, Israel. Wikimedia Commons.

Deeper into the distance, detail is lost, and the carriages and crowds merge into one another. Still they have a rhythm, highlights and shadows, and form. He must have spent day after day at his hotel window populating these busy streets.

Other Impressionist paintings appear at first sight to have been painted quickly in front of the motif, but were more likely worked on over a period of months in the studio. Once the public had come to expect an Impressionist painting to look as if it had been painted quickly, they expected the same look even though some paintings may have required several months painting.

monetfloweringplumtrees
Claude Monet (1840–1926), Flowering Plum Trees (1879), oil on canvas, 64.3 x 81 cm, Szépművészeti Múzeum, Budapest, Hungary. Wikimedia Commons.

Monet’s Flowering Plum Trees (1879), for example, has a complex structure in its paint layer, as seen from the surface in the detail below. Some marks have been added wet-in-wet, but many wet-on-dry, demonstrating it must have been worked on over a period of weeks or months.

monetfloweringplumtreesd1
Claude Monet (1840–1926), Flowering Plum Trees (detail) (1879), oil on canvas, 64.3 x 81 cm, Szépművészeti Múzeum, Budapest, Hungary. Wikimedia Commons.

The myth about Monet’s Grainstacks series is that they depict transient effects of season, weather, and light, as they were painted en plein air over the course of the winter. Looking at all twenty-five, I have long had my doubts, and suspect that Monet spent a lot of the time prior to their exhibition making further changes to them. This in no way lessens Monet’s sublime achievement, nor their art in any way. It’s just that they aren’t quite the paintings described by the myth that has grown around them.

monetgrainstacksendsummer1266
Claude Monet (1840–1926), Grainstacks, End of Summer (W1266) (1891), oil on canvas, 60 x 100 cm, Musée d’Orsay, Paris. Wikimedia Commons.

Looking at Grainstacks, End of Summer, considered to be one of the earliest in the series and numbered 1266, the trees behind the two grainstacks are still in full summer leaf, with no indication of the advent of autumn. Yet Monet’s signature gives the year as 1891. Looking at its paint surface in detail (below), some has been applied wet-in-wet and blended with underlying and adjacent paint, but many other brushstrokes have clearly been applied over dry underlayers.

monetgrainstacksendsummer1266d1
Claude Monet (1840–1926), Grainstacks, End of Summer (W1266) (detail) (1891), oil on canvas, 60 x 100 cm, Musée d’Orsay, Paris. Wikimedia Commons.

The blue-grey shadow of this grainstack was applied with relatively dilute paint wet-on-dry over thicker off-white paint with marked surface texture. However, that off-white paint has itself been applied wet-on-dry over a pale green layer. This couldn’t have been achieved in the same day, even when the ambient temperatures were warmer during the early autumn, but probably reflects at least three sessions with drying time in between them.

monetgrainstacksunmist1286
Claude Monet (1840–1926), Grainstack, Sun in the Mist (W1286) (1891), oil on canvas, 60 x 100.3 cm, Minneapolis Institute of Art, Minneapolis, MN. Wikimedia Commons.

Grainstack, Sun in the Mist, numbered 1286, is thought to be one of the later paintings in the series, apparently showing the sole remaining grainstack in the Spring of 1891. It too has multiple layers applied wet-on-dry, with many hatched brushstrokes in shades of orange and pink apparently applied over a well-dried surface. These are again shown well in the detail (below) of the grainstack itself.

At the right side of the foot of the grainstack, the lowest layer of paint consists of dull blue and green that appear to have been applied at about the same time and have blended in places. When that layer had dried, infrequent and relatively thick streaks of white were added wet-on-dry. When that had dried, brown-orange was applied to form the uppermost layer. That uppermost layer has also been used to remodel the form of the grainstack using thickly-applied flesh, pale yellow and orange paint.

monetgrainstacksunmist1286d1
Claude Monet (1840–1926), Grainstack, Sun in the Mist (W1286) (detail) (1891), oil on canvas, 60 x 100.3 cm, Minneapolis Institute of Art, Minneapolis, MN. Wikimedia Commons.

The evidence points to Monet starting each of this series with a sketch using more dilute paint in front of the motif in the circumstances described in the title. He then brought each canvas into his studio, where he continued to work on it, making further adjustments, adding partial layers of paint, and tweaking each work in comparison to the others in the series. This would have taken place over a period of several weeks: in the case of the canvases that he had started at the end of the summer of 1890, such as W1266 above, that period could have amounted to six months.

That may well have been longer than the time taken by Cranach to paint Salome.

What happens to images when you disable Live Text?

By: hoakley
19 August 2025 at 14:30

For many of us, Live Text and Visual Look Up are real boons, making it simple to copy text from images, to perform Optical Character Recognition (OCR) on images of text, and to identify objects of interest. They are also used by the mediaanalysisd service to extract text and object identifications for indexing by Spotlight, making those image contents searchable. Although the latter can be disabled generally or for specific folders in Spotlight settings, there appears to be only one control over Live Text, and none for Visual Look Up. This article examines what that single control does, using log extracts obtained from a Mac mini M4 Pro running macOS Sequoia 15.6. It follows my recent article on how these features work.

Setting

Live Text, which is enabled by default, can be disabled in Language & Region settings. When that is turned off, opening an image containing text in Preview no longer makes any text selectable. However, Visual Look Up still works as normal.

Textual images

When an image containing recognisable text but no other objects is opened in Preview, the VisionKit subsystem is still activated soon after the image is loaded. VisionKit initially reports that the “device” supports analysis, but immediately clarifies that to
Device does not support image analysis, but does support Visual Search, limiting to just Visual Search.
It then starts a VKImageAnalyzerProcessRequestEvent with a MAD parse request. That leads to a Visual Search Gating Task being run, and the Apple Neural Engine (ANE) and all CPU P cores are prepared for that.

Less than 0.1 second later, the end of the VKImageAnalyzerProcessRequestEvent is reported, and VisionKit returns an analysis that no image segments merits further analysis. Preview’s ⓘ Info button remains in its normal state, and clicking on that doesn’t alter the image displayed.

Images with other objects

An image containing potentially recognisable objects doesn’t stop there. If VisionKit returns an analysis indicating Visual Search could extract objects from the image, the ⓘ Info button adds stars and waits for the user to open the Info window.

VisionKit reports in the log
Setting Active Interaction Types: [private], [private]
then that it
DidShowVisualSearchHints with invocationType: VisualSearchHintsActivated, id: 1

When one of those Visual Search Hints is clicked, the Lookup View is prepared, followed by a notice from LookupViewService that it’s Changing state from LVSDisplayStateConfigured to LVSDisplayStateSearching. That leads to VisionKit making a Visual Search request from mediaanalysisd.

After the Apple Neural Engine (ANE) is run to progress that, successful search results in PegasusKit making its internet connection to identify the object, exactly as it does when Live Text is enabled and text has been recovered from the image:
Querying https: // api-glb-aeuw1b.smoot.apple.com/apple.parsec.visualsearch.v2.VisualSearch/VisualSearch with request (requestId: [UUID]) : (headers: ["Content-Type": "application/grpc+proto", "grpc-encoding": "gzip", "grpc-accept-encoding": "gzip", "grpc-message-type": "apple.parsec.visualsearch.v2.VisualSearchRequest", "X-Apple-RequestId": "[UUID]", "User-Agent": "PegasusKit/1 (Mac16,11; macOS 15.6 24G84) visualintelligence/1", "grpc-timeout": "10S"]) [private]

The ANE is finally cleaned up and shut down as the search results are displayed in the Lookup View.

Conclusions

  • When Live Text is disabled in Language & Region settings, images are still analysed when they are opened, to determine if they’re likely to contain objects that can be recognised in Visual Search for Visual Look Up.
  • If there are no such objects detected, VisionKit proceeds no further.
  • If there are suitable objects, mediaanalysisd and VisionKit proceed to identify them using Visual Search Hints, as normal.
  • If the user clicks on a Visual Search Hint, PegasusKit connects to Apple’s servers to identify that object and provide information for display in the Lookup View.
  • Although there is less extensive use of the ANE and CPU cores than when Live Text is enabled, neural networks are still run locally to perform a more limited image analysis.

I’m very grateful to Benjamin for pointing out this control over Live Text.

Paintings of Dante’s Inferno: 4 Paolo and Francesca

By: hoakley
18 August 2025 at 19:30

In the First Circle of Hell, Dante and his guide Virgil saw the souls caught in Limbo. From there they descend to the Second Circle, where they find those guilty of the sin of lust. They pass the figure of Minos, who extracts a confession from every sinner as they begin their descent, and directs them onward to the appropriate circle for their sins.

blakeminos
William Blake (1757–1827), Minos (Dante’s Inferno) (1824-27), watercolour on paper, dimensions not known, National Gallery of Victoria, Melbourne, Australia. Wikimedia Commons.
doreminos
Gustave Doré (1832–1883), Minos, Judge of Hell (c 1857), engraving, dimensions not known, location not known. Image by Moïra Elliott, via Wikimedia Commons.

Here the light is dim, and there is an eternal storm blowing those in this circle, ensuring they never obtain any comfort or relief from its incessant blast. The first of those described by Virgil to Dante is Semiramis, who married her father and made such incestuous relationships legal. (This is now known to be a false legend recorded by Orosius, popular in Dante’s time.)

Then they see Cleopatra, Achilles, Paris and Tristan. Dante tells the story of Francesca in most detail, and possibly for the first time in literature. She appears, blown in the wind, with her lover Paolo, but it’s Francesca who speaks to Dante.

Francesca da Rimini was the aunt of Dante’s host when he lived his later years in Ravenna. In about 1275, she married Gianciotto of the ruling family in Rimini, for political reasons. There’s strong suspicion that she had been tricked into this: her husband turned out to be disfigured and uncouth, but pre-nuptial negotiations were conducted by his handsome and eloquent brother Paolo, suggesting she was duped.

Soon after the marriage, Paolo and Francesca became lovers, apparently inspired by the story of Lancelot and Guinevere. Gianciotto suspected the couple, and one day caught them together in his wife’s bedroom.

ingrespaolofrancesca
Jean Auguste Dominique Ingres (1780–1867), Paolo and Francesca (1819), oil on canvas, dimensions not known, Musée des beaux-arts, Angers, France. Wikimedia Commons.

Paolo had become stuck when trying to escape through a trapdoor. Francesca was unaware of that, and let her husband in, who then attacked his brother with his sword. But Francesca stepped in between them to save her lover and was killed; Gianciotto then killed his brother, and after his own death had descended further into Hell for that double murder.

Dante’s story has inspired a succession of masterly paintings.

cabaneldeathfrancescapaolo
Alexandre Cabanel (1823–1889), The Deaths of Francesca da Rimini and Paolo Malatesta (1870), oil on canvas, 184 x 255 cm, Musée d’Orsay, Paris. Wikimedia Commons.
previatipaolofrancesca
Gaetano Previati (1852–1920), Paolo and Francesca (c 1887), oil on canvas, 98 x 227 cm, Accademia Carrara, Bergamo, Italy. Wikimedia Commons.
blakeloverswhirlwind
William Blake (1757–1827), The Circle of the Lustful: Francesca da Rimini (The Whirlwind of Lovers) (c 1824), pen and watercolour over pencil, 36.8 x 52.2 cm, Birmingham Museums and Art Gallery, Birmingham, England. The Athenaeum.

It was William Blake’s Whirlwind of Lovers that transformed these depictions.

schefferdantevirgilpaolofrancesca
Ary Scheffer (1795–1858), Dante and Virgil with Paolo and Francesca (c 1835), oil on canvas, 72 x 101.6 cm, location not known. Wikimedia Commons.
schefferdantevirgilghosts
Ary Scheffer (1795–1858), Dante and Virgil Encountering the Shades of Francesca de Rimini and Paolo in the Underworld (1855), oil on canvas, 171 x 239 cm, Musée du Louvre, Paris. Wikimedia Commons.
frascheridantevirgilpaolofrancesca
Giuseppe Frascheri (1809–1886), Dante and Virgil Encounter Paolo and Francesca (1846), oil on canvas, 61 x 38.5 cm, Civica Galleria d’Arte Moderna Savona, Savona, Italy. Wikimedia Commons.
dorepaolofrancesca
Gustave Doré (1832–1883) Paolo and Francesca da Rimini (1863), oil on canvas, 280.7 x 194.3 cm, Private collection. Wikimedia Commons.
wattspaolofrancesca
George Frederic Watts (1817–1904), Paolo and Francesca (The Story of Rimini) (date not known), media and dimensions not known, Private collection. Wikimedia Commons.
boccionidream
Umberto Boccioni (1882–1916), The Dream (Paolo and Francesca) (1908-09), oil on canvas, 140 × 130 cm, Private collection. Wikimedia Commons.
Paolo and Francesca da Rimini 1855 by Dante Gabriel Rossetti 1828-1882
Dante Gabriel Rossetti (1828–1882), Paolo and Francesca da Rimini (1855), watercolour on paper, 25.4 x 44.9 cm, The Tate Gallery (Purchased with assistance from Sir Arthur Du Cros Bt and Sir Otto Beit KCMG through the Art Fund 1916), London. © The Tate Gallery and Photographic Rights © Tate (2019), CC-BY-NC-ND 3.0 (Unported), https://www.tate.org.uk/art/artworks/rossetti-paolo-and-francesca-da-rimini-n03056

This story is told in Dante Gabriel Rossetti’s watercolour triptych: at the left, the lovers are reading the legend of Lancelot and Guinevere. In the centre are Dante and Virgil, and at the right Paolo and Francesca are being blown in the storms of the Second Circle of Hell.

Dante faints at the tragic story that Francesca has told him, and collapses as if dead.

The artists

William Blake (1757–1827) was a British visionary painter and illustrator whose last and incomplete work was an illustrated edition of the Divine Comedy for the painter John Linnell. Most of his works shown in this series were created for that, although he did draw and paint scenes during his earlier career. I have a major series on his work here.

Umberto Boccioni (1882–1916) was an Italian painter and sculptor whose tragically short career was a major influence over the development of Futurism. Drafted into the Italian Army during the First World War, he was thrown from his horse and trampled to death when he was only thirty-three.

Alexandre Cabanel (1823–1889) was a major French painter of history in an academic style, and a precocious artist. He won the Prix de Rome in 1845, and was appointed a professor at the École des Beaux-Arts in Paris in 1864, teaching many successful pupils including Jules Bastien-Lepage. This article summarises his career and work.

Gustave Doré (1832–1883) was the leading French illustrator of the nineteenth century, whose paintings are still relatively unknown. Early in his career, he produced a complete set of seventy illustrations for translations of the Inferno, first published in 1857 and still being used. These were followed in 1867 by more illustrations for Purgatorio and Paradiso, and this painting was highly praised when shown at the Paris Salon in 1863. This article looks at his paintings.

Giuseppe Frascheri (1809–1886) was an Italian painter in fresco and oils who has been almost completely forgotten.

Jean Auguste Dominique Ingres (1780–1867) was a major French painter in Neoclassical style, best known for his history and other narrative paintings. He was a pupil of Jacques-Louis David, and continued much in his tradition, and in opposition to the more Romantic painting of Eugène Delacroix. His work extended from portraits to Orientalism.

Gaetano Previati (1852–1920) was an Italian painter who worked mainly in Divisionist style, but is now known for his Symbolism. He was most famous in the period 1880-1920, during which he was involved in the Venice Biennale and exhibitions in Italy and Paris.

Dante Gabriel Rossetti (1828–1882) was of Italian descent but born in London. In 1848, he co-founded the Pre-Raphaelite Brotherhood, and was a major figure in British painting until his early death in 1882. A published poet and author himself, many of his paintings were in response to literature, particularly the poems of John Keats. He had a succession of relationships with his models and muses, including Elizabeth Siddal, Fanny Cornforth, and William Morris’s wife Jane. The triptych shown here is the earliest of at least three paintings of his showing Paolo and Francesca, another similar triptych being from 1862.

Ary Scheffer (1795–1858) was a major narrative painter of the first half of the nineteenth century, born in the Netherlands but trained and working in Paris. Among his favourite literary themes were Goethe’s Faust, and the story of Paolo and Francesca. This article looks at his narrative work.

George Frederic Watts (1817–1904) was a major British painter and sculptor in the middle and late nineteenth century who was associated with several artistic circles and movements including the Pre-Raphaelites, but who worked independently in more Symbolist style. This article looks at his career and paintings.

References

Wikipedia
Danteworlds

Robin Kirkpatrick (trans) (2012) Dante, The Divine Comedy, Inferno, Purgatorio, Paradiso, Penguin Classics. ISBN 978 0 141 19749 4.
Richard Lansing (ed) (2000) The Dante Encyclopedia, Routledge. ISBN 978 0 415 87611 7.
Guy P Raffa (2009) The Complete Danteworlds, A Reader’s Guide to the Divine Comedy, Chicago UP. ISBN 978 0 2267 0270 4.
Prue Shaw (2014) Reading Dante, From Here to Eternity, Liveright. ISBN 978 1 63149 006 4.

Solutions to Saturday Mac riddles 321

By: hoakley
18 August 2025 at 16:00

I hope that you enjoyed Saturday’s Mac Riddles, episode 321. Here are my solutions to them.

1: Where to sell an image of the Knolls in a two-year exclusive.

Click for a solution

Photoshop

Where to sell (a shop) an image (a photo) of the Knolls (originally developed by brothers Thomas and John Knoll, and licensed by Adobe) in a two-year exclusive (from February 1990 until its release on Windows in November 1992, it was exclusive to Mac).

2: Rembrandt, Claude Monet, JMW Turner and Corel.

Click for a solution

Painter

Rembrandt, Claude Monet, JMW Turner (all three were painters) and Corel (originally released in 1991 by Fractal Design, Painter was eventually bought by Corel).

3: One of the first two, it could be beige acrylic and written by Bill.

Click for a solution

MacPaint

One of the first two (together with MacWrite, it was one of the two apps bundled with the 128K Mac), it could be beige acrylic (paint the same colour as the 128K Mac) and written by Bill (Atkinson, 1951-2025, who wrote the app).

The common factor

Click for a solution

They have all been major raster graphics editors on the Mac.

I look forward to your putting alternative cases.

SpotTest 1.0 will help you diagnose Spotlight problems

By: hoakley
18 August 2025 at 14:30

There are some topics that invariably generate comments from those who have either abandoned a major feature in macOS, or are struggling with it. Some of the most persistent are problems with Spotlight, particularly with its local search of files on your Mac. To help grapple with those, four years ago I added some Spotlight tests to Mints that can be used to work out where those problems are occurring. I’m delighted now to offer an extension to those in a whole new app, perhaps predictably named SpotTest.

Spotlight is so substantial, almost silent in the log, and impenetrable that the best approach to diagnosing its problems is to test it out in a controlled way. Mints has been doing that by creating a folder of files containing an unusual word, then searching for that. Although that’s still useful for a quick test, we need something more focused and flexible, and that’s what SpotTest aims to deliver.

Following deep dives into how Spotlight indexes and searches metadata and contents of files, and how it can search text extracted from images and the results of image analysis, I’ve realised that different test files are required, together with alternative means of search. For example, the standard approach used in compiled apps, with NSMetadataQuery, is incapable of finding content tags obtained using Visual Look Up, which only appear when using the mdfind command. SpotTest takes these into account.

There are now 15 carefully crafted test files, of which one cannot currently be found, no matter what method of search you try.

A perfect 13/15 result from NSMetadataQuery is only possible after waiting a day or more for background mediaanalysisd processing to recognise and extract the text in file I, a PNG image. The other 12 here should all be found when running this test a few seconds after the test files have been created. They rely on a range of mdimporter modules bundled in macOS, apart from file L, an XML property list.

Another of SpotTest’s tools will list the mdimporters used for each of the test files.

Run the search using the mdfind command within SpotTest and, once mediaanalysisd has done its image recognition, you should get a perfect 14/15.

The only current limitation of SpotTest version 1.0 is that it can only run tests on the Data volume that your Mac started up from, using a folder at the top level of your Home folder. A future version will let you test other volumes as well. Its Help book runs to nine pages: please read them, as its test might seem deceptively simple but provide a lot of useful information about how Spotlight local search is functioning. Coupled with log extracts using LogUI it should shine light in the darkness.

SpotTest 1.0, which requires macOS 14.6 or later, is now available from here: spottest10
and from its new place in its Product Page.

I wish you successful searching.

A green weekend: Viridian

By: hoakley
17 August 2025 at 19:30

The element chromium gains its name from the rich colours seen in many of its salts and compounds. One of them, chromium oxide, was discovered in about 1798 by Louis-Nicolas Vauquelin, who immediately recognised its future use as a pigment, because of its “fine emerald colour”. But painters were still enamoured with more toxic greens, and straight chromium oxide doesn’t look particularly brilliant, being a rather dull yellow-green. Its introduction into paintings probably didn’t start until around 1840, when landscape painting outdoors was becoming all the rage.

vonschwindmermaidstag
Moritz von Schwind (1804–1871), Mermaids Watering a Stag (c 1846), oil on canvas, 69 × 40 cm, Sammlung Schack, Bayerische Staatsgemäldesammlungen, Munich, Germany. Wikimedia Commons.

Some of the earliest paintings known to use chromium oxide are those of Moritz von Schwind, of which the first example that I can show is his Mermaids Watering a Stag from about 1846. He seems to have used the pigment quite extensively here in foliage, although probably in combination with other pigments.

vonschwindkingkrokus
Moritz von Schwind (1804–1871), King Krokus and the Wood Nymph (c 1855), oil on canvas, 78.7 x 45.5 cm, Bayerische Staatsgemäldesammlungen, Munich, Germany. Wikimedia Commons.

Von Schwind’s King Krokus and the Wood Nymph from about 1855 is a clearer image, where he probably used chromium oxide in combination for most of his greens.

As these works were being painted, an improved version of chromium oxide was being developed: hydrated chromium oxide, which became known as viridian during the 1860s. This first became available at a reasonable price after Guignet started to make it in quantity in 1859, so has also been known as Guignet’s green. It’s sometimes termed émeraude or emerald, which only serves to confuse viridian with copper acetoarsenate, more widely known as emerald green.

Viridian came into use during the 1860s, and has proved far more popular than chromium oxide. Both pigments are reliably lightfast, opaque, and have good covering power, but viridian is the more intense, and doesn’t appear dull like plain chromium oxide.

feuerbachpaolofrancesca
Anselm Feuerbach (1829–1880), Paolo and Francesca (1864), oil on canvas, 137 × 99.5 cm, Sammlung Schack, Bayerische Staatsgemäldesammlungen, Munich, Germany. Wikimedia Commons.

Anselm Feuerbach’s painting of Paolo and Francesca from 1864 is one of the earlier works found to contain viridian among its many rich greens.

manetbalcony
Édouard Manet (1832–1883), The Balcony (1868-69), oil on canvas, 170 × 124.5 cm, Musée d’Orsay, Paris. Wikimedia Commons.

The best example showing off the colour of viridian is perhaps Édouard Manet’s The Balcony (1868-69), where he appears to have used the pigment throughout the blinds and railings, most probably mixed with lead white, and unmixed for the woman’s parasol.

bocklintritonnereid
Arnold Böcklin (1827–1901), Triton and Nereid (1874), tempera on canvas, 105.3 × 194 cm, Sammlung Schack, Bayerische Staatsgemäldesammlungen, Munich, Germany. Wikimedia Commons.

Arnold Böcklin’s Triton and Nereid from 1874 is unusual in several respects. It’s reported as being painted in tempera rather than oils, but its deep lustrous greens were developed using a base of predominantly viridian, over which Böcklin applied a copper resinate glaze.

renoirskiff
Pierre-Auguste Renoir (1841-1919), La Yole (The Skiff) (1875), oil on canvas, 71 x 92 cm, The National Gallery (Bought, 1982), London. Courtesy of and © The National Gallery, London.

Pierre-Auguste Renoir’s La Yole (The Skiff) of 1875 uses viridian as the main colour for the reeds in the left foreground.

monetarrivalnormandytrain
Claude Monet (1840–1926), Arrival of the Normandy Train, Gare Saint-Lazare (1877), oil on canvas, 59.6 x 80.2 cm, Art Institute of Chicago, Chicago, IL. Wikimedia Commons.

Analysis of Claude Monet’s series of paintings of the Gare Saint-Lazare in 1877 has revealed extensive use of viridian in mixtures, including the green shadows in the roof. In Arrival of the Normandy Train, Gare Saint-Lazare (1877), the pigment is apparent (and confirmed) throughout the green foreground of the platform, an optical effect resulting from light passing through the glass roof of the station.

renoirchrysanthemums
Pierre-Auguste Renoir (1841–1919), Chrysanthemums (1881-82), oil on canvas, 54.7 × 65.9 cm, Art Institute of Chicago, Chicago, IL. Image by Rlbberlin, via Wikimedia Commons.

Renoir used viridian together with malachite green and other pigments for the greens in his Chrysanthemums (1881-82).

Georges Seurat, Un dimanche après-midi à l'Île de la Grande Jatte (A Sunday Afternoon on the Island of La Grande Jatte) (1884-6), oil on canvas, 207.5 × 308.1 cm, Art Institute of Chicago, Chicago, IL. Wikimedia Commons.
Georges Seurat (1859-91), Un dimanche après-midi à l’Île de la Grande Jatte (A Sunday Afternoon on the Island of La Grande Jatte) (1884-6), oil on canvas, 207.5 × 308.1 cm, Art Institute of Chicago, Chicago, IL. Wikimedia Commons.

If you care to spend some time examining the myriads of tiny dots in Georges Seurat’s monumental Divisionist painting of A Sunday Afternoon on the Island of La Grande Jatte (1884-86), I’m assured that you’ll find many of those forming its vegetation contain viridian.

Viridian remained popular among the post-Impressionists, from whom I have two well-known paintings as examples.

vangoghwheatfieldcypresses
Vincent van Gogh (1853-1890), A Wheatfield, with Cypresses (1889), oil on canvas, 72.1 × 90.9 cm, The National Gallery (Bought, Courtauld Fund, 1923), London. Courtesy of and © The National Gallery, London.

Vincent van Gogh included viridian in the pigments used in the range of greens in his A Wheatfield, with Cypresses (1889), which is more unusual for his use of ultramarine blue mixed to form green.

cezannehillsideprovence
Paul Cézanne (1839-1906), Hillside in Provence (1890-92), oil on canvas, 63.5 x 79.4 cm, The National Gallery (Bought, Courtauld Fund, 1926), London. Courtesy of and © The National Gallery, London.

Paul Cézanne is known to have had a strong preference for viridian as one of the key colours in his palette. However, in his Hillside in Provence (1890-92), it is emerald green that is the more prominent, and the major part of the painting’s more brilliant greens, even into its pale turquoise sky. Some green passages, such as the patch of yellow-green grass at the edge of the path in the foreground, at the right edge of the canvas, have been built with a base of lead white and viridian, over which he has applied a yellow lake glaze.

Chromium oxide and viridian remain widely available today; although the former is not popular or widely used, viridian remains a mainstay green widely recommended for its colour and other properties. Being virtually insoluble, chromium oxide and viridian pose minimal risks of toxicity to the artist. However, there is growing concern over their environmental effects, and great care is needed when handling waste paint containing either pigment.

Reference

Richard Newman (1997) Artists’ Pigments, vol 3, ed Elisabeth West FitzHugh, Archetype. ISBN 978 1 904982 76 0.

Last Week on My Mac: Drought and neural engines

By: hoakley
17 August 2025 at 15:00

If there’s one thing you can rely on about the UK weather, it’s rain. Unless you live in that narrow belt of East Anglia officially classed as semi-arid, you’ll be used to rain whatever the season or forecast.

The last time we had a long dry summer was 1976, when much of Northern Europe basked in sunshine from late May until the end of August. This year has proved similar, so here we are again, dry as a bone, banned from using hosepipes except to wash down horses, wondering when the inevitable floods will start. In 1976, dry weather broke but a couple of weeks after the appointment of a Minister for Drought, whose brief was promptly extended to cover the ensuing inundation.

With this shortage of water, it might seem surprising that over the next five years around a hundred new data centres are expected to be built in the UK. These are the data centres we all want to support our AI chatbots and cloud services, but nobody wants in their neighbourhood. No one has explained where all their power and water supplies will come from, although apparently ten new reservoirs are already being built in anticipation.

The best piece of advice we have been given to help our shortage of water is to delete all our old emails and photos. Apparently by reducing what we have stored in the cloud, those data centres won’t get so hot, and will consume less water. Really?

Meanwhile back on planet Earth, last week I was studying the log entries made on behalf of the Apple Neural Engine, ANE, inside my Mac mini’s M4 Pro chip, when it was running local models to support Live Text and Visual Look Up. We now take these features for granted, and maybe aren’t even aware of using them, or of what our Mac’s ANE is doing. Yet every Apple silicon Mac sold over the last five years has the dedicated hardware possessed by only a small minority of PCs. They can, of course, use other hardware including GPUs, well known for their excessive power and cooling demands. For many the only solution is to go off-device and call on some of those data centres, as you do with ChatGPT, Google’s answer engine, and even Elon Musk’s Grok if you really must.

Live Text is a particularly good example of a task that can, given the right hardware, be performed entirely on-device, and at relatively low energy cost. It’s also one that many of us would rather not farm out to someone’s data centre, but keep to the privacy of our own Mac. While it does work surprisingly well on recent Intel Macs, it’s just what the ANE was intended to make sufficiently performant that it can be commonplace. Just over three years ago, before WWDC 2022, I wrote: “But if I had to put my money anywhere, it would be on the ANE working harder in the coming months and years, to our advantage.”

With so many Macs now capable of what seemed miraculous in the recent past, we’re only going to see more apps taking advantage of those millions of ANEs. Developers are already starting to use Apple’s new Foundation Models supported by macOS 26 Tahoe, all of which run on-device rather than in those data centres. In case you’re concerned about the ethics of what this might be unleashing, Apple has already anticipated that in a stringent set of acceptable use requirements, that also apply to apps provided outside the App Store.

Obtaining reliable estimates of the performance and power consumption of the ANE is fraught, but I have measured them during Visual Look Up on an M1 Max (with an H11ANE), and found peak power used was 30-50 mW. According to mot’s comment to that article, when running an inference task intended to push that in an M1 Pro to the maximum, its ANE drew a maximum of 2 W. That’s frugal compared to running equivalent intensive tasks on Performance CPU cores or an Apple silicon GPU, which can readily use more than 1 W per P core.

Can someone suggest that, instead of deleting old emails and photos, we’d be better off running our favourite AI on-device using an Apple Neural Engine? I still don’t think it would do anything to help our current drought, but it could spare us a few of those projected data centres.

A green weekend: Emerald

By: hoakley
16 August 2025 at 19:30

Rumours still abound as to the cause of Napoleon’s death over two centuries ago. One theory, not currently in favour, is that he was poisoned by arsenic in the wallpaper. At the time, that would have been unusual, but by the 1860s such deaths were significant enough to be reported in newspapers. Their ultimate cause was also one of the factors behind the success of Impressionist landscape painting: emerald green.

Getting a good range of green pigments was vital for landscape painting, and more generally for coloured commercial products such as wallpaper and clothing. The first of the ‘poison greens’ to be discovered was that named after Carl Wilhelm Scheele, the Swedish chemist who originally made it in 1775: copper arsenite, a highly toxic salt of arsenic. Soon after its introduction from about 1780, it became clear that it tended to darken with age, and the search began for a replacement.

Little attention has been paid to the use of Scheele’s green, and it isn’t clear how widely it was used, or even when it was first used in painting.

Guildford from the Banks of the Wey c.1805 by Joseph Mallord William Turner 1775-1851
Joseph Mallord William Turner (1775–1851), Guildford from the Banks of the Wey (c 1805), oil on mahogany veneer mounted onto cedar panel, 25.4 x 19.7 cm, The Tate Gallery (Turner Bequest 1856), London. © The Tate Gallery and Photographic Rights © Tate (2016), CC-BY-NC-ND 3.0 (Unported), http://www.tate.org.uk/art/artworks/turner-guildford-from-the-banks-of-the-wey-n02310

JMW Turner’s early oil sketch of Guildford from the Banks of the Wey, painted in about 1805, has been found to contain Scheele’s green. Given its range of greens, that could be quite extensive.

Wilhelm Sattler, a paint manufacturer in Schweinfurt, Germany, worked with Friedrich Russ to discover an even better arsenic compound for use as a colourant, and from 1814 Sattler’s company manufactured Schweinfurt or emerald green, the equally toxic copper acetoarsenite. Its alluringly brilliant green colour appears very stable, with only slight darkening resulting from reaction with hydrogen sulphide, a common atmospheric pollutant.

Going to School, for Rogers's 'Poems' circa 1832 by Joseph Mallord William Turner 1775-1851
Joseph Mallord William Turner (1775–1851), Going to School, for Rogers’s ‘Poems’ (c 1830–32), watercolour on paper, 26.9 x 21.9 cm, The Tate Gallery (Turner Bequest 1856), London. © The Tate Gallery and Photographic Rights © Tate (2016), CC-BY-NC-ND 3.0 (Unported), http://www.tate.org.uk/art/artworks/turner-going-to-school-for-rogerss-poems-d27715

By about 1830-32, when Turner painted Going to School as an illustration for Rogers’s Poems, he had switched to using emerald green, obvious from its characteristic colour standing out from the small bag on the boy’s back.

Rouen, Looking Downstream circa 1832 by Joseph Mallord William Turner 1775-1851
Joseph Mallord William Turner (1775–1851), Rouen, Looking Downstream (c 1832), gouache and watercolour on paper, 14 x 19.2 cm, The Tate Gallery (Turner Bequest 1856), London. © The Tate Gallery and Photographic Rights © Tate (2016), CC-BY-NC-ND 3.0 (Unported), http://www.tate.org.uk/art/artworks/turner-rouen-looking-downstream-d24673

Turner used emerald green again in this watercolour painting of Rouen, Looking Downstream from about 1832, here in combination with other pigments, so less brashly.

Concerns over the established toxicity of these two greens were raised by 1839, when warnings were first issued in Bavaria. Despite those, the use of emerald green became more widespread, and it was even ‘fixed’ to ball gowns using albumen or dextrin, which allowed its poisonous dust to brush free from the garment when dancing. It also became particularly popular, and insidiously toxic, in coloured wallpapers. When applied on damp walls, as were common at the time, fungal products could produce trimethyl arsine gas, which is thought to have been responsible for many of the symptoms and deaths that were reported.

Édouard Manet (1832–1883), Music in the Tuileries (1862), oil on canvas, 76.2 × 118.1 cm, The National Gallery, London, and the Hugh Lane, Dublin. Courtesy of National Gallery (CC), via Wikimedia Commons.
Édouard Manet (1832–1883), Music in the Tuileries (1862), oil on canvas, 76.2 × 118.1 cm, The National Gallery, London, and the Hugh Lane, Dublin. Courtesy of National Gallery (CC), via Wikimedia Commons.

Édouard Manet’s Music in the Tuileries (1862) is an unusual example of a painting containing both Scheele’s and emerald greens. Manet used them in combination in two different glazes applied to the areas of foliage. In one transparent glaze, they are mixed with yellow lake, small amounts of ivory black, and yellow ochre; the other more opaque glaze consists of the two greens, with yellow ochre and white.

The last recorded use of Scheele’s green was by Edwin Landseer in 1866.

bazilleselfportrait
Frédéric Bazille (1841–1870), Self-Portrait with Palette (1865), oil on canvas, 108.9 x 71.1 cm, The Art Institute of Chicago, Chicago, IL. Wikimedia Commons.

The Impressionists relied heavily on emerald green for its brilliance and intensity of colour. Frédéric Bazille’s Self-Portrait with Palette (1865) shows some emerald green paint on his palette, squeezed out and ready to paint vegetation such as sunlit grass.

Claude Monet, Bathers at la Grenouillère (1869), oil on canvas, 73 x 92 cm, The National Gallery, London. WikiArt.
Claude Monet (1840-1926), Bathers at la Grenouillère (1869), oil on canvas, 73 x 92 cm, The National Gallery, London. WikiArt.

Claude Monet used emerald green among other green pigments and mixtures in his famous Bathers at la Grenouillère, painted in 1869. It has also been found widely in the landscapes of Cézanne, Gauguin, Pissarro and Vincent van Gogh.

By the late nineteenth century, concern over the consequences of using emerald green in household products had risen to the point where the pigment was banned in a succession of countries.

gauguinarlesiennes
Paul Gauguin (1848–1903), Arlésiennes (Mistral) (1888), oil on jute, 73 x 92 cm, The Art Institute of Chicago, Chicago, IL. Wikimedia Commons.

Paul Gauguin’s Arlésiennes (Mistral) (Old Women at Arles) (1888) uses emerald green for the band of bright green grass sweeping up across the painting from the right. It is also mixed for the skin and hair of some of the figures, and in the foliage more generally.

redonsita
Odilon Redon (1840–1916), Sîta (c 1893), pastel, with touches of black Conté crayon, over various charcoals, on cream wove paper altered to a golden tone, 53.6 × 37.7 cm, The Art Institute of Chicago, Chicago, IL. Image by Rlbberlin, via Wikimedia Commons.

Odilon Redon’s pastel painting of Sîta from about 1893 uses emerald green, chrome yellow and chalk in the prominent yellow-green halo surrounding the woman’s head. Working with soft pastels containing this pigment was particularly hazardous, because of the likelihood of inhaling their dust. At least today we have effective respiratory protection available.

During the twentieth century, genuine emerald green was withdrawn from use as a pigment, although it wasn’t completely discontinued until the 1960s. Since then, paints sold as being emerald green have contained alternatives that are far less toxic.

cezannelargebathers
Paul Cézanne (1839-1906), The Large Bathers (1906), oil on canvas, 210.7 x 251 cm, The Philadelphia Museum of Art, Philadelphia, PA. Wikimedia Commons.

Emerald green has been found in mixtures used by Paul Cézanne in the patches of vegetation in his huge The Large Bathers (1906). Alongside lead white, vermilion and ultramarine blue, this pigment appears to have been among his most frequently used.

hassamwhitemountainspolandsprings
Childe Hassam (1859-1935), White Mountains from Poland Springs (1917), watercolour over black chalk on cream wove paper, 25.4 x 35.4 cm, Harvard Art Museums/Fogg Museum (Gift of Grenville L. Winthrop, Class of 1886), Cambridge, MA. Courtesy of Harvard Art Museums/Fogg Museum.

Childe Hassam’s watercolour of White Mountains from Poland Springs from 1917 is one of the last major paintings that appears to have relied on emerald green. Its use in the meadow in the foreground is perhaps the pigment’s last brash farewell.

Reference

Inge Fiedler and Michael Bayard (1997) Artists’ Pigments, vol 3, ed Elisabeth West Fitzhugh, Archetype. ISBN 978 1 904982 76 0.

Saturday Mac riddles 321

By: hoakley
16 August 2025 at 16:00

Here are this weekend’s Mac riddles to entertain you through family time, shopping and recreation.

1: Where to sell an image of the Knolls in a two-year exclusive.

2: Rembrandt, Claude Monet, JMW Turner and Corel.

3: One of the first two, it could be beige acrylic and written by Bill.

To help you cross-check your solutions, or confuse you further, there’s a common factor between them.

I’ll post my solutions first thing on Monday morning.

Please don’t post your solutions as comments here: it spoils it for others.

A brief history of XML and property lists

By: hoakley
16 August 2025 at 15:00

Before the arrival of Mac OS X, our Macs had remained almost free from the property lists and other XML files that now seem to fill them. Those owe their origin to the grandfather of markup languages, SGML, originally known as Generalised Markup Language. That was invented by Charles Goldfarb, Ed Mosher and Ray Lorie in 1969, when they were working at IBM, as a means of structuring text semantically, and first used a different form of markup, as in
:h1.Chapter 1: Introduction
to set that text as a top-level headline. Ordered lists should look familiar to anyone who writes HTML:
:ol
:li.Item one.
:li.Item two.
:eol.

SGML was flexible as to markup formatting, but has become most widely seen using the angle brackets <> common to HTML, XML, and other markup languages.

Although it has never been popular in its own right, SGML still features in some products where markup is required to impart structure and meaning.

FrameMaker, originally developed by Frame Technology, is a high-end technical publishing system bought by Adobe in 1995. It was then offered in a premium version with extensive support for SGML, seen here in 2002, two years before Adobe dropped this Mac version.

XML

In 1996, a working group of W3C (the World Wide Web Consortium) started developing a profile of SGML that became known as Extended Markup Language, or XML. Work continued through 1997, and in February 1998 XML 1.0 was adopted as a W3C Recommendation. While there’s also a slightly different version 1.1, published in 2004, and various editions of 1.0, in its fundamentals the XML we use today is still version 1.0, with 1.1 only recommended for special purposes.

Property lists

Unlike traditional implementations of Unix, NeXTSTEP used its own property lists to contain serialised objects including settings. When Mac OS X was introduced, those were replaced by a new XML format using a public Document Type Declaration (DTD) still used today.

Although intended to be expressed in plain text, binary representations of XML developed during the early years of the new millennium, and Apple decided to adopt its own, bplist, in the early days of Mac OS X. This brought improved parsing speed, as well as being more compact, and has acted as a deterrent to those who might make casual changes to critical property lists. These were introduced in Mac OS X 10.2 Jaguar in 2002, and have been used as standard for property lists since Mac OS X 10.4. They are described well in this Wikipedia article.

A typical modern property list coded in XML might read
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<array>
<date>2017-10-10T13:13:43Z</date>
</array>
</plist>

That specifies a datestamp in an extended attribute.

Tools

Bundled tools to create and edit property lists have remained disappointingly primitive, but there has been no shortage of contenders from third parties.

This is the ElfData XML Editor, one of the first to be released in 2001, seen two years later in Mac OS X 10.2 Jaguar editing DocBook XML format.

In 2004, David Reitter created a version of GNU Emacs with an Aqua interface and named it Aquamacs. It’s seen here in 2006, in Mac OS X 10.4 Tiger, with its XML tools for editing a property list.

Another early entrant, from 2002, that has blossomed into one of the most extensive and sophisticated XML development environments is cross-platform Oxygen, from SyncRO Soft. Although written in Java its Mac versions have been sensitively implemented. It’s seen here in Mac OS X 10.4 Tiger in 2006, viewing an XML rendition of Shakespeare’s Hamlet.

This is Syntext Serna in 2007, again in Mac OS X 10.4 Tiger, seen editing an XML version of my PhD thesis that had originally been written in Adobe FrameMaker+SGML.

Other editors came and went, such as XML Editor, here in the last few days of Mac OS X 10.4 Tiger in 2007. This is a table from my thesis.

Major text editors also gained XML powers. These are Safari’s preferences in Mac OS X 10.5 Leopard, seen rendered by Rich Siegel’s BBEdit. He first distributed this text editor for System 6 back in 1992, and over 30 years later it remains one of the few high-end text editors for macOS.

My final example returns to the specialist features in Oxygen, seen here in Mac OS X 10.7 Lion in 2012, where it’s being used with a botanical flora.

Today XML and property lists remain at the heart of macOS, something I doubt that Charles Goldfarb ever dreamed of back in 1969.

References

Charles F Goldfarb (1996) The Roots of SGML – A Personal Recollection, Wayback Machine
SGML on Wikipedia
XML on Wikipedia
Property lists on Wikipedia

A green weekend: Malachite

By: hoakley
15 August 2025 at 19:30

As we all should really be on holiday, I’m taking a long weekend to look at the stories of three green pigments, starting today with the oldest and most elusive of them, the mineral malachite.

Because green is a secondary colour, it might seem better mixed from blue and yellow, as it has been in various recipes such as Prussian green. But the painter always prefers using single pigments for the purity of their chroma, and the fact that the more pigments that get mixed, the closer the colour comes to muddy grey.

Given the shortage of lightfast bright greens, it’s surprising how little-used malachite green is in European painting, despite its rich colour. For a while it rejoiced quietly under traditional names including chrysocolla, green verditer, and even green bice, but it only ever became popular in Japan and China.

As a natural mineral, malachite is not uncommon, and a reliable source of pure pigment, which is chemically basic carbonate of copper. Malachite green was known to the ancient Egyptians, who appear to have used it as eye-paint. Found abundantly in Japanese and Chinese paintings from the seventh century onwards, it wasn’t used much in Europe until the Renaissance. After that, it almost died out in Europe until the nineteenth century, when it enjoyed a brief revival.

Two versions of the painting by Watanabe Kazan 渡辺崋山 of Sato Issai 佐藤一斎(五十歳)像 show malachite green at its finest.

kazansatoissaiwashington
Watanabe Kazan 渡辺崋山 (1793-1841), Portrait of Sato Issai 佐藤一斎(五十歳)像 (1824), ink and colour on silk mounted on panel, 212.2 x 67 cm, Freer Gallery of Art (Purchase — Charles Lang Freer Endowment), Washington, DC. Courtesy of the Freer Gallery and the Smithsonian Institution.

This version from 1824, now in the Freer in Washington, is known to use malachite green with a slightly blue shade and deep in colour.

kazansatoissaitokyo
Watanabe Kazan 渡辺崋山 (1793-1841), Portrait of Sato Issai (age 50) 佐藤一斎(五十歳)像 (1821), colour on silk 絹本着色, 80.6 x 50.2 cm, Tokyo National Museum 東京国立博物館, Tokyo, Japan. Wikimedia Commons.

This smaller and earlier version from 1821, now in Tokyo, is a lighter, more yellow shade. I’m not aware of its pigment having been analysed, but I’d be surprised if it was straight malachite green.

The biggest problem with its adoption in Europe was the popularity there of oil paint. The pigment worked well where it could be ground quite coarsely and used in water-based media like fresco and egg tempera, but the finer you grind it, the paler it becomes. Oil painters like smooth buttery paints with fine pigment particles, which sadly didn’t work for malachite green.

aretinovirginenthroned
Spinello Aretino (1350/52-1410), Virgin Enthroned with Angels (c 1380), tempera and gold leaf on panel, 195.3 x 113 cm, Harvard Art Museums/Fogg Museum (Gift of Mrs. Edward M. Cary), Cambridge, MA. Courtesy of Harvard Art Museums/Fogg Museum.

The rich, almost emerald green robes of Spinello Aretino’s Virgin Enthroned with Angels from about 1380 contain malachite green, here in tempera medium.

vaneyckmysticlambd
Hubert van Eyck (c 1366–1426) and Jan van Eyck (c 1390–1441), Adoration of the Lamb, panel from the Ghent Altarpiece (c 1425-1432), oil on panel, 137.7 x 242.3 cm (panel), Saint Bavo Cathedral Sint-Baafskathedraal, Ghent, Belgium. Wikimedia Commons.

Among its earliest appearances in oil paint is this spectacular centre panel of the van Eyck brothers’ Ghent Altarpiece, famous in its own right as the Adoration of the Lamb (c 1425-1432).

dellafrancescabaptismchrist
Piero della Francesca (c 1415/20-1492), The Baptism of Christ (after 1437), egg on poplar, 167 x 116 cm, The National Gallery (Bought, 1861), London. Courtesy of and © The National Gallery, London.

Continuing use of egg tempera in the Southern Renaissance helped it survive. Piero della Francesca’s famous The Baptism of Christ (after 1437), made in egg tempera on poplar wood, relies on the pigment for its greens. Microscopic examination of the paint layer here shows coarse mineral particles typical of natural malachite.

delcossastvincentferrer
Francesco del Cossa (c 1435/6-1477/8), Saint Vincent Ferrer (c 1473-75), egg on poplar, 153.7 x 59.7 cm, The National Gallery (Bought, 1858), London. Courtesy of and © The National Gallery, London.

In Francesco del Cossa’s Saint Vincent Ferrer from about 1473-75, it has been identified in the dark green grass at the foot of the painting. This too was made using egg tempera.

However, microscopy of this paint layer shows that these pigment particles don’t seem to have been fractured as if they have been ground, but are globular, as occurs when the malachite green has been made by a process of precipitation. Such artificial malachite green didn’t appear in European paintings until after about 1430, just in time for Francesco del Cossa.

tintorettostgeorgedragon
Tintoretto (1519–1594), Saint George and the Dragon (c 1555), oil on canvas, 158.3 x 100.5 cm, The National Gallery, London. Wikimedia Commons.

Although he painted in oils, Tintoretto was an enthusiastic user of malachite green. To obtain the range of greens seen in the rich and varied colours of vegetation in his Saint George and the Dragon from about 1555, he used this pigment with copper resinate glazes, a technique found in other paintings of the period.

tintorettolastjudgement
Tintoretto (1519–1594), The Last Judgment (1560-62), oil on canvas, 1450 x 590 cm, Chiesa della Madonna dell’Orto, Venice, Italy. Wikimedia Commons.

Tintoretto’s vast oil painting of The Last Judgment (1560-62) in the Chiesa della Madonna dell’Orto, Venice, has been found to contain malachite green, I suspect in the band of green depicting the Flood just below the centre. The detail below makes this a bit clearer.

tintorettolastjudgementd1
Tintoretto (1519–1594), The Last Judgment (detail) (1560-62), oil on canvas, 1450 x 590 cm, Chiesa della Madonna dell’Orto, Venice, Italy. Wikimedia Commons.
domenichinoapollopursuingdaphne
Domenichino (1581-1641) and assistants, Apollo pursuing Daphne (1616-18), fresco formerly in Villa Aldobrandini transferred to canvas and mounted on board, 311.8 x 189.2 cm, The National Gallery (Bought, 1958), London. Courtesy of and © The National Gallery, London.

When painting the frescoes formerly in the Villa Aldobrandini between 1616-18, Domenichino and his assistants relied heavily on malachite green. It has been formally identified in this section, showing Apollo pursuing Daphne, where it’s the mainstay colour remaining, and is suspected in most of the others.

Although only classed as moderately permanent, these and other examples of very old frescoes show how well malachite green has retained its colour after four centuries or more. But with the rise of oil painting in European art, it fell from favour.

renoirchrysanthemums
Pierre-Auguste Renoir (1841–1919), Chrysanthemums (1881-82), oil on canvas, 54.7 × 65.9 cm, Art Institute of Chicago, Chicago, IL. Image by Rlbberlin, via Wikimedia Commons.

One of those who participated in its revival in the nineteenth century was Pierre-Auguste Renoir, whose painting of Chrysanthemums from 1881-82 shows how it could still be used in oil paint. But by then there was a much wider choice of more modern green pigments; the revival was short-lived, and malachite green has hardly been used since.

Reference

Rutherford J Gettens and Elisabeth West Fitzhugh (1993) Artists’ Pigments, vol 2, edited by Ashok Roy, Archetype. ISBN 978 1 904982 75 3.

How XProtect’s detection rules have changed 2019-25

By: hoakley
15 August 2025 at 14:30

XProtect is the front-line tool in macOS for detecting known malware. When a downloaded app is run for the first time and put through Gatekeeper checks, those rely on detection rules defined in the XProtect.yara file inside the XProtect bundle in /System/Library/CoreServices. Those are updated periodically to extend their coverage as new malware is detected and analysed by Apple’s security engineers. This article looks at how they have changed over the last six years.

My starting point is XProtect version 2103 released on 2 May 2019, in the heyday of macOS 10.14.4 Mojave. That contains a total of 92 rules in a text file of 42,903 bytes, for an average rule size of 456 bytes. Among those are many old chestnuts such as Bundlore.

My end point is version 5310 released this week, on 12 August 2025, for macOS 15.6 Sequoia and earlier. That contains a total of 372 rules in a text file of 969,662 bytes, giving an average rule size of 2,572 bytes. Still among those are the same old chestnuts including Bundlore.

Thus the number of rules is now 4 times what it was six years ago, and they take over 22 times as much space.

For the period up to the end of 2023, I have analysed XProtect’s Yara file in updates every 6 months, in May and November, or the closest update available. From the start of 2024 updates became more frequent, and I have therefore analysed the last update in each month. In late 2024, XProtect in macOS Sequoia started using iCloud to deliver its XProtect data updates. For this analysis I have excluded version 5273, which was only released via iCloud and wasn’t provided through the regular softwareupdate route used by all previous versions.

The number of Yara rules increased steadily until updates became more frequent in 2024, following which there was a very steep rise early that year. Since then they have continued to rise more steeply than before 2024, but now appear more linear, as seen in the red line of regression. Over this period, hardly any Yara rules have been removed.

Total size of the Yara file has followed a similar pattern, with little change until the start of 2024. It then peaked briefly before reducing slightly, pausing a little, then undergoing a step increase from 288 KB to 877 KB. Growth has been steadier for the last year, although it appears to be on track to reach 1 MB in 2026.

Average size of Yara rules changed little between 2021-2023, but increased greatly with the addition of some very large rules in June-July 2024. It has since declined slowly, as more recent rules have been far smaller.

This prodigious growth in the number of Yara rules and their size has inevitably had its effect on the time taken to complete Gatekeeper checks that include XProtect scans. macOS Tahoe has been promised to limit that, by not scanning notarized apps with XProtect, so improving app launch times.

Given that remarkably few old Yara rules have been removed over the last six years, this growth has been inevitable. However, unless old malware is incapable of being run on Macs still supported by XProtect updates, it’s hard to see how it could be safe to remove old rules. When support for running x86 code (except that for “older unmaintained gaming titles”) is dropped from macOS 28, many older Yara rules could be dropped from XProtect updates without putting Apple silicon Macs at risk, but even that isn’t an easy decision. In the meantime, at least our faster Macs should be able to complete XProtect scans more quickly.

The Dutch Golden Age: Rembrandt after 1640

By: hoakley
14 August 2025 at 19:30

In 1640, soon after Rembrandt and his wife Saskia had moved into their own house in a fashionable quarter of Amsterdam, she gave birth to their third child, who died shortly afterwards. The following year, their fourth was born, Titus, the only one to survive to adulthood, although even he died before Rembrandt.

rembrandtnightwatch
Rembrandt Harmenszoon van Rijn (1606–1669), The Night Watch (1642), oil on canvas, 363 x 437 cm, Rijksmuseum Amsterdam, Amsterdam, The Netherlands. Wikimedia Commons.

His vast group portrait of The Night Watch (1642) is perhaps the most famous of all those of militia in the Dutch Republic. It’s more correctly titled Militia Company of District II under the Command of Captain Frans Banninck Cocq, and features the commander and seventeen members of his civic guard company in Amsterdam, and took the artist three years to complete from his first commission to its display in the guards’ great hall.

Captain Frans Banninck Cocq (in black with a red sash), followed by his lieutenant Willem van Ruytenburch (in yellow with a white sash) are leading out this militia company, their colours borne by the ensign Jan Visscher Cornelissen. The small girl to the left of them is carrying a dead chicken, a symbol of arquebusiers, the type of weapon several are carrying.

At the time, Saskia’s health was declining rapidly, and she died in 1642, most probably from tuberculosis, which was rife at the time. Rembrandt hired a widow, Geertje Dircx, to look after his young son Titus, and she became the artist’s lover.

rembrandtdavidjonathan
Rembrandt Harmenszoon van Rijn (1606–1669), David and Jonathan (1642), oil on panel, 61.5 x 73 cm, Hermitage Museum, Saint Petersburg. Wikimedia Commons.

Another superb example of Rembrandt’s later techniques is in his painting of David and Jonathan from 1642.

rembrandtmill
Rembrandt Harmenszoon van Rijn (1606–1669), The Mill (1645-48), oil on canvas, 87.6 x 105.6 cm, National Gallery of Art, Washington, DC. Wikimedia Commons.

Rembrandt painted few non-narrative landscapes, but among them is his dramatic view of The Mill (1645-48) seen in the rich rays of twilight. This is a post mill, whose wooden top was turned into the wind to set its sails turning.

His relationship with Titus’ nurse broke up acrimoniously in 1649, and he first had to pay her alimony, then the cost of confining her in a house of correction when she broke her side of their agreement. As they were parting, he began a relationship with the much younger Hendrickje Stoffels, who had been his maid.

Rembrandt Harmenszoon van Rijn, A Woman bathing in a Stream (1654), oil on panel, 61.8 x 47 cm, National Gallery, London. Wikimedia Commons.
Rembrandt Harmenszoon van Rijn (1606-1669), A Woman Bathing in a Stream (1654), oil on panel, 61.8 x 47 cm, National Gallery, London. Wikimedia Commons.

Stoffels is claimed to have been the model for A Woman Bathing in a Stream, painted in 1654, when she was expecting their first child.

Rembrandt Harmenszoon van Rijn, Bathsheba with King David's Letter (1654), oil on canvas, 142 x 142 cm, Musée du Louvre, Paris. Wikimedia Commons.
Rembrandt Harmenszoon van Rijn (1606-1669), Bathsheba with King David’s Letter (1654), oil on canvas, 142 x 142 cm, Musée du Louvre, Paris. Wikimedia Commons.

She probably appears again in his masterly painting of Bathsheba with King David’s Letter from 1654, showing an imagined moment late in this Old Testament story.

Bathsheba is at her bath, this time in the privacy of her bedchamber, her feet being cared for by an old and presumably worldly-wise maid or nurse. Clutched in Bathsheba’s right hand is a letter, the title tells us from the king himself. Her eyebrows are raised in surprise, and she stares dreamily down at her attendant. We must presume that this letter is the king’s invitation to her to join with him in adultery. Rembrandt skilfully heightens the suspense in the lighting, and enhances the intimate detail with Bathsheba’s jewellery and ornamented hair. The crumpled sheets behind her make it clear that David’s invitation isn’t to a public engagement, but to a very private one.

In June 1654, Stoffels was summoned by her church accused of committing “the acts of a whore with Rembrandt the painter”, for which she was banned from receiving communion. That October, she gave birth to their daughter, but the couple were unable to marry as Rembrandt would consequently have lost access to a trust set up by Saskia. His finances continued to worsen, and in 1656 he declared his insolvency, resulting in his house being sold at auction early in 1658. He was, though, allowed to keep his studio equipment, and he was able to live on as a tenant. That year Rembrandt’s son Titus and Hendrickje Stoffels formed a company of art dealers, thus enabling the artist to continue painting.

rembrandtphilemonbaucis
Rembrandt Harmenszoon van Rijn (1606–1669), Baucis and Philemon (1658), oil on panel mounted on panel, 54.5 × 68.5 cm, The National Gallery of Art, Washington, DC. Courtesy of The National Gallery of Art, via Wikimedia Commons.

Rembrandt’s Baucis and Philemon (1658) shows Jupiter looking decidedly Christlike, and Mercury the younger, almost juvenile, figure, sat at the table of a dark and rough cottage, lit by a lamp behind Mercury. This dramatic lighting is precursor to similar effects in his later Ahasuerus and Haman and Conspiracy of the Batavians, shown below. Philemon and Baucis are crouched, chasing the evasive goose towards Jupiter. A humble bowl of food is in the centre of the table, and there is a glass of beer. As is usual in Rembrandt’s narrative paintings, he dresses them in contemporary rather than historic costume.

rembrandtselfportrait1658
Rembrandt (1606–1669), Self-Portrait (1658), oil on canvas, 133.7 x 103.8 cm, The Frick Collection, New York, NY. Wikimedia Commons.

Rembrandt’s Self-Portrait from 1658 is one of the most insightful of his unique series of self-portraits, showing the artist bankrupt and growing old.

rembrandtahasuerushamanesther
Rembrandt Harmenszoon van Rijn (1606–1669), Ahasuerus and Haman at the Feast of Esther (1660), oil on canvas, 73 x 94 cm, Pushkin Museum, Moscow. Wikimedia Commons.

He drew Ahasuerus and Haman at the Feast of Esther (1660) from an Old Testament story in the book of Esther, via the contemporary play Hester by Johannes Serwouters, first performed the previous year. The original narrative revolved around Haman, one of King Ahasuerus’ officials, who proposed to hang Mordechai as a scapegoat for the Jewish nation, as revenge for their pride. In this painting, Haman is shown in the shadows on the left, with King Ahasuerus in the centre, and Esther – Mordechai’s cousin and Ahasuerus’s wife – radiant in her intervention to save Mordechai’s life.

In 1661, Rembrandt secured a major commission for what was then the new Amsterdam City Hall, completed in 1655, now the Royal Palace. The dozen large spaces intended for paintings were going to be filled by Govert Flinck, who had started but not completed them when he died in 1660. Rembrandt sketched what he is believed to have completed in the summer of 1662.

rembrandtconspiracybatavians
Rembrandt Harmenszoon van Rijn (1606–1669), The Conspiracy of the Batavians under Claudius Civilis (1661-2), oil on canvas, 196 x 309 cm, Nationalmuseum, Stockholm. Wikimedia Commons.

The painting that we see today as The Conspiracy of the Batavians under Claudius Civilis (1661-2) is but a small central rectangle within the original. His entire painting was hung in place for a while, but appears to have fallen into disfavour. It was taken down and returned to the artist, who wasn’t paid, and no longer had sufficient influence to change anyone’s mind in the matter. Meanwhile Jürgen Ovens (1623–1678) completed Flinck’s version, which was hung instead of Rembrandt’s. Rembrandt was desperately short of money at this time, so cut the painting down to a more saleable size, repainted parts of it, and sold it on.

Hendrickje Stoffels died in July 1663, leaving Rembrandt with his son Titus. Despite his advancing years and continuing battles to pay his rent and bills, Rembrandt’s paintings attained new heights. Typical of these are two portraits of Lucretia ending her life following her rape by Sextus Tarquinius.

rembrandtlucretia1
Rembrandt Harmenszoon van Rijn (1606–1669), Lucretia (1664), oil on canvas, 120 x 101 cm, The National Gallery of Art, Washington, DC. Wikimedia Commons.

In the earlier of the two, from 1664, Lucretia is seen just about to run the dagger home into her chest. Rembrandt dresses her in fine contemporary clothes, rather than the black robes of the story, and she is richly decorated with jewellery. She faces the viewer, but her head is slightly inclined to the right, and she stares emptily at her right hand. Her face shows calm resignation to her fate, with a tinge of wistful sadness. Her arms are outstretched to the edges of the canvas. The left hand is grubby and held open, palm towards the viewer, perhaps protesting her virtue. The right grasps the handle of a dagger, which is just being brought around in an arc to impale her chest and bring her end.

rembrandtlucretia2
Rembrandt Harmenszoon van Rijn (1606–1669), Lucretia (1666), oil on canvas, 110.2 x 92.3 cm, Minneapolis Institute of Arts, Minneapolis, MN. Wikimedia Commons.

Rembrandt’s later painting of 1666 is more remarkable still: Lucretia has already pierced her chest with the blade. Her fine clothing has been pulled back to reveal her simple white shift, with a broad streak of fresh, bright red blood running down from the point at which the dagger was inserted. Her arms are outstretched here too, but for very different purposes. The right hand still clutches the dagger, which has dropped to waist level already. Her left hand is dragging a beaded bell-pull, presumably to summon her family to witness her final moments on earth. It is her face, though, that makes this painting. Her eyes, moistened by welling tears, are looking away to the right of the painting, in an absent-minded stare. Her brow is tensed with subtle anxiety. She knows that she is about to die, and is preparing herself for that moment.

Rembrandt Harmenszoon van Rijn, The Jewish Bride (c 1667), oil on canvas, 121.5 x 166.5 cm, Rijksmuseum, Amsterdam. Wikimedia Commons.
Rembrandt Harmenszoon van Rijn, The Jewish Bride (c 1667), oil on canvas, 121.5 x 166.5 cm, Rijksmuseum, Amsterdam. Wikimedia Commons.

Rembrandt continued to develop his mark-making right up to his death. It’s often at its most florid when he painted fabrics, such as the clothing of the couple shown in The Jewish Bride of about 1665. The Dutch Republic had long been a safe harbour for Jews fleeing from oppression in other European countries, and Rembrandt had cultivated close relationships with members of the large Jewish community in Amsterdam, some of whom had modelled for his paintings of Old Testament stories.

rembrandtreturnprodigalson
Rembrandt Harmenszoon van Rijn (1606–1669), The Return of the Prodigal Son (c 1668), oil on canvas, 262 x 205 cm, Hermitage Museum Государственный Эрмитаж, Saint Petersburg, Russia. Wikimedia Commons.

The Return of the Prodigal Son from about 1668, the year before the artist’s death, is a more conventional treatment of this parable from the Gospels, in which the younger son, almost barefoot and in rags, kneels in front of his father. Around them are members of the household, and details that are now hard to read. As with other late works, there’s a profound feeling of tenderness and redemption, which may have had personal significance.

Rembrandt’s son Titus van Rijn died in 1668, at the age of only 26, and Rembrandt died on Friday 4 October 1669. Three years later the Dutch Republic was invaded by French forces, and its Golden Age came to an abrupt end.

Inside PDF annotations

By: hoakley
14 August 2025 at 14:30

In addition to reading laid-out documents, the most popular purposes for PDFs are forms and annotation. As far as filling in PDF forms are concerned, I have just one word to say: Fillably, Joel Norvell’s outstanding app available from the App Store, which transforms Preview into the ideal platform for tax and other forms. Rather than struggling with the tangle of tools in a general PDF editor, Fillably provides the perfect suite for creating PDF forms.

Annotating PDFs is more complicated, though.

Encoding annotations

Annotations aren’t an afterthought, but a central part of PDF. All PDF documents consist of a list of hundreds or thousands of objects of different types, including annotations of the Annot type, and those are listed in one of the file’s standard dictionaries, its Annotations Dictionary, Annots.

There are at least 27 sub-types of Annot, including Caret, Highlight and Stamp, which are reflected in the annotation tools provided by apps from Acrobat to Preview. Seemingly complex annotations like popup notes are straightforward to code in PDF, requiring just two linked objects, one for the popup and its text, the other to specify its placement on the page. Others are more involved, as they can extend to include file attachments, sound, movie and other multimedia.

PDF versions

Despite their original simplicity, there are multiple problems that can arise with annotations.

With more recent versions of PDF, the ways in which they can be coded has increased. Mark up a PDF using the latest versions of Adobe Acrobat Reader or its ‘Pro’ CC colleague and they’ll cast it in PDF-1.6 and you’re unlikely to see a single Annot in their source. Most apps built on the Quartz PDF engine should write their files in PDF-1.3 so they can be accessed more widely, and should use regular Annot sub-types throughout. However, Preview likes to use opaque AAPL:AKAnnotationObjects that you won’t encounter anywhere else.

What Quartz does is to ‘flatten’ each PDF into a common 1.3 format for rendering, and that can be saved to disk. At present, that seems to work faithfully, but might give the impression that macOS can’t render more recent versions of PDF, which isn’t true. You can demonstrate that by opening an Acrobat PDF-1.6 document using an app that relies on the Quartz engine, such as PDF Expert, Preview or my Podofyllin, and comparing that with the original in Acrobat.

Podofyllin has a convenient feature for doing just that, in its source window. The uppermost of its three views displays Quartz ‘flattened’ code in PDF-1.3, the middle shows the original, here in PDF-1.6, and the lowermost is a summary of the latter.

Hidden annotations

The biggest dangers with annotations arise because of PDF’s ancient origins and a file format that doesn’t make sufficiently clear distinction between data and metadata. All annotations are metadata added to the underlying document, but in PDF, objects for each are mixed freely within the source. When they’re clearly distinguished with the Annot type, they should be easy to remove as a group, and PDF Expert offers that as a convenient command. That’s ideal when a document has been developed with the aid of reviewers’ annotations, to prepare the finished version for release.

Unfortunately this can cause its own problems, as PDF source is notorious for retaining old content that’s no longer visible in the rendered document, but can be read by anyone with a little knowledge about PDF. Like incomplete redactions, such hidden annotations have caused many embarrassments in the past, and will continue to catch folk out.

Preview’s bugs

Finally, Preview has had more than its fair share of bugs in handling PDF annotations. During my research for this article, Preview 11.0 (1069.7.1) in macOS 15.6 was generally well behaved, but did mangle comments added to a test document by PDF Expert and Adobe Acrobat. Preview has two behaviours that can appear disconcerting: that of its Highlights and Notes tool, and its use of versioning.

All Preview’s tools are single-shot apart from Highlights and Notes, the drawing pencil icon to the left of its popup menu. Click this once to apply highlighting to selected blocks of text, and to remove existing highlighted sections. Unfortunately when this tool is turned on, its own highlighting is so weak that it’s hard to see.

Overwritten files

Preview has a habit of saving PDF documents automatically when closing them, without any warning. If it has just mutilated an annotation, for example, you might assume the original file has just been overwritten and lost. However, Preview saves PDFs using the macOS document versioning system, so you can always recover the previous version.

This might at first seem an impossible task: use Preview to restore that old version and it will repeat its mutilation, defeating the purpose. Yet the original PDF editor won’t have access to previous versions, as it doesn’t use the versioning system. The solution is to use Revisionist, or Versatility, which can save the original as a separate document.

Key points

  • Annotations are a central feature of PDF, come in many sub-types, and can be complicated as they can be expressed in different ways.
  • The macOS Quartz PDF engine transforms them into PDF-1.3, which makes them simpler and more explicit, so they can be saved ‘flattened’.
  • PDF format mixes document data with metadata and annotations.
  • Few PDF editors offer to remove all annotations, and there’s a risk of some remaining hidden from view, but still remaining in the PDF source, potentially causing embarrassment when they’re discovered.
  • Preview’s earlier bugs in annotations have improved, but it can still mutilate those made by other PDF editors.
  • If Preview saves a mutilated PDF, you should be able to recover the previous version of that file using Revisionist or Versatility.

The Dutch Golden Age: Rembrandt to 1640

By: hoakley
13 August 2025 at 19:30

Rembrandt is probably the most famous artist of the Dutch Golden Age. Although his career is by no means typical, it does illustrate some of the forces at work behind the explosive growth of art during this period, and is a good excuse to show a few of his paintings for context with other artists of the period.

He was born in the city of Leiden, then the second largest in the Dutch Republic after Amsterdam, with a population of 45,000 in 1622, and growing rapidly. Its major industry was the weaving of textiles, and through the seventeenth century it attracted many weavers to migrate from Flanders. Another flourishing local industry was printing and publishing, which was helped by the city’s university, founded in 1575, and its role as a centre of learning and scientific development.

Rembrandt was the ninth child in a prosperous family, his father being a miller. He was well educated, initially at a school in the centre of the city, then from the age of 14 at the university. He soon opted to be apprenticed as a painter, and joined the workshop of Jacob van Swanenburg in Leiden, who had trained in Italy. After three years, Rembrandt went on to work for shorter periods with Pieter Lastman, a history painter in Amsterdam, and others there.

rembrandtoperation
Rembrandt Harmenszoon van Rijn (1606–1669), The Operation (The Sense of Touch) (1624-25), oil on panel, 21.6 × 17.7 cm, Private collection. Wikimedia Commons.

Rembrandt’s early painting of The Operation, from his late teens in 1624-25, shows a barber-surgeon and his assistant performing surgery on the side of a man’s head.

In 1625, when he was only 19, he became a master in his own right, and opened his first studio in Leiden, shared with his former fellow-student Jan Lievens. Two years later he started taking on his own apprentices.

rembrandtmangorget
Rembrandt (1606–1669), Man in a Gorget and a Plumed Cap (1626-27), oil on oak wood, 40 x 29.4 cm, Private collection. Wikimedia Commons.

In 1626-27, Rembrandt painted this portrait of a Man in a Gorget and a Plumed Cap, demonstrating the strange effects that cast shadows can have on perception of the face. This also shows his early mastery of surface textures and reflected highlights.

Rembrandt’s break came in 1629, when he was discovered by a distinguished poet and composer Constantijn Huygens, who was secretary to the head of state, held influence in the Hague, and was the father of Christiaan Huygens, a leading mathematician and physicist. Huygens helped arrange commissions for Rembrandt, and introduced his work to Prince Frederik Hendrik, then head of state.

rembrandtstpeterprison
Rembrandt Harmenszoon van Rijn (1606–1669), Saint Peter in Prison (The Apostle Peter Kneeling) (1631), oil on panel, 59 x 47.8 cm, Israel Museum מוזיאון ישראל, Jerusalem, Israel. Wikimedia Commons.

Although several of his best-known chiaroscuro paintings were made in his old age, Rembrandt had long used the technique when appropriate, here in Saint Peter in Prison (The Apostle Peter Kneeling) from 1631.

rembrandtrapeproserpine
Rembrandt Harmenszoon van Rijn (1606–1669), The Abduction of Proserpina (c 1631), oil on oak panel, 84.8 x 79.7 cm, Gemäldegalerie der Staatlichen Museen zu Berlin, Berlin, Germany. Wikimedia Commons.

Rembrandt’s The Abduction of Proserpina (c 1631) is probably the first masterpiece to show this myth. Pluto is trying to drive his chariot away, with Proserpine inside it. She’s putting up fierce resistance, and trying to fend him off. Hanging on to the hem of Proserpine’s floral dress is a woman who should perhaps be her mother Ceres, but bears the crescent moon normally associated with Diana. Pluto’s chariot is being drawn by two black horses through an ethereal almost fluid carpet of flowers. The horses and chariot are about to disappear into a black cleft in the earth to make their descent to Hades.

In 1631, Rembrandt moved his studio to Amsterdam, the centre of trade and business for the Dutch Republic, and growing rapidly from a population of about 50,000 in 1600 to exceed 200,000 in the 1660s. He started getting commissions to paint portraits of those enjoying success in the city.

rembrandtanatomylesson
Rembrandt Harmenszoon van Rijn (1606–1669), The Anatomy Lesson of Dr. Nicolaes Tulp (1632), oil on canvas, 169.5 x 216.5 cm, Koninklijk Kabinet van Schilderijen Mauritshuis, The Hague, The Netherlands. Wikimedia Commons.

Rembrandt painted his Anatomy Lesson of Dr. Nicolaes Tulp in 1632, as an early commission soon after his arrival in Amsterdam. It’s a group portrait of distinguished members of the Surgeons’ Guild in their working environment, and a good example of his lucrative work. Portraits like this would typically be paid for by subscription of those included, often in proportion to their standing.

rembrandtabductionofeuropa
Rembrandt Harmenszoon van Rijn (1606–1669), The Abduction of Europa (1632), oil on oak panel, 64.6 × 78.7 cm, J. Paul Getty Museum, Los Angeles, CA. Wikimedia Commons.

Rembrandt’s The Abduction of Europa (1632) isn’t well known today. It conforms to Ovid’s account in his Metamorphoses, but loses dramatic effect by placing the bolting bull in a dominant and very Dutch landscape, cluttered with Europa’s carriage, large trees, and a distant port.

rembrandtphilosopherinmeditation
Rembrandt Harmenszoon van Rijn (1606–1669), Philosopher in Meditation (1632), oil on oak panel, 28 x 34 cm, Musée du Louvre, Paris. Wikimedia Commons.

His Philosopher in Meditation from 1632 shows the sinuous curves of a spiral staircase seemingly defying gravity as it rises to the storey above, and is one of his early interiors.

rembrandtdanielcyrus
Rembrandt Harmensz. van Rijn (1606-1669), Daniel and Cyrus before the Idol Bel (1633), oil on panel, 23.5 x 30.2 cm, The J. Paul Getty Museum, Los Angeles, CA. Courtesy of the Getty Center, via Wikimedia Commons.

The young prophet Daniel (of lions’ den fame) was King Cyrus the Great’s confidant, according to the book of Daniel. When Cyrus asked Daniel why he didn’t worship the Persian god Bel (Baal), Daniel responded by saying that he worshipped a living god, not a mere idol. Cyrus then claimed that Bel too was a living god, and pointed to the offerings of food and wine that were placed before his statue, and were consumed each night. Daniel remarked cautiously that bronze statues do not eat, which for a moment threw Cyrus. But Daniel had exposed the deception of Bel’s priests.

In this painting of Daniel and Cyrus before the Idol Bel of 1633, Rembrandt has captured Cyrus, standing in the centre, pointing at the food and wine placed on the altar to Bel, whose huge idol is seen rather murkily at the upper right. Behind the modest figure of Daniel are some of the priests who maintained this deception.

32.100.23
Rembrandt Harmenszoon van Rijn (1606–1669), Bellona (1633), oil on canvas, 127 x 97.5 cm, Metropolitan Museum of Art, New York, NY. Wikimedia Commons.

Rembrandt painted this portrait of Bellona in 1633, when his career was flourishing. Given that she’s holding the Aegis normally associated with Minerva (Athena), I wonder whether there has been a misunderstanding here, but there’s no mention of the possibility that this might be Minerva instead.

rembrandtselfportraitpoodle
Rembrandt Harmenszoon van Rijn (1606-1669), Self-portrait in Oriental Attire with Poodle (1631-33), oil on oak panel, 55.5 x 52 cm, Petit Palais, Paris. Wikimedia Commons.

His self-portrait from 1631-33 shows the artist in fancy dress with a large poodle, making it clear that he had truly arrived.

In 1634, Rembrandt became properly established in Amsterdam, when he was accepted as a member of Guild of Saint Luke, and married Saskia van Uylenburgh, daughter of a respected lawyer. The following year, the couple moved into a rented property with a view of the river. That December, she gave birth to their first child, a son, who lived for only two months.

rembrandtrembrandtsaskia
Rembrandt Harmenszoon van Rijn (1606–1669), Rembrandt and Saskia in the Parable of the Prodigal Son (c 1635), oil on canvas, 161 x 131 cm, Gemäldegalerie Alte Meister, Dresden, Germany. Wikimedia Commons.

Rembrandt and Saskia in the Parable of the Prodigal Son from about 1635, when the artist was just short of being thirty years old, shows the young wife sitting on his lap as he raises a large fluted glass of beer at the viewer.

With his artistic and commercial success, Rembrandt’s income rose rapidly. Like many successful Dutch citizens of the time, much of that income was spent on gathering possessions. In his case, these included a remarkable collection of Old Masters, including several paintings by Giorgione, objets d’arts, and even suits of armour. Some of these appear as props in his paintings.

rembrandtblindingsamson
Rembrandt (Rembrandt Harmenszoon van Rijn) (1606–1669), The Blinding of Samson (1636), oil on canvas, 219.3 x 305 cm, Städelsches Kunstinstitut und Städtische Galerie, Frankfurt am Main, Germany. Wikimedia Commons.

Rembrandt’s Blinding of Samson from 1636 is an explicit depiction of the destruction of his eyes, as Delilah makes off behind with his hair and a pair of shears.

rembrandtbelshazzarsfeasta
Rembrandt Harmenszoon van Rijn (1606-1669), Belshazzar’s Feast (c 1635-1638), oil on canvas, 167.6 x 209.2 cm, The National Gallery, London. Wikimedia Commons.

His outstanding painting of Belshazzar’s Feast was made in about 1635-38, when he was developing his distinctive techniques of depicting decorative metals, as shown in the detail below.

rembrandtbelshazzarsfeastdet1
Rembrandt Harmenszoon van Rijn (1606-1669), Belshazzar’s Feast (detail) (c 1635-1638), oil on canvas, 167.6 x 209.2 cm, The National Gallery, London. Wikimedia Commons.

In the summer of 1638, Saskia gave birth to their second child, who died less than a month later.

rembrandtdeadpeacocks
Rembrandt (1606–1669), Still Life with Two Peacocks and a Girl (c 1639), oil on canvas, 145 x 135.5 cm, Rijksmuseum Amsterdam, Amsterdam, The Netherlands. Wikimedia Commons.

The following year he followed fashion in painting this Still Life with Two Peacocks and a Girl (c 1639).

That Spring Rembrandt and his wife moved into their own house in one of the city’s more fashionable streets, among successful artists and dealers in art. To finance this purchase, the artist had to raise a substantial mortgage, which was to come back and haunt his later life, as I’ll describe in tomorrow’s conclusion.

How to search Spotlight for Live Text and objects in images

By: hoakley
13 August 2025 at 14:30

Spotlight has been able to find text extracted from images using Live Text, and the names of objects recognised using Visual Look Up, for some years now. This article considers how you can and cannot search for those. Although this might seem obvious, it’s more confusing than it appears and could mislead you into thinking that Spotlight indexing or search isn’t working.

As detailed in yesterday’s account of Live Text, text recognition in images uses a lexicon to match words rather than proceeding in single characters. Terms assigned to recognised objects are also words. Thus, when searching for either type you should use words as much as possible to increase the chances of success.

Global Spotlight 🔍

Type a word like cattle into Spotlight’s search window and you can expect to see a full selection of documents and images containing the term or cattle objects. Those include images containing the word, and images containing objects identified as cattle, but don’t include images in PDF files, as they’re not analysed by mediaanalysisd, so don’t undergo character or object recognition in the same way that regular images like JPEGs do.

The Finder’s Find

Open a new window in the Finder and turn it into a Spotlight search using the Finder’s File menu Find command. In its search box at the top right, type in a word like cattle and in the popup menu select the lower option, Content contains. Press Return and the search box will now display ANY cattle. Then set the Kind to Image in the toolbar above search results, to narrow results down to image files. You should then see a full listing of image files that either contain the word cattle, or contain objects identified by image analysis as being cattle. Note how many of those appear.

Reconfigure the search so the search box is empty, and there are two rows of search settings: the first can remain the same as Kind is Image, but set the second to Contents contains cattle. Those images containing objects identified as cattle will now vanish, leaving images containing the word cattle still listed.

To understand the difference between these, you can save those two Find windows and read the underlying terms used for each search. The search that returned text obtained by both Live Text and Visual Look Up used
(((** = "cattle*"cdw)) && (_kMDItemGroupId = 13))
while the one excluding Visual Look Up used
(((kMDItemTextContent = "cattle*"cdw)) && (_kMDItemGroupId = 13))
instead. We can transfer those to the mdfind command tool to explore further.

mdfind

To use those as search predicates with mdfind we’ll translate them into more general form,
mdfind "(** == 'cattle*'cdw) && (kMDItemContentTypeTree == 'public.image'cd)"
should return both Live Text and Visual Look Up, while
mdfind "(kMDItemTextContent == "cattle*"cdw) && (kMDItemContentTypeTree == 'public.image'cd)"
only returns Live Text results.

The term (** == 'cattle*'cdw) has a special meaning because of its wild card **, and will return any match found in the metadata and contents of files. kMDItemTextContent is similar, but confined to text content, which doesn’t include the names of objects recognised in an image, and Apple doesn’t reveal whether there’s an equivalent that does.

Code search

Although apps can call mdfind to perform searches, they normally use NSMetadataQuery with an NSPredicate instead. That isn’t allowed to use a predicate like
** ==[cdw] "cattle"
so can’t search for objects identified using Visual Look Up. When it uses the substitute of
kMDItemTextContent ==[cdw] "cattle"
it also fails to find text obtained using Live Text. So the only way to search for recovered text in a compiled app is to call mdfind.

Timing

Searching for text obtained using Live Text, or object labels obtained using Visual Look Up, depends entirely on those being added to the Spotlight indexes on the volume. Observations of the log demonstrate just how quickly normal indexing by mdworker processes takes place. Here’s an example for a screenshot:
06.148292 com.apple.screencapture Write screenshot to temporary location
06.151242 [0x6000009bc4b0] activating connection: mach=true listener=false peer=false name=com.apple.metadata.mds
06.162302 com.apple.screencapture Moving screenshot to final location
06.169565 user/501/com.apple.mdworker.shared.1E000000-0600-0000-0000-000000000000 internal event: WILL_SPAWN, code = 0
06.198868 com.apple.DiskArbitration.diskarbitrationd mdworker_shared [7266]:118071 -> diskarbitrationd [380]
06.226997 kernel Sandbox apply: mdworker_shared[7266]

In less than 0.1 second an mdworker process has been launched and granted the sandbox it uses to generate metadata and content for Spotlight’s indexes. Unfortunately, that doesn’t include any Live Text or Visual Look Up content, which are generated separately by mediaanalysisd later. It’s hard to estimate how much later, although you shouldn’t expect to find such recovered text for several hours or days, depending on the opportunities for mediaanalysisd to perform background image analysis for this purpose.

Summary

  • Words recovered from images (not those in PDF files, though) and objects recognised in them can be found by Spotlight search. For best results, choose words rather than letter fragments for search terms.
  • Global Spotlight gives full access to both types.
  • The Finder’s Find gives full access to both only when the search term is entered in the search box as Content contains, otherwise it may exclude objects recognised.
  • mdfind can give full access to both types only when using a wildcard term such as (** == 'cattle*'cdw).
  • NSMetadataQuery currently appears unable to access either type. Call mdfind instead.
  • The delay before either type is added to the volume Spotlight indexes can be hours or days.

Apple has just released an update to XProtect for all macOS

By: hoakley
13 August 2025 at 03:14

Apple has just released an update to XProtect for all supported versions of macOS, bringing it to version 5310. As usual, Apple doesn’t release information about what security issues this update might add or change.

This version adds a single new detection rule for MACOS.SOMA.AUENA, further extending its coverage of Soma/Amos.

You can check whether this update has been installed by opening System Information via About This Mac, and selecting the Installations item under Software.

A full listing of security data file versions is given by SilentKnight and SystHist for El Capitan to Tahoe available from their product page. If your Mac hasn’t yet installed this update, you can force it using SilentKnight or at the command line.

If you want to install this as a named update in SilentKnight, its label is XProtectPlistConfigData_10_15-5310

Sequoia systems only

This update has already been released for Sequoia via iCloud. If you want to check it manually, use the Terminal command
sudo xprotect check
then enter your admin password. If that returns version 5310 but your Mac still reports an older version is installed, you may be able to force the update using
sudo xprotect update

Medium and Message: Watercolour on paper

By: hoakley
12 August 2025 at 19:30

On the face of it, watercolour painting should be the simplest of all the more popular painting media. The paper is both support and ground, the paint layer is thin, with a little binder of gum arabic and a diluent of plain water. Although some have tried using varnish and other protective layers, in the great majority of watercolour paintings, that’s all there is.

In practice, though, as anyone who has taken watercolour painting seriously knows, there’s a great deal more to it. Much of that is hard to see and can only be inferred from images of watercolour paintings.

raphaelmiraculousdraftfishes
Raphael (Rafael Sanzio de Urbino) (1483–1520), The Miraculous Draft of Fishes (c 1515-16), bodycolour over charcoal on paper, mounted on canvas, 319 x 399 cm, The Royal Collection of the United Kingdom, UK. Wikimedia Commons.

Raphael’s The Miraculous Draft of Fishes (c 1515-16) is among the earliest large paintings made using opaque watercolour. Because of limitations in the manufacture of paper at the time, it was made on many sheets that have been mounted on canvas. At around 3 x 4 metres (10.5 x 13 feet), it’s huge by any standards, and even today would probably need to be painted on multiple sheets and mounted on added support.

Over three centuries later, the Pre-Raphaelite artist Marie Spartali Stillman painted her watercolours in layers, using a combination of transparent and opaque watercolour on paper that had been hot-pressed to give it a satin-smooth finish. When re-wetted with another layer of wet paint, watercolour usually becomes liquid again, resulting in the layers mixing. Great care and skill is required to apply wet watercolour on dry paint in the way that she did. Even then some paintings simply don’t work, the layers mix and that attempt has to be discarded. When successful, the end result can resemble layered oil paints, which don’t suffer the same problem when dry paint is overpainted.

stillmanchildhoodsaintcecilia
Marie Spartali Stillman (1844–1927), The Childhood of Saint Cecily (1883), watercolour and graphite heightened by gouache, 101 x 74 cm, Private collection. Wikimedia Commons.

The Childhood of Saint Cecily (1883) was one of the last paintings Stillman composed when she lived in Florence, as reflected in its idealised Tuscan background. As with so many paintings of saints, it departs from even the most inventive of hagiographies, here for the patron saint of music, Cecilia. The saint is shown playing a harp-like psaltery, while an angel adjusts the garland on her head. She has worked subtle patterns into the blue fabric on the arm of the angel, and in the side of the instrument. Flowers and hair have fine detail with sharp highlights, just as might be seen with oils.

stillmanlovesmessenger
Marie Spartali Stillman (1844–1927), Love’s Messenger (1885), watercolor, tempera and gold paint on paper mounted on wood, 81.3 × 66 cm, Delaware Art Museum, Wilmington, DE. Wikimedia Commons.

Love’s Messenger (1885) is probably the finest of her single-figure paintings, and was her most successful ‘problem picture’. The woman stands by her embroidery at an outside window. On her right hand is a messenger dove/pigeon, to which a letter is attached. She clutches that letter to her breast with her left hand, implying that its contents relate to matters of the heart. The dove is being fed corn, which could either be its reward for having reached its destination (thus the woman is the recipient of the message), or preparation for its departure (she is the sender). Despite being exhibited at the Grosvenor Gallery in 1885, and elsewhere, this painting didn’t sell until after she had reworked the background in the 1890s, which must have been a feat in itself.

stillmanlovesmessengerdet
Marie Spartali Stillman (1844–1927), Love’s Messenger (detail) (1885), watercolor, tempera and gold paint on paper mounted on wood, 81.3 × 66 cm, Delaware Art Museum, Wilmington, DE. Wikimedia Commons.

A detail view of Love’s Messenger shows how her watercolour technique results in a facture more closely resembling that of oils, although this painting is an extreme example with its use of tempera too. This was accomplished by using transparent watercolours more like oil glazes, and gouache (opaque watercolour) for details.

stillmanbeatrice1896
Marie Spartali Stillman (1844–1927), Beatrice (1896), watercolour and gouache on paper mounted on board, 57.6 × 43.2 cm, Delaware Art Museum, Wilmington, DE. Wikimedia Commons.

Her portrait of Beatrice (1896) refers to Dante’s Vita Nuova, through Dante Gabriel Rossetti’s popular translation into English. In this her first version, she shows Dante’s beloved Beatrice lost in contemplation while reading, an intimate insight set firmly in the Pre-Raphaelite mediaeval. This was exhibited at the New Gallery later that year.

stillmanbeatrice1896det
Marie Spartali Stillman (1844–1927), Beatrice (detail) (1896), watercolour and gouache on paper mounted on board, 57.6 × 43.2 cm, Delaware Art Museum, Wilmington, DE. Wikimedia Commons.

This detail view of Beatrice provides more insight into her exacting technique.

Over the same period, other artists were developing techniques for use on cold-pressed paper with its coarser texture.

cozensmountainouslandscapecastle
Alexander Cozens (1717–1786), Mountainous Landscape with a Castle and Waterfall (date not known), watercolour on paper, 16 x 22.9 cm, The Victoria and Albert Museum, London. Image courtesy of and © Victoria and Albert Museum, London.

At a time when most watercolour painting was still disparagingly considered to be ‘drawing’ for routine topographic views, Alexander Cozens developed specialist techniques, such as keeping ‘reserved space’ to let his white paper ground show through, wet on wet as well as wet on dry application of paint, and scratching out. He also employed both transparent and opaque paints for different effects.

JMW Turner did a great deal to advance both technique and the critical reception of large watercolour works painted in the studio, although even today his oils are much better known, with a few exceptions such as his sublime paintings of the Rigi.

homerwatchertynemouth
Winslow Homer (1836–1910), The Watcher, Tynemouth (1882), transparent and opaque watercolor, with rewetting, blotting, and scraping, heightened with gum glaze, over graphite, on moderately thick, slightly textured, cream wove paper (all edges trimmed), 21.3 × 37.7 cm, Art Institute of Chicago, Chicago, IL. Wikimedia Commons.

Towards the end of the nineteenth century, Winslow Homer earned his place as one of the greatest watercolour painters of America during a period spent in a fishing community in north-east England. The advanced techniques which he used are shown well in The Watcher, Tynemouth (1882), and include both transparent and opaque paints, rewetting and blotting to remove paint for highlights, scraping, application of wax to resist the adherence of paint, and the use of pure gum solution as a glaze. In this case, his paper is only lightly textured, though.

Perhaps the greatest exponent of these techniques was another American, John Singer Sargent.

sargenttease
John Singer Sargent (1856-1925), Simplon Pass: The Tease (1911), transparent watercolour, opaque watercolour and wax over graphite pencil on paper, 40 x 52.4 cm, Museum of Fine Arts, Boston, MA. Wikimedia Commons.

Sargent’s most radical watercolours were painted when he stayed with various friends in the Bellevue Hotel, at the top of the Simplon Pass, in the summers before the First World War. While his family and friends whiled away their days in leisure, Sargent got them to pose for a unique series of informal portraits. They may have been reclining at leisure, but Sargent took those watercolours very seriously, and deployed an amazing array of techniques. Among the finest is his Simplon Pass: The Tease from the summer of 1911.

sargentteased1
John Singer Sargent (1856-1925), Simplon Pass: The Tease (detail) (1911), transparent watercolour, opaque watercolour and wax over graphite pencil on paper, 40 x 52.4 cm, Museum of Fine Arts, Boston, MA. Wikimedia Commons.

One of his most unusual techniques, used extensively here, is wax resist. Before applying paint, Sargent scribbled over areas intended to be vegetation, using a soft wax crayon, probably made from beeswax. On fairly rough paper, that wax is deposited unevenly, and when painted over using watercolour it shows the white paper through. This creates disruptive patterns of near-white in the midst of the greens, and a superb textural effect, as shown in this detail.

hughesnighttrainstars
Edward Robert Hughes (1851-1914), Night with her Train of Stars (1912), watercolour, bodycolour and gold medium, 76.2 x 127 cm, Birmingham Museum and Art Gallery, Birmingham, England. Wikimedia Commons.

In complete contrast, Edward Robert Hughes’ Night with her Train of Stars of the following year has been painted in a controlled and meticulous manner, although it too uses advanced techniques, particularly in the sky and background. I suspect that some of the latter may have relied on the scattering of salt grains to impart its fine texture. In other passages he has allowed different colours to rewet and blur what would otherwise be sharp edges.

Of course, AI can now mimic these when provided with suitable original material to plagiarise. But there’s still nothing like an original painted by a master.

How do Live Text and Visual Look Up work now?

By: hoakley
12 August 2025 at 14:30

Live Text and Visual Look Up are recent features in macOS, first appearing in Monterey nearly four years ago. As that immediately followed Apple’s short debacle over its now-abandoned intention to scan images for CSAM, most concerns have been over whether these features send details of images to Apple.

Although recent Intel Macs also support both these features, they don’t have the special hardware to accelerate them, so are far slower. For this walkthrough, I’ll only present information from Apple silicon Macs, in particular for the M4 Pro chip in a Mac mini.

Initiation

When an image is opened from disk, the VisionKit system starts up early, often within 0.1 second of it starting to open. Its initial goal is to segment the image according to its content, and identify whether there’s any part of it that could provide text. If there is, then Live Text is run first so you can select and use that as quickly as possible.

In the log, first mention of this comes from com.apple.VisionKit announcing
Setting DDTypes: All, [private]
Cancelling all requests: [private]
Signpost Begin: "VKImageAnalyzerProcessRequestEvent"

It then adds a request to Mad Interface, that’s the mediaanalysisd service, with a total method return time, and that’s processed with another signpost (a regular log entry rather than a Signpost):
Signpost Begin: "VisionKit MAD Parse Request"

com.apple.mediaanalysis receives that request
[MADServicePublic] Received on-demand image processing request (CVPixelBuffer) with MADRequestID
then runs that
Running task VCPMADServiceImageProcessingTask

This is run at a high Quality of Service of 25, termed userInitiated, for tasks the user needs to complete to be able to use an app, and is scheduled to run in the foreground. Next Espresso creates a plan for a neural network to perform segmentation analysis, and the Apple Neural Engine, ANE, is prepared to load and run that model. There’s then a long series of log entries posted for the ANE detailing its preparations. As this proceeds, segmentation may be adjusted and the model run repeatedly. This can involve CoreML, TextRecognition, Espresso and the ANE, which can appear in long series of log entries.

Text recognition

With segmentation analysis looking promising for the successful recognition of text in the image, LanguageModeling prepares its model by loading linguistic data, marked by com.apple.LanguageModeling reporting
Creating CompositeLanguageModel ([private]) for locale(s) ([private]): [private]
NgramModel: Loaded language model: [private]

and the appearance of com.apple.Lexicon. An n-gram is an ordered sequence of symbols, that could range from letters to whole words, and the lexicon depends on the language locales. In my case, two locales are used, en (generic English) and en_US (US English).

At this point, mediaanalysisd declares the VCPMADVIDocumentRecognitionTask is complete, and runs a VCPMADVIVisualSearchGatingTask, involving com.apple.triald, TRIClient, PegasusKit and Espresso again. Another neural network is loaded into the ANE, and is run until the VCPMADVIVisualSearchGatingTask is complete and text returned.

The next task is for the translationd service to perform any translations required. If that’s not needed, VisionKit reports
Translation Check completed with result: NO, [private]
These may be repeated with other image segments until all probable text has been discovered and recognised. At that stage, recognised text is fully accessible to the user.

Object recognition

Further image analysis is then undertaken on segments of interest, to support Visual Look Up. Successful completion of that phase is signalled in Preview by the addition of two small stars at the upper left of its ⓘ Info tool. That indicates objects of interest can be identified by clicking on that tool, and isn’t offered when only Live Text has been successful. VisionKit terms those small buttons Visual Search Hints, and remains paused until the user clicks on one.

Visual Search Hints

Clicking on a Visual Search Hint then engages the LookupViewService, and changes the state from Configured to Searching. VisionKit records another
Signpost Begin: "VisionKit MAD VisualSearch Request"
and submits a request to MAD for image processing to be performed. If necessary, the kernel then brings all P cores online in preparation, and the ANE is put to work with a new model.

PegasusKit then makes the first off-device connection for assistance in visual search:
Querying https: // api-glb-aeus2a.smoot.apple.com/apple.parsec.visualsearch.v2.VisualSearch/VisualSearch with request (requestId: [UUID]) : (headers: ["grpc-message-type": "apple.parsec.visualsearch.v2.VisualSearchRequest", "Content-Type": "application/grpc+proto", "grpc-encoding": "gzip", "grpc-accept-encoding": "gzip", "X-Apple-RequestId": "[UUID]", "grpc-timeout": "10S", "User-Agent": "PegasusKit/1 (Mac16,11; macOS 15.6 24G84) visualintelligence/1"]) [private]

When the visual search task completes, information is displayed about the object of interest in a floating window. Visual Look Up is then complete, and in the absence of any further demands, the ANE may be shut down to conserve energy, and any inactive CPU cluster likewise:
ANE0: power_off_hardware: Powering off... done
PE_cpu_power_disable>turning off power to cluster 2

Key points

  • Image analysis starts shortly after the image is loaded.
  • Central components are VisionKit and mediaanalysisd, MAD.
  • In Apple silicon Macs, extensive use is made of the Apple Neural Engine throughout, for neural network modelling.
  • Most if not all is run at high QoS of 25 and in the foreground, for performance.
  • Segmentation analysis identifies areas that might contain recoverable text.
  • Segments are then analysed, using language modelling for appropriate locales and languages, and lexicons, to return words rather than fragmented characters.
  • When Live Text is ready, segments are then analysed for recognisable objects. When that’s complete, each is marked by a Visual Search Hint.
  • Clicking on a Visual Search Hint initiates a network connection to provide information about that object, displayed in a floating window.

Paintings of Dante’s Inferno: 3 In Limbo

By: hoakley
11 August 2025 at 19:30

Dante lost consciousness just before he was expecting to be ferried across the River Acheron in Charon’s boat, from Hell’s Gate to its First Circle.

botticellimaphell
Sandro Botticelli (1445–1510), Map of Hell (1480-90), silverpoint, ink and distemper, 33 x 47.5 cm, Biblioteca Apostólica Vaticana, Vatican City. Wikimedia Commons.

Botticelli’s Map of Hell from 1480-90 shows these stages of their descent at the very top: highest are the woods through which Dante was wandering when he encountered the three wild beasts. At the left, Virgil led Dante down to the area in which the cowards are trapped, neither being allowed admittance to Heaven, nor to Hell. Charon’s boat then crosses the River Acheron, shown in blue, taking Dante and his guide Virgil to the First Circle of Limbo.

Dante is woken by thunder, and realises that he’s on the edge of the abyss that is Hell. Virgil leads him down into darkness, where there is no grief or pain, and explains that the multitude there never sinned at all, but none was baptised in faith as they had lived before the Christian era. This is where Virgil’s ghost now inhabits, for despite his merit and attainments, he never revered the Christian God.

dorevirtuouspagans
Gustave Doré (1832–1883), The Virtuous Pagans (1857), engraving, dimensions not known, location not known. Wikimedia Commons.

Dante asks whether any of those in Limbo, as this circle is known, have ever been blessed and been able to leave. This allows Virgil to explain the Harrowing of Hell by Christ after his crucifixion. This occurred not long after Virgil’s death: following his crucifixion, Jesus Christ descended into Hell, where he reached the First Circle, blessed and liberated from it the many Old Testament figures who had been faithful to the God of the Jews, also known as Anastasis.

The descent of Christ into Limbo and his Harrowing of Hell was a popular theme in religious painting until the end of the Renaissance, and would have been familiar to Dante’s readers. Here is a small selection of some of the finest paintings of this, from 1530 to 1600.

beccafumichristlimbo
Domenico di Pace Beccafumi (1486–1551), The Descent of Christ into Limbo (1530-35), media not known, 398 x 253 cm, Pinacoteca Nazionale di Siena, Siena, Italy. Wikimedia Commons.
tintorettodescentintolimbo
Jacopo Tintoretto (c 1518-1594), The Descent into Limbo (E&I 144) (1568), oil on canvas, 342 x 373 cm, San Cassiano, Venice, Italy. Wikimedia Commons.
brueghelchristlimbo
Jan Brueghel the Elder (1568–1625) and Hans Rottenhammer (1564–1625), Christ’s Descent into Limbo (1597), oil on copper, 26.5 x 35.5 cm, Koninklijk Kabinet van Schilderijen Mauritshuis, The Hague, The Netherlands. Wikimedia Commons.
cespedeslimbo
Pablo de Céspedes (1538–1608), Christ’s Descent into Limbo (c 1600), oil on panel, dimensions not known, Indianapolis Museum of Art, Indianapolis, IN. Wikimedia Commons.

Virgil then introduces the great classical writers: Homer, Horace the satirist, Ovid and Lucan. Together with Virgil, these five invite Dante to join them as the sixth among the ranks of great writers, in an ambitious piece of self-promotion.

blakehomerlimbo
William Blake (1757–1827), Homer and the Ancient Poets in the First Circle of Hell (Limbo) (Dante’s Inferno) (1824-27), pen and ink and watercolour over pencil, dimensions and location not known. Wikimedia Commons.
dorehomerlimbo
Gustave Doré (1832–1883), Homer, the Classic Poets (c 1857), engraving, dimensions not known, location not known. Image by Karl Hahn, via Wikimedia Commons.

The group walk on to the Dome of Light, and further to a castle surrounded by seven curtain walls and a moat. When they enter that they see many ancient heroes, including Electra, Hector, Aeneas, and other figures from classical history and legend. Next Dante notices a group of philosophers, including Socrates, Plato and others. Finally, he sees other learned figures from the past, including Euclid, Ptolemy and Hippocrates.

Here Dante and Virgil bid farewell to the spirits of those great figures as they move onward to the next circle.

The artists

Domenico di Pace Beccafumi (1486–1551) was one of the last of the Sienese School of Painting, which contrasted with the better-known Renaissance painting of Florence. He has been aptly summarised as “a mediaeval believer of miracles awaking in Renaissance reality.”

William Blake (1757–1827) was a British visionary painter and illustrator whose last and incomplete work was an illustrated edition of the Divine Comedy for the painter John Linnell. Most of his works shown in this series were created for that, although he did draw and paint scenes during his earlier career. I have a major series on his work here.

Sandro Botticelli (1445–1510) was one of the leading painters of the early Southern Renaissance, working in his native city of Florence. In addition to his huge egg tempera masterpieces of Primavera (c 1482) and The Birth of Venus (c 1485), he was a lifelong fan of Dante’s writings. He produced drawings that were engraved for the first printed edition of the Divine Comedy in 1481, but those weren’t successful, most copies only having two or three of the 19 that were engraved. He later began a manuscript illustrated edition on parchment, but few pages were ever fully illuminated.

Jan Brueghel the Elder (1568–1625) was the son of Pieter Brueghel the Elder, who specialised in floral still lifes. The painting shown above was made in collaboration with the figure painter Hans Rottenhammer, a relationship that lasted between 1595-1610. At the time of this painting, Brueghel had returned to Antwerp, and Rottenhammer was in Venice.

Pablo de Céspedes (1538–1608) was a Spanish polymath from Córdoba, who was an accomplished painter, poet and architect who worked for twenty years in Italy, largely because he fell foul of the Inquisition of Valladolid in Spain. He was also a linguist and theologian.

Gustave Doré (1832–1883) was the leading French illustrator of the nineteenth century, whose paintings are still relatively unknown. Early in his career, he produced a complete set of seventy illustrations for translations of the Inferno, that were first published in 1857 and continue to be used. These were followed in 1867 by more illustrations for Purgatorio and Paradiso. This article looks at his paintings.

Hans Rottenhammer (1564–1625) was a German figure painter who worked in Italy from 1593-1606. Later during that period, when he was in Venice, he collaborated with Jan Brueghel the Elder on the work shown above. He was probably responsible for the early training of Adam Elsheimer, and for introducing him to the technique of painting on a small scale using oil on copper plate.

Jacopo Tintoretto (c 1518-1594) was one of the three grand masters working in Venice in the middle and late sixteenth century, alongside the more senior figure of Titian, and Paolo Veronese. Primarily a religious painter, I have looked in detail at his major works and biography. His painting shown above was made to accompany his Crucifixion for the church of San Cassiano in Venice.

References

Wikipedia
Danteworlds

Robin Kirkpatrick (trans) (2012) Dante, The Divine Comedy, Inferno, Purgatorio, Paradiso, Penguin Classics. ISBN 978 0 141 19749 4.
Richard Lansing (ed) (2000) The Dante Encyclopedia, Routledge. ISBN 978 0 415 87611 7.
Guy P Raffa (2009) The Complete Danteworlds, A Reader’s Guide to the Divine Comedy, Chicago UP. ISBN 978 0 2267 0270 4.
Prue Shaw (2014) Reading Dante, From Here to Eternity, Liveright. ISBN 978 1 63149 006 4.

Solutions to Saturday Mac riddles 320

By: hoakley
11 August 2025 at 16:00

I hope that you enjoyed Saturday’s Mac Riddles, episode 320. Here are my solutions to them.

1: What ET wants is a call coming to the Mac.

Click for a solution

Phone

What ET wants (to phone home) is a call (a phone call) coming to the Mac (macOS Tahoe is bringing the Phone app).

2: A glass to enlarge among the liquid.

Click for a solution

Magnifier

A glass (a magnifying glass) to enlarge (what it does) among the liquid (Tahoe’s Liquid Glass interface feature).

3: Daybook you might already have started elsewhere.

Click for a solution

Journal

Daybook (a journal) you might already have started elsewhere (it was released in iOS 17.2, and is coming to macOS in Tahoe).

The common factor

Click for a solution

They are all new apps coming to macOS 26 Tahoe.

I look forward to your putting alternative cases.

Inside XProtect Remediator, and how it could save us from disaster

By: hoakley
11 August 2025 at 14:30

Six years ago, in July 2019, Macs came closer to disaster than at any time before or since. Millions of Mac users around the world had, at some time or other, installed Zoom conferencing software, and in doing so had unknowingly put their Macs at risk. For their convenience, the old Zoom installers of that time also installed a hidden web server that was left running. That was capable of reinstalling the Zoom client, and had been discovered to contain an easily exploitable vulnerability that exposed all those Macs to remote attacks.

The only solution was for Apple to harness its old Malware Removal Tool, MRT, to remove that web server from all Macs before they came under attack. Although MRT had been widely criticised for what others considered to be weakness, on this occasion it proved its value. MRT version 1.45 was released by Apple on 10 July 2019, and averted that potential catastrophe.

Three years later, in the summer of 2022, Apple replaced MRT with its successor, XProtect Remediator or XPR, which has been vastly improved, and still contains the remnants of MRT in its MRTv3 scanning module. As Apple documents almost nothing about XPR, it has been up to others to dive deep inside it, among them Koh M Nakagawa, @tsunek0h, of FFRI Security. While others have merely scratched the surface, he has just presented a superb and deep account of XPR at Black Hat USA. You can download the slides for his presentation from here.

Status_code 30 PlugInCanceled

If you check XPR scans using SilentKnight or XProCheck, you’ll be aware that for many months some of them are terminated prematurely with a status_code of 30 and the message PlugInCanceled. This most commonly affects Adload scans, and still occurs in beta-releases of macOS 26 Tahoe. According to Koh’s research, the Adload scanning module alone contains over 1,000 Yara detection rules, accounting for the long time it takes whenever XPR runs a set of scans.

Before XPR started terminating its scans as it does now, a full set could take an hour or more, so XPR has started using a timer. If the scan exceeds the time allowed, then it will be abruptly terminated, resulting in this status_code and message. There’s nothing the user can do to avoid it, and we’re surprised that XPR continues to exhibit this behaviour.

Laptop Macs

The other significant limitation in XPR affects those using MacBook Pro, MacBook Air and MacBook models. Because XPR scans take a substantial amount of energy, even when run almost entirely on the E cores of Apple silicon Macs, daily full scans will only be run when those laptops are using mains power, and won’t be run at all on battery.

As XPR scans are also normally run when a Mac is awake but only under a light load, it’s possible for a laptop to go several days without running an XPR scan. The only solution is to leave it connected to mains power, awake and doing little else for an hour or so, when it should seize the opportunity to catch up with that and other important background tasks with similar requirements.

Unfortunately, XPR won’t warn you that it hasn’t run any scans for several days, but SilentKnight and XProCheck will.

Painting the summer storm 2

By: hoakley
10 August 2025 at 19:30

In the first of these two articles showing masterly landscape paintings of summer storms, I had reached John Constable in the early 1830s.

troyonapproachingstorm
Constant Troyon (1810–1865), The Approaching Storm (1849), oil on canvas on board, 116.2 x 157.5 cm, The National Gallery of Art, Washington, DC. Wikimedia Commons.

Of Constant Troyon’s early paintings the most outstanding must be The Approaching Storm from 1849. Set on a river worthy of Constable, two anglers appear to be readying themselves for the torrential rain heading towards them, while others still wander in the last patch of sunshine on the far bank.

noeldieppe
Jules Noel (1815-1881), Panorama of the Town of Dieppe (c 1865), further details not known. Image by Philippe Alès, via Wikimedia Commons.

Jules Noel’s Panorama of the Town of Dieppe (c 1865) shows a large picnic party on the cliffs overlooking the town of Dieppe on the coast of northern France. These families seem blissfully unaware of the dark clouds and heavy rain already over the land to the right.

Albert Bierstadt, A Storm in the Rocky Mountains, Mt. Rosalie (1866), oil on canvas, 210.8 x 361.3 cm, Brooklyn Museum, New York, NY. Wikimedia Commons.
Albert Bierstadt (1830-1902), A Storm in the Rocky Mountains, Mt. Rosalie (1866), oil on canvas, 210.8 x 361.3 cm, Brooklyn Museum, New York, NY. Wikimedia Commons.

One of the finest and most dramatic of Albert Bierstadt’s paintings from his second expedition to the West in 1863 is this of A Storm in the Rocky Mountains, Mt. Rosalie from 1866. Its foreground shows a pastoral valley floor with a native American camp, in mottled light. Some people and their animals are seen making haste to return from the pastures to the shelter of the camp. A small rocky outcrop has trees straggling over it, which are silhouetted against the brilliant sunlight on the lake behind, in the middle distance.

Behind the lake the land rises sharply, with rock crags also bright in the sunshine. In the background the land is blanketed by indigo and black storm-clouds. Those are piled high, obscuring much of Mount Rosalie, but its ice-clad peaks show proud, high up above the storm, with patches of blue sky above and beyond them. A single large bird, an eagle perhaps, is seen in silhouette, high above the lake.

orlovskyharvest
Volodymyr Orlovsky (1842–1914), Harvest (1882), oil on canvas, 62 x 100 cm, National Art Museum of Ukraine Національний художній музей України, Kyiv, Ukraine. Wikimedia Commons.

It was Volodymyr Orlovsky’s painting of Harvest on the steppe in Ukraine, in 1882, that apparently earned the artist’s promotion to Professor in the Imperial Academy.

homerhurricanebahamas
Winslow Homer (1836–1910), Hurricane, Bahamas (1898), watercolor and graphite on wove paper, 36.7 × 53.5 cm, The Metropolitan Museum of Art, New York, NY. Wikimedia Commons.

Few artists ever get to witness tropical storms, but after his time painting winter storms at Cullercoats in England, Winslow Homer witnessed and painted this Hurricane, Bahamas in 1898.

klimtapproachingthunderstorm
Gustav Klimt (1862–1918), Approaching Thunderstorm (The Large Poplar II) (1903), oil on canvas, 100.8 x 100.7 cm, Leopold Museum (Die Sammlung Leopold), Vienna, Austria. Wikimedia Commons.

In 1903, Gustav Klimt spent his summer holiday at Attersee with his partner’s family, where he painted this landscape of an Approaching Thunderstorm. Many of his other landscape paintings made during his summers away show no sky at all, but this is an exception.

bonnardthunderstormvernouillet
Pierre Bonnard (1867-1947), Thunderstorm at Vernouillet (1908), oil on canvas, 50.2 x 65.1 cm, Private collection. The Athenaeum.

Thunderstorm at Vernouillet is an atmospheric landscape painted by Pierre Bonnard in 1908, or the following year. Vernouillet is on the southern bank of the river Seine, midway between the centre of Paris and Monet’s property at Giverny.

thomsonthunderhead
Tom Thomson (1877–1917), Thunderhead (1912-13), oil on canvasboard, 17.5 x 25.2 cm, National Gallery of Canada / Musée des beaux-arts du Canada, Ottawa, ON. The Athenaeum.

The young Canadian artist and canoeist Tom Thomson excelled in rapid sketching in oils, with several witnessed accounts of him dashing off a painting in little more than fifteen minutes. As a result he was able to capture many transient effects, such as the passing thunderstorm in Thunderhead from 1912-13.

If you’re fortunate, the storm is soon gone, its humid air blows away, and summer returns.

kuindzhirafterthunderstorm
Arkhyp Kuindzhi (1841-1910), After a Thunderstorm (1879), further details not known. Wikimedia Commons.

Arkhyp Kuindzhi specialised in painting in spectacular light. After a Thunderstorm from 1879 is one of his oil sketches capturing the brilliant colour and light following heavy summer rain on the steppe.

❌
❌