Aeneas has just returned from visiting his father’s spirit in the underworld, with the Sibyl of Cumae as his guide. Ovid then uses two of Ulysses’ men to relate episodes from Homer’s Odyssey in flashback. The first is Achaemenides, who survived an encounter with Polyphemus.

Aeneas sails on from Cumae and lands on the coast at Caieta (Gaeta), midway between Naples and Rome. When they’re ashore, Achaemenides, whom Aeneas had rescued from Sicily, comes across Macareus, another survivor of Ulysses’ crew who had returned from the Trojan War. Their meeting prompts Achaemenides to give a brief account of the encounter between the Cyclops Polyphemus and Ulysses (Odysseus) and his men, a story familiar to the Roman reader from its fuller version in Homer’s Odyssey.

Polyphemus, a savage one-eyed man-eating giant, spent his days tending his flock of sheep. Polyphemus held Ulysses and his crew captive, then devoured several of them, so Ulysses got the Cyclops drunk in order to engineer their escape. Polyphemus asked Ulysses his name, and the latter replied Οὖτις (Outis, Greek for nobody). Once the giant had fallen into a stupor, Ulysses drove a hardened stake into the Cyclops’ one eye, blinding him.

The following morning, Ulysses and his men tied themselves to the undersides of the sheep in Polyphemus’ flock so that he couldn’t feel them escaping. Recognising he had lost his captives, Polyphemus called out for help from the other Cyclops, telling them that ‘Nobody’ had hurt him. The other Cyclops therefore didn’t come to his aid.

Christoffer Wilhelm Eckersberg’s Ulysses Fleeing the Cave of Polyphemus (1812) shows Ulysses about to make his way out of the Cyclops’ cave, as his captor strokes one of his sheep. With Polyphemus’ face turned away from the viewer, it’s difficult to confirm that he has been blinded at this stage, though.

Jacob Jordaens pictures the crew fastening themselves to the underside of the sheep as they prepare to escape, in his Odysseus in the Cave of Polyphemus, probably painted in about 1650. Again, the Cyclops is facing away from the viewer, and it’s hard to be sure that this is taking place after his blinding.

Achaemenides became separated from the main group, who made their way down to the ship and sailed off into the dawn, deriding the blind Polyphemus as they went. Achaemenides was thus able to see Polyphemus fly into a rage, and hurl huge rocks at Ulysses in his ship.

Guido Reni’s account in his Polyphemus from 1639-40 is clearer. The Cyclopean eye socket is now empty, where Ulysses had poked its single eye out. In the distance, the hero and his crew are making their way out to their ships in two smaller boats, in their haste to depart.

Arnold Böcklin’s Odysseus and Polyphemus (1896) shows Ulysses’ crew rowing frantically out to sea, through large waves, as Polyphemus prepares to hurl a huge rock at them from the shore. The detailed realism and tight composition make this one of Böcklin’s most dramatic and active paintings, and a vivid account.

JMW Turner’s magnificent Ulysses Deriding Polyphemus is probably his finest narrative painting, and the product of a long gestation. He seems to have started work on rough sketches for this in a sketchbook thought to date to 1807, and this finished painting was exhibited at the Royal Academy over twenty years later, in 1829.

The massive figure of Polyphemus is wreathed in cloud above the wooded coast towards the upper left, as the rays of the rising sun light the whole scene from Apollo’s chariot.

The entire crew is dressing the masts and rigging, and Ulysses brandishes two large flags, to deride the blinded giant. The orange flag on the mainmast bears the Greek letters Οὖτις (Outis), the name that Ulysses told Polyphemus was his. Below it is another flag showing the wooden horse of Troy, a reference to Virgil’s Aeneid. In front of the bows of the ship are ghostly white Nereids and sea creatures, presumably a reference to Neptune, Polyphemus’ father, whose curse results from this incident.

The Cyclops then strode the slopes of Mount Etna in his rage, cursing Greeks in general and Ulysses in particular. Achaemenides felt certain that Polyphemus would discover him, and that he would suffer the same fate as his colleagues who had been eaten alive. He hid himself and lived on grass and acorns until he spotted Aeneas’ ship, and he became a Greek rescued by a Trojan ship.

One of the most unnerving experiences with a Mac is to discover that it has either restarted and is waiting for you to log in, or has shut itself down completely. This article explains what might have happened, and how you can distinguish between those causes.

Power failure

The commonest single cause for these events is loss of power to the Mac’s internals, which could mean anything from the mains power supply or internal battery through to the Mac’s power supply unit (PSU). Even if your Mac is up and running fine again, and supplied by an uninterruptible power supply (UPS), confirm that there hasn’t been a power glitch. Any good UPS should keep an event log that you can check to see whether there was anything untoward.

Intermittent PSU faults are rarer but can be tricky to diagnose, and hardware diagnostics may fail to pick them up. If you don’t have any evidence that anything went wrong with power supply, put it to the bottom of the list for the moment. However, if you suspect your Mac’s PSU might be defective in any way, don’t use it again until a trained Apple technician has checked it carefully and assured you that it’s safe. Mains power still kills many people, including those who should know better.

Other hardware faults

There’s a long list of other hardware causes, from a defective system management controller (SMC) to faulty memory. If your Mac is getting long in the tooth or has shown other signs suggesting it might have a hardware problem, now is the time to run hardware diagnostics to check. But if it has been working fine, move this lower down in your list, to return to later if other causes aren’t evident.

Kernel panic

macOS is designed to keep its kernel running through thick and thin, even when apps are crashing all around it. Sometimes, though, the most robust of kernels can reach a point of no return, and it should then panic, allowing the Mac to restart (or in some older Macs, shut down) and try again. That’s a better option than everything grinding to a halt in a ‘freeze’, when you have to force the Mac to shut down by pressing and holding the Power button, which may not result in production of a panic log.

Shortly after starting up following a kernel panic, you should be offered the panic log, as I’ve described elsewhere. But what do you do if you think it might have been a panic but don’t see any dialog offering a log? Your next move depends on whether it’s an Apple silicon Mac or an Intel model.

Intel: cause codes

When an Intel Mac starts up (including following a restart) or wakes from sleep, the reason for the previous shutdown (or initiation of a restart) or sleep should be reported in the log as a cause code. In El Capitan and earlier versions of OS X, you can find recent cause codes in the logs using Console: search for shutdown cause, or sleep cause when looking for a wake event instead. From Sierra onwards, you’ll need to check the unified log; in macOS 14.6 and later, that’s simplest using LogUI. Set its Predicate menu to read eventMessage, and enter shutdown cause in the text box to the right. Ensure the time period includes the first few seconds of the boot or reboot, and you should then be presented with an entry similar to:
2025-04-16 19:48:55.630+0100 kernel Previous shutdown cause: 5

Negative cause codes refer to hardware causes originating mainly from the SMC, and positive codes refer to software. A special code of 0 indicates an intermediate, which can occur when there’s sudden loss of power on some systems.

Among the hardware cause codes, the following are notable:

• -3 multiple temperature sensors too high
• -61, -62 unresponsive app resulting in forced shutdown
• -64 kernel panic
• -71 memory too hot
• -74 battery too hot
• -75 MagSafe power adaptor communication problem
• -78 incorrect input current from power adaptor
• -79 incorrect current from battery
• -86, -95 proximity temperature (heatsink etc.) too high
• -100 power supply too hot
• -101 display too hot
• -103 battery voltage too low
• -104 unknown battery fault
• -127 PMU/SMC forced shutdown for another cause

In the software cause codes, there seem to be only two that occur commonly:

• 3 is a ‘dirty’ shutdown resulting from a forced restart or shutdown
• 5 is a ‘clean’ shutdown initiated by the user.

You can find a more detailed list on George Garside’s blog. However, these don’t appear to be given for Apple silicon Macs, and even Intel models don’t seem as reliable at writing them to the log now.

Apple silicon: hunt the panic

Although you can try finding a log entry giving a cause code, I’ve not been successful yet on an Apple silicon Mac, where you have to look for other clues as to whether the cause was a kernel panic. Those include:

• Look for /var/db/com.apple.DumpPanic.panicLogPathBreadcrumb. If that file exists, drag-copy it to your Documents folder and open it with a text or property list editor. It should contain a single dictionary, with a UUID key and a string. If that’s empty, there’s no panic log, otherwise it may give you a further clue.
• Look for the word paniclog in the eventMessage field for log entries in the minute or two after the Mac restarts. If that extract reads failed to map memory for paniclog output - 0x3 then there’s likely to be a panic log somewhere.
• Browse log entries from the subsystem com.apple.DumpPanic in the minute or so after startup. That subsystem handles generation of the panic log, and makes it clear whether there is one.

From bitter experience, I regret to inform you that trying to gain any information about a kernel panic, or its cause, from log entries made before the Mac shut down or restarted are almost certainly doomed. In any case, most of the time you don’t know when the Mac shut down or restarted, so would waste time trying to discover that.

DumpPanic

In an Apple silicon Mac, at least, if there are log entries from com.apple.DumpPanic confirming that a panic log was generated, you’ve struck gold, even if you can’t find the log itself. Make a note of the time that subsystem reports
DumpPanic launched after boot to check for device panic data
then use that as the start time for a log extract set to a subsystem of com.apple.osanalytics.preoslog, and examine those entries. Starting with the entry
preoslog dump begin
you’ll see breadcrumb data from iBoot stages 1 and 2, each introduced with the emoji , and ending with
preoslog dump end

A little further on, com.apple.DumpPanic should give the first line of the panic log, such as
embedded panic string decoded: panic(cpu 0 caller 0xfffffe002513b34c): Kernel data abort. at pc 0xfffffe0025acf058, lr 0x70c77e0025acf40c (saved state: 0xfffffe8dff723310)
Even if you can’t see the full panic log, at least you’ve got its punchline.

Causes to consider

• Loss of mains or battery power.
• PSU fault.
• Other hardware faults.
• Kernel panic, or freeze preventing that.
• Human or animal intervention.

Apple has just released an urgent security update to macOS Sequoia to bring it to version 15.4.1. There are no matching security updates for Sonoma or Ventura.

This is claimed to install more reliably on those M1 and other Macs that struggled or failed to update to 15.4. However, it still terminates early with a kernel panic on some Apple silicon Virtual Machines.

For Apple silicon Macs the download is about 1.8 GB in size, and a mere 840 MB or so for Intel Macs.

This fixes two vulnerabilities in CoreAudio and RPAC that appear to have been exploited already in “an extremely sophisticated attack against targeted individuals on iOS” according to Apple’s security release notes.

macOS 15.4.1 has a build number of 24E263, and Safari is unchanged with a version number of 18.4 (20621.1.15.11.10). There are no changes in iBoot firmware for Apple silicon Macs, nor in firmware for Intel Macs.

Updated 1917 GMT 16 April 2025.

Two hundred years ago, on 16 April 1825, the Swiss artist Henry Fuseli, who had lived and worked in Britain for much of his life, died in Putney Hill, London. (There is a disparity in the date of his death between Wikipedia, which claims it occurred the following day, and the Royal Academy.)

Fuseli became a full academician in the Royal Academy in 1790, and nine years later was appointed its Professor of Painting. He continued to hold office in the Academy until his death.

His liberal fantasy of Titania and Bottom from about 1790 is loosely based on the opening of Act 4 Scene 1 of Shakespeare’s A Midsummer Night’s Dream, with Titania’s words:
Come, sit thee down upon this flowery bed,
While I thy amiable cheeks do coy,
And stick musk-roses in thy sleek smooth head,
And kiss thy fair large ears, my gentle joy.

Titania (left of centre) calls on her fairies to attend to Bottom, who wears the ass’s head to the right of her. Peaseblossom scratches Bottom’s head, with Mustardseed on his hand, and Cobweb kills a bee to bring its honey to him. Fuseli has borrowed liberally from other sources: Titania’s pose is from Leonardo da Vinci’s Leda (c 1506), the elves at the right from a Botticelli illustration for Dante’s Paradiso (c 1469), and the girl with butterfly wings on her head in the left foreground is based on some of Sir Joshua Reynolds’ child portraits.

Fuseli’s version of Falstaff in the Laundry Basket from 1792 makes the hiding of Falstaff in Shakespeare’s Merry Wives of Windsor appear rushed, as one of the armed men looking for Falstaff is already outside.

Another fine example of Fuseli’s dramatic paintings is The Shepherd’s Dream from 1793, telling a story of fairy elves bewitching a peasant, from John Milton’s Paradise Lost (1667). In 1799, Fuseli organised a gallery of paintings of the writings of John Milton, but it proved a commercial failure and closed the following year.

Fuseli continued with Shakespearean scenes in this painting of Titania, Bottom and the Fairies from 1793-94. This shows the queen with her arms around the unfortunate Bottom, while attendant fairies serenade the couple.

His Odysseus in front of Scylla and Charybdis (1794-96) is a vivid depiction of Odysseus passing these twin dangers described in Homer’s Odyssey. He stands on the fo’c’s’le of his ship, holding his shield up in defence as the oarsmen down below him struggle to propel the craft through the Straits of Messina.

Tekemessa and Eurysakes, painted in the period 1800-10, is one of the most obscure classical Greek mythological paintings that I have come across. Tekemessa (or Tecmessa) was a princess, whose father was killed by Telamonian Ajax during the Trojan War, and who was taken captive by Ajax. She was famously beautiful, and had a son by Ajax named Eurysakes (or Eurysaces). Mother and son survived Ajax’s suicide, and later Eurysakes became king of Salamis Island, Ajax’s homeland. Fuseli’s painting shows the mother comforting her son, perhaps after Ajax’s suicide, although its subtitle of Eros reviving Psyche is a different interpretation altogether.

Many of Fuseli’s later paintings were concerned with a world of Satan, devils, and witches, among them his Satan Calling up His Legions from 1802.

In another obscure myth, this time from Ovid’s Metamorphoses, Ino was transformed into a sea goddess known as Leucothea, who appeared in the form of a gannet to Odysseus when he was shipwrecked during the Odyssey. Fuseli’s Shipwreck of Odysseus from 1803 is a highly dramatic account.

Fuseli’s Sleep and Death Carrying away Sarpedon of Lycia from 1803 is one of the most faithful accounts of this myth. Thanatos and his twin Hypnos are carrying away this dead hero, a son of Zeus who fought for the Trojans, according to Homer’s Iliad.

In Shakespeare’s Richard III, the king is visited by the ghosts of those he has had murdered: King Henry VI, Prince Edward, Clarence, Elizabeth’s brother and son, the two young princes in the Tower, Lady Anne, Buckingham, and others. They each curse him and wish victory to his rival Richmond. The King wakes with a start in the morning, realising that he is about to die. This engraving after Fuseli’s painting of The Ghosts Vanish from 1805 shows Richard awakening as the ghosts of his nightmare are dispersing.

His dark and heavily stylised painting of Lady Macbeth Receives the Daggers from 1812 shows Shakespeare’s character leaning forward towards her husband, who is holding the two daggers and looking distraught, moments after he has murdered King Duncan.

Fuseli captured the dynamics of Theseus’ fight with the Minotaur in this spirited mixed-media sketch of Ariadne Watching the Struggle of Theseus with the Minotaur from 1815-20. Theseus appears almost skeletal as he tries to bring his dagger down to administer the fatal blow, and Ariadne looks like a wraith or spirit.

Fairy Mab, painted by Henry Fuseli in 1815-20, shows a character referred to by Mercutio in Shakespeare’s Romeo and Juliet Act 1 Scene 4, who is the “fairies’ midwife”, and attributed the portentous dreams that have been troubling Romeo. Here she’s more probably in the guise of her reinvention in Percy Bysshe Shelley’s (1792–1822) first large poetic work, Queen Mab, published in 1813. The name Mab is apparently pronounced as if it were Mave, to rhyme with save.

As a teacher in the Royal Academy Schools, Fuseli taught Wiliam Etty and Edwin Landseer, but his greatest influence was undoubtedly on the younger William Blake. He was also an influence on Caspar David Friedrich and the German Romantic painters.

On 16 (or 17) April 1825, Henry Fuseli died in Putney Hill, London. He was accorded the honour of being buried in the crypt of Saint Paul’s Cathedral, where the Duke of Wellington, Lord Nelson, and other major figures are interred. He is perhaps the greatest and most prolific narrative painter of the British canon.

References

Wikipedia

Myrone, M (2001) Henry Fuseli, British Artists, Tate Publishing. ISBN 978 1 8543 7357 1.

App extensions or appexes perform a wide range of tasks, from providing support for file systems like ExFAT to generating thumbnails for QuickLook and enabling Spotlight to index the contents of files. Although they’re relatively old, macOS made major changes in their management in Ventura, and they’ve become popular in many third-party apps. Despite that, there’s remarkably little information about how appexes are managed. As a result, when they play up it’s not clear what you should do. This article tries to disperse that cloud of unknowing.

There are four relatively unknown services responsible for managing apps, their extensions and related services:

• LaunchServices, which plays a prominent part in managing app launch, and maintains a large and comprehensive database of information about known apps and their extensions;
• RunningBoard, which manages resources such as memory and GPU access for some apps and their extensions;
• PlugInKit, which manages appexes for QuickLook, Spotlight, and many other services;
• Duet Activity Scheduler (DAS), which dispatches and manages background activities.

At the heart of PlugInKit is its management daemon pkd, in /usr/libexec, which relies on working files and folders buried in a locked directory deep in /var/folders. It maintains its own registry of appexes, to which it adds annotations such as when they were last managed, and whether they have been ‘elected’. You can follow activities in the log using the subsystem com.apple.PlugInKit, and exchanges with com.apple.launchservices and PlugInKit’s client services such as com.apple.quicklook.ThumbnailsAgent, responsible for the generation of QuickLook thumbnails for files.

Discovery

Of the four services, only LaunchServices appears to maintain a database that persists across restarts, although it’s rumoured to be stored over more than one database. RunningBoard maintains a list of running processes, DAS maintains a list of activities that it’s scheduled to dispatch, and PlugInKit keeps a registry of appexes, but each of those appears to be built from scratch during startup.

Shortly after user login, PlugInKit is initialised and starts populating its registry by a process of discovery, apparently deriving its information from the LaunchServices database, where each installed appex is detailed. Among the information stored there for appexes is their PlugInKit dictionary (PKDict) with the NSExtensionPointIdentifier that sets what type of appex it is, and their SDK data, repeating that type information as the NSExtensionPointName.

PlugInKit looks up batches of appexes to register, grouped according to their NSExtensionPointName. The first of these is com.apple.textinputmethod-services, providing text input methods such as Vietnamese and Traditional Chinese. After those come com.apple.FinderSync and com.apple.fileprovider-nonui, and so on through a set sequence until ending with com.apple.widgetkit-extension.

Log entries for this discovery phase are remarkable as, provided appexes haven’t changed in the LaunchServices database, entries by PlugInKit are almost identical during every startup. This stability is particularly helpful over appex UUIDs: so long as the appex remains the same, its UUID and order in discovery will be the same as well.

Coverage and versions

Particularly in recent versions of macOS, LaunchServices appears to cast its net widely, adding apps to its database from almost any accessible source. This results in some of the features it supports listing multiple versions of apps, some of which aren’t installed in traditional Applications folders.

PlugInKit’s coverage appears more focussed, and its rules over which appex to use ensure that old versions are excluded. Although old versions are registered during discovery, PlugInKit normally only offers the most recent version and, if there are multiple copies of that, the last registered by its timestamp in the registry. It’s also more conservative about which appexes it recognises: while LaunchServices will happily add apps that aren’t stored in an Applications folder and have never been opened on that Mac, PlugInKit appears more cautious in those it registers.

This is best illustrated in a VM with the host Applications folder shared. Initially, before that folder has been opened in the VM, apps and appexes inside it aren’t offered in the Finder’s Open With menu, and appexes such as a QuickLook thumbnail previewer can’t be used. When that shared folder has been opened in the Finder, LaunchServices makes its apps available through Open With. But the thumbnail previewer is only registered with PlugInKit when its shared parent app has been run in the VM.

Continuous discovery

In addition to startup discovery, PlugInKit has automatic continuous discovery during normal running. This can be seen best when an app containing an appex is installed and launched. LaunchServices adds the new app and its appex to its database, in what its log entries refer to as seeding. This is reported to PlugInKit, which then performs re-discovery for all appexes with the same NSExtensionPointName, so adding the new appex to its registry. During this, PlugInKit informs the service using that type of appex, triggering deployment of the capabilities of the new appex.

For example, launching a new app containing an appex with the NSExtensionPointName of com.apple.quicklook.thumbnail results in LaunchServices adding that app and its appex to its database, then PlugInKit performs another discovery of all appexes with that NSExtensionPointName. When the new appex is added to its registry, PlugInKit informs com.apple.quicklook.ThumbnailsAgent of the new QuickLook thumbnail previewer, so it can be made available for creating thumbnails almost immediately.

Discovery is readily traced in the log, but even simpler to follow by opening successive windows in AppexIndexer, and following the UUIDs given there.

Removal of an app with an enclosed appex is also quickly reflected in PlugInKit’s registry, and the appex’s service is informed immediately to ensure that no attempt is made to run the deleted extension.

Practical consequences

• Features of appexes are made available by the subsystem they act in.
• PlugInKit informs an appex’s subsystem of its availability during discovery.
• PlugInKit’s discovery relies on updates to the LaunchServices database.
• Damage to or dysfunction of the LaunchServices database can therefore block or impair PlugInKit registration, in turn preventing correct function of the appex.
• Resetting the LaunchServices database will inevitably delay PlugInKit’s discovery, and could lead to malfunction of appexes, such as failure to generate QuickLook thumbnails.
• Controlling appexes is currently only available in System Settings > General > Login Items & Extensions.
• Controlling appexes using the pluginkit command tool is only temporary, and any changes made there will be reverted in subsequent discovery.
• Investigating appex problems by examining com.apple.PlugInKit subsystem entries in the log is clear and straightforward, and individual appexes can readily be traced using their UUID.

Apple has just released an update to XProtect for all supported versions of macOS, bringing it to version 5295. As usual, Apple doesn’t release information about what security issues this update might add or change.

This version adds a single new rule for MACOS.SOMA.BYTE.SEQUENCE.B.

You can check whether this update has been installed by opening System Information via About This Mac, and selecting the Installations item under Software.

A full listing of security data file versions is given by SilentKnight, LockRattler and SystHist for El Capitan to Sequoia available from their product page. If your Mac hasn’t yet installed this update, you can force it using SilentKnight, LockRattler, or at the command line.

If you want to install this as a named update in SilentKnight, its label is XProtectPlistConfigData_10_15-5295.

Sequoia systems only

This update has also been released for Sequoia via iCloud. If you want to check that manually, use the Terminal command
sudo xprotect check
then enter your admin password. If that returns version 5295 but your Mac still reports an older version is installed, you can force the update using
sudo xprotect update

I have updated the reference pages here which are accessed directly from LockRattler 4.2 and later using its Check blog button.

Two hundred years ago, on either 16 or 17 April 1825, the Swiss artist Henry Fuseli died in his adopted country Britain, where he had been one of the leading narrative painters, and an important figure in the Royal Academy. In this article and tomorrow’s sequel, I outline his career with the support of a small selection of his paintings. The uncertainty over the date of his death results from a conflict with Wikipedia, which claims it was a day later than the Royal Academy does.

He was born in 1741 as Johann Heinrich Füssli in Zürich, Switzerland, to a large artistic family. Expecting to train to paint, he was surprised when his father sent him instead to start theological training, with the intention of him becoming a priest. He took up orders in 1761, but fled Switzerland shortly afterwards because of his involvement in exposing an unjust magistrate. He travelled through Germany, and in 1765 arrived in England.

At first, he made a precarious living in England by writing and translating. He seized the chance to show Sir Joshua Reynolds his drawings, and was advised to devote himself to painting. To further this goal, as he had received little formal training at this stage, he went to Italy in 1770, where he studied painting, and changed his last name to Fuseli.

On his return to England in 1779 he found his reputation already building, and was commissioned to paint for Boydell’s new Shakespeare Gallery, a bold scheme to develop an English school of history painting, based largely on income generated from prints.

His Thetis Lamenting the Death of Achilles from 1780 isn’t easy to read. In the foreground, Achilles’ body lies like a fallen statue on his shield, his great spear by his left side. There’s no sign of any wound, arrow, or injury. At the water’s edge, his mother Thetis is waving her arms in lament for her dead son. Another deity is flying past in the distance, and is seen white against the dark and funereal sea and sky.

He painted The Two Murderers of the Duke of Clarence in 1780-82, probably for Boydell’s gallery. It shows a scene from William Shakespeare’s historical play Richard III, where the King has sent this pair to kill Clarence in the Tower of London.

Fuseli became a prolific painter of literary narrative. His Tiresias Appears to Ulysses During the Sacrifice from 1780-85 is perhaps the only painting that shows Odysseus summoning the ghost of the blind seer Tiresias, after he had spent a year with Circe. In Book 11 of Homer’s Odyssey, Odysseus was instructed to consult Tiresias about his means of returning home to Ithaca, and does so using a process known as nekyia, with the sacrifice of a ram and a ewe as shown here.

Fuseli’s transformative year was 1781, when he painted no less than three masterpieces.

Dido has here mounted her funeral pyre, and is on the couch on which she and Aeneas had earlier made love. She then fell on the sword that Aeneas had given her, and that rests, covered with her blood, beside her, its tip pointing up towards her right breast. Her sister Anna rushes in to embrace her during her dying moments, and Jupiter sends Iris (wielding a golden sickle) to release Dido’s spirit from her body. Already smoke seems to be rising from the pyre, confirming to Aeneas that she has killed herself, as he heads towards the horizon, and the eventual founding of Rome.

The Nightmare was exhibited at the Royal Academy in 1782, and remains the work by which Fuseli is best known today. It shows a daemonic incubus squatting on the torso of a young woman, who is laid out as if in a deep sleep in bed, her head thrown back, and her arms above her head. Lurking in the darkness to the left is the head of a black horse, whose eyes appear unseeing. The incubus stares directly at the viewer in a manner that arouses discomfort. Fuseli also painted a second version with a slightly different composition, which is as well-known.

Dream of Queen Katherine, above, is a remarkable fragment of a larger painting intended to show this scene from Shakespeare’s Henry VIII, and was commissioned by Thomas Macklin in 1779 for his Poets’ Gallery. It’s most likely to have been cut down from a copy of a painting similar to The Vision of Catherine of Aragon, below, which was commissioned by Sir Robert Smith and exhibited at the Royal Academy in 1781.

Queen Katherine of Aragon, wife of King Henry VIII of England, is on her deathbed. After her attendant has told her about the death of Cardinal Wolsey, the queen falls asleep and has a remarkable dream, for which Fletcher’s stage directions read:
The vision. Enter, solemnly tripping one after another, six personages, clad in white robes, wearing on their heads garlands of bays, and golden vizards on their faces; branches of bays or palm in their hands. They first congee unto her, then dance; and, at certain changes, the first two hold a spare garland over her head; at which the other four make reverent curtsies; then the two that held the garland deliver the same to the other next two, who observe the same order in their changes, and holding the garland over her head: which done, they deliver the same garland to the last two, who likewise observe the same order: at which, as it were by inspiration, she makes in her sleep signs of rejoicing, and holdeth up her hands to heaven: and so in their dancing vanish, carrying the garland with them. The music continues.

Fuseli’s painting from another play by Shakespeare, King John, Act III, scene 1 (1783), shows the young Arthur with his mother distraught at the compromise for peace, which dropped his claim to the throne.

His painting of Percival Delivering Belisane from the Enchantment of Urma (1783) shows a narrative that the artist had invented for this painting. It appears to be one of a series, although only one other work has been identified as part of that, and that precursor is only known from a print of 1782. He also preceded this series with a single painting of Ezzelin and Meduna (1779), referring to another unique narrative, but doesn’t appear to have any associated works.

Fuseli provides the viewer with a rich array of ‘Gothic’ narrative elements to form their own account of the story. There are visions of faces in the distance on the left, chains leading to an unseen figure apparently manacled into a bed at the right, Percival swinging a sword above his head, to strike the cloaked figure of Urma in the left foreground, and a beautiful young woman (presumably Belisane) embraced by Percival’s left arm, kneeling on the floor.

The Shepherd’s Dream from 1786 is an elaborate drawing made in preparation for the oil painting below. As it shows many of the elements within Fuseli’s composition more clearly than the painting, it is probably more useful for understanding their narrative.

John Milton’s (1608-1674) Paradise Lost held a special appeal for Fuseli since he had been introduced to it when a student. These works show a scene in the poem when the fallen angels in the Hall of Pandemonium (in Hell) are compared to the fairies who bewitch a peasant with their music and dancing:
… fairy elves,
Whose midnight revels by a forest side
Or fountain some belated peasant sees,
Or dreams he sees, while over head the moon
Sits arbitress, and nearer to the earth
Wheels her pale course, they on their mirth and dance
Intent, with jocund music charm his ear;
At once with joy and fear his heart rebounds.

Fuseli transforms the convention of these fairies dancing on the ground, and instead they swirl through the air above the sleeping shepherd. One of the fairies is touching the shepherd with his wand, to keep him asleep. At the lower left, a fairy has pulled a mandrake root, which has transformed into a tiny homunculus, and is now standing. At the far right, sat on the steps, is the small figure of Queen Mabs (or Mab), responsible for bringing nightmares.

The Battle Between Thor and the Snake of Midgard (1788) shows one of Thor’s many exploits: his battle with the monstrous Jörmungandr, a sea serpent born of the giant Angrboða and Loki. This celebrated battle occurred when Thor went fishing with the giant Hymir. Thor baited a strong line with an ox head, which the serpent bit. When Thor pulled it from the water, Hymir shied away, as shown here. When Thor reached for his hammer to kill Jörmungandr, Hymir cut the line, letting the serpent escape, only to face a further battle with Thor at Ragnarök, the end of the world.

I believe this was the painting that Fuseli presented as his diploma work when he was elected a full academician in the Royal Academy in 1790.

His painting of Prince Arthur and the Fairy Queen from about 1788 crosses into Arthurian legend in showing Arthur, son of Uther Pendragon, here the bearer of a magic shield that blinds his enemies and turns them to stone.

Macs should never shut down or restart of their own accord, nor should they ever freeze. If yours does any of those, you should assume it’s the result of a kernel panic, and that’s not something you should ignore. The most important evidence as to what happened in a kernel panic, and clues as to why it happened, comes in the panic log, shown shortly after you’ve logged back into your Mac. Don’t dismiss that dialog until you’ve saved its contents for future reference.

Save the panic log

Panic logs used to be saved in /Library/Logs/DiagnosticReports, from where you could open them in Console, but more recently were found somewhere closer to /var/db/PanicReporter, but now seem to vanish into thin air. You therefore need to copy its contents as soon as it appears and before sending it to Apple.

If the alert isn’t already showing the panic log, click on its Report… button, then open a text editor like TextEdit. Copy the whole contents of the panic log into a new text document and save it somewhere safe before clicking on the button to send the report to Apple. Once you’ve done that, the alert is dismissed and can’t be brought back.

Unlike app crash logs, panic logs are normally brief and to the point. Although they may be non-specific and not help much, in many cases they contain obvious clues as to what caused the panic. Formats have changed over the years, and the current Paniclog version is 14, but the following sections are likely to prove worthwhile examining.

Immediate cause

At the very top, following the first word panic, the log gives summary information and may suggest a cause:
panic(cpu 0 caller 0xfffffe002f4e48bc): cannot find IOAESAccelerator
tells you that the panic occurred on CPU core 0, because a key kernel extension couldn’t be found, a cause that isn’t particularly useful in discovering why the panic occurred.

Other non-specific examples include:
panic(cpu 0 caller 0xffffff80015efa76): Kernel trap at 0xffffff7fa047645c, type 14=page fault, registers:
panic(cpu 4 caller 0xfffffe001b91de94): Kernel data abort. at pc 0xfffffe001c2b2538, lr 0x65a4fe001c2b28ec (saved state: 0xfffffe402ecdb310)

Sometimes you strike lucky at the start:
panic(cpu 1 caller 0xfffffff01731bd68): SEP Panic: :SEPD/MDMA: 0x0000b72d 0x0002791b 0x0000971f 0x00003a91 0x00003bb7 0x00000000 0x00000000 0x00000000 [rnit]
reveals that it was the SEP, Secure Enclave Processor, that panicked. That’s likely to result in a boot-loop panic, where every time the Mac tries to start up, it panics immediately, and continues to cycle through booting and panicking until you or your Mac force it to shut down.

panic(cpu 8 caller 0xffffff80017729eb): "zalloc: zone map exhausted while allocating from zone kalloc.12288, likely due to memory leak in zone kalloc.48 (6586956000 total bytes, 137228148 elements allocated)"@/AppleInternal/BuildRoot/Library/Caches/com.apple.xbs/Sources/xnu/xnu-6153.141.1/osfmk/kern/zalloc.c:3627
is pure gold, as it reveals a probable memory leak as the cause.

Exceptions mentioned here can include page faults, in which something has tried to access an invalid memory address, invalid instruction codes for the processor, and general protection faults which include a wide variety of other bugs. As far as the user is concerned, all exceptions indicate a bug or problem in the code that’s being run.

Further down you should see confirmation that this was a kernel panic, in a line like
Debugger message: panic

OS details

Normally you’ll see a couple of lines reporting the version number of macOS running at the time. For example
OS version: 24C101
Kernel version: Darwin Kernel Version 24.2.0: Fri Dec 6 18:57:59 PST 2024; root:xnu-11215.61.5~2/RELEASE_ARM64_VMAPPLE
You can compare those with the build number of macOS shown in System Information / Software, and in Mints. This is an unusual situation, as RELEASE_ARM64_VMAPPLE means this is from a virtual machine running on an Apple silicon Mac.

Sometimes you might see a line like
OS version: Not set yet
simply indicating that the version hasn’t been recorded yet.

On Apple silicon Macs, you should also see the iBoot version, and the current level of boot security:
iBoot version: iBoot-11881.61.3
secure boot?: YES
The latter is important, as running in Secure Boot means that no third-party kernel extensions have been loaded.

Memory leak

If there has been a memory leak, the panic log may well contain a breakdown of system memory zones giving more detailed clues.
Zone Name Cur Size Free Size
vm objects 78041088 26795008
…
Zone Name Cur Size Free Size
kalloc.32 280834048 3040
kalloc.48 6586956000 4896
kalloc.64 4241453056 5000896
…
Note how the Free Sizes of kalloc.32 and kalloc.48 are very small, and that of kalloc.64 is fairly low too. This is consistent with the kernel running out of memory in one of those zones. Further information may follow:
Backtrace suspected of leaking: (outstanding bytes: 288)

Because there’s the suspicion of memory leakage, the panic log also gives a detailed backtrace of where it suspects that leakage is occurring, and details of the kexts involved in that. Note that those may not coincide with any kexts identified earlier as possible culprits.

Panicked task

It’s worth looking through the log to discover the task that was running at the time of the panic. That might simply be the kernel
Panicked task 0xfffffe166cff1f18: 10735 pages, 374 threads: pid 0: kernel_task
or may give more specific information
BSD process name corresponding to current thread: WindowServer
Boot args: chunklist-security-epoch=0 -chunklist-no-rev2-dev
or
Panicked task 0xfffffe1b55369798: 24964 pages, 8 threads: pid 800: com.apple.Mobile
alternatively
Process name corresponding to current thread: mediaanalysisd

This is the name of the process running its code at the time, and can give another clue as to where the problem lies.

You may also be given a list of kernel extensions that might be involved:
Kernel Extensions in backtrace:
com.apple.filesystems.apfs(1412.141.1)[6DA33D13-4501-3D48-B4D8-0329E6AEC86D]@0xffffff7f84e7d000->0xffffff7f84fa4fff
dependency: com.apple.kec.corecrypto(1.0)[804DD660-F561-3444-A076-05D7A52D65E3]@0xffffff7f82746000
…

Third-party kexts

Whatever the cause, you should next look at the list of unloaded and loaded kexts forming the rest of the panic log. These are listed in the order that they were loaded, with the most recent kext at the top. As third-party kexts are the last to be loaded, the top of the lists start with any third-party kexts installed on that system and loaded at the time of the panic:
last loaded kext at 939128480512562: >!UAudio 323.4 (addr 0xffffff7f86baa000, size 434176)
last unloaded kext at 948795488738566: >usb.IOUSBHostHIDDevice 1.2 (addr 0xffffff7f8556c000, size 45056)
loaded kexts:
>!ATopCaseHIDEventDriver 3430.1
…
In most cases, the name of the kext as you’ll find it in /System/Library/Extensions is the last part of the ID given. For example, the kext with the ID of com.apple.driver.AppleMobileFileIntegrity is named AppleMobileFileIntegrity.kext.

If those lists contain any third-party kexts, they should be immediately suspected as being the cause of that panic, unless another cause is apparent.

Keep your Mac’s panic logs

Although you’ll want to get on with whatever you were going to do when you were so rudely interrupted by that kernel panic, put that record of the panic log somewhere safe. If your Mac does suffer another panic, you can then refer back to it for any common features that might indicate they had the same cause. Panic logs are also invaluable for others who might assist you in discovering what was wrong. I’m very grateful to those who send me their panic logs, and here wish to acknowledge Joe, who kindly sent me my first SEP panic, a real collector’s item.

There’s more information about dealing with kernel panics in the following articles here:
Crashes, panics, freezes and other unexpected events
How to deal with a kernel panic

A century ago today, on 14 April 1925, John Singer Sargent died in London. This last article celebrating his career and art resumes in the final months of the First World War, when Sargent had returned to Britain.

In 1918, John Singer Sargent was commissioned by the War Memorials Committee of the Ministry of Information in Britain to paint a large work showing Anglo-American co-operation in the war. This was originally destined for a Hall of Remembrance, which was never built, but required a very large if not monumental painting. He set off for the Western Front with Henry Tonks, a distinguished British artist and teacher, in July 1918, and they visited units near Arras and Ypres.

According to Tonks’ recollections recorded in a letter two years later, they both witnessed the result of a mustard gas attack during the opening of the Second Battle of the Somme on 21 August 1918 (although records suggest that may have been on 26 August). In the late afternoon, they heard that many casualties were arriving at a Corps dressing station at le Bac-du-Sud, so went there. Lines of gassed casualties were being led in, in parties of about half a dozen with a medical orderly in front. Apparently, Sargent was “struck by the scene and immediately made a lot of notes.”

This change to his commission required the approval of the War Memorials Committee, which he obtained before he started work on the painting in his studio in Fulham, London, in late 1918. I don’t know exactly when Sargent made each of the pencil sketches for his painting, but some may have been made near Arras, while others were clearly based on the professional models who he employed in his studio.

Many, like Study for Gassed Soldiers (1918), show details of different passages for the final painting, and could have been made in Arras or Fulham.

The most interesting, though, are his assemblies of figures, such as this Study for ‘Gassed’ (1918). This particular group was turned into the more distant line of casualties, at the right of the finished work.

These Two Studies for “Gassed” (1918) in the Fogg Museum are more compositional in purpose, and show the shape of the final painting starting to form. Note, though, that the nearer line of casualties consists of only six (or seven) figures. In the finished painting, this becomes eleven, and forms most of the width of his panoramic canvas.

There are several fascinating details in the finished painting, including the game of soccer taking place in the distance, seen in the detail above. Sargent probably added that as a reference to the activities of normal life, contrasting with the horror that is taking place throughout the rest of the painting.

Most remarkably, there’s only one pair of eyes visible in all the soldiers present, in the medical orderly near the head of the second line at the right. He even turned the orderly who is tending to the nearer line of casualties so that he faces away from the viewer. This emphasises the blinding effects of the mustard gas, and develops the painting’s theme of vision and art.

Inevitably, Sargent faced increasing criticism of his outdated style and refusal to embrace the new styles of Cubism or Futurism. After the war he spent more time in the USA working on his series of murals in the Boston area.

This large masterpiece Orestes Pursued by the Furies was started in 1922, and completed in 1925, just prior to his death. Over the 100 square feet of its canvas, it shows a young and naked Orestes cowering under the attacks of the Furies as he tries to run from them. The swarm of no less than a dozen fearsome Furies have daemonic mask-like faces, blond hair swept back, and hold out burning brands and fistfuls of small snakes.

Sargent has gilded the flames on the brands to make them shine proud like fire. The isolated woman who stands in Orestes’ way is no Fury, though: she wears a gilded crown, and with the clean incision of a stab wound above her left breast can only be his mother Clytemnestra. There’s a profusion of arms, eight of them clutching snakes and thrust in Orestes’ direction.

This vast canvas of The Danaïdes (c 1922-25) decorates the entrance to the Library of the Museum of Fine Arts in Boston.

Atlas and the Hesperides, painted over a similar period, shows the giant still carrying the heavens on his shoulders, as seven naked Hesperides sleep on the ground around him.

In 1922, Sargent co-founded Grand Central Art Galleries and its associated academy the Grand Central School of Art, in New York City. The former held a major exhibition of his work in 1924, following which he returned to London, where he died on 14 March 1925.

By this time, the avant garde had moved on, and Sargent’s art was becoming increasingly reviled. At the 1926 London retrospective exhibition to commemorate his death, critics led by Roger Fry dismissed him as not even being an artist. It wasn’t until the latter half of the twentieth century that his art was recognised again, and his paintings are still in the throes of that revival.

Previous articles in this series

1 Pupil
2 London
3 Venice
4 Travels
5 War

References

Wikipedia
Murals at Boston Public Library
Carnation, Lily, Lily, Rose on Wikipedia

The nine volumes of his catalogue raisonné are probably the finest and largest of any catalogue raisonné to date. Volumes particularly recommended are:
Ormond R and Kilmurrary E (2012) John Singer Sargent. Figures and Landscapes, 1900-1907. Complete Paintings, volume VII, Yale UP. ISBN 978 0 300 17736 0.
Ormond R and Kilmurrary E (2014) John Singer Sargent. Figures and Landscapes, 1908-1913. Complete Paintings, volume VIII, Yale UP. ISBN 978 0 300 17736 7.

Redford, B (2016) John Singer Sargent and the Art of Allusion, Yale UP, ISBN 978 0 300 21930 2.

There are several large format and excellently illustrated selections of his oil paintings available. However his watercolours are best covered by:
Little C (1998) The Watercolors of John Singer Sargent, University of California Press. ISBN 978 0 520 21970 0.
Hirshler EE and Carbone TA (2012) John Singer Sargent Watercolors, Museum of Fine Arts Boston and Brooklyn Museum. ISBN 978 0 8784 6791 4.
Erica E Hirschler and Teresa A Carbone (2012) John Singer Sargent, Watercolors, MFA Boston and Brooklyn Museum. ISBN 978 0 8784 6791 4.

I hope that you enjoyed Saturday’s Mac Riddles, episode 303. Here are my solutions to them.

1: Harvard or Yale cipher brought emoji and Ugaritic.

2: US standard for 128 Roman characters now over 60.

3: Two plus 128 more came in 1989, gained a euro in 1998, and still supported.

The common factor

I look forward to your putting alternative cases.

I’m very grateful to all of you who looked at my little AppexIndexer, and particularly to those who commented and made suggestions. I’m delighted to come back with version 1.0 build 8, which I hope gets closer to what you’ll enjoy using. Its changes include:

• Adding support for appex UUIDs. Although the log tends to censor most clues about which appex an entry is referring to, it’s more likely to give its UUID, and armed with AppexIndexer you can use that to identify the appex in question.
• Providing a range of four sort orders. These are the SDK or type, the name of its parent app, the UUID, and the appex’s display name. Once you have loaded up the list of appexes, you can switch instantly between these sort orders.
• ‘Live’ search for UUIDs, explained below.

Tools at the top of each window include the UUID search box at the top right, four radio buttons at the left to switch between sort orders, and checkboxes for the two content options of showing appex and parent paths, and UUIDs. Start by clicking on the Get Appexes button to populate the window, then you can set it up how you want.

To help distinguish the name of parent apps, there’s a ‘parent’ emoji preceding each. You’ll also notice that SDKs shown now omit the standard com.apple. opening, as that is universal.

As before, AppexIndexer supports mixtures of continuous and discontinuous selection. Copy those you want, and they’ll paste as text containing all the available fields, not just those being displayed at the time.

Search was quite a challenge, and my solution is inspired by that explained by Tiago Gomes Pereira in his Create with Swift blog.

SwiftUI Search on Lists and similar is nothing like macOS Find, and is better-suited to displaying those entries that match in a single field rather than in all their text content. With its new sort options, AppexIndexer should be quick and simple to locate appexes by all criteria except UUID. Rather than requiring the user to paste in the UUID they want to find, this ‘live’ search should produce perfect matches when you’ve only typed in a few characters from the target UUID. Those don’t have to be characters from the start, but can be any from within the UUID. For example, to find the appex with a UUID of E1366424-89DD-4CEB-85D8-C8E00928313F, you could start typing in e1366, or c8e00, etc., as you wish. You don’t need to use capitals either.

Typing the first couple of characters should narrow the list down quickly, and by the third or fourth you should have a perfect match. If you want to return to the full list of appexes, select that appex entry and empty the search box by clicking on the X button at its right and just that single entry will be selected in the full list.

If you type in an incorrect character, you’ll be informed that no results could be found.

AppexIndexer 1.0 build 8 is now available from here: appexindexer108
I’m afraid that it still requires Sonoma 14.6 or later, but hope that you find it efficient in use and a good tool for exploring appexes.

Enjoy!

During the second decade of the twentieth century, John Singer Sargent continued his travels through Europe and in the USA. He painted some notable portraits of Americans, and progressed series of large murals in the Boston area of Massachusetts.

His larger oil paintings from this period often show finer details, that were almost certainly developed later in the studio. But even in those he retained a distinct painterliness, as shown in this view of workers Bringing Down Marble from the Quarries in Carrara which Sargent painted in 1911. These marble quarries in the north of Tuscany, Italy, provided most of the fine white and blue-grey marble for classical Roman buildings and statuary, and that for Michelangelo’s famous statue of David in 1501-04.

One of Sargent’s frequent companions during these travels was his sister, Emily, who was also a keen artist. In the Generalife (1912) shows her sketching in the gardens of the Generalife in Granada, Spain. She’s using a low metal easel with telescopic legs, and kneels sideways to work at it. Behind her is his friend Jane de Glehn, and to the right is a Spanish friend known only as Dolores. The unusual highlight effect seen in bushes above them, and on parts of the ground, was produced by scribbling with a colourless beeswax crayon, which resists the watercolour paint.

His oil painting of this Hospital at Granada from the same year shows the sick scattered haphazardly outside the wards and clinics, apparently awaiting medical attention.

The following year, Sargent visited Italy’s largest lake, at the southern edge of the Italian Alps, where he painted this tiny harbour of San Vigilio, Lake Garda, with its intricate broken reflections and underwater details.

In the summer of 1914, Sargent was back in the cooler mountain air of the Alpine passes, this time in the company of the British artist Adrian Stokes (1854–1935) and his equally talented Austrian wife Marianne (1855-1927).

The Master and His Pupils (1914) shows Adrian Stokes and Sargent’s sister Emily engaged in a painting lesson in the Alps.

The Sketchers (1914) shows another artistic couple, probably the de Glehns or the Stokes, painting en plein air.

Sargent travelled through much of the summer of that year, and by July had reached Austria in the company of Adrian and Marianne Stokes. When the First World War broke out at the end of that month, they found themselves in a country that was suddenly at war with Britain. The Austrian authorities forbade them from leaving the country, but by the middle of December they had managed to reach Switzerland, from where they were able to return home safely.

Sargent spent the latter part of the First World War in the USA, where he painted this magnificent watercolour of Muddy Alligators (1917) when staying on the Miami estate of James Deering, whose wealth came from farm machinery.

When he returned to Britain in 1918, Sargent was commissioned as a British War Artist. One of the most famous paintings of aviation during that war is his Crashed Aeroplane (1918). While two farmers get on with their harvest, there’s a crashed British biplane planted in the hillside behind.

Sargent went on to paint scenes in military medical facilities, including this watercolour of the Interior of a Hospital Tent in 1918. Although makeshift and temporary, this appears more orderly and modern than that hospital in Granada.

Apps are getting ever more flexible, and in doing so they’re also becoming increasingly complex. Gone are the days when they mostly opened files, did things to them, and saved them again. We now expect to be able to use our favourite image editor from inside the Photos app, and to share documents between multiple apps, using features as services in reusable components.

For those of us who used OpenDoc back in the 1990s this is all familiar territory. Intended as Apple’s response to Microsoft’s OLE (Object Linking and Embedding), OpenDoc broke apps down to single-task components that worked together. This was best exemplified in the suite of Internet tools provided collectively as Cyberdog for a brief period in 1996-97. Those included a web browser, FTP and email clients, and a newsreader, that could be embedded in other apps that supported OpenDoc’s Bento format.

When Steve Jobs killed OpenDoc in 1997, few could have envisaged what was to come later in app extensions, or appexes, nor how extensively they have become used by macOS. From speech synthesisers and Blu-ray encoders to wallpapers and widgets, appexes have proliferated far beyond the wildest dreams of the OpenDoc designers, but so little is known about they’re managed by macOS.

macOS Sequoia keeps extensive registries of apps and appexes. The most detailed is the grand database maintained by LaunchServices, only visible through its hidden lsregister command tool. Appexes are the preserve of the PlugInKit registry, which can be dumped using the pluginkit tool. Resource management is performed by RunningBoard and appears inaccessible, as do the activity schedules managed by Duet Activity Scheduler (DAS).

All four registries appear to be constructed afresh during startup, in the case of LaunchServices and PlugInKit by a process of discovery, something I’ll be looking at in more detail in the near future. For PlugInKit, it’s discovery that determines which appex services are offered, whether they’re generators of QuickLook thumbnails or previews, Safari extensions, or file systems such as ExFAT or MS-DOS. The latter are refugees from their former existence as kernel extensions, a route now being followed by macFuse 5.0.

Although the user has limited control over those in System Settings and, in the case of Safari extensions, in Safari’s settings, the PlugInKit registry is designed to operate automatically. If the user does try making changes using pluginkit those are likely to be undone when the registry is next updated, and in any case following reboot.

There are some differences obvious between LaunchServices’ database and PlugInKit’s registry. While LaunchServices comfortably accommodates as many versions of apps that it can find, and offers them as choices for opening documents in the Finder’s contextual menu, PlugInKit makes the user’s life simpler by only offering the latest version of each appex. Given that appexes now include replacements for QuickLook’s qlgenerators, and Spotlight importers, that’s hardly surprising, and the prospect of being offered multiple versions in the Share menu would be overwhelming for any user.

PlugInKit and appexes aren’t recent, and probably date back to OS X 10.9 Mavericks, with their NSExtension property list definitions appearing a year later in Yosemite. In macOS 13 Ventura, Apple augmented that with ExtensionKit and ExtensionFoundations both for creating extensions and the extension points offered by host apps. Appexes now cover many different domains, and have become increasingly popular in third-party products, with some like Eternal Storms’ Yoink relying on them for their tight integration with macOS.

Improving our understanding of appexes and their management by PlugInKit isn’t an academic exercise. Host apps and their extensions don’t always work in perfect harmony. Whether you’re developing either of them, or just trying to cope with their disagreements, insight can be important. Now that Sequoia requires QuickLook thumbnail and preview generation to occur in appexes rather than qlgenerators, the qlmanage command tool is of limited value, and you have to rely on PlugInKit instead.

Once upon a time, Apple used to provide extensive and well-written conceptual documentation, where it explained how Mac OS worked, so that when we came to tackle problems we could fall back on understanding. Now we’re largely left to fend for ourselves, so armed with a forthcoming new version of AppexIndexer, I’m off to discover PlugInKit discovery.

Few nineteenth century novels were featured in as many paintings and prints as Victor Hugo’s story of Quasimodo and Esmeralda, told in his Notre Dame de Paris, most popularly known as the Hunchback of Notre Dame.

Hugo’s book has a curious origin. In the 1820s, the great cathedral of Notre Dame in Paris, probably the city’s most visible and distinctive building, underwent restoration to repair the damage that had occurred during the Revolution. One of the foremen of the stonemasons working on the building was a ‘hunchback’ with a spinal deformity. Hugo became greatly interested in the cathedral’s Gothic architecture, and was keen to raise awareness of its importance and beauty. In 1829, he started work on this novel.

After an intense final few months of writing, Notre Dame de Paris was published in early 1831. It became enormously popular, and has been the basis for over a dozen movies since 1905, TV series, plays, operas and musicals, and ballets. As a result, its hunchback hero Quasimodo has developed a life of his own in modern legend.

Set in Paris in 1482, its central characters are Quasimodo, the bell-ringer of the cathedral who not only has a spinal deformity, but is nearly blind and largely inarticulate, and Esmeralda, a beautiful young dancer, thought (incorrectly, it turns out) to be a gypsy, who is the object of much male lust, and has a pet goat Djali who performs tricks.

Quasimodo’s guardian, the Archdeacon Frollo, lusts after Esmeralda and orders the bell-ringer to kidnap her for him. Quasimodo’s attempt fails, and the following day he is punished by a flogging and being put in the pillory. While there, he is badly dehydrated and calls for water, provided by Esmeralda. She’s later arrested and falsely charged of attempted murder, for which she is sentenced to death by hanging.

As Esmeralda is being led to the gallows, Quasimodo swings down on a bell-rope and carries her off to sanctuary inside the cathedral. However, the court of parliament then decides to remove her right of sanctuary, making her liable to arrest. Local gypsies rally to this, and charge the cathedral to rescue her.

When Quasimodo sees the gypsies, he assumes that they want to hurt Esmeralda, so drives them away; when the king’s men arrive, he misunderstands their purpose, and tries to help them. Esmeralda is then ‘rescued’ by the Archdeacon, who tries to seduce her, then to betray her when she rejects him.

Esmeralda is finally taken to the gallows, where the Archdeacon laughs as she is killed. Quasimodo gets his revenge by pushing the Archdeacon from the height of the cathedral, then goes to the cemetery where he dies of starvation while hugging Esmeralda’s corpse. Much later, they are discovered still in their embrace; when their bones are separated, Quasimodo’s turn to dust.

Probably one of the earliest paintings to show Victor Hugo’s story is this undated work by a Mademoiselle Henry who is claimed to have lived between 1790-1873. It shows Quasimodo Saving Esmeralda from the Hands of her Executioners: the bell-ringer has just swept the young woman from the gallows, and she has swooned away on his shoulder. He carries her in through the main entrance of the cathedral, to claim sanctuary for her. Her pet goat Djali is at the top of the steps. The rope running down the steps is the bell-rope on which Quasimodo swung down onto the gallows.

The strange Belgian narrative painter Antoine Wiertz painted a pair of portraits in 1839 showing the novel’s male and female leads. This is his Quasimodo, who resembles the figure in the painting above. Wiertz doesn’t appear to have been happy with this work, and labeled it a bad study.

For his portrait of Esmeralda, Wiertz used his favourite model, and an affectionate goat. The letters on her lap spell Phɶbus, the name of the captain of the King’s Archers, who she is convicted of attempting to murder.

Louis Boulanger painted this fascinating and painterly group of Six of Victor Hugo’s Characters in 1853, apparently for a friend. Clockwise from the top left they are Don Ruy Gomez, Don César de Bazan, Don Salluste, Hernani, Esméralda and De Saverny, but there’s no goat.

Jozef Van Lerius’ portrait of Esmeralda and Djali, which must have been completed before the artist contracted meningitis in 1875, is startlingly realist and gently erotic. Djali is shown with gold horns and hooves, and in front of the girl are, once again, the letters forming the name Phɶbus.

William-Adolphe Bouguereau’s Little Esmeralda from 1874 conforms less to Hugo’s character. She is fair and would never be taken for a ‘gypsy’, and is seen carrying wild flowers out in the country, perhaps on the coast of Normandy. She does, though, have Djali as her companion.

There have been many illustrated editions of Notre Dame de Paris, in its original French, English and other translations. Among them is an edition published in 1889, with engravings based on a series of drawings made by the Naturalist Luc-Olivier Merson between 1881 and 1889, three of which I show here.

This shows Esmeralda taking pity on Quasimodo when he had been flogged and put in the pillory, by giving him a drink of water. Naturally she is accompanied by Djali.

Esmeralda and Djali are here seen with Phɶbus, I think.

This is Merson’s treatment of Quasimodo carrying the swooning Esmeralda from her first brief visit to the gallows up into the sanctuary of the cathedral.

Here are this weekend’s Mac riddles to entertain you through family time, shopping and recreation.

1: Harvard or Yale cipher brought emoji and Ugaritic.

2: US standard for 128 Roman characters now over 60.

3: Two plus 128 more came in 1989, gained a euro in 1998, and still supported.

To help you cross-check your solutions, or confuse you further, there’s a common factor between them.

I’ll post my solutions first thing on Monday morning.

Please don’t post your solutions as comments here: it spoils it for others.

The first file system for Macintosh computers wasn’t HFS+ or even its predecessor HFS, but Macintosh File System, MFS. This was introduced in System 1 on the 128K Mac just over 41 years ago, to support its 400 KB floppy disks. Although it was fairly primitive, it incorporated some visionary features, including forks. Each file had two sets of data: a data fork as in other file systems, and a resource fork for storing structured blobs of data or resources.

File naming was liberal compared with MS-DOS, allowing names up to 255 characters long, although that was restricted to 63 by the Finder. Names could consist of any printable character except the colon :, a limitation that persists in the Finder today. As there was no directory hierarchy, folders were an illusion and couldn’t be created directly by the user. Instead there was always an Empty Folder available, and when that was used, a fresh Empty Folder was created. As this was a single-user file system, there were no permissions.

MFS was still supported until it was finally discontinued 13 years later in System 8, in 1997.

Hierarchical File System, HFS

MFS had been designed for the low-capacity floppy disks of the time, and not for use on hard disks, where its limitations would have been only too apparent. For the release of the Macintosh Hard Disk 20 in September 1985, and in anticipation of the Macintosh SE 18 months later, a new Hierarchical File System had to be released to replace MFS in System 2.1. HFS remained fully supported until the arrival of Mac OS X 10.6 Snow Leopard in 2009, and finally dropped altogether in macOS Catalina a decade later.

Developed by Patrick Dirks and Bill Bruffey, HFS maintained many of the novel features in MFS, with resource forks, long file names up to a maximum of 31 characters, still excluding the colon, and in its standard single-user version didn’t support permissions. The latter were incorporated into AppleShare later. File and folder names were case-preserving but case-insensitive.

Larger storage capacities brought the need for a hierarchical directory structure, implemented using B-trees in a Catalog File that made the display of even large directories very quick. Although much of HFS used 32-bit integers, that didn’t apply to the number of files in a logical disk, which was limited to 65,535, which must have seemed sufficient at the time, and given the maximum volume size of 2 TB. With early hard disks being measured in tens of MB, that may have seemed in the distant future.

Mac OS Extended, HFS+

With the growth in capacity of hard disks, HFS had to be updated to address its limitations, in a project with the internal name of Sequoia, delivering HFS+ in Mac OS 8.1 in 1998. Switching to 32-bit fields to identify allocation blocks allowed more efficient use to be made of storage and a larger number of files in each volume. File names were increased in maximum length to 255 characters, and changed from MacRoman encoding to Unicode UTF-16 to accommodate a broader range of languages. Support for additional forks beyond data and resource paved the way for the switch to extended attributes, and OS startup support was improved to allow alien operating systems to boot from HFS+ volumes.

This screenshot shows a set of custom icons in a BNDL resource, in the QuarkXPress app in about 2000.

This shows file information available in HFS+ in Classic Mac OS in 2002.

HFS+ and its predecessors were prone to develop errors as a result of operating system crashes and other unexpected events, and those could be cumulative, leading to data loss. This was addressed with the introduction of journalling, designed and implemented by Dominic Giampaolo, who came to Apple from implementing the file system for BeOS. This was tentatively introduced as an option in Mac OS X 10.2.2 in late 2002, and made a standard feature in 10.3 the following October. Alongside that came an optional wrapper for case-sensitivity in what was dubbed HFSX, and a change in Unicode decomposition to Normalisation Form D (NFD).

Mac OS X 10.4 augmented Posix permissions with Access Control Lists (ACLs), although they were little-used outside server environments for some years. Prior to 10.5, as with most other file systems, HFS+ supported file but not directory hard-links. With the introduction of Time Machine in 10.5 Leopard, directory hard-links were added to support the structure and illusions of Time Machine backup stores.

File system support for encryption was a bit more troubled. The original FileVault, introduced in 2003 with Mac OS X 10.3 Panther, located user Home folders in an encrypted sparse disk image, which was improved in 10.5 by moving to sparse bundles. This suffered several shortcomings and vulnerabilities, and was replaced by whole-volume encryption in FileVault 2 in Mac OS X 10.7 Lion. That required the addition of a logical volume manager, Core Storage, which was then used for Fusion Drives introduced in 2012.

Apple File System, APFS

HFS+ had been designed for computers with hard disks. It lacks some of the features of more modern file systems such as snapshots, special files such as sparse files, and concurrent access. It’s also not well-suited to use with SSDs and storage in smaller, mobile devices, although when the first iPhone shipped with iOS 1.0 in 2007, it used HFSX, the case-sensitive variant of HFS+. That was until the release of iOS 10.3 on 27 March 2017, which silently converted its file system to APFS.

In 2014, Apple had decided to write its own file system from scratch, and Dominic Giampaolo, responsible for journalling in HFS+, and Mike Mackovitch became its lead engineers. APFS was announced two years later at WWDC in 2016, when it was expected to be released in another 18 months if development and testing went smoothly. Those who had hoped for ZFS were disappointed and many remain so today. macOS Sierra already had a pre-release version for those who wanted to preview it, but as we discovered when we upgraded to High Sierra, that was a far cry from what was to come.

After a promising period in beta, Apple discovered fundamental problems between APFS and its popular Fusion Drives. The first release of macOS 10.13 shipped with APFS version 748.1.46, but abruptly dropped support for those, so converted only those startup volumes on SSDs and hard disks. Snapshots were wobbly at first, and it quickly became clear that APFS was never going to perform well on rotating disks.

High Sierra had a stormy early release history, marred by a series of security gaffes. Vulnerabilities were fixed in the Supplemental Update released less than two weeks after 10.13, leaving snapshots to be improved in 10.13.1 on 31 October. Many expected problems with Fusion Drives would be fixed quickly, but those weren’t ready for release until the following September. Another problem that troubled the introduction of APFS to all platforms was the refusal during beta-testing to incorporate Unicode normalisation; this had to be resolved in later versions of macOS 10.13 and iOS 10, as explained here and here.

In September 2018, Apple at last released Mojave 10.14 with support for Fusion Drives, accompanied by the first version of the Apple File System Reference. Although a long and detailed document, developers soon realised how incomplete it was, in spite of the long delay in its publication. At last third-party file system developers had some hard information to work with, and users started assuming that third-party disk maintenance and repair tools were imminent.

Catalina brought major changes to APFS, with the use of expanded volume roles to form System Volume Groups, with their separate but firmlinked System and Data volumes. macOS 10.15.5 fixed a serious bug preventing the transfer of very large amounts of data to RAID volumes. At that time, Apple released an updated version of the Apple File System Reference, building expectations that third-party tools were just round the corner, at least among those who weren’t aware of how much information was still missing. Nearly five years later, it’s still that same edition dated 22 June 2020 that remains the latest information released by Apple about APFS.

Further major changes came with Big Sur 11.0.1 when it was released in November 2020, introducing the sealed and signed snapshot now used to boot macOS. This was also the first release to support making Time Machine backups to APFS volumes, and to support Apple silicon Macs.

Although Apple dropped early hints that APFS might be released as open source, unlike its predecessors, after eight years, information about its internals released by Apple still appears to be insufficient to allow third-party developers to create maintenance tools independent of those bundled in macOS. This reluctance may stem from the deep involvement between the file system and macOS security.

Summary timeline

• MFS Jan 1984 – Sep 1985, end of support 1997
• HFS Sep 1985 – Jan 1988, end of support 2019
• HFS+ Jan 1988 – present, still supported
• APFS Sep 2017 (iOS March) – present, still supported

References

Inside Macintosh: Files, Chapter 2 – File Manager, on HFS
MacCyclopedia critical account of HFS and HFS+. 25 May 2003
Apple TN1150 HFS Plus Volume Format, 5 March 2004
Apple’s APFS Reference (PDF), last revised 22 June 2020.

Wikipedia on
MFS
HFS
HFS+

Although few of those who migrated to the towns and cities from the countryside prospered as a result, there were sufficient examples to lure others to take their chances. For a young woman, success could come through the growing world of fashion.

The foot of the ladder was the greatest challenge: how to make the break from the worn-out worker shown in Christian Krohg’s Tired from 1885. This young seamstress was one of the many thousands who worked at home at that time, toiling for long hours by lamplight for a pittance. A few of them had the good fortune to be discovered and taken up into a small dressmaker’s.

They might then enter the world of Moritz Stifter’s New Dress from 1889. Every face is smiling here, some perhaps a little vacuously, as an affluent young woman tries on a new dress, with its incredibly small waist. Although this room is full of fabric and the trappings of dressmaking, including the mandatory sewing machine, no one actually appears to be making anything.

A few specialised in making hats, as shown in Edgar Degas’ The Millinery Shop (1879/86). While husbands and partners were expected to pay for a woman’s hats, their choice was hers, and hers alone.

Jean Béraud’s fashionably-dressed Milliner on the Champs Elysées is enjoying her success, and carrying her work in two large hatboxes. She has also attracted the attention of the well-dressed man in a top hat behind and to the left of her.

Les Modistes (Two Milliners in the Rue du Caire, Paris) from 1885-86 is one of Paul Signac’s transitional paintings to Seurat’s Divisionism. These two young milliners are busy making fashionable hats and making their way into bourgeois life.

Pierre-Georges Jeanniot’s At the Milliner (1901) shows the milliner in a mirror at the right.

Millinery was one of the staples of fashion houses like that of Paquin, whose success was characteristic of the late nineteenth century, and shown in Henri Gervex’s Five Hours at Paquin’s from 1906.

The purpose of these expensive hand-made hats was for show, when the lady was seen in appropriate surroundings. Jeanniot’s painting of the patrons of one of the most fashionable hotels in Paris shows all the hats out on parade in the inner garden of the Paris Ritz in fine weather.

Béraud’s Workers leaving the Maison Paquin (1907) shows the ladies who worked in Jeanne Paquin’s highly successful fashion house in the Rue de la Paix, as they left work at the end of the day.

A select few were fortunate enough to marry into the middle class and forge a more secure future for themselves.

Béraud’s After the Service at the Church of Sainte-Trinité (the ‘American Cathedral’) (c 1900) shows affluent Franco-American society at the turn of the century, and the prominence of hats and clothes.

Recent updates to macOS Sequoia 15.4, Sonoma 14.7.5 and Ventura 13.7.5 brought firmware updates for some Macs, but not others. As I have now analysed those, and they’re reflected in the databases accessed by SilentKnight, and in my reference articles here (listed at the end), this article explains which are still being maintained by Apple.

Intel Macs without T2 chips

There are only two models of Mac without a T2 or Apple silicon chip whose firmware is still supported for updates: the iMac19,1 and 19,2, respectively the 2019 Retina 5K 27-inch and Retina 4K 21.5-inch. In this round of updates, they moved up to an EFI version of 2075.100.3.0.3, dated as recently as 3 March 2025. As they can run Sequoia, they’re expected to have continuing macOS security updates until at least the summer of 2027.

Older models of iMacs, MacBook Pros, and a single MacBook, remain with EFI firmware that was last updated in June 2024, and is unlikely ever to be updated any further. macOS support for them is expected to end when security updates for Ventura are discontinued at the end of the summer this year.

T2 Macs

For the 20 days between the release of 15.3.2 and 15.4, Intel Macs with T2 chips that were running Sequoia had a slightly more recent release of iBridge firmware. In 15.3.1, 14.7.4 and 13.7.4, that was 22.16.13051.0.0,0, but 15.3.2 brought version 22.16.13060.0.0,0. This is one of very few occasions in which T2 Macs running supported versions of macOS have had different firmware versions installed.

Thankfully, this last round of updates has rectified that, and all Macs with T2 chips should now be running 2075.101.2.0.0 (iBridge 22.16.14248.0.0,0). This is encouraging, not only for simplicity, but because it demonstrates that Apple is continuing to support not only the ‘Bridge’ Arm chip, but EFI as well. How much longer that will continue depends on whether there is Intel support in macOS 16, expected to be announced at WWDC in early June, and released in September or October this year.

At a minimum, macOS support for T2 Macs should last at least until summer 2027, and that should be extended to the following year if macOS 16 comes with Intel support.

Apple silicon Macs

All Apple silicon Macs should now be using iBoot version 11881.101.1, which was installed with these updates. The most recent MacBook Air and Mac Studio models with M4 family (or M3 Ultra) chips had their own update to 15.3.2, but 15.4 covers all current models in the single distribution, with the same firmware version.

There’s a growing number of reports of Apple silicon Macs experiencing problems updating to Sequoia 15.4, either on their internal SSD or on bootable external disks. This seems most likely in models with M1 family chips, and suggests that changes made in the installer might be responsible. As this doesn’t appear to affect 14.7.5 or 13.7.5 updates, it’s unlikely to lie in the firmware. There are several strategies you can adopt to work around this, including:

• Try updating in Safe mode. This is a longstanding function of Safe mode, described here.
• Start up in the correct paired Recovery system, and install Sequoia there. This should be attempted conservatively, without creating a fresh Data volume, but you must ensure that you have at least one complete backup ready in case anything goes wrong and the whole boot volume group has to be replaced.

Provided the Mac is already running at Full Security, there shouldn’t be any value in changing that. Performing a full Restore in DFU Mode isn’t as daunting as it might seem, but is a drastic solution requiring a recent second Mac, and full restore from your backup. If you’re getting to that stage, contact Apple Support who hopefully will now be only too familiar with these problems.

Summary

• Intel Macs without T2 chips: iMac19,1 and 19,2: EFI 2075.100.3.0.3; no change in other models.
• Intel Macs with T2 chips: 2075.101.2.0.0 (iBridge 22.16.14248.0.0,0).
• Apple silicon Macs: 11881.101.1.

Reference data

Which firmware should your Mac be using? (version 9, Sequoia)
Which firmware should your Mac be using? (version 8) – for Sonoma
Which firmware should your Mac be using? (version 7) – for Ventura

Folding screens were first recorded in ancient China, where they were used as portable room dividers and as decorative furniture. They’re thought to have made their way to Europe in the late Middle Ages, and started to spread more widely during the seventeenth and eighteenth centuries.

Early screens were made of wood, but were soon covered with painted paper or silk. Kanō Hideyori’s magnificent Maple Viewers (紙本著色観楓図) (Muromachi, early 1500s) is painted on paper in the classical style of the Kanō school, then applied to a six-section folding screen.

In Europe, screens served several purposes in addition to dividing a larger space into two. They could be used to keep drafts away, provide privacy, hide a feature like a servant’s entrance to a kitchen, or purely for decoration.

In the fourth painting in William Hogarth’s moralising narrative series Marriage A-la-Mode, The Toilette (c 1743), Countess Squander is being entertained while completing her dressing and preparations for the day. In the background at the right is a painted screen showing a masquerade ball.

It was the popularity of East Asian artefacts in the latter half of the nineteenth century that put folding screens in many homes and quite a few paintings. They featured in at least two of James Abbott McNeill Whistler’s works from the mid-1860s.

Behind Whistler’s Princess from the Land of Porcelain (1863-65), from his Peacock Room, is a painted screen from Japan.

A more elaborately painted screen forms the backdrop to Whistler’s Caprice in Purple and Gold: The Golden Screen from 1864.

Lucy Madox Brown Rossetti’s The Duet (1870) attracted favourable reviews when exhibited at the Royal Academy. This features a decorated folding screen from East Asia in the left background. The artist was the daughter of the Pre-Raphaelite painter Ford Madox Brown, and was Dante Gabriel Rossetti’s sister-in-law.

In 1872 William Quiller-Orchardson completed Dolce Far Niente, incorporating in its painted screen a contemporary flavour of Japonisme. His woman, dressed in sober black, reclines on a thoroughly European chaise longue, her open book and fan beside her as she stares idly out of an unseen window.

Like other artists of the day, Elihu Vedder developed a fascination for objets d’art from the Far East, which he assembled in this Japanese Still Life in 1879. This unusual collection may have been assisted by the fact that his brother was a US Navy doctor who was stationed in Japan as it was being re-opened to the West.

Bouderie, which means sulking, is a splendid and intimate portrait of Pascal Dagnan-Bouveret’s friend and colleague Gustave Courtois, painted in 1880. Courtois is seen at one end of a large sofa, smiling wryly and staring into the distance. He holds his palette and brushes in his left hand, and what may be a long mahlstick in the right. At the opposite end of the sofa, turned with her back towards Courtois, is a young woman dressed in fashionable clothing, in black throughout, apart from white lace trim at the foot of her skirts. Also shown is a screen decorated with Japanese imagery, and on the floor the skin of a big cat, perhaps a lioness.

Pierre Bonnard developed his earlier Man and Woman in an Interior into his Man and Woman in about 1900. Marthe isn’t getting dressed here, but sits up in the sunshine. A folded wooden screen divides the painting into two. Bonnard stands at the right edge of the painting, his legs looking skeletal in the sunlight.

William McGregor Paxton’s Tea Leaves (1909) show two well-dressed young women taking tea together. The woman in the blue-trimmed hat seems to be staring into the leaves at the bottom of her cup, a traditional means of fortune-telling, and behind them is a large folding screen, whose details are intentionally blurred and vague.

The New Necklace from the following year is one of Paxton’s best-known paintings, and perhaps his most intriguing open narrative. A younger woman is sat at a narrow bureau writing. She has turned her chair to reach behind and hold out her left hand to receive the new necklace from a slightly older woman in a dark blue-green dress. Their backdrop is another folding screen, this time with its East Asian painting clearly visible.

My final screen is the painting itself.

Pierre Bonnard’s exquisite three-panelled Japoniste screen of The Stork and Four Frogs was painted at the outset of his career, in about 1889. Its story is contrastingly European, and based on one of Aesop’s fables retold by Jean de La Fontaine’s The Frogs who Demand a King.

The version retold by La Fontaine centres on a colony of frogs, who ask Jupiter for a king. The god’s first response to their request is a laid-back and gentle leader, whom the frogs reject as being too weak to rule them. Jupiter’s second attempt is a crane, who kills and eats the frogs for his pleasure. When the frogs complain to Jupiter, he then responds that they had better be happy with what they have got this time, or they could be given something even worse. Bonnard’s magnificent panel is traditionally interpreted not as showing the evil crane of the second attempt, but the first and gentle ruler.

App extensions, appexes, have become plentiful and widely used by macOS and third-party software, yet discovering and controlling them is patchy and limited. The most coherent access is in System Settings > General > Login Items & Extensions, where some are gathered in the list of Extensions at the end. Others like Safari extensions are controlled in app settings, while most remain hidden out of sight.

To take stock of all these appexes, I turned to the pluginkit command tool, but the lists it generates are seemingly ordered at random, and so extensive that it would require some serious scripting to make any sense. Instead, it’s easier and more effective to put together a little app to do that. So I present you with AppexIndexer, an exploratory utility that displays key information about all appexes recognised by macOS.

Click on its button to Get Appexes and the window below will fill with well over 400 items, arranged in alphabetical order by the first entry in each line, the SDK or NSExtensionPointIdentifier. Some of those should be fairly obvious: for instance, those appexes listed in Photos Editing settings use the com.apple.photo-editing SDK. In a future article I will explore the relationships between settings categories and SDKs given.

Following that comes the display name of that appex, again ordered alphabetically within that SDK group, which should be the same as that used in System Settings. Next comes the path to that appex, so you can inspect it and its Info.plist for further information.

Many appexes also have a parent, so the last two entries given are the name and path to that parent, when they’re available. One quick way to recognise third-party appexes is to glance down the right side of the list, as they invariably have a familiar parent. Appexes built into macOS are far less likely to have parents (and you can read into that what you like!).

Even in a modest installation, you’re likely to see well over 400 in your Mac’s list, from SpamSieve, an Email Extension with the SDK of com.apple.email.extension, through to QuickLook thumbnail previewers, screensavers and wallpaper. I’ve already explained in general terms what these are and how they work, in this article.

One significant feature missing at this stage is Find/Search, which I’m still working on, for LogUI as well. There’s also additional information given by the pluginkit command tool, and more still that’s available from each appex’s Info.plist file inside its bundle. This initial release lets you save the window’s contents using the Save as RTF button, and you can copy any selected entries and paste them as text. Row selection can be continuous using the Shift key, and discontinuous using Command.

Appexes are not only growing in number, but also becoming increasingly important in macOS. In some cases, they include background processes that could be used maliciously as a method of persistence. Although appexes still need to comply with TCC’s strict rules for accessing protected services and data, they can be an effective way to fly under a user’s radar.

AppexIndexer 1.0 build 5 is now available from here: appindexer105
I’m afraid that it requires macOS Sonoma 14.6 or later, to support the features it uses in SwiftUI.

I hope that you find this information of use. Please let me know what features you’d like the app to support, whether you’d like it to access appex property lists, or other useful data, and how you might want to use a future version. While I’ve got my own ideas, I’m interested in yours, and will try to accommodate them.

In 1907, after over twenty years of lucrative work painting portraits, John Singer Sargent closed his studio in London, and cut himself adrift to travel where and when he wanted.

The American artists Jane de Glehn and her husband Wilfrid (1870-1951) were long-standing friends. Sargent first met Wilfrid around 1895 when he was working on murals in Boston Public Library, and Wilfrid married Jane Emmet (1873-1961), sister of Lydia Field Emmet, in 1904. The Fountain, Villa Torlonia, Frascati, Italy (1907) shows Jane working at a lightweight wooden easel in the grounds of the villa.

The composition in his Dolce Far Niente (1907) is complex, with five of the figures staggered and slightly out of line along the gentle curve of the bank crossing this unusually wide canvas, its aspect ratio being more typical of marine views and panoramas. Against this are steep diagonals in the middle of the painting, formed by the edge of the brown reflection on the water, the male in the left pair of figures, and the closest female. The cropping of the horizon and any background beyond the immediate meadow and stream gives a sense of space and recession, aided by the foreshortening of the closest figure, despite the proximity of the individuals to one another.

The painting consists of a multitude of daubs, strokes, and dabs of colour, those marks composed to provide just enough information for the viewer to assemble them into the whole, which as a result ‘pops’ out in a vivid reality.

It’s thought that all three male figures were modelled by Nicola d’Inverno, the painter’s manservant, and the woman seen asleep appears to be his friend Jane de Glehn. Sargent had purchased the costumes in the Middle East during his travels there, and they were transported in trunks to this site, believed to be the brook at Peuterey in the Val d’Aosta, most probably in the summer of 1907.

This painting was hung in the summer exhibition of the New English Art Club, London, in 1909, and was favourably received by the critics. It was sold within an hour of the opening of the press view, to Augustus Healy, founder of the Brooklyn Museum, where it has hung ever since.

Sargent’s bravura watercolour sketch of Grand Canal, Venice (1907) is composed of a sparse, even minimalist, collection of brushstrokes of watercolour assembled into a detailed view of the motif. He views Venice from the level of a gondola, the bows of which are also shown. His palette for these sketches is generally centred on earth colours for the buildings, with blue for the sky, water, and usually the shadows.

The following year, his Flotsam and Jetsam follows in the same style, with the figures of young boys in the foreground sketched in roughly to suggest movement.

Sargent was an early adopter of cadmium yellow pigment in watercolours such as Olive Trees, Corfu from 1909, where it ensured that his greens remained lightfast.

He wasn’t dependent on sophisticated techniques, though: Rio dei Mendicanti, Venice from about 1909 works its magic almost entirely using a combination of passages using wet on dry and wet on wet. There isn’t even much in the way of a graphite drawing under its thin washes.

Sargent met up with the plein air specialist Ambrogio Raffele again when he returned to the Alps during the summers of 1909 to 1911, and painted this watercolour of him as an Artist in the Simplon at some time in those years. Raffele is painting a view of the Fletschhorn, to the south-west of the Simplon Pass, using an improvised easel formed from two crossed poles.

In the summers of 1909-11, Sargent stayed with various friends in the Bellevue Hotel at the top of the Simplon Pass, enjoying the cool mountain air at a time when much of the rest of Europe would have been stiflingly hot. While his family and friends whiled away their days in leisure, Sargent got them to pose for a unique series of informal portraits. They may have been reclining at leisure, but Sargent took those watercolours very seriously, and deployed an amazing array of techniques. Among the finest is his Simplon Pass: The Tease from the summer of 1911. For any watercolour artist, it is a lexicon of advanced techniques.

One of the most unusual, used here extensively, is wax resist. Before applying paint, Sargent scribbled over areas that were intended to be vegetation, using a soft wax crayon, probably made from beeswax. On a fairly rough paper, the wax is deposited unevenly, and when painted over using watercolour it shows the white paper through. This creates disruptive patterns of near-white in the midst of the greens, and a superb effect.

Most of the paint used is transparent watercolour, applied as a wash in small areas, and in gestural marks elsewhere. In the upper third of this detail, he has applied white gouache (opaque watercolour) sufficiently thickly for it to now have fine cracks. The large pale blue area crossing the middle appears to have been rewetted and some of its colour lifted to reduce its intensity, although most of his applications of paint over existing paint have been made wet on dry.

Complex details such as the faces and hands of the figures have undergone multiple repainting, starting with the palest flesh of the face, and progressively darkening to near-black. In most cases, the clean edges of the marks demonstrate that these were applied wet on dry, with as many as six different layers in the hair.

In the midst of this complex assembly of layers, Sargent still keeps to the lines of his original graphite sketch, which he uses to give the parasol form, and maintains small reserved areas, here forming the spectacle frames in the white of the paper. He could have used wax resist here, but if using pure beeswax it’s hard to keep the soft wax to fine lines.

Sargent is the Chess Grand Master, the strategist whose moves at times might almost seem random or abstract, but in the end they all come together to bring this masterly watercolour to life.

For many years, most types of disk image were inefficient in their use of storage space, as they occupied their full size on disk. Until recently, when you created a 5 GB read-write UDIF disk image, one of the most popular, it invariably took up 5 GB in storage, even when empty. This also applied to the raw disk images used by Virtual Machines: give a VM 100 GB, and that’s just what it took on disk. With the introduction of sparse files in APFS, this has changed, and many disk images now only take the space they need. I’m not sure exactly when this change occurred, as Apple still doesn’t appear to have documented it, but it seems to have changed with macOS Monterey.

This is easiest to see with a plain read-write disk image, created using DropDMG or Disk Utility.

Disk image

Here’s one I made earlier, a whole 350 GB in size. When it’s created, it’s automatically attached and mounted at full size. For the sake of example, I then copied a large IPSW to it, so it wasn’t entirely empty.

Unmount it and Get Info on the disk image and you’ll see it does still take up a full 350 GB on disk. Mount it again, though, and APFS works its magic. You can see this in LogUI, or the custom log extract provided by Mints.

When unmounted again it has shrunk down to take little more than the size of the IPSW file in it, at just over 17 GB. That’s less than 5% of its nominal size, without using any compression.

It’s worth looking through entries in the log made by APFS for the mount process. First, APFS checks whether the data store for the disk image is already sparse:
01.470 container_backingstore_is_sparse:1652: Image url file:///Volumes/LaCie2tb/350gbudif.dmg Image path /Volumes/LaCie2tb/350gbudif.dmg
01.470 container_backingstore_is_sparse:1659: Image /Volumes/LaCie2tb/350gbudif.dmg is a flat file, do not consider as sparse

It then sets it to sparse, ready for sparsification:
01.475 handle_apfs_set_backingstore:6207: disk9s1 Set backing store as sparse
01.475 handle_apfs_set_backingstore:6240: disk9 Backing storage is a raw file

Space Manager performs an initial scan for free blocks without any Trimming:
01.479 spaceman_scan_free_blocks:4136: disk9 scan took 0.004272 s (no trims)
01.479 spaceman_fxc_print_stats:477: disk9 dev 0 smfree 81258479/85398014 table 4/452 blocks 81258479 32766:20314619:79974226 100.00% range 35869:85362145 99.95% scans 1

Space Manager then scans and Trims free storage blocks, taking just over 0.7 second to complete:
02.196 spaceman_scan_free_blocks:4106: disk9 scan took 0.717433 s, trims took 0.715705 s
02.196 spaceman_scan_free_blocks:4110: disk9 81258479 blocks free in 25 extents, avg 3250339.16
02.196 spaceman_scan_free_blocks:4119: disk9 81258479 blocks trimmed in 25 extents (28628 us/trim, 34 trims/s)
02.196 spaceman_scan_free_blocks:4122: disk9 trim distribution 1:0 2+:0 4+:0 16+:0 64+:0 256+:25

VM

What happens with an Apple silicon VM is a bit more complicated, and harder to observe. This time the virtualisation app should create the disk image inside the VM bundle as a sparse file to begin with, then copy into that what’s needed for the VM, so skipping the first mount stage and Trimming during the second mount.

The result is the same, though, with a 350 GB VM taking just 22 GB on disk. Inspect that disk image using my free utility Precize, and you’ll see that economy confirmed, and the Sparse File flag set.

Conclusions

For plain read-write disk images and those inside VMs to be sparse files:

• they must contain a suitable raw disk image, such as UDIF read-write;
• the host file system must be APFS, as HFS+ doesn’t support sparse files;
• for normal disk images, they must be stored on an SSD that supports Trimming;
• there must be sufficient free space in the disk image;
• the guest file system can be APFS, either plain or encrypted, or HFS+J;
• for normal disk images, they must have been mounted at least once since first being created.

Apple has just released an update to XProtect for all supported versions of macOS, bringing it to version 5293. As usual, Apple doesn’t release information about what security issues this update might add or change.

This version adds a single new rule for MACOS.SOMA.J.

You can check whether this update has been installed by opening System Information via About This Mac, and selecting the Installations item under Software.

A full listing of security data file versions is given by SilentKnight, LockRattler and SystHist for El Capitan to Sequoia available from their product page. If your Mac hasn’t yet installed this update, you can force it using SilentKnight, LockRattler, or at the command line.

If you want to install this as a named update in SilentKnight, its label is XProtectPlistConfigData_10_15-5293.

Sequoia systems only

This update has also been released for Sequoia via iCloud. If you want to check that manually, use the Terminal command
sudo xprotect check
then enter your admin password. If that returns version 5293 but your Mac still reports an older version is installed, you can force the update using
sudo xprotect update

I have updated the reference pages here which are accessed directly from LockRattler 4.2 and later using its Check blog button.

John Singer Sargent’s move to London in 1886 had proved a commercial success, and he painted portraits of the rich and famous until he closed his studio there in 1907.

His group portrait of The Ladies Alexandra, Mary, and Theo Acheson, normally simply known as The Acheson Sisters, was exhibited at the Royal Academy in 1902, where it was both very popular and favourably received. And at first sight, it is indeed a delight, as they sit around the front of a huge urn decorated with floral garlands, one of the ladies reaching up to pick oranges from a tree just above the urn. Even the late Queen Victoria would, I am sure, have approved. However, there are hidden references that link back through earlier portraits by Sir Joshua Reynolds to Nicolas Poussin’s previous paintings of bacchanalian orgies.

Meanwhile, the other John Singer Sargent continued his travels across Europe and beyond. A visit to Venice in 1902 brought this stunning watercolour of Rio dell Angelo, where he provides his response to the Impressionists’ question on the colour of shadows.

The same year, Sargent visited New York, where he painted this portrait of his friend and fellow artist William Merritt Chase in his fifties. He’s immaculately dressed with a carnation in his button-hole, and the tools of his art in hand.

The following year, Sargent was back in Venice to paint this watercolour of Scuola di San Rocco assembled from a virtuoso series of marks and gestural strokes of the brush.

When he broke free of his studio for the summer of 1904, Sargent travelled to the Alps for his first season of serious plein air painting there. He stayed in the Italian mountain town of Purtud, to the south-west of Mont Blanc, where there was a group of Italian artists doing the same thing. Among them was Ambrogio Raffele (1845-1928), probably the best and most experienced of the group; Sargent became particularly friendly with him, and in An Artist in His Studio (1904) shows Raffele at work in his room there.

This painting is a paradox, in that Sargent shows an accomplished plein air painter working not in front of his motif, but in his bedroom. It’s plausible that Raffele is painting a larger version of the small sketch seen at the lower left of the large canvas.

When he reached Venice, Sargent’s watercolours became even more gestural, as shown in this view of Unloading Boats in Venice (1904).

The following summer Sargent turned his attention to his fellow travellers as they crossed the Alps on their way south. He sketched his friends during their siesta, in this Group with Parasols painted in oils in about 1905.

Here they are again in watercolour, in Siesta from the same year.

A decade after her dancing career had gone into decline, and fifteen years after his first painting of her, Sargent produced a completely different portrait of La Carmencita (c 1905). Now his virtuoso brushstrokes capture her motion. His inspiration was no longer Manet, but Giovanni Boldini and his ‘swish’.

In further time out of his studio, Sargent travelled to North Africa, where he painted this Bedouin Camp in 1905-6.

This portrait of an Arab Woman from 1905-06 is another fine example of his watercolour sketching.

At times, Sargent’s brushstrokes appear so casual that it’s almost as if he was just doodling with pigment, as in the blue shadows In a Levantine Port (1905-6). But they coalesce into the image that Sargent clearly had in his mind all the way along, and pop out at the viewer.

Open System Settings, then General, and Login Items & Extensions. Scroll to the end of that list and you’ll see a section titled Extensions. All looks tidy there and in order, but you’re looking at the tip of the iceberg. Click on the ⓘ button at the right of any of those entries, and prepare to be thoroughly confused. These aren’t, of course, kernel extensions, nor are they only system extensions (although some may be), they’re app extensions, conveniently shortened to appexes, the subject of this article.

System Settings

That section in System Settings is unusual as its list depends entirely on what you have installed on your Mac. Among those you’re most likely to see are:

• Actions allow access to an app’s functions from within other apps, such as Markup provided by macOS.
• Dock Tiles customise the Dock and normally run in the background (although not listed in Background items above), including several phantom ‘apps’ added by macOS.
• File Providers allow you to see both local and remote-storage files together in the Finder, and normally run in the background (although not listed in Background items above). Note this isn’t confined to ‘file providers’ in the sense of cloud services like iCloud Drive.
• File System Extensions, userland file systems, including ExFAT and MSDOS in macOS 15.4, which are intended to replace kernel extensions.
• Finder provides enhanced search and other functions for files and more. These can also be accessed directly through the Quick Actions item in the Finder’s contextual menu.
• Photos Editing provides enhanced editing in the Photos app. This also includes Markup provided by macOS.
• Quick Look includes custom QuickLook thumbnail and preview extensions, replacing qlgenerators.
• Sharing includes features provided in the Share menu. These include some from macOS that can’t be disabled, such as Mail and Messages, others that are optional, as well as third-party apps.
• Spotlight includes custom mdimporter modules to extract indexable content from custom file types not supported by macOS.

To add to the uncertainty, not all those available in Sequoia 15.4 are listed in the Mac User Guide’s total of 17 classes, or Apple’s list of 25 for developers.

Where are appexes?

Most of these are installed as .appex bundles inside a PlugIns folder inside the bundle of an app, although some can instead be in a Library folder inside the app. The best information about each is in the Info.plist file in their appex bundle. In that, the nested dictionary of NSExtensionAttributes is most informative. That gives the NSExtensionPointIdentifier type, which for a QuickLook appex might be com.apple.quicklook.preview, indicating that it generates custom previews for QuickLook, in the way that qlgenerators used to. That type corresponds to the SDK entry listed by pluginkit, described below.

Not all appexes are exposed in System Settings, though. New-style drivers supplied in .dext bundles, that are listed as extensions, aren’t included despite there being 17 bundled in macOS 15.4. There’s also no mention of nearly 200 appexes provided in /System/Library/ExtensionKit/Extensions.

pluginkit

In addition to their control in System Settings, the command tool for working with appexes is pluginkit. Most of its options are aimed at those developing and debugging their own appexes, but there’s one command that will dump details of all managed appexes to a lengthy text file, with a form like
pluginkit -m -vv > ~/Documents/pluginkitOut.text
which pipes its output to the file at ~/Documents/pluginkitOut.text. You can add another v to the options for greater details.

The output from pluginkit reveals just how many appexes there are, possibly as many as 500 or more installed in your Mac. Most are system components that aren’t exposed in System Settings, and many have SDK names, specifying their type, that fall outside the categories listed by Apple. For instance, there’s a com.apple.CloudDocs.iCloudDriveFileProvider appex buried deep in the CloudDocs private framework that has an SDK type of com.apple.fileprovider-nonui for iCloud Drive.

Anomalies

Extensions settings currently appears to be a work in progress. It’s among the most opaque sections in System Settings, with all of its controls accessed through ⓘ buttons and floating windows, rather than being laid out clearly. It’s riddled with inconsistencies, and some sections don’t appear to work properly, most notably Quick Look.

This screenshot shows that Apparency’s Quick Look appex is currently disabled, but at the right is a QuickLook preview demonstrating Apparency’s customisation. This applies to other custom Quick Look appexes in Sequoia 15.4: when apparently disabled, they continue to work normally.

As system qlgenerators aren’t included in the Quick Look list, it can’t be used to disable those to allow third-party appexes to generate thumbnails and previews instead, which might have been a useful function.

Summary

• Appexes are app extensions, now found in the PlugIns or Library folders within app bundles.
• Although some appexes are also system extensions, or their relatives, most aren’t, and simply extend that app’s features.
• Many appexes are controlled in System Settings > General > Login Items & Extensions, at the end.
• Lists shown there vary according to which types of appex are installed. Click on the ⓘ button to view and control them.
• Some system appexes are listed but can’t be disabled, while others can be.
• They can also be controlled and listed using the pluginkit command tool, although that’s not straightforward.
• In Sequoia 15.4, Quick Look appex controls appear dysfunctional.

References

man pluginkit
Apple’s developer master page with links to documentation
QuickLook and its appexes
Dock tile appexes.

Aeneas has been rowed through the Straits of Messina, avoiding the rock pinnacle that Scylla had been transformed into. From there he heads north-west until he meets a fierce northerly storm that blows him and his crew south to the city of Carthage, on the Libyan coast. Ovid breezes through what takes Virgil almost a whole book in the Aeneid, in a brief summary of the affair between Aeneas and Dido, Queen of Carthage. This ends with him abandoning her to fall upon the sword he had given her, and her body to be consumed on her funeral pyre.

Pierre-Narcisse Guérin’s Aeneas tells Dido the misfortunes of the City of Troy, painted in about 1815, is probably the standard work showing the beginnings of their romance. Unfortunately it doesn’t give any clues to its tragic outcome.

In about 1875, when Paul Cézanne was still experimenting with narrative genres, he first drew a compositional study, then painted Aeneas Meeting Dido at Carthage. The queen is at the left, surrounded by her court. The warrior figure of Aeneas stands to the right of centre, and to the right of him is the shrouded spectre of Aeneas’ wife, Creusa, who had been abandoned by Aeneas as the family fled the burning city of Troy.

Normally titled The Death of Dido, Tiepolo’s painting from 1757-70 shows an odd composite scene in which Aeneas, packed and ready to sail with his ship, watches on as Dido suffers the agony of their separation, lying on the bed of her funeral pyre. A portentous puff of black smoke has just risen to the left, although it’s surely far too early for anyone to think of setting the timbers alight.

Dido’s spectacular death is shown best in what is perhaps Henry Fuseli’s most conventional history painting, known simply as Dido (1781). Dido has just been abandoned by Aeneas, has mounted her funeral pyre, and is on the couch on which she and Aeneas made love. She then falls on the sword Aeneas had given her, and that rests, covered with her blood, beside her, its tip pointing up towards her right breast. Her sister Anna rushes in to embrace her during her dying moments, and Jupiter sends Iris (shown above, wielding a golden sickle) to release Dido’s spirit from her body. Already smoke seems to be rising up from the pyre, confirming visually to Aeneas that she has killed herself, as he sails away from Carthage.

After a close call with the Sirens, Aeneas reaches the land of the Cercopes, who had been transformed into apes by Jupiter because of their treachery. The ship continues to the north-west along the coast of Italy, passing Naples.

This has been shown only by those like Antonio Tempesta who engraved for illustrated editions of the Metamorphoses. Tempesta’s Jupiter Changing the Cercopians into Monkeys from around 1600 shows Jupiter at the right, accompanied as ever by his huge eagle, with the transformed monkeys.

Once past Naples, Aeneas and his crew land at Cumae to visit the Sibyl there in her cave. He needs her assistance to go to the underworld to speak to the ghost of his father Anchises. The Sibyl reassures Aeneas that he will achieve his goals, and to that end she takes him to Proserpine’s sacred glade. Finding a golden bough there, she tells Aeneas to break that from the tree. The two of them travel to the underworld bearing that golden bough, make contact with the ghost of Anchises, and return safely.

During their walk back, Aeneas thanks the Sibyl for her help and guidance, and offers to build a temple to her, assuming she is a goddess. The Sibyl points out that she is no goddess, and explains how she had once been offered immortality if she were to let the god Apollo take her virginity. When Apollo had invited her to wish for anything, she had pointed to a pile of sand, and asked to live as many years as there were grains, but forgot to wish for eternal youth to accompany that.

Apollo offered her eternal youth as well, but she declined and remained a virgin. After seven hundred years, with another three hundred still to go, she is well into old age, infirm, and steadily vanishing as her body wastes away until only her voice will remain. With that, the pair reach Cumae, and Aeneas sets sail.

This is depicted in one of Claude Lorrain’s most wonderful coastal landscapes, his Coast View with Apollo and the Cumaean Sibyl from about 1645-49. Although their figures are small, Apollo on the left is holding his lyre in his left arm, trying to persuade the seated Sibyl, to the right, to let him take her virginity. Around them are the ruins of classical buildings and a stand of tall trees, as the land drops away to an idealised view of the coast of Italy. In the small bay immediately below them are some ships, which may be a forward reference to Aeneas’ future visit, although that would have been seven centuries later according to the Sibyl’s account.

JMW Turner didn’t tackle the first part of this story until 1823, when he painted The Bay of Baiae, with Apollo and the Sibyl. His view appears to have been loosely based on Claude’s, but is set at Baiae, in the Bay of Naples. Apollo is again on the left, with his lyre, but the dark-haired Sibyl has adopted an odd kneeling position. She is holding some sand in the palm of her right hand, asking Apollo to grant her as many years of life as there are grains.

When Claude was painting his coastal view, François Perrier was painting a more conventional figurative account of Aeneas and the Cumaean Sibyl (c 1646). Aeneas, stood to the left of the incense burner, appears to be offering to burn incense in honour of the Sibyl, who stands at the right in front of her cave, and is just about to tell him her life-story. Behind Aeneas is a queue of people, including a king, bearing gifts and waiting to consult with the Sibyl. At the top left corner is a temple, and in the clouds above it the god Apollo, I believe.

JMW Turner’s first version of this later scene is thought to have been his first mythological painting, in about 1798. This second version, Lake Avernus: Aeneas and the Cumaean Sybil, dates from 1814 or 1815, and is both an improvement on the original and in better condition. True to the spirit of Claude’s landscape, this too is a mythological landscape showing the beautiful setting of Lake Avernus, near Pozzuoli, to the west of the city of Naples. In the distance are Baiae and the cliffs of Cape Miseno. The Sibyl, who doesn’t show her years, holds aloft a golden sprig rather than a bough, and Aeneas stands with his back to the viewer, as if he too is enjoying the view.

Turner’s last account is The Golden Bough, exhibited in 1834. It shows well how much his style had changed, although it retains compositional features from his earlier paintings. The Sibyl stands on the left, radiant in white light, and holding aloft a more substantial golden branch, with the golden sickle used to cut that branch, in her right hand. Down towards Lake Avernus are the Fates, dancing around a white glow. A couple of female companions of the Sibyl rest under the tree, but Aeneas is nowhere to be seen, although he might be in the middle of the Fates, perhaps. In the right foreground is a snake, a symbol of the underworld.

I hope that you enjoyed Saturday’s Mac Riddles, episode 302. Here are my solutions to them.

1: Shortened characters into the most common extension, formerly ASCII.

2: Medical practitioner at the end of word files until gaining a cross in 2002.

3: At the end of real estate inventory, most commonly for Info and preferences.

The common factor

I look forward to your putting alternative cases.

APFS has two special file types designed to economise on storage space: clone and sparse files. Clone files are two or more distinct files within the same volume whose data is shared; sparse files save space by skipping empty data and only storing data containing information. This article explores how they behave in use, with particular emphasis on Time Machine backups and iCloud Drive. The latter also involves a third type of special file, dataless files.

Clone files

In contrast to hard-linked files, clone files are two or more distinct files within the same file system (volume) whose file extents are identical, so share the same data, as shown below. They’re created by variants of normal file copying, including duplicating in the Finder (and drag-copying within the same volume), and the cp -c command.

Instead of duplicating everything, only the inode and its attributes (blue and pink) are duplicated, together with their file extent information. You can verify this by inspecting the numbers of those inodes, as they’re different, and information in the attributes such as the file’s name will also be different. There’s a flag in the file’s attributes to indicate that cloning has taken place. At first, the two cloned files share the same data blocks and extended attributes, but as the two files are changed by editing, they start to drift apart and become uncloned.

Clone files are becoming more popular thanks to the Hyperspace app, which deduplicates files within the same volume by replacing copies with clones.

Because they can only exist within the same file system, clone files are fragile. Any copy or move to another file system is invariably accompanied by the copying of their full data, and their economy of storage can only remain as long as they stay within the same volume.

Backups

One notable exception to this same-volume rule is in Time Machine backups. As clone files are preserved in local snapshots, when Time Machine constructs a backup as a snapshot in the backup storage volume, shared file extents are retained, so preserving clones. This is reflected in the size of the backup snapshot, and in the report written to the log. For example, when backing up three distinct files and ten clones of one of those, that report included:
14 Total Items in Backup (l: 16 GB p: 11.02 GB)
3 Files Copied (l: 6 GB p: 1.02 GB)
1 Directories Copied (l: Zero KB p: Zero KB)
10 Files Cloned (l: 10 GB p: 10 GB)

Backups made by other utilities are unlikely to reproduce this behaviour, though, as they can’t synthesise snapshots in the way that Time Machine does. To preserve clone files in their backups, they’d have to identify clones in the source and explicitly perform cloning in their backup store. Although Carbon Copy Cloner claims that “in some cases CCC may clone a file on the destination prior to updating its contents”, it doesn’t appear to attempt to preserve clone files in the backups it makes. I’m not aware of any third-party utility that does.

Unfortunately, Time Machine appears unable to restore directly from backup snapshots in the backup store, and performs Finder copies when restoring. That saves each of those clone files as a completely separate file, without any sharing of data. As a result, the space occupied on disk for a restored volume can be substantially greater than the original or its backup. Extensive use of clone files could thus cause problems when restoring from backups.

Of course, rolling a volume back to a local snapshot, such as one made during Time Machine backups, preserves all clone files within that volume.

iCloud Drive

Clone files created within the same volume as local iCloud Drive storage on the Data volume, or cloned when within a folder in iCloud Drive, remain within the same file system and clones are therefore preserved, and when the file is moved to other folders in the same volume.

However, clone files are treated as simple copies as far as iCloud Drive’s remote storage is concerned. While a pair of cloned 5 GB files only use a total of 5 GB local storage, they require a full 10 GB of your iCloud allocation, indicating that their cloud storage is separate and not common to both. Although the effects of eviction (removing local data) and materialisation (restoring local data from cloud storage) are difficult to observe directly, they appear to lose the benefits of cloning.

When the local copy of a file also stored remotely in the cloud is evicted, its data is removed from local storage, rendering it dataless, as shown below.

When that file is to be used locally again, its data has to be downloaded from the cloud service, and the local dataless file is materialised by adding its data back. As far as I can tell, that doesn’t result in the reconstruction of the shared file extents, so changes cloned files into normal copies with different file extents. You would then need to use Hyperspace to restore them as clone files. Other Macs sharing the same iCloud Drive also see them as full copies rather than clones.

These behaviours could also catch the user by surprise.

Sparse files

Unlike clone files, the structure of sparse files in APFS is conventional, as shown below.

They achieve their economy in storage by only including file extents containing non-null data, and thus aren’t dependent on remaining within the same file system (volume), making them more robust. Their primary requirement is that they’re created and maintained using specific file system operations, and are only copied or moved to other APFS file systems.

Backups

When backed up by Time Machine to another APFS volume, sparse files are preserved reliably, and are also restored as sparse files. That isn’t likely to hold, though, if the file is transferred using a network file system such as SMB, as all network transfers currently appear to explode sparse files to full size prior to transfer. Because of the way in which they have to be created, only the app maintaining that file could restore its sparse format. In the case of disk images, this should normally occur the next time they’re mounted in the Finder and Trimmed by APFS.

iCloud Drive

Assessing what happens with sparse files in iCloud Drive is considerably simpler than with clone files. As long as they remain downloaded to local storage, they are preserved, and can be moved in and out of iCloud Drive storage without exploding in size. However, they too are stored in full when in iCloud storage, requiring their full size in your iCloud allocation, and the eviction-materialisation cycle explodes them to full size, and their sparse file flag is removed.

The only way to return a former sparse file to its original economical format is then to open and save it using the app that creates and maintains it. In the case of disk images, this should occur when they’re next mounted and Trimmed.

Conclusions

Clone files:

• are only preserved when moved within the same file system (volume);
• are preserved and restored from local snapshots;
• are preserved in Time Machine backups, but aren’t restored from them;
• aren’t preserved in other backups;
• could result in a restored volume being substantially larger than its original;
• occupy their full space in your iCloud allocation;
• are only preserved in iCloud Drive when they aren’t evicted from local storage;
• can be regenerated using Hyperspace.

Sparse files:

• are only preserved when copied or moved directly between APFS volumes;
• aren’t preserved when copied or moved over network connections, or using SMB;
• aren’t preserved when copied or moved to different file systems, including HFS+;
• are preserved in and restored from local Time Machine backups;
• should be preserved in and restored from other local backups;
• occupy their full space in your iCloud allocation;
• are only preserved in iCloud Drive when they aren’t evicted from local storage;
• can only be regenerated by the app that creates and maintains them.

Both clone and sparse files can result in substantial savings in storage space. However, because that’s fragile, their greatest value is in minimising erase-write cycles in SSDs, hence slowing their ageing.

References

Apple’s APFS Reference (PDF), last revised 22 June 2020.
Dataless files are explained here.
How sparse files work
Files and clones
Special file types, including dataless files

In the first of these two articles tracing the first century of railways in paintings from the early 1840s, I had reached Claude Monet’s views of the Gare Saint-Lazare in Paris before 1880. By this time few countries in Europe had no railways, and trains frequently conveyed artists from their studios in the cities out to the beaches and mountains, journeys that a few years earlier could have taken days rather than hours.

Although Norway was a greater challenge for the railway engineers, Frits Thaulow seized the opportunity to show the results in The Train is Arriving from 1881. The country’s first public steam-hauled railway was developed by the son of George Stephenson, whose Rocket locomotive had inaugurated the first steam railway in the world. Norway’s line opened in 1854, and during the 1870s progressively made its way to Trondheim.

In 1888, Vincent van Gogh gave us The Blue Train (Viaduct in Arles).

Volodymyr Orlovsky’s undated Steppe shows a river in summer, with water levels at their minimum. Cattle are taking the opportunity to drink and cool off in the water. In the distance is the plume of smoke from a railway train, probably carrying grain and other produce from the Ukrainian countryside to one of the growing coastal cities for export.

The twentieth century brought the beginning of the end of the power of steam, marked in an unexpected twist of history. Between 1898 and 1900, a new railway station, initially known as the Gare d’Orléans, was built on the bank of the Seine at Quai d’Orsay, Paris. The first electrified urban railway terminal in the world, it was a star of the Exposition Universelle in 1900, where many Impressionist paintings were exhibited.

Victor Marec’s painting shows construction work being progressed in 1899, with a steam locomotive hauling construction trucks.

The Gare d’Orsay, as it became, started to suffer physical limitations in 1939, and its upper levels closed from 1973. In 1986 it re-opened as the most extensive collection of Impressionist art in the world, the Musée d’Orsay.

Maximilien Luce was one of the most expressive artists, who wasn’t an official war artist, to show scenes relating to the First World War. In his La Gare de l’Est (1917), a collection of wounded and battle-weary soldiers are shown at the entrance to this large Paris railway station.

The Gare de l’Est in Snow (1917) is even better-known, and a classic painting of falling snow in a large city.

Lesser Ury’s Nollendorfplatz Station at Night from 1925 shows the brilliant electric lighting around this busy railway station to the south of the Tiergarten, in one of Berlin’s shopping districts.

By this time, painting trains was becoming something of a sub-genre, particularly as steam trains were being replaced throughout Europe.

Eric Ravilious is one example of a twentieth century artist who painted motifs deeply embedded in the railway, in his Train Landscape from 1940.

A few narrative artists, including Joaquín Sorolla, set their stories inside railway carriages. My favourite among these is Berthold Woltze’s Der lästige Kavalier (1874), rendered into English as The Annoying Bloke, from 1874.

This is set in a railway carriage where there are two men and a young woman. She is dressed completely in black, and stares towards the viewer with tears in her eyes. Beside her is a carpet-bag, and opposite is a small wooden box and grey drapes.

Leaning over the back of her seat, and leering at her, is a middle-aged dandy with a brash moustache and mutton-chop whiskers, brandishing a lit cigar. He appears to be trying to chat her up, quite inappropriately, and very much against her wishes. Behind him, and almost cropped off the left edge of the canvas, is an older man with a dour, drawn face.

The young woman has apparently suffered a recent bereavement, and may even be travelling back after the funeral. She looks too young to have just buried a husband, so I think it more likely that she has just lost her last parent, and is now living alone, prey to the likes of this annoying and abusive bloke.