Although there are a few still life paintings from classical Roman times, the first known in modern painting was made by Hans Memling in about 1485, and Caravaggio painting one in about 1599. There were precious few until after 1610, and it wasn’t until the Dutch Golden Age that they appeared in any quantity. Once they started, they quickly became popular, and may have accounted for as much as 10% of all paintings sold in Leiden, for instance. Their success was the result of religious intolerance.

Unlike the Italian Renaissance, the Flemish Renaissance revelled in the faithful depiction of surface textures and adventures in optics. Centres such as Antwerp trained painters in the skills needed, but Flanders and Brabant formed the Catholic Spanish Netherlands, where religious paintings were expected. Artists who followed the Reformed tradition rather than Catholicism or who wanted to paint secular works found themselves oppressed, and many migrated to the north, to paint in the Dutch Republic.

One of the most successful of the pioneer still life painters of the early seventeenth century was also a woman, Clara Peeters, and one of the finest still life painters of any age. We don’t even know when she was born, but she seems to have trained in Antwerp, then pursued her career successfully in the Dutch Republic. She’s thought to have been internationally successful by 1611, when at least four of her paintings were sold to Spain. Her last reliably-dated works are from 1621, although there are a few attributed to her from later.

Venetian Glass, Roemer and a Candlestick (1607) is one of Peeters’ earliest known works, which shows an extraordinary skill in rendering the varied surfaces and their optical properties. It is also one of the first still lifes in which the artist has included their own image reflected in the motif, here the base of the candlestick holder.

As in many still lifes, its contents have interesting symbolic meaning. The confectionery shown is sweet and ephemeral, the ring a sign of earthly riches and temporal relationships, the fly an indicator of earthly decay, and the burning candle combines remembrance with the strict limits on lifespan in this world. This is not just a still life, but an expression of vanitas, the futility and limits of our earthly existence, a theme for a separate article in this series.

Her paintings from 1611 that ended up in the Spanish Royal Collection, and are now in the Prado, move on from that impressive start.

This Table is laid out for a meal, with its range of food and surfaces with different optical properties. Settings for meals, particularly that of breakfast, were later to become a sub-genre in their own right.

Over the coming centuries, still life paintings featuring game were to become popular throughout Europe. Peeters’ Still Life with Game Piece and Poultry is their ancestor. Shells are another vanitas association.

Her Still Life of Fish and a Candlestick is one of the earliest and most accomplished paintings of the fruits de mer, which were to find favour with William Merritt Chase nearly three centuries later.

In the last of these from the Spanish collection, Clara Peeters makes another cameo appearance in its reflections, providing tantalising glimpses of herself.

The following year, her still life with Flowers and Gold Cups of Honour (1612) reveals multiple miniature self-portraits reflected in the gold cup at the right.

In her still life with Cheeses, Almonds and Pretzels from about 1615, her surface and optical rendering is breathtaking, and all thoughts of vanitas have gone. This is a celebration of the thoroughly earthly and sensuous pleasures of food. These are sustained in several of her other later paintings.

She hadn’t entirely forgotten the spiritual dimension, though. Another of her most interesting paintings returns to the concept of vanitas and the ephemeral.

Peeters established herself an international reputation, sold her paintings into major art collections, and pioneered what was to come in the rest of the century, yet is omitted from many accounts of painting in the Dutch Golden Age.

By this time, still life paintings were enjoying growing popularity in the buoyant market of the Dutch Golden Age. Ambrosius Bosschaert (1573–1621) painted this Flower Still Life in oil on copper in 1614, during the early years. He had been born in Antwerp, but because of the threat of religious persecution moved to Middelburg in the Dutch Republic, where he founded a school of floral painting.

At first its eclectic mixture of different flowers and flying insects appears haphazard. These merit a deeper reading, though: the flowers include carnation, rose, tulip, forget-me-nots, lilies of the valley, cyclamen, violet and hyacinth. These could never, at that time, have bloomed at the same time. The butterflies, bee and dragonfly are as ephemeral as the flowers around them. This too has more than a touch of vanitas.

By 1620, still life paintings were much in demand in northern Europe, and had ceased being occasional curiosities. Bosschaert’s career and family business was founded on the still life, which had come of age at last.

Collations of food grew ever more inventive, with Pieter Claesz combining a table of bread and delights in his Still Life with Musical Instruments from 1623. His underlying themes here are the rich browns of the food, wood and tortoise, and their curved forms. Claesz had been born near Antwerp, trained in that city and became a master there in 1620, when he too migrated to the Dutch Republic, where he established his studio in Haarlem.

Other artists developed the still life in the direction of food, as shown in Willem Kalf’s Still Life with Ewer, Vessels and Pomegranate from about 1645. He brings together an impressive variety of surface optical effects too, in this bravura display of technique.

Still life paintings pressed on into culinary exhibitions, usually centred on the breakfast table (ontbijtjes), which in Spain developed into bodegone, populated by caterers and their customers at roadside stalls.

Another fine example is Pieter Claesz’s Still Life with Salt Tub from about 1644, with its combination of bread, fish, sea salt, and an ornate glass goblet with its optical effects.

I’ve already shown some still life paintings including living creatures. Those developed into another sub-genre of dead game, which in turn linked to hunting and the depiction of wildlife.

Jan Weenix specialised in this sub-genre. His Still Life of a Dead Hare, Partridges, and Other Birds in a Niche from about 1675 is one of a large number of finely detailed and realistic paintings which he made. Weenix was born in Amsterdam, where he lived and worked for much of his life, but was a Catholic who worshipped in ‘hidden’ churches that were tolerated in the Dutch Republic.

These piles of animal corpses spilled out into a strangely dark countryside, in paintings such as his Still Life of Game including a Hare, Black Grouse and Partridge, a Spaniel looking on with a Pigeon in Flight from about 1680. These became popular at the time, and Weenix was commissioned to decorate the houses of the rich with large murals on canvas, and to paint series for European royal courts. The more ostentatious paintings were known as pronkstilleven.

Others used the still life as a link to what later became natural history painting.

For their familiarity, bright colours, and natural beauty, butterflies were popular in the Dutch Golden Age, particularly in smaller paintings such as still lifes destined for the collector’s cabinet. Nicolaes de Vree’s undated Forest Floor Still Life with Flowering Plants and Butterflies from the latter half of the seventeenth century is a fine example of a painting that goes beyond the normal still life and depicts a more natural scene.

Still life painting during the Dutch Golden Age flourished and brought commercial success to many artists. It also laid the foundations for several sub-genres which were to be developed later. Far from being the lowest of the genres, for around a century in the Dutch Republic they were among the most innovative and exciting.

Security utilities that detect known malicious software do so using sets of detection rules. Since their introduction by Victor Alvarez of VirusTotal 12 years ago, the most common method of expressing these rules is in a text file with the extension .yara. Apparently YARA stands for either YARA: Another Recursive Acronym, or Yet Another Ridiculous Acronym.

Yara rules are used extensively in macOS by both the original XProtect and its sibling XProtect Remediator. Those of XProtect are found in the XProtect.yara file in XProtect.bundle, in /Library/Apple/System/Library/CoreServices and its additional location in /private/var/protected/xprotect in Sequoia and later. Further Yara rules are also encrypted and embedded in XProtect Remediator’s scanning modules, as detailed by Koh M. Nakagawa in the FFRI Security GitHub.

As used by Apple, each rule can consist of up to three sections:

• meta, containing the rule’s metadata including a description and in more recent cases a UUID for the rule.
• strings, specifying some of the content of the file, typically in the form of hexadecimal strings such as { A0 6B }.
• condition, a logical expression that, when satisfied, meets the requirements of that rule, so identifying it as malicious.

I’ll exemplify these using Yara rules used in XProtect version 5310.

Private rules

At the start of the Yara file are any private rules. These are a bit like macros, in that they define properties that are then used in multiple rules later. Laid out in compact form, an example reads:

private rule Shebang
{ meta:
description = "private rule to match shell scripts by shebang (!#)"
condition:
uint16(0) == 0x2123
}

This starts with description metadata for this private rule, then states the condition for satisfying this rule, that the first 16-bit unsigned integer in the file contains the hex 0x2123, the UTF-8 characters 0x21 or ! and 0x23 or #, together known as the shebang, and the opening characters of many shell scripts.

This defines what’s required of a Shebang, and can be included in the conditions of other Yara rules. Instead of having to redefine the same feature in every rule, they can simply include that Shebang rule in their condition.

Regular rules

After 3-5 private rules, the XProtect Yara file goes on to enumerate 372 normal rules, including this one:

rule XProtect_MACOS_SOMA_JLEN
{meta:
description = "MACOS.SOMA.JLEN"
uuid = "4215C9D4-57D5-4D30-82E1-96477493E8D5"
strings:
$a0 = { 4c 8d 3d ?? 74 0b 00 4c 8d 25 ?? ?? 0b 00 4c 8d 2d ?? ?? 0b 00 48 8d 5d c0 }
$a1 = { 73 62 06 91 d4 03 00 f0 94 42 21 91 }
condition:
Macho and ( ( $a0 ) or ( $a1 ) ) and filesize < 5MB
}

This rule has its internal code name as its description, and has been assigned the UUID shown. It then defines two binary strings, a0 and a1, the former containing ‘wild’ values expressed using the question mark ?. The condition for satisfying the rule is that the file must:

• be a Mach-O binary, and
• contain either a0 or a1, and
• its size must be less than 5 MB.

Further details about Yara rules are given here.

Implementation

There are standard implementations that can check files against custom sets of Yara rules. Rules are normally compiled into binary form from their text originals before use. Full details are given on VirusTotal.

Apple’s use of Yara files is mysterious, as for some years all the descriptions used arbitrary code names as obfuscation. When the source of all the rules is given in plain text, it’s hard to see what purpose that served, and it meant that users were told that MACOS.0e32a32 had been detected in an XProtect scan, for instance. Thankfully, Apple has more recently replaced most of those with more meaningful names.

I’m grateful to Duncan for asking me to explain this, and hope I have been successful.

Apple has just released an update to XProtect for all supported versions of macOS, bringing it to version 5311. As usual, Apple doesn’t release information about what security issues this update might add or change.

This version adds eight new detection rules, for MACOS.BANSHEE.MA, MACOS.BANSHEE.MA2, MACOS.SOMA.GEGO, MACOS.POSEIDON.B, MACOS.TIMELYTURTLE.FUNA, MACOS.TIMELYTURTLE, MACOS.TIMELYTURTLE.INDRBYSE and MACOS.TIMELYTURTLE.INDR. Banshee, Poseidon and TimelyTurtle are new names in XProtect’s Yara rules.

You can check whether this update has been installed by opening System Information via About This Mac, and selecting the Installations item under Software.

A full listing of security data file versions is given by SilentKnight and SystHist for El Capitan to Tahoe available from their product page. If your Mac hasn’t yet installed this update, you can force it using SilentKnight or at the command line.

If you want to install this as a named update in SilentKnight, its label is XProtectPlistConfigData_10_15-5311

Sequoia and Tahoe systems only

This update has already been released for Sequoia via iCloud. If you want to check it manually, use the Terminal command
sudo xprotect check
then enter your admin password. If that returns version 5311 but your Mac still reports an older version is installed, you may be able to force the update using
sudo xprotect update

Unlike watercolour, oil paint ‘dries’ by an irreversible process of chemical polymerisation. Once ‘dried’ it resists solvents and can be painted over without any risk of its pigments mixing between layers. Unlike modern acrylic paints, oil paint usually takes at least a week or two before its surface is dry, so allows the painter to control mixing of an existing layer with fresh paint. Skilful control of paint viscosity and drying rate thus gives fine control over the softness of edges and their blurring or sharpness.

This is illustrated well in Lucas Cranach the Elder’s portrait of Salome with the Head of Saint John the Baptist from about 1530. Crisp edges appear where you expect, for example between skin and clothing. In some places, he also outlined edges with thin lines of dark shadow for emphasis. Where skin tone changes more subtly, and in Salome’s eyebrows, there are soft transitions achieved by painting wet on wet and blurring the edge, a technique often known as sfumato, as seen in the detail below.

Cranach and the staff of his workshop would have worked on that painting over a period of many weeks to achieve those effects. In contrast, sketching with oil paints in front of the motif is far simpler, and on a more modest scale. Because of constantly changing light and shadow, most proficient landscape artists aim to complete their oil sketches in under two hours, and an hour is ideal.

Robert Henri’s Landscape Sketch at Escorial (1906) was painted on a wooden pochade panel, almost certainly in a single short session outside the city of Madrid, in the hills near the Escorial. Although he used the viscosity of different paints to make its skyline sharp, you can see where his coarse brushstrokes have been applied and colours mixed and laid in streaks.

The young Canadian artist Tom Thomson excelled in rapid sketching in oils, with several witnessed accounts of him dashing off a painting in little more than fifteen minutes. As a result he was able to capture many transient effects, such as the passing thunderstorm in Thunderhead from 1912-13. He has found it harder to keep a crisp skyline, and clearest separation of paint is in the white masts of the boats at the edge of the water. Those were painted last, in single strokes with as little diluent as possible.

Before the nineteenth century, quick oil sketches were almost never shown to the public, but used by masters including Valenciennes and Constable purely as preparative studies. When fashions changed, it became acceptable if not desirable for paintings to look sketchy and rushed, although appearances can sometimes be deceptive.

Some masters of fast painting used these skills in multiple sessions, to increase the amount of detail they could incorporate into a landscape. When Pissarro suffered from eye problems late in his career, he painted from rooms with views over the streets of Paris, and produced some of his finest cityscapes.

Boulevard Montmartre, Spring Morning (1897) is composed primarily of buildings and streets, a plethora of figures, and countless carriages to move those people around, the ingredients for so many of his late paintings.

In the foreground, Pissarro may have formed each quite roughly, but he has painted in sufficient detail. Three white horses range in tone and colour, with highlights on the front of each head. You can see which people are wearing hats, and spot ladies in their fashionable clothing.

Deeper into the distance, detail is lost, and the carriages and crowds merge into one another. Still they have a rhythm, highlights and shadows, and form. He must have spent day after day at his hotel window populating these busy streets.

Other Impressionist paintings appear at first sight to have been painted quickly in front of the motif, but were more likely worked on over a period of months in the studio. Once the public had come to expect an Impressionist painting to look as if it had been painted quickly, they expected the same look even though some paintings may have required several months painting.

Monet’s Flowering Plum Trees (1879), for example, has a complex structure in its paint layer, as seen from the surface in the detail below. Some marks have been added wet-in-wet, but many wet-on-dry, demonstrating it must have been worked on over a period of weeks or months.

The myth about Monet’s Grainstacks series is that they depict transient effects of season, weather, and light, as they were painted en plein air over the course of the winter. Looking at all twenty-five, I have long had my doubts, and suspect that Monet spent a lot of the time prior to their exhibition making further changes to them. This in no way lessens Monet’s sublime achievement, nor their art in any way. It’s just that they aren’t quite the paintings described by the myth that has grown around them.

Looking at Grainstacks, End of Summer, considered to be one of the earliest in the series and numbered 1266, the trees behind the two grainstacks are still in full summer leaf, with no indication of the advent of autumn. Yet Monet’s signature gives the year as 1891. Looking at its paint surface in detail (below), some has been applied wet-in-wet and blended with underlying and adjacent paint, but many other brushstrokes have clearly been applied over dry underlayers.

The blue-grey shadow of this grainstack was applied with relatively dilute paint wet-on-dry over thicker off-white paint with marked surface texture. However, that off-white paint has itself been applied wet-on-dry over a pale green layer. This couldn’t have been achieved in the same day, even when the ambient temperatures were warmer during the early autumn, but probably reflects at least three sessions with drying time in between them.

Grainstack, Sun in the Mist, numbered 1286, is thought to be one of the later paintings in the series, apparently showing the sole remaining grainstack in the Spring of 1891. It too has multiple layers applied wet-on-dry, with many hatched brushstrokes in shades of orange and pink apparently applied over a well-dried surface. These are again shown well in the detail (below) of the grainstack itself.

At the right side of the foot of the grainstack, the lowest layer of paint consists of dull blue and green that appear to have been applied at about the same time and have blended in places. When that layer had dried, infrequent and relatively thick streaks of white were added wet-on-dry. When that had dried, brown-orange was applied to form the uppermost layer. That uppermost layer has also been used to remodel the form of the grainstack using thickly-applied flesh, pale yellow and orange paint.

The evidence points to Monet starting each of this series with a sketch using more dilute paint in front of the motif in the circumstances described in the title. He then brought each canvas into his studio, where he continued to work on it, making further adjustments, adding partial layers of paint, and tweaking each work in comparison to the others in the series. This would have taken place over a period of several weeks: in the case of the canvases that he had started at the end of the summer of 1890, such as W1266 above, that period could have amounted to six months.

That may well have been longer than the time taken by Cranach to paint Salome.

For many of us, Live Text and Visual Look Up are real boons, making it simple to copy text from images, to perform Optical Character Recognition (OCR) on images of text, and to identify objects of interest. They are also used by the mediaanalysisd service to extract text and object identifications for indexing by Spotlight, making those image contents searchable. Although the latter can be disabled generally or for specific folders in Spotlight settings, there appears to be only one control over Live Text, and none for Visual Look Up. This article examines what that single control does, using log extracts obtained from a Mac mini M4 Pro running macOS Sequoia 15.6. It follows my recent article on how these features work.

Setting

Live Text, which is enabled by default, can be disabled in Language & Region settings. When that is turned off, opening an image containing text in Preview no longer makes any text selectable. However, Visual Look Up still works as normal.

Textual images

When an image containing recognisable text but no other objects is opened in Preview, the VisionKit subsystem is still activated soon after the image is loaded. VisionKit initially reports that the “device” supports analysis, but immediately clarifies that to
Device does not support image analysis, but does support Visual Search, limiting to just Visual Search.
It then starts a VKImageAnalyzerProcessRequestEvent with a MAD parse request. That leads to a Visual Search Gating Task being run, and the Apple Neural Engine (ANE) and all CPU P cores are prepared for that.

Less than 0.1 second later, the end of the VKImageAnalyzerProcessRequestEvent is reported, and VisionKit returns an analysis that no image segments merits further analysis. Preview’s ⓘ Info button remains in its normal state, and clicking on that doesn’t alter the image displayed.

Images with other objects

An image containing potentially recognisable objects doesn’t stop there. If VisionKit returns an analysis indicating Visual Search could extract objects from the image, the ⓘ Info button adds stars and waits for the user to open the Info window.

VisionKit reports in the log
Setting Active Interaction Types: [private], [private]
then that it
DidShowVisualSearchHints with invocationType: VisualSearchHintsActivated, id: 1

When one of those Visual Search Hints is clicked, the Lookup View is prepared, followed by a notice from LookupViewService that it’s Changing state from LVSDisplayStateConfigured to LVSDisplayStateSearching. That leads to VisionKit making a Visual Search request from mediaanalysisd.

After the Apple Neural Engine (ANE) is run to progress that, successful search results in PegasusKit making its internet connection to identify the object, exactly as it does when Live Text is enabled and text has been recovered from the image:
Querying https: // api-glb-aeuw1b.smoot.apple.com/apple.parsec.visualsearch.v2.VisualSearch/VisualSearch with request (requestId: [UUID]) : (headers: ["Content-Type": "application/grpc+proto", "grpc-encoding": "gzip", "grpc-accept-encoding": "gzip", "grpc-message-type": "apple.parsec.visualsearch.v2.VisualSearchRequest", "X-Apple-RequestId": "[UUID]", "User-Agent": "PegasusKit/1 (Mac16,11; macOS 15.6 24G84) visualintelligence/1", "grpc-timeout": "10S"]) [private]

The ANE is finally cleaned up and shut down as the search results are displayed in the Lookup View.

Conclusions

• When Live Text is disabled in Language & Region settings, images are still analysed when they are opened, to determine if they’re likely to contain objects that can be recognised in Visual Search for Visual Look Up.
• If there are no such objects detected, VisionKit proceeds no further.
• If there are suitable objects, mediaanalysisd and VisionKit proceed to identify them using Visual Search Hints, as normal.
• If the user clicks on a Visual Search Hint, PegasusKit connects to Apple’s servers to identify that object and provide information for display in the Lookup View.
• Although there is less extensive use of the ANE and CPU cores than when Live Text is enabled, neural networks are still run locally to perform a more limited image analysis.

I’m very grateful to Benjamin for pointing out this control over Live Text.

In the First Circle of Hell, Dante and his guide Virgil saw the souls caught in Limbo. From there they descend to the Second Circle, where they find those guilty of the sin of lust. They pass the figure of Minos, who extracts a confession from every sinner as they begin their descent, and directs them onward to the appropriate circle for their sins.

Here the light is dim, and there is an eternal storm blowing those in this circle, ensuring they never obtain any comfort or relief from its incessant blast. The first of those described by Virgil to Dante is Semiramis, who married her father and made such incestuous relationships legal. (This is now known to be a false legend recorded by Orosius, popular in Dante’s time.)

Then they see Cleopatra, Achilles, Paris and Tristan. Dante tells the story of Francesca in most detail, and possibly for the first time in literature. She appears, blown in the wind, with her lover Paolo, but it’s Francesca who speaks to Dante.

Francesca da Rimini was the aunt of Dante’s host when he lived his later years in Ravenna. In about 1275, she married Gianciotto of the ruling family in Rimini, for political reasons. There’s strong suspicion that she had been tricked into this: her husband turned out to be disfigured and uncouth, but pre-nuptial negotiations were conducted by his handsome and eloquent brother Paolo, suggesting she was duped.

Soon after the marriage, Paolo and Francesca became lovers, apparently inspired by the story of Lancelot and Guinevere. Gianciotto suspected the couple, and one day caught them together in his wife’s bedroom.

Paolo had become stuck when trying to escape through a trapdoor. Francesca was unaware of that, and let her husband in, who then attacked his brother with his sword. But Francesca stepped in between them to save her lover and was killed; Gianciotto then killed his brother, and after his own death had descended further into Hell for that double murder.

Dante’s story has inspired a succession of masterly paintings.

It was William Blake’s Whirlwind of Lovers that transformed these depictions.

This story is told in Dante Gabriel Rossetti’s watercolour triptych: at the left, the lovers are reading the legend of Lancelot and Guinevere. In the centre are Dante and Virgil, and at the right Paolo and Francesca are being blown in the storms of the Second Circle of Hell.

Dante faints at the tragic story that Francesca has told him, and collapses as if dead.

The artists

William Blake (1757–1827) was a British visionary painter and illustrator whose last and incomplete work was an illustrated edition of the Divine Comedy for the painter John Linnell. Most of his works shown in this series were created for that, although he did draw and paint scenes during his earlier career. I have a major series on his work here.

Umberto Boccioni (1882–1916) was an Italian painter and sculptor whose tragically short career was a major influence over the development of Futurism. Drafted into the Italian Army during the First World War, he was thrown from his horse and trampled to death when he was only thirty-three.

Alexandre Cabanel (1823–1889) was a major French painter of history in an academic style, and a precocious artist. He won the Prix de Rome in 1845, and was appointed a professor at the École des Beaux-Arts in Paris in 1864, teaching many successful pupils including Jules Bastien-Lepage. This article summarises his career and work.

Gustave Doré (1832–1883) was the leading French illustrator of the nineteenth century, whose paintings are still relatively unknown. Early in his career, he produced a complete set of seventy illustrations for translations of the Inferno, first published in 1857 and still being used. These were followed in 1867 by more illustrations for Purgatorio and Paradiso, and this painting was highly praised when shown at the Paris Salon in 1863. This article looks at his paintings.

Giuseppe Frascheri (1809–1886) was an Italian painter in fresco and oils who has been almost completely forgotten.

Jean Auguste Dominique Ingres (1780–1867) was a major French painter in Neoclassical style, best known for his history and other narrative paintings. He was a pupil of Jacques-Louis David, and continued much in his tradition, and in opposition to the more Romantic painting of Eugène Delacroix. His work extended from portraits to Orientalism.

Gaetano Previati (1852–1920) was an Italian painter who worked mainly in Divisionist style, but is now known for his Symbolism. He was most famous in the period 1880-1920, during which he was involved in the Venice Biennale and exhibitions in Italy and Paris.

Dante Gabriel Rossetti (1828–1882) was of Italian descent but born in London. In 1848, he co-founded the Pre-Raphaelite Brotherhood, and was a major figure in British painting until his early death in 1882. A published poet and author himself, many of his paintings were in response to literature, particularly the poems of John Keats. He had a succession of relationships with his models and muses, including Elizabeth Siddal, Fanny Cornforth, and William Morris’s wife Jane. The triptych shown here is the earliest of at least three paintings of his showing Paolo and Francesca, another similar triptych being from 1862.

Ary Scheffer (1795–1858) was a major narrative painter of the first half of the nineteenth century, born in the Netherlands but trained and working in Paris. Among his favourite literary themes were Goethe’s Faust, and the story of Paolo and Francesca. This article looks at his narrative work.

George Frederic Watts (1817–1904) was a major British painter and sculptor in the middle and late nineteenth century who was associated with several artistic circles and movements including the Pre-Raphaelites, but who worked independently in more Symbolist style. This article looks at his career and paintings.

References

Wikipedia
Danteworlds

Robin Kirkpatrick (trans) (2012) Dante, The Divine Comedy, Inferno, Purgatorio, Paradiso, Penguin Classics. ISBN 978 0 141 19749 4.
Richard Lansing (ed) (2000) The Dante Encyclopedia, Routledge. ISBN 978 0 415 87611 7.
Guy P Raffa (2009) The Complete Danteworlds, A Reader’s Guide to the Divine Comedy, Chicago UP. ISBN 978 0 2267 0270 4.
Prue Shaw (2014) Reading Dante, From Here to Eternity, Liveright. ISBN 978 1 63149 006 4.

I hope that you enjoyed Saturday’s Mac Riddles, episode 321. Here are my solutions to them.

1: Where to sell an image of the Knolls in a two-year exclusive.

2: Rembrandt, Claude Monet, JMW Turner and Corel.

3: One of the first two, it could be beige acrylic and written by Bill.

The common factor

I look forward to your putting alternative cases.

There are some topics that invariably generate comments from those who have either abandoned a major feature in macOS, or are struggling with it. Some of the most persistent are problems with Spotlight, particularly with its local search of files on your Mac. To help grapple with those, four years ago I added some Spotlight tests to Mints that can be used to work out where those problems are occurring. I’m delighted now to offer an extension to those in a whole new app, perhaps predictably named SpotTest.

Spotlight is so substantial, almost silent in the log, and impenetrable that the best approach to diagnosing its problems is to test it out in a controlled way. Mints has been doing that by creating a folder of files containing an unusual word, then searching for that. Although that’s still useful for a quick test, we need something more focused and flexible, and that’s what SpotTest aims to deliver.

Following deep dives into how Spotlight indexes and searches metadata and contents of files, and how it can search text extracted from images and the results of image analysis, I’ve realised that different test files are required, together with alternative means of search. For example, the standard approach used in compiled apps, with NSMetadataQuery, is incapable of finding content tags obtained using Visual Look Up, which only appear when using the mdfind command. SpotTest takes these into account.

There are now 15 carefully crafted test files, of which one cannot currently be found, no matter what method of search you try.

A perfect 13/15 result from NSMetadataQuery is only possible after waiting a day or more for background mediaanalysisd processing to recognise and extract the text in file I, a PNG image. The other 12 here should all be found when running this test a few seconds after the test files have been created. They rely on a range of mdimporter modules bundled in macOS, apart from file L, an XML property list.

Another of SpotTest’s tools will list the mdimporters used for each of the test files.

Run the search using the mdfind command within SpotTest and, once mediaanalysisd has done its image recognition, you should get a perfect 14/15.

The only current limitation of SpotTest version 1.0 is that it can only run tests on the Data volume that your Mac started up from, using a folder at the top level of your Home folder. A future version will let you test other volumes as well. Its Help book runs to nine pages: please read them, as its test might seem deceptively simple but provide a lot of useful information about how Spotlight local search is functioning. Coupled with log extracts using LogUI it should shine light in the darkness.

SpotTest 1.0, which requires macOS 14.6 or later, is now available from here: spottest10
and from its new place in its Product Page.

I wish you successful searching.

The element chromium gains its name from the rich colours seen in many of its salts and compounds. One of them, chromium oxide, was discovered in about 1798 by Louis-Nicolas Vauquelin, who immediately recognised its future use as a pigment, because of its “fine emerald colour”. But painters were still enamoured with more toxic greens, and straight chromium oxide doesn’t look particularly brilliant, being a rather dull yellow-green. Its introduction into paintings probably didn’t start until around 1840, when landscape painting outdoors was becoming all the rage.

Some of the earliest paintings known to use chromium oxide are those of Moritz von Schwind, of which the first example that I can show is his Mermaids Watering a Stag from about 1846. He seems to have used the pigment quite extensively here in foliage, although probably in combination with other pigments.

Von Schwind’s King Krokus and the Wood Nymph from about 1855 is a clearer image, where he probably used chromium oxide in combination for most of his greens.

As these works were being painted, an improved version of chromium oxide was being developed: hydrated chromium oxide, which became known as viridian during the 1860s. This first became available at a reasonable price after Guignet started to make it in quantity in 1859, so has also been known as Guignet’s green. It’s sometimes termed émeraude or emerald, which only serves to confuse viridian with copper acetoarsenate, more widely known as emerald green.

Viridian came into use during the 1860s, and has proved far more popular than chromium oxide. Both pigments are reliably lightfast, opaque, and have good covering power, but viridian is the more intense, and doesn’t appear dull like plain chromium oxide.

Anselm Feuerbach’s painting of Paolo and Francesca from 1864 is one of the earlier works found to contain viridian among its many rich greens.

The best example showing off the colour of viridian is perhaps Édouard Manet’s The Balcony (1868-69), where he appears to have used the pigment throughout the blinds and railings, most probably mixed with lead white, and unmixed for the woman’s parasol.

Arnold Böcklin’s Triton and Nereid from 1874 is unusual in several respects. It’s reported as being painted in tempera rather than oils, but its deep lustrous greens were developed using a base of predominantly viridian, over which Böcklin applied a copper resinate glaze.

Pierre-Auguste Renoir’s La Yole (The Skiff) of 1875 uses viridian as the main colour for the reeds in the left foreground.

Analysis of Claude Monet’s series of paintings of the Gare Saint-Lazare in 1877 has revealed extensive use of viridian in mixtures, including the green shadows in the roof. In Arrival of the Normandy Train, Gare Saint-Lazare (1877), the pigment is apparent (and confirmed) throughout the green foreground of the platform, an optical effect resulting from light passing through the glass roof of the station.

Renoir used viridian together with malachite green and other pigments for the greens in his Chrysanthemums (1881-82).

If you care to spend some time examining the myriads of tiny dots in Georges Seurat’s monumental Divisionist painting of A Sunday Afternoon on the Island of La Grande Jatte (1884-86), I’m assured that you’ll find many of those forming its vegetation contain viridian.

Viridian remained popular among the post-Impressionists, from whom I have two well-known paintings as examples.

Vincent van Gogh included viridian in the pigments used in the range of greens in his A Wheatfield, with Cypresses (1889), which is more unusual for his use of ultramarine blue mixed to form green.

Paul Cézanne is known to have had a strong preference for viridian as one of the key colours in his palette. However, in his Hillside in Provence (1890-92), it is emerald green that is the more prominent, and the major part of the painting’s more brilliant greens, even into its pale turquoise sky. Some green passages, such as the patch of yellow-green grass at the edge of the path in the foreground, at the right edge of the canvas, have been built with a base of lead white and viridian, over which he has applied a yellow lake glaze.

Chromium oxide and viridian remain widely available today; although the former is not popular or widely used, viridian remains a mainstay green widely recommended for its colour and other properties. Being virtually insoluble, chromium oxide and viridian pose minimal risks of toxicity to the artist. However, there is growing concern over their environmental effects, and great care is needed when handling waste paint containing either pigment.

Reference

Richard Newman (1997) Artists’ Pigments, vol 3, ed Elisabeth West FitzHugh, Archetype. ISBN 978 1 904982 76 0.

If there’s one thing you can rely on about the UK weather, it’s rain. Unless you live in that narrow belt of East Anglia officially classed as semi-arid, you’ll be used to rain whatever the season or forecast.

The last time we had a long dry summer was 1976, when much of Northern Europe basked in sunshine from late May until the end of August. This year has proved similar, so here we are again, dry as a bone, banned from using hosepipes except to wash down horses, wondering when the inevitable floods will start. In 1976, dry weather broke but a couple of weeks after the appointment of a Minister for Drought, whose brief was promptly extended to cover the ensuing inundation.

With this shortage of water, it might seem surprising that over the next five years around a hundred new data centres are expected to be built in the UK. These are the data centres we all want to support our AI chatbots and cloud services, but nobody wants in their neighbourhood. No one has explained where all their power and water supplies will come from, although apparently ten new reservoirs are already being built in anticipation.

The best piece of advice we have been given to help our shortage of water is to delete all our old emails and photos. Apparently by reducing what we have stored in the cloud, those data centres won’t get so hot, and will consume less water. Really?

Meanwhile back on planet Earth, last week I was studying the log entries made on behalf of the Apple Neural Engine, ANE, inside my Mac mini’s M4 Pro chip, when it was running local models to support Live Text and Visual Look Up. We now take these features for granted, and maybe aren’t even aware of using them, or of what our Mac’s ANE is doing. Yet every Apple silicon Mac sold over the last five years has the dedicated hardware possessed by only a small minority of PCs. They can, of course, use other hardware including GPUs, well known for their excessive power and cooling demands. For many the only solution is to go off-device and call on some of those data centres, as you do with ChatGPT, Google’s answer engine, and even Elon Musk’s Grok if you really must.

Live Text is a particularly good example of a task that can, given the right hardware, be performed entirely on-device, and at relatively low energy cost. It’s also one that many of us would rather not farm out to someone’s data centre, but keep to the privacy of our own Mac. While it does work surprisingly well on recent Intel Macs, it’s just what the ANE was intended to make sufficiently performant that it can be commonplace. Just over three years ago, before WWDC 2022, I wrote: “But if I had to put my money anywhere, it would be on the ANE working harder in the coming months and years, to our advantage.”

With so many Macs now capable of what seemed miraculous in the recent past, we’re only going to see more apps taking advantage of those millions of ANEs. Developers are already starting to use Apple’s new Foundation Models supported by macOS 26 Tahoe, all of which run on-device rather than in those data centres. In case you’re concerned about the ethics of what this might be unleashing, Apple has already anticipated that in a stringent set of acceptable use requirements, that also apply to apps provided outside the App Store.

Obtaining reliable estimates of the performance and power consumption of the ANE is fraught, but I have measured them during Visual Look Up on an M1 Max (with an H11ANE), and found peak power used was 30-50 mW. According to mot’s comment to that article, when running an inference task intended to push that in an M1 Pro to the maximum, its ANE drew a maximum of 2 W. That’s frugal compared to running equivalent intensive tasks on Performance CPU cores or an Apple silicon GPU, which can readily use more than 1 W per P core.

Can someone suggest that, instead of deleting old emails and photos, we’d be better off running our favourite AI on-device using an Apple Neural Engine? I still don’t think it would do anything to help our current drought, but it could spare us a few of those projected data centres.

Rumours still abound as to the cause of Napoleon’s death over two centuries ago. One theory, not currently in favour, is that he was poisoned by arsenic in the wallpaper. At the time, that would have been unusual, but by the 1860s such deaths were significant enough to be reported in newspapers. Their ultimate cause was also one of the factors behind the success of Impressionist landscape painting: emerald green.

Getting a good range of green pigments was vital for landscape painting, and more generally for coloured commercial products such as wallpaper and clothing. The first of the ‘poison greens’ to be discovered was that named after Carl Wilhelm Scheele, the Swedish chemist who originally made it in 1775: copper arsenite, a highly toxic salt of arsenic. Soon after its introduction from about 1780, it became clear that it tended to darken with age, and the search began for a replacement.

Little attention has been paid to the use of Scheele’s green, and it isn’t clear how widely it was used, or even when it was first used in painting.

JMW Turner’s early oil sketch of Guildford from the Banks of the Wey, painted in about 1805, has been found to contain Scheele’s green. Given its range of greens, that could be quite extensive.

Wilhelm Sattler, a paint manufacturer in Schweinfurt, Germany, worked with Friedrich Russ to discover an even better arsenic compound for use as a colourant, and from 1814 Sattler’s company manufactured Schweinfurt or emerald green, the equally toxic copper acetoarsenite. Its alluringly brilliant green colour appears very stable, with only slight darkening resulting from reaction with hydrogen sulphide, a common atmospheric pollutant.

By about 1830-32, when Turner painted Going to School as an illustration for Rogers’s Poems, he had switched to using emerald green, obvious from its characteristic colour standing out from the small bag on the boy’s back.

Turner used emerald green again in this watercolour painting of Rouen, Looking Downstream from about 1832, here in combination with other pigments, so less brashly.

Concerns over the established toxicity of these two greens were raised by 1839, when warnings were first issued in Bavaria. Despite those, the use of emerald green became more widespread, and it was even ‘fixed’ to ball gowns using albumen or dextrin, which allowed its poisonous dust to brush free from the garment when dancing. It also became particularly popular, and insidiously toxic, in coloured wallpapers. When applied on damp walls, as were common at the time, fungal products could produce trimethyl arsine gas, which is thought to have been responsible for many of the symptoms and deaths that were reported.

Édouard Manet’s Music in the Tuileries (1862) is an unusual example of a painting containing both Scheele’s and emerald greens. Manet used them in combination in two different glazes applied to the areas of foliage. In one transparent glaze, they are mixed with yellow lake, small amounts of ivory black, and yellow ochre; the other more opaque glaze consists of the two greens, with yellow ochre and white.

The last recorded use of Scheele’s green was by Edwin Landseer in 1866.

The Impressionists relied heavily on emerald green for its brilliance and intensity of colour. Frédéric Bazille’s Self-Portrait with Palette (1865) shows some emerald green paint on his palette, squeezed out and ready to paint vegetation such as sunlit grass.

Claude Monet used emerald green among other green pigments and mixtures in his famous Bathers at la Grenouillère, painted in 1869. It has also been found widely in the landscapes of Cézanne, Gauguin, Pissarro and Vincent van Gogh.

By the late nineteenth century, concern over the consequences of using emerald green in household products had risen to the point where the pigment was banned in a succession of countries.

Paul Gauguin’s Arlésiennes (Mistral) (Old Women at Arles) (1888) uses emerald green for the band of bright green grass sweeping up across the painting from the right. It is also mixed for the skin and hair of some of the figures, and in the foliage more generally.

Odilon Redon’s pastel painting of Sîta from about 1893 uses emerald green, chrome yellow and chalk in the prominent yellow-green halo surrounding the woman’s head. Working with soft pastels containing this pigment was particularly hazardous, because of the likelihood of inhaling their dust. At least today we have effective respiratory protection available.

During the twentieth century, genuine emerald green was withdrawn from use as a pigment, although it wasn’t completely discontinued until the 1960s. Since then, paints sold as being emerald green have contained alternatives that are far less toxic.

Emerald green has been found in mixtures used by Paul Cézanne in the patches of vegetation in his huge The Large Bathers (1906). Alongside lead white, vermilion and ultramarine blue, this pigment appears to have been among his most frequently used.

Childe Hassam’s watercolour of White Mountains from Poland Springs from 1917 is one of the last major paintings that appears to have relied on emerald green. Its use in the meadow in the foreground is perhaps the pigment’s last brash farewell.

Reference

Inge Fiedler and Michael Bayard (1997) Artists’ Pigments, vol 3, ed Elisabeth West Fitzhugh, Archetype. ISBN 978 1 904982 76 0.

Here are this weekend’s Mac riddles to entertain you through family time, shopping and recreation.

1: Where to sell an image of the Knolls in a two-year exclusive.

2: Rembrandt, Claude Monet, JMW Turner and Corel.

3: One of the first two, it could be beige acrylic and written by Bill.

To help you cross-check your solutions, or confuse you further, there’s a common factor between them.

I’ll post my solutions first thing on Monday morning.

Please don’t post your solutions as comments here: it spoils it for others.

Before the arrival of Mac OS X, our Macs had remained almost free from the property lists and other XML files that now seem to fill them. Those owe their origin to the grandfather of markup languages, SGML, originally known as Generalised Markup Language. That was invented by Charles Goldfarb, Ed Mosher and Ray Lorie in 1969, when they were working at IBM, as a means of structuring text semantically, and first used a different form of markup, as in
:h1.Chapter 1: Introduction
to set that text as a top-level headline. Ordered lists should look familiar to anyone who writes HTML:
:ol
:li.Item one.
:li.Item two.
:eol.
SGML was flexible as to markup formatting, but has become most widely seen using the angle brackets <> common to HTML, XML, and other markup languages.

Although it has never been popular in its own right, SGML still features in some products where markup is required to impart structure and meaning.

FrameMaker, originally developed by Frame Technology, is a high-end technical publishing system bought by Adobe in 1995. It was then offered in a premium version with extensive support for SGML, seen here in 2002, two years before Adobe dropped this Mac version.

XML

In 1996, a working group of W3C (the World Wide Web Consortium) started developing a profile of SGML that became known as Extended Markup Language, or XML. Work continued through 1997, and in February 1998 XML 1.0 was adopted as a W3C Recommendation. While there’s also a slightly different version 1.1, published in 2004, and various editions of 1.0, in its fundamentals the XML we use today is still version 1.0, with 1.1 only recommended for special purposes.

Property lists

Unlike traditional implementations of Unix, NeXTSTEP used its own property lists to contain serialised objects including settings. When Mac OS X was introduced, those were replaced by a new XML format using a public Document Type Declaration (DTD) still used today.

Although intended to be expressed in plain text, binary representations of XML developed during the early years of the new millennium, and Apple decided to adopt its own, bplist, in the early days of Mac OS X. This brought improved parsing speed, as well as being more compact, and has acted as a deterrent to those who might make casual changes to critical property lists. These were introduced in Mac OS X 10.2 Jaguar in 2002, and have been used as standard for property lists since Mac OS X 10.4. They are described well in this Wikipedia article.

A typical modern property list coded in XML might read
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<array>
<date>2017-10-10T13:13:43Z</date>
</array>
</plist>
That specifies a datestamp in an extended attribute.

Tools

Bundled tools to create and edit property lists have remained disappointingly primitive, but there has been no shortage of contenders from third parties.

This is the ElfData XML Editor, one of the first to be released in 2001, seen two years later in Mac OS X 10.2 Jaguar editing DocBook XML format.

In 2004, David Reitter created a version of GNU Emacs with an Aqua interface and named it Aquamacs. It’s seen here in 2006, in Mac OS X 10.4 Tiger, with its XML tools for editing a property list.

Another early entrant, from 2002, that has blossomed into one of the most extensive and sophisticated XML development environments is cross-platform Oxygen, from SyncRO Soft. Although written in Java its Mac versions have been sensitively implemented. It’s seen here in Mac OS X 10.4 Tiger in 2006, viewing an XML rendition of Shakespeare’s Hamlet.

This is Syntext Serna in 2007, again in Mac OS X 10.4 Tiger, seen editing an XML version of my PhD thesis that had originally been written in Adobe FrameMaker+SGML.

Other editors came and went, such as XML Editor, here in the last few days of Mac OS X 10.4 Tiger in 2007. This is a table from my thesis.

Major text editors also gained XML powers. These are Safari’s preferences in Mac OS X 10.5 Leopard, seen rendered by Rich Siegel’s BBEdit. He first distributed this text editor for System 6 back in 1992, and over 30 years later it remains one of the few high-end text editors for macOS.

My final example returns to the specialist features in Oxygen, seen here in Mac OS X 10.7 Lion in 2012, where it’s being used with a botanical flora.

Today XML and property lists remain at the heart of macOS, something I doubt that Charles Goldfarb ever dreamed of back in 1969.

References

Charles F Goldfarb (1996) The Roots of SGML – A Personal Recollection, Wayback Machine
SGML on Wikipedia
XML on Wikipedia
Property lists on Wikipedia

As we all should really be on holiday, I’m taking a long weekend to look at the stories of three green pigments, starting today with the oldest and most elusive of them, the mineral malachite.

Because green is a secondary colour, it might seem better mixed from blue and yellow, as it has been in various recipes such as Prussian green. But the painter always prefers using single pigments for the purity of their chroma, and the fact that the more pigments that get mixed, the closer the colour comes to muddy grey.

Given the shortage of lightfast bright greens, it’s surprising how little-used malachite green is in European painting, despite its rich colour. For a while it rejoiced quietly under traditional names including chrysocolla, green verditer, and even green bice, but it only ever became popular in Japan and China.

As a natural mineral, malachite is not uncommon, and a reliable source of pure pigment, which is chemically basic carbonate of copper. Malachite green was known to the ancient Egyptians, who appear to have used it as eye-paint. Found abundantly in Japanese and Chinese paintings from the seventh century onwards, it wasn’t used much in Europe until the Renaissance. After that, it almost died out in Europe until the nineteenth century, when it enjoyed a brief revival.

Two versions of the painting by Watanabe Kazan 渡辺崋山 of Sato Issai 佐藤一斎（五十歳）像 show malachite green at its finest.

This version from 1824, now in the Freer in Washington, is known to use malachite green with a slightly blue shade and deep in colour.

This smaller and earlier version from 1821, now in Tokyo, is a lighter, more yellow shade. I’m not aware of its pigment having been analysed, but I’d be surprised if it was straight malachite green.

The biggest problem with its adoption in Europe was the popularity there of oil paint. The pigment worked well where it could be ground quite coarsely and used in water-based media like fresco and egg tempera, but the finer you grind it, the paler it becomes. Oil painters like smooth buttery paints with fine pigment particles, which sadly didn’t work for malachite green.

The rich, almost emerald green robes of Spinello Aretino’s Virgin Enthroned with Angels from about 1380 contain malachite green, here in tempera medium.

Among its earliest appearances in oil paint is this spectacular centre panel of the van Eyck brothers’ Ghent Altarpiece, famous in its own right as the Adoration of the Lamb (c 1425-1432).

Continuing use of egg tempera in the Southern Renaissance helped it survive. Piero della Francesca’s famous The Baptism of Christ (after 1437), made in egg tempera on poplar wood, relies on the pigment for its greens. Microscopic examination of the paint layer here shows coarse mineral particles typical of natural malachite.

In Francesco del Cossa’s Saint Vincent Ferrer from about 1473-75, it has been identified in the dark green grass at the foot of the painting. This too was made using egg tempera.

However, microscopy of this paint layer shows that these pigment particles don’t seem to have been fractured as if they have been ground, but are globular, as occurs when the malachite green has been made by a process of precipitation. Such artificial malachite green didn’t appear in European paintings until after about 1430, just in time for Francesco del Cossa.

Although he painted in oils, Tintoretto was an enthusiastic user of malachite green. To obtain the range of greens seen in the rich and varied colours of vegetation in his Saint George and the Dragon from about 1555, he used this pigment with copper resinate glazes, a technique found in other paintings of the period.

Tintoretto’s vast oil painting of The Last Judgment (1560-62) in the Chiesa della Madonna dell’Orto, Venice, has been found to contain malachite green, I suspect in the band of green depicting the Flood just below the centre. The detail below makes this a bit clearer.

When painting the frescoes formerly in the Villa Aldobrandini between 1616-18, Domenichino and his assistants relied heavily on malachite green. It has been formally identified in this section, showing Apollo pursuing Daphne, where it’s the mainstay colour remaining, and is suspected in most of the others.

Although only classed as moderately permanent, these and other examples of very old frescoes show how well malachite green has retained its colour after four centuries or more. But with the rise of oil painting in European art, it fell from favour.

One of those who participated in its revival in the nineteenth century was Pierre-Auguste Renoir, whose painting of Chrysanthemums from 1881-82 shows how it could still be used in oil paint. But by then there was a much wider choice of more modern green pigments; the revival was short-lived, and malachite green has hardly been used since.

Reference

Rutherford J Gettens and Elisabeth West Fitzhugh (1993) Artists’ Pigments, vol 2, edited by Ashok Roy, Archetype. ISBN 978 1 904982 75 3.

XProtect is the front-line tool in macOS for detecting known malware. When a downloaded app is run for the first time and put through Gatekeeper checks, those rely on detection rules defined in the XProtect.yara file inside the XProtect bundle in /System/Library/CoreServices. Those are updated periodically to extend their coverage as new malware is detected and analysed by Apple’s security engineers. This article looks at how they have changed over the last six years.

My starting point is XProtect version 2103 released on 2 May 2019, in the heyday of macOS 10.14.4 Mojave. That contains a total of 92 rules in a text file of 42,903 bytes, for an average rule size of 456 bytes. Among those are many old chestnuts such as Bundlore.

My end point is version 5310 released this week, on 12 August 2025, for macOS 15.6 Sequoia and earlier. That contains a total of 372 rules in a text file of 969,662 bytes, giving an average rule size of 2,572 bytes. Still among those are the same old chestnuts including Bundlore.

Thus the number of rules is now 4 times what it was six years ago, and they take over 22 times as much space.

For the period up to the end of 2023, I have analysed XProtect’s Yara file in updates every 6 months, in May and November, or the closest update available. From the start of 2024 updates became more frequent, and I have therefore analysed the last update in each month. In late 2024, XProtect in macOS Sequoia started using iCloud to deliver its XProtect data updates. For this analysis I have excluded version 5273, which was only released via iCloud and wasn’t provided through the regular softwareupdate route used by all previous versions.

The number of Yara rules increased steadily until updates became more frequent in 2024, following which there was a very steep rise early that year. Since then they have continued to rise more steeply than before 2024, but now appear more linear, as seen in the red line of regression. Over this period, hardly any Yara rules have been removed.

Total size of the Yara file has followed a similar pattern, with little change until the start of 2024. It then peaked briefly before reducing slightly, pausing a little, then undergoing a step increase from 288 KB to 877 KB. Growth has been steadier for the last year, although it appears to be on track to reach 1 MB in 2026.

Average size of Yara rules changed little between 2021-2023, but increased greatly with the addition of some very large rules in June-July 2024. It has since declined slowly, as more recent rules have been far smaller.

This prodigious growth in the number of Yara rules and their size has inevitably had its effect on the time taken to complete Gatekeeper checks that include XProtect scans. macOS Tahoe has been promised to limit that, by not scanning notarized apps with XProtect, so improving app launch times.

Given that remarkably few old Yara rules have been removed over the last six years, this growth has been inevitable. However, unless old malware is incapable of being run on Macs still supported by XProtect updates, it’s hard to see how it could be safe to remove old rules. When support for running x86 code (except that for “older unmaintained gaming titles”) is dropped from macOS 28, many older Yara rules could be dropped from XProtect updates without putting Apple silicon Macs at risk, but even that isn’t an easy decision. In the meantime, at least our faster Macs should be able to complete XProtect scans more quickly.

In 1640, soon after Rembrandt and his wife Saskia had moved into their own house in a fashionable quarter of Amsterdam, she gave birth to their third child, who died shortly afterwards. The following year, their fourth was born, Titus, the only one to survive to adulthood, although even he died before Rembrandt.

His vast group portrait of The Night Watch (1642) is perhaps the most famous of all those of militia in the Dutch Republic. It’s more correctly titled Militia Company of District II under the Command of Captain Frans Banninck Cocq, and features the commander and seventeen members of his civic guard company in Amsterdam, and took the artist three years to complete from his first commission to its display in the guards’ great hall.

Captain Frans Banninck Cocq (in black with a red sash), followed by his lieutenant Willem van Ruytenburch (in yellow with a white sash) are leading out this militia company, their colours borne by the ensign Jan Visscher Cornelissen. The small girl to the left of them is carrying a dead chicken, a symbol of arquebusiers, the type of weapon several are carrying.

At the time, Saskia’s health was declining rapidly, and she died in 1642, most probably from tuberculosis, which was rife at the time. Rembrandt hired a widow, Geertje Dircx, to look after his young son Titus, and she became the artist’s lover.

Another superb example of Rembrandt’s later techniques is in his painting of David and Jonathan from 1642.

Rembrandt painted few non-narrative landscapes, but among them is his dramatic view of The Mill (1645-48) seen in the rich rays of twilight. This is a post mill, whose wooden top was turned into the wind to set its sails turning.

His relationship with Titus’ nurse broke up acrimoniously in 1649, and he first had to pay her alimony, then the cost of confining her in a house of correction when she broke her side of their agreement. As they were parting, he began a relationship with the much younger Hendrickje Stoffels, who had been his maid.

Stoffels is claimed to have been the model for A Woman Bathing in a Stream, painted in 1654, when she was expecting their first child.

She probably appears again in his masterly painting of Bathsheba with King David’s Letter from 1654, showing an imagined moment late in this Old Testament story.

Bathsheba is at her bath, this time in the privacy of her bedchamber, her feet being cared for by an old and presumably worldly-wise maid or nurse. Clutched in Bathsheba’s right hand is a letter, the title tells us from the king himself. Her eyebrows are raised in surprise, and she stares dreamily down at her attendant. We must presume that this letter is the king’s invitation to her to join with him in adultery. Rembrandt skilfully heightens the suspense in the lighting, and enhances the intimate detail with Bathsheba’s jewellery and ornamented hair. The crumpled sheets behind her make it clear that David’s invitation isn’t to a public engagement, but to a very private one.

In June 1654, Stoffels was summoned by her church accused of committing “the acts of a whore with Rembrandt the painter”, for which she was banned from receiving communion. That October, she gave birth to their daughter, but the couple were unable to marry as Rembrandt would consequently have lost access to a trust set up by Saskia. His finances continued to worsen, and in 1656 he declared his insolvency, resulting in his house being sold at auction early in 1658. He was, though, allowed to keep his studio equipment, and he was able to live on as a tenant. That year Rembrandt’s son Titus and Hendrickje Stoffels formed a company of art dealers, thus enabling the artist to continue painting.

Rembrandt’s Baucis and Philemon (1658) shows Jupiter looking decidedly Christlike, and Mercury the younger, almost juvenile, figure, sat at the table of a dark and rough cottage, lit by a lamp behind Mercury. This dramatic lighting is precursor to similar effects in his later Ahasuerus and Haman and Conspiracy of the Batavians, shown below. Philemon and Baucis are crouched, chasing the evasive goose towards Jupiter. A humble bowl of food is in the centre of the table, and there is a glass of beer. As is usual in Rembrandt’s narrative paintings, he dresses them in contemporary rather than historic costume.

Rembrandt’s Self-Portrait from 1658 is one of the most insightful of his unique series of self-portraits, showing the artist bankrupt and growing old.

He drew Ahasuerus and Haman at the Feast of Esther (1660) from an Old Testament story in the book of Esther, via the contemporary play Hester by Johannes Serwouters, first performed the previous year. The original narrative revolved around Haman, one of King Ahasuerus’ officials, who proposed to hang Mordechai as a scapegoat for the Jewish nation, as revenge for their pride. In this painting, Haman is shown in the shadows on the left, with King Ahasuerus in the centre, and Esther – Mordechai’s cousin and Ahasuerus’s wife – radiant in her intervention to save Mordechai’s life.

In 1661, Rembrandt secured a major commission for what was then the new Amsterdam City Hall, completed in 1655, now the Royal Palace. The dozen large spaces intended for paintings were going to be filled by Govert Flinck, who had started but not completed them when he died in 1660. Rembrandt sketched what he is believed to have completed in the summer of 1662.

The painting that we see today as The Conspiracy of the Batavians under Claudius Civilis (1661-2) is but a small central rectangle within the original. His entire painting was hung in place for a while, but appears to have fallen into disfavour. It was taken down and returned to the artist, who wasn’t paid, and no longer had sufficient influence to change anyone’s mind in the matter. Meanwhile Jürgen Ovens (1623–1678) completed Flinck’s version, which was hung instead of Rembrandt’s. Rembrandt was desperately short of money at this time, so cut the painting down to a more saleable size, repainted parts of it, and sold it on.

Hendrickje Stoffels died in July 1663, leaving Rembrandt with his son Titus. Despite his advancing years and continuing battles to pay his rent and bills, Rembrandt’s paintings attained new heights. Typical of these are two portraits of Lucretia ending her life following her rape by Sextus Tarquinius.

In the earlier of the two, from 1664, Lucretia is seen just about to run the dagger home into her chest. Rembrandt dresses her in fine contemporary clothes, rather than the black robes of the story, and she is richly decorated with jewellery. She faces the viewer, but her head is slightly inclined to the right, and she stares emptily at her right hand. Her face shows calm resignation to her fate, with a tinge of wistful sadness. Her arms are outstretched to the edges of the canvas. The left hand is grubby and held open, palm towards the viewer, perhaps protesting her virtue. The right grasps the handle of a dagger, which is just being brought around in an arc to impale her chest and bring her end.

Rembrandt’s later painting of 1666 is more remarkable still: Lucretia has already pierced her chest with the blade. Her fine clothing has been pulled back to reveal her simple white shift, with a broad streak of fresh, bright red blood running down from the point at which the dagger was inserted. Her arms are outstretched here too, but for very different purposes. The right hand still clutches the dagger, which has dropped to waist level already. Her left hand is dragging a beaded bell-pull, presumably to summon her family to witness her final moments on earth. It is her face, though, that makes this painting. Her eyes, moistened by welling tears, are looking away to the right of the painting, in an absent-minded stare. Her brow is tensed with subtle anxiety. She knows that she is about to die, and is preparing herself for that moment.

Rembrandt continued to develop his mark-making right up to his death. It’s often at its most florid when he painted fabrics, such as the clothing of the couple shown in The Jewish Bride of about 1665. The Dutch Republic had long been a safe harbour for Jews fleeing from oppression in other European countries, and Rembrandt had cultivated close relationships with members of the large Jewish community in Amsterdam, some of whom had modelled for his paintings of Old Testament stories.

The Return of the Prodigal Son from about 1668, the year before the artist’s death, is a more conventional treatment of this parable from the Gospels, in which the younger son, almost barefoot and in rags, kneels in front of his father. Around them are members of the household, and details that are now hard to read. As with other late works, there’s a profound feeling of tenderness and redemption, which may have had personal significance.

Rembrandt’s son Titus van Rijn died in 1668, at the age of only 26, and Rembrandt died on Friday 4 October 1669. Three years later the Dutch Republic was invaded by French forces, and its Golden Age came to an abrupt end.

In addition to reading laid-out documents, the most popular purposes for PDFs are forms and annotation. As far as filling in PDF forms are concerned, I have just one word to say: Fillably, Joel Norvell’s outstanding app available from the App Store, which transforms Preview into the ideal platform for tax and other forms. Rather than struggling with the tangle of tools in a general PDF editor, Fillably provides the perfect suite for creating PDF forms.

Annotating PDFs is more complicated, though.

Encoding annotations

Annotations aren’t an afterthought, but a central part of PDF. All PDF documents consist of a list of hundreds or thousands of objects of different types, including annotations of the Annot type, and those are listed in one of the file’s standard dictionaries, its Annotations Dictionary, Annots.

There are at least 27 sub-types of Annot, including Caret, Highlight and Stamp, which are reflected in the annotation tools provided by apps from Acrobat to Preview. Seemingly complex annotations like popup notes are straightforward to code in PDF, requiring just two linked objects, one for the popup and its text, the other to specify its placement on the page. Others are more involved, as they can extend to include file attachments, sound, movie and other multimedia.

PDF versions

Despite their original simplicity, there are multiple problems that can arise with annotations.

With more recent versions of PDF, the ways in which they can be coded has increased. Mark up a PDF using the latest versions of Adobe Acrobat Reader or its ‘Pro’ CC colleague and they’ll cast it in PDF-1.6 and you’re unlikely to see a single Annot in their source. Most apps built on the Quartz PDF engine should write their files in PDF-1.3 so they can be accessed more widely, and should use regular Annot sub-types throughout. However, Preview likes to use opaque AAPL:AKAnnotationObjects that you won’t encounter anywhere else.

What Quartz does is to ‘flatten’ each PDF into a common 1.3 format for rendering, and that can be saved to disk. At present, that seems to work faithfully, but might give the impression that macOS can’t render more recent versions of PDF, which isn’t true. You can demonstrate that by opening an Acrobat PDF-1.6 document using an app that relies on the Quartz engine, such as PDF Expert, Preview or my Podofyllin, and comparing that with the original in Acrobat.

Podofyllin has a convenient feature for doing just that, in its source window. The uppermost of its three views displays Quartz ‘flattened’ code in PDF-1.3, the middle shows the original, here in PDF-1.6, and the lowermost is a summary of the latter.

Hidden annotations

The biggest dangers with annotations arise because of PDF’s ancient origins and a file format that doesn’t make sufficiently clear distinction between data and metadata. All annotations are metadata added to the underlying document, but in PDF, objects for each are mixed freely within the source. When they’re clearly distinguished with the Annot type, they should be easy to remove as a group, and PDF Expert offers that as a convenient command. That’s ideal when a document has been developed with the aid of reviewers’ annotations, to prepare the finished version for release.

Unfortunately this can cause its own problems, as PDF source is notorious for retaining old content that’s no longer visible in the rendered document, but can be read by anyone with a little knowledge about PDF. Like incomplete redactions, such hidden annotations have caused many embarrassments in the past, and will continue to catch folk out.

Preview’s bugs

Finally, Preview has had more than its fair share of bugs in handling PDF annotations. During my research for this article, Preview 11.0 (1069.7.1) in macOS 15.6 was generally well behaved, but did mangle comments added to a test document by PDF Expert and Adobe Acrobat. Preview has two behaviours that can appear disconcerting: that of its Highlights and Notes tool, and its use of versioning.

All Preview’s tools are single-shot apart from Highlights and Notes, the drawing pencil icon to the left of its popup menu. Click this once to apply highlighting to selected blocks of text, and to remove existing highlighted sections. Unfortunately when this tool is turned on, its own highlighting is so weak that it’s hard to see.

Overwritten files

Preview has a habit of saving PDF documents automatically when closing them, without any warning. If it has just mutilated an annotation, for example, you might assume the original file has just been overwritten and lost. However, Preview saves PDFs using the macOS document versioning system, so you can always recover the previous version.

This might at first seem an impossible task: use Preview to restore that old version and it will repeat its mutilation, defeating the purpose. Yet the original PDF editor won’t have access to previous versions, as it doesn’t use the versioning system. The solution is to use Revisionist, or Versatility, which can save the original as a separate document.

Key points

• Annotations are a central feature of PDF, come in many sub-types, and can be complicated as they can be expressed in different ways.
• The macOS Quartz PDF engine transforms them into PDF-1.3, which makes them simpler and more explicit, so they can be saved ‘flattened’.
• PDF format mixes document data with metadata and annotations.
• Few PDF editors offer to remove all annotations, and there’s a risk of some remaining hidden from view, but still remaining in the PDF source, potentially causing embarrassment when they’re discovered.
• Preview’s earlier bugs in annotations have improved, but it can still mutilate those made by other PDF editors.
• If Preview saves a mutilated PDF, you should be able to recover the previous version of that file using Revisionist or Versatility.

Rembrandt is probably the most famous artist of the Dutch Golden Age. Although his career is by no means typical, it does illustrate some of the forces at work behind the explosive growth of art during this period, and is a good excuse to show a few of his paintings for context with other artists of the period.

He was born in the city of Leiden, then the second largest in the Dutch Republic after Amsterdam, with a population of 45,000 in 1622, and growing rapidly. Its major industry was the weaving of textiles, and through the seventeenth century it attracted many weavers to migrate from Flanders. Another flourishing local industry was printing and publishing, which was helped by the city’s university, founded in 1575, and its role as a centre of learning and scientific development.

Rembrandt was the ninth child in a prosperous family, his father being a miller. He was well educated, initially at a school in the centre of the city, then from the age of 14 at the university. He soon opted to be apprenticed as a painter, and joined the workshop of Jacob van Swanenburg in Leiden, who had trained in Italy. After three years, Rembrandt went on to work for shorter periods with Pieter Lastman, a history painter in Amsterdam, and others there.

Rembrandt’s early painting of The Operation, from his late teens in 1624-25, shows a barber-surgeon and his assistant performing surgery on the side of a man’s head.

In 1625, when he was only 19, he became a master in his own right, and opened his first studio in Leiden, shared with his former fellow-student Jan Lievens. Two years later he started taking on his own apprentices.

In 1626-27, Rembrandt painted this portrait of a Man in a Gorget and a Plumed Cap, demonstrating the strange effects that cast shadows can have on perception of the face. This also shows his early mastery of surface textures and reflected highlights.

Rembrandt’s break came in 1629, when he was discovered by a distinguished poet and composer Constantijn Huygens, who was secretary to the head of state, held influence in the Hague, and was the father of Christiaan Huygens, a leading mathematician and physicist. Huygens helped arrange commissions for Rembrandt, and introduced his work to Prince Frederik Hendrik, then head of state.

Although several of his best-known chiaroscuro paintings were made in his old age, Rembrandt had long used the technique when appropriate, here in Saint Peter in Prison (The Apostle Peter Kneeling) from 1631.

Rembrandt’s The Abduction of Proserpina (c 1631) is probably the first masterpiece to show this myth. Pluto is trying to drive his chariot away, with Proserpine inside it. She’s putting up fierce resistance, and trying to fend him off. Hanging on to the hem of Proserpine’s floral dress is a woman who should perhaps be her mother Ceres, but bears the crescent moon normally associated with Diana. Pluto’s chariot is being drawn by two black horses through an ethereal almost fluid carpet of flowers. The horses and chariot are about to disappear into a black cleft in the earth to make their descent to Hades.

In 1631, Rembrandt moved his studio to Amsterdam, the centre of trade and business for the Dutch Republic, and growing rapidly from a population of about 50,000 in 1600 to exceed 200,000 in the 1660s. He started getting commissions to paint portraits of those enjoying success in the city.

Rembrandt painted his Anatomy Lesson of Dr. Nicolaes Tulp in 1632, as an early commission soon after his arrival in Amsterdam. It’s a group portrait of distinguished members of the Surgeons’ Guild in their working environment, and a good example of his lucrative work. Portraits like this would typically be paid for by subscription of those included, often in proportion to their standing.

Rembrandt’s The Abduction of Europa (1632) isn’t well known today. It conforms to Ovid’s account in his Metamorphoses, but loses dramatic effect by placing the bolting bull in a dominant and very Dutch landscape, cluttered with Europa’s carriage, large trees, and a distant port.

His Philosopher in Meditation from 1632 shows the sinuous curves of a spiral staircase seemingly defying gravity as it rises to the storey above, and is one of his early interiors.

The young prophet Daniel (of lions’ den fame) was King Cyrus the Great’s confidant, according to the book of Daniel. When Cyrus asked Daniel why he didn’t worship the Persian god Bel (Baal), Daniel responded by saying that he worshipped a living god, not a mere idol. Cyrus then claimed that Bel too was a living god, and pointed to the offerings of food and wine that were placed before his statue, and were consumed each night. Daniel remarked cautiously that bronze statues do not eat, which for a moment threw Cyrus. But Daniel had exposed the deception of Bel’s priests.

In this painting of Daniel and Cyrus before the Idol Bel of 1633, Rembrandt has captured Cyrus, standing in the centre, pointing at the food and wine placed on the altar to Bel, whose huge idol is seen rather murkily at the upper right. Behind the modest figure of Daniel are some of the priests who maintained this deception.

Rembrandt painted this portrait of Bellona in 1633, when his career was flourishing. Given that she’s holding the Aegis normally associated with Minerva (Athena), I wonder whether there has been a misunderstanding here, but there’s no mention of the possibility that this might be Minerva instead.

His self-portrait from 1631-33 shows the artist in fancy dress with a large poodle, making it clear that he had truly arrived.

In 1634, Rembrandt became properly established in Amsterdam, when he was accepted as a member of Guild of Saint Luke, and married Saskia van Uylenburgh, daughter of a respected lawyer. The following year, the couple moved into a rented property with a view of the river. That December, she gave birth to their first child, a son, who lived for only two months.

Rembrandt and Saskia in the Parable of the Prodigal Son from about 1635, when the artist was just short of being thirty years old, shows the young wife sitting on his lap as he raises a large fluted glass of beer at the viewer.

With his artistic and commercial success, Rembrandt’s income rose rapidly. Like many successful Dutch citizens of the time, much of that income was spent on gathering possessions. In his case, these included a remarkable collection of Old Masters, including several paintings by Giorgione, objets d’arts, and even suits of armour. Some of these appear as props in his paintings.

Rembrandt’s Blinding of Samson from 1636 is an explicit depiction of the destruction of his eyes, as Delilah makes off behind with his hair and a pair of shears.

His outstanding painting of Belshazzar’s Feast was made in about 1635-38, when he was developing his distinctive techniques of depicting decorative metals, as shown in the detail below.

In the summer of 1638, Saskia gave birth to their second child, who died less than a month later.

The following year he followed fashion in painting this Still Life with Two Peacocks and a Girl (c 1639).

That Spring Rembrandt and his wife moved into their own house in one of the city’s more fashionable streets, among successful artists and dealers in art. To finance this purchase, the artist had to raise a substantial mortgage, which was to come back and haunt his later life, as I’ll describe in tomorrow’s conclusion.

Spotlight has been able to find text extracted from images using Live Text, and the names of objects recognised using Visual Look Up, for some years now. This article considers how you can and cannot search for those. Although this might seem obvious, it’s more confusing than it appears and could mislead you into thinking that Spotlight indexing or search isn’t working.

As detailed in yesterday’s account of Live Text, text recognition in images uses a lexicon to match words rather than proceeding in single characters. Terms assigned to recognised objects are also words. Thus, when searching for either type you should use words as much as possible to increase the chances of success.

Global Spotlight

Type a word like cattle into Spotlight’s search window and you can expect to see a full selection of documents and images containing the term or cattle objects. Those include images containing the word, and images containing objects identified as cattle, but don’t include images in PDF files, as they’re not analysed by mediaanalysisd, so don’t undergo character or object recognition in the same way that regular images like JPEGs do.

The Finder’s Find

Open a new window in the Finder and turn it into a Spotlight search using the Finder’s File menu Find command. In its search box at the top right, type in a word like cattle and in the popup menu select the lower option, Content contains. Press Return and the search box will now display ANY cattle. Then set the Kind to Image in the toolbar above search results, to narrow results down to image files. You should then see a full listing of image files that either contain the word cattle, or contain objects identified by image analysis as being cattle. Note how many of those appear.

Reconfigure the search so the search box is empty, and there are two rows of search settings: the first can remain the same as Kind is Image, but set the second to Contents contains cattle. Those images containing objects identified as cattle will now vanish, leaving images containing the word cattle still listed.

To understand the difference between these, you can save those two Find windows and read the underlying terms used for each search. The search that returned text obtained by both Live Text and Visual Look Up used
(((** = "cattle*"cdw)) && (_kMDItemGroupId = 13))
while the one excluding Visual Look Up used
(((kMDItemTextContent = "cattle*"cdw)) && (_kMDItemGroupId = 13))
instead. We can transfer those to the mdfind command tool to explore further.

mdfind

To use those as search predicates with mdfind we’ll translate them into more general form,
mdfind "(** == 'cattle*'cdw) && (kMDItemContentTypeTree == 'public.image'cd)"
should return both Live Text and Visual Look Up, while
mdfind "(kMDItemTextContent == "cattle*"cdw) && (kMDItemContentTypeTree == 'public.image'cd)"
only returns Live Text results.

The term (** == 'cattle*'cdw) has a special meaning because of its wild card **, and will return any match found in the metadata and contents of files. kMDItemTextContent is similar, but confined to text content, which doesn’t include the names of objects recognised in an image, and Apple doesn’t reveal whether there’s an equivalent that does.

Code search

Although apps can call mdfind to perform searches, they normally use NSMetadataQuery with an NSPredicate instead. That isn’t allowed to use a predicate like
** ==[cdw] "cattle"
so can’t search for objects identified using Visual Look Up. When it uses the substitute of
kMDItemTextContent ==[cdw] "cattle"
it also fails to find text obtained using Live Text. So the only way to search for recovered text in a compiled app is to call mdfind.

Timing

Searching for text obtained using Live Text, or object labels obtained using Visual Look Up, depends entirely on those being added to the Spotlight indexes on the volume. Observations of the log demonstrate just how quickly normal indexing by mdworker processes takes place. Here’s an example for a screenshot:
06.148292 com.apple.screencapture Write screenshot to temporary location
06.151242 [0x6000009bc4b0] activating connection: mach=true listener=false peer=false name=com.apple.metadata.mds
06.162302 com.apple.screencapture Moving screenshot to final location
06.169565 user/501/com.apple.mdworker.shared.1E000000-0600-0000-0000-000000000000 internal event: WILL_SPAWN, code = 0
06.198868 com.apple.DiskArbitration.diskarbitrationd mdworker_shared [7266]:118071 -> diskarbitrationd [380]
06.226997 kernel Sandbox apply: mdworker_shared[7266]

In less than 0.1 second an mdworker process has been launched and granted the sandbox it uses to generate metadata and content for Spotlight’s indexes. Unfortunately, that doesn’t include any Live Text or Visual Look Up content, which are generated separately by mediaanalysisd later. It’s hard to estimate how much later, although you shouldn’t expect to find such recovered text for several hours or days, depending on the opportunities for mediaanalysisd to perform background image analysis for this purpose.

Summary

• Words recovered from images (not those in PDF files, though) and objects recognised in them can be found by Spotlight search. For best results, choose words rather than letter fragments for search terms.
• Global Spotlight gives full access to both types.
• The Finder’s Find gives full access to both only when the search term is entered in the search box as Content contains, otherwise it may exclude objects recognised.
• mdfind can give full access to both types only when using a wildcard term such as (** == 'cattle*'cdw).
• NSMetadataQuery currently appears unable to access either type. Call mdfind instead.
• The delay before either type is added to the volume Spotlight indexes can be hours or days.

Apple has just released an update to XProtect for all supported versions of macOS, bringing it to version 5310. As usual, Apple doesn’t release information about what security issues this update might add or change.

This version adds a single new detection rule for MACOS.SOMA.AUENA, further extending its coverage of Soma/Amos.

You can check whether this update has been installed by opening System Information via About This Mac, and selecting the Installations item under Software.

A full listing of security data file versions is given by SilentKnight and SystHist for El Capitan to Tahoe available from their product page. If your Mac hasn’t yet installed this update, you can force it using SilentKnight or at the command line.

If you want to install this as a named update in SilentKnight, its label is XProtectPlistConfigData_10_15-5310

Sequoia systems only

This update has already been released for Sequoia via iCloud. If you want to check it manually, use the Terminal command
sudo xprotect check
then enter your admin password. If that returns version 5310 but your Mac still reports an older version is installed, you may be able to force the update using
sudo xprotect update

On the face of it, watercolour painting should be the simplest of all the more popular painting media. The paper is both support and ground, the paint layer is thin, with a little binder of gum arabic and a diluent of plain water. Although some have tried using varnish and other protective layers, in the great majority of watercolour paintings, that’s all there is.

In practice, though, as anyone who has taken watercolour painting seriously knows, there’s a great deal more to it. Much of that is hard to see and can only be inferred from images of watercolour paintings.

Raphael’s The Miraculous Draft of Fishes (c 1515-16) is among the earliest large paintings made using opaque watercolour. Because of limitations in the manufacture of paper at the time, it was made on many sheets that have been mounted on canvas. At around 3 x 4 metres (10.5 x 13 feet), it’s huge by any standards, and even today would probably need to be painted on multiple sheets and mounted on added support.

Over three centuries later, the Pre-Raphaelite artist Marie Spartali Stillman painted her watercolours in layers, using a combination of transparent and opaque watercolour on paper that had been hot-pressed to give it a satin-smooth finish. When re-wetted with another layer of wet paint, watercolour usually becomes liquid again, resulting in the layers mixing. Great care and skill is required to apply wet watercolour on dry paint in the way that she did. Even then some paintings simply don’t work, the layers mix and that attempt has to be discarded. When successful, the end result can resemble layered oil paints, which don’t suffer the same problem when dry paint is overpainted.

The Childhood of Saint Cecily (1883) was one of the last paintings Stillman composed when she lived in Florence, as reflected in its idealised Tuscan background. As with so many paintings of saints, it departs from even the most inventive of hagiographies, here for the patron saint of music, Cecilia. The saint is shown playing a harp-like psaltery, while an angel adjusts the garland on her head. She has worked subtle patterns into the blue fabric on the arm of the angel, and in the side of the instrument. Flowers and hair have fine detail with sharp highlights, just as might be seen with oils.

Love’s Messenger (1885) is probably the finest of her single-figure paintings, and was her most successful ‘problem picture’. The woman stands by her embroidery at an outside window. On her right hand is a messenger dove/pigeon, to which a letter is attached. She clutches that letter to her breast with her left hand, implying that its contents relate to matters of the heart. The dove is being fed corn, which could either be its reward for having reached its destination (thus the woman is the recipient of the message), or preparation for its departure (she is the sender). Despite being exhibited at the Grosvenor Gallery in 1885, and elsewhere, this painting didn’t sell until after she had reworked the background in the 1890s, which must have been a feat in itself.

A detail view of Love’s Messenger shows how her watercolour technique results in a facture more closely resembling that of oils, although this painting is an extreme example with its use of tempera too. This was accomplished by using transparent watercolours more like oil glazes, and gouache (opaque watercolour) for details.

Her portrait of Beatrice (1896) refers to Dante’s Vita Nuova, through Dante Gabriel Rossetti’s popular translation into English. In this her first version, she shows Dante’s beloved Beatrice lost in contemplation while reading, an intimate insight set firmly in the Pre-Raphaelite mediaeval. This was exhibited at the New Gallery later that year.

This detail view of Beatrice provides more insight into her exacting technique.

Over the same period, other artists were developing techniques for use on cold-pressed paper with its coarser texture.

At a time when most watercolour painting was still disparagingly considered to be ‘drawing’ for routine topographic views, Alexander Cozens developed specialist techniques, such as keeping ‘reserved space’ to let his white paper ground show through, wet on wet as well as wet on dry application of paint, and scratching out. He also employed both transparent and opaque paints for different effects.

JMW Turner did a great deal to advance both technique and the critical reception of large watercolour works painted in the studio, although even today his oils are much better known, with a few exceptions such as his sublime paintings of the Rigi.

Towards the end of the nineteenth century, Winslow Homer earned his place as one of the greatest watercolour painters of America during a period spent in a fishing community in north-east England. The advanced techniques which he used are shown well in The Watcher, Tynemouth (1882), and include both transparent and opaque paints, rewetting and blotting to remove paint for highlights, scraping, application of wax to resist the adherence of paint, and the use of pure gum solution as a glaze. In this case, his paper is only lightly textured, though.

Perhaps the greatest exponent of these techniques was another American, John Singer Sargent.

Sargent’s most radical watercolours were painted when he stayed with various friends in the Bellevue Hotel, at the top of the Simplon Pass, in the summers before the First World War. While his family and friends whiled away their days in leisure, Sargent got them to pose for a unique series of informal portraits. They may have been reclining at leisure, but Sargent took those watercolours very seriously, and deployed an amazing array of techniques. Among the finest is his Simplon Pass: The Tease from the summer of 1911.

One of his most unusual techniques, used extensively here, is wax resist. Before applying paint, Sargent scribbled over areas intended to be vegetation, using a soft wax crayon, probably made from beeswax. On fairly rough paper, that wax is deposited unevenly, and when painted over using watercolour it shows the white paper through. This creates disruptive patterns of near-white in the midst of the greens, and a superb textural effect, as shown in this detail.

In complete contrast, Edward Robert Hughes’ Night with her Train of Stars of the following year has been painted in a controlled and meticulous manner, although it too uses advanced techniques, particularly in the sky and background. I suspect that some of the latter may have relied on the scattering of salt grains to impart its fine texture. In other passages he has allowed different colours to rewet and blur what would otherwise be sharp edges.

Of course, AI can now mimic these when provided with suitable original material to plagiarise. But there’s still nothing like an original painted by a master.

Live Text and Visual Look Up are recent features in macOS, first appearing in Monterey nearly four years ago. As that immediately followed Apple’s short debacle over its now-abandoned intention to scan images for CSAM, most concerns have been over whether these features send details of images to Apple.

Although recent Intel Macs also support both these features, they don’t have the special hardware to accelerate them, so are far slower. For this walkthrough, I’ll only present information from Apple silicon Macs, in particular for the M4 Pro chip in a Mac mini.

Initiation

When an image is opened from disk, the VisionKit system starts up early, often within 0.1 second of it starting to open. Its initial goal is to segment the image according to its content, and identify whether there’s any part of it that could provide text. If there is, then Live Text is run first so you can select and use that as quickly as possible.

In the log, first mention of this comes from com.apple.VisionKit announcing
Setting DDTypes: All, [private]
Cancelling all requests: [private]
Signpost Begin: "VKImageAnalyzerProcessRequestEvent"

It then adds a request to Mad Interface, that’s the mediaanalysisd service, with a total method return time, and that’s processed with another signpost (a regular log entry rather than a Signpost):
Signpost Begin: "VisionKit MAD Parse Request"

com.apple.mediaanalysis receives that request
[MADServicePublic] Received on-demand image processing request (CVPixelBuffer) with MADRequestID
then runs that
Running task VCPMADServiceImageProcessingTask

This is run at a high Quality of Service of 25, termed userInitiated, for tasks the user needs to complete to be able to use an app, and is scheduled to run in the foreground. Next Espresso creates a plan for a neural network to perform segmentation analysis, and the Apple Neural Engine, ANE, is prepared to load and run that model. There’s then a long series of log entries posted for the ANE detailing its preparations. As this proceeds, segmentation may be adjusted and the model run repeatedly. This can involve CoreML, TextRecognition, Espresso and the ANE, which can appear in long series of log entries.

Text recognition

With segmentation analysis looking promising for the successful recognition of text in the image, LanguageModeling prepares its model by loading linguistic data, marked by com.apple.LanguageModeling reporting
Creating CompositeLanguageModel ([private]) for locale(s) ([private]): [private]
NgramModel: Loaded language model: [private]
and the appearance of com.apple.Lexicon. An n-gram is an ordered sequence of symbols, that could range from letters to whole words, and the lexicon depends on the language locales. In my case, two locales are used, en (generic English) and en_US (US English).

At this point, mediaanalysisd declares the VCPMADVIDocumentRecognitionTask is complete, and runs a VCPMADVIVisualSearchGatingTask, involving com.apple.triald, TRIClient, PegasusKit and Espresso again. Another neural network is loaded into the ANE, and is run until the VCPMADVIVisualSearchGatingTask is complete and text returned.

The next task is for the translationd service to perform any translations required. If that’s not needed, VisionKit reports
Translation Check completed with result: NO, [private]
These may be repeated with other image segments until all probable text has been discovered and recognised. At that stage, recognised text is fully accessible to the user.

Object recognition

Further image analysis is then undertaken on segments of interest, to support Visual Look Up. Successful completion of that phase is signalled in Preview by the addition of two small stars at the upper left of its ⓘ Info tool. That indicates objects of interest can be identified by clicking on that tool, and isn’t offered when only Live Text has been successful. VisionKit terms those small buttons Visual Search Hints, and remains paused until the user clicks on one.

Visual Search Hints

Clicking on a Visual Search Hint then engages the LookupViewService, and changes the state from Configured to Searching. VisionKit records another
Signpost Begin: "VisionKit MAD VisualSearch Request"
and submits a request to MAD for image processing to be performed. If necessary, the kernel then brings all P cores online in preparation, and the ANE is put to work with a new model.

PegasusKit then makes the first off-device connection for assistance in visual search:
Querying https: // api-glb-aeus2a.smoot.apple.com/apple.parsec.visualsearch.v2.VisualSearch/VisualSearch with request (requestId: [UUID]) : (headers: ["grpc-message-type": "apple.parsec.visualsearch.v2.VisualSearchRequest", "Content-Type": "application/grpc+proto", "grpc-encoding": "gzip", "grpc-accept-encoding": "gzip", "X-Apple-RequestId": "[UUID]", "grpc-timeout": "10S", "User-Agent": "PegasusKit/1 (Mac16,11; macOS 15.6 24G84) visualintelligence/1"]) [private]

When the visual search task completes, information is displayed about the object of interest in a floating window. Visual Look Up is then complete, and in the absence of any further demands, the ANE may be shut down to conserve energy, and any inactive CPU cluster likewise:
ANE0: power_off_hardware: Powering off... done
PE_cpu_power_disable>turning off power to cluster 2

Key points

• Image analysis starts shortly after the image is loaded.
• Central components are VisionKit and mediaanalysisd, MAD.
• In Apple silicon Macs, extensive use is made of the Apple Neural Engine throughout, for neural network modelling.
• Most if not all is run at high QoS of 25 and in the foreground, for performance.
• Segmentation analysis identifies areas that might contain recoverable text.
• Segments are then analysed, using language modelling for appropriate locales and languages, and lexicons, to return words rather than fragmented characters.
• When Live Text is ready, segments are then analysed for recognisable objects. When that’s complete, each is marked by a Visual Search Hint.
• Clicking on a Visual Search Hint initiates a network connection to provide information about that object, displayed in a floating window.

Dante lost consciousness just before he was expecting to be ferried across the River Acheron in Charon’s boat, from Hell’s Gate to its First Circle.

Botticelli’s Map of Hell from 1480-90 shows these stages of their descent at the very top: highest are the woods through which Dante was wandering when he encountered the three wild beasts. At the left, Virgil led Dante down to the area in which the cowards are trapped, neither being allowed admittance to Heaven, nor to Hell. Charon’s boat then crosses the River Acheron, shown in blue, taking Dante and his guide Virgil to the First Circle of Limbo.

Dante is woken by thunder, and realises that he’s on the edge of the abyss that is Hell. Virgil leads him down into darkness, where there is no grief or pain, and explains that the multitude there never sinned at all, but none was baptised in faith as they had lived before the Christian era. This is where Virgil’s ghost now inhabits, for despite his merit and attainments, he never revered the Christian God.

Dante asks whether any of those in Limbo, as this circle is known, have ever been blessed and been able to leave. This allows Virgil to explain the Harrowing of Hell by Christ after his crucifixion. This occurred not long after Virgil’s death: following his crucifixion, Jesus Christ descended into Hell, where he reached the First Circle, blessed and liberated from it the many Old Testament figures who had been faithful to the God of the Jews, also known as Anastasis.

The descent of Christ into Limbo and his Harrowing of Hell was a popular theme in religious painting until the end of the Renaissance, and would have been familiar to Dante’s readers. Here is a small selection of some of the finest paintings of this, from 1530 to 1600.

Virgil then introduces the great classical writers: Homer, Horace the satirist, Ovid and Lucan. Together with Virgil, these five invite Dante to join them as the sixth among the ranks of great writers, in an ambitious piece of self-promotion.

The group walk on to the Dome of Light, and further to a castle surrounded by seven curtain walls and a moat. When they enter that they see many ancient heroes, including Electra, Hector, Aeneas, and other figures from classical history and legend. Next Dante notices a group of philosophers, including Socrates, Plato and others. Finally, he sees other learned figures from the past, including Euclid, Ptolemy and Hippocrates.

Here Dante and Virgil bid farewell to the spirits of those great figures as they move onward to the next circle.

The artists

Domenico di Pace Beccafumi (1486–1551) was one of the last of the Sienese School of Painting, which contrasted with the better-known Renaissance painting of Florence. He has been aptly summarised as “a mediaeval believer of miracles awaking in Renaissance reality.”

William Blake (1757–1827) was a British visionary painter and illustrator whose last and incomplete work was an illustrated edition of the Divine Comedy for the painter John Linnell. Most of his works shown in this series were created for that, although he did draw and paint scenes during his earlier career. I have a major series on his work here.

Sandro Botticelli (1445–1510) was one of the leading painters of the early Southern Renaissance, working in his native city of Florence. In addition to his huge egg tempera masterpieces of Primavera (c 1482) and The Birth of Venus (c 1485), he was a lifelong fan of Dante’s writings. He produced drawings that were engraved for the first printed edition of the Divine Comedy in 1481, but those weren’t successful, most copies only having two or three of the 19 that were engraved. He later began a manuscript illustrated edition on parchment, but few pages were ever fully illuminated.

Jan Brueghel the Elder (1568–1625) was the son of Pieter Brueghel the Elder, who specialised in floral still lifes. The painting shown above was made in collaboration with the figure painter Hans Rottenhammer, a relationship that lasted between 1595-1610. At the time of this painting, Brueghel had returned to Antwerp, and Rottenhammer was in Venice.

Pablo de Céspedes (1538–1608) was a Spanish polymath from Córdoba, who was an accomplished painter, poet and architect who worked for twenty years in Italy, largely because he fell foul of the Inquisition of Valladolid in Spain. He was also a linguist and theologian.

Gustave Doré (1832–1883) was the leading French illustrator of the nineteenth century, whose paintings are still relatively unknown. Early in his career, he produced a complete set of seventy illustrations for translations of the Inferno, that were first published in 1857 and continue to be used. These were followed in 1867 by more illustrations for Purgatorio and Paradiso. This article looks at his paintings.

Hans Rottenhammer (1564–1625) was a German figure painter who worked in Italy from 1593-1606. Later during that period, when he was in Venice, he collaborated with Jan Brueghel the Elder on the work shown above. He was probably responsible for the early training of Adam Elsheimer, and for introducing him to the technique of painting on a small scale using oil on copper plate.

Jacopo Tintoretto (c 1518-1594) was one of the three grand masters working in Venice in the middle and late sixteenth century, alongside the more senior figure of Titian, and Paolo Veronese. Primarily a religious painter, I have looked in detail at his major works and biography. His painting shown above was made to accompany his Crucifixion for the church of San Cassiano in Venice.

References

Wikipedia
Danteworlds

Robin Kirkpatrick (trans) (2012) Dante, The Divine Comedy, Inferno, Purgatorio, Paradiso, Penguin Classics. ISBN 978 0 141 19749 4.
Richard Lansing (ed) (2000) The Dante Encyclopedia, Routledge. ISBN 978 0 415 87611 7.
Guy P Raffa (2009) The Complete Danteworlds, A Reader’s Guide to the Divine Comedy, Chicago UP. ISBN 978 0 2267 0270 4.
Prue Shaw (2014) Reading Dante, From Here to Eternity, Liveright. ISBN 978 1 63149 006 4.

I hope that you enjoyed Saturday’s Mac Riddles, episode 320. Here are my solutions to them.

1: What ET wants is a call coming to the Mac.

2: A glass to enlarge among the liquid.

3: Daybook you might already have started elsewhere.

The common factor

I look forward to your putting alternative cases.

Six years ago, in July 2019, Macs came closer to disaster than at any time before or since. Millions of Mac users around the world had, at some time or other, installed Zoom conferencing software, and in doing so had unknowingly put their Macs at risk. For their convenience, the old Zoom installers of that time also installed a hidden web server that was left running. That was capable of reinstalling the Zoom client, and had been discovered to contain an easily exploitable vulnerability that exposed all those Macs to remote attacks.

The only solution was for Apple to harness its old Malware Removal Tool, MRT, to remove that web server from all Macs before they came under attack. Although MRT had been widely criticised for what others considered to be weakness, on this occasion it proved its value. MRT version 1.45 was released by Apple on 10 July 2019, and averted that potential catastrophe.

Three years later, in the summer of 2022, Apple replaced MRT with its successor, XProtect Remediator or XPR, which has been vastly improved, and still contains the remnants of MRT in its MRTv3 scanning module. As Apple documents almost nothing about XPR, it has been up to others to dive deep inside it, among them Koh M Nakagawa, @tsunek0h, of FFRI Security. While others have merely scratched the surface, he has just presented a superb and deep account of XPR at Black Hat USA. You can download the slides for his presentation from here.

Status_code 30 PlugInCanceled

If you check XPR scans using SilentKnight or XProCheck, you’ll be aware that for many months some of them are terminated prematurely with a status_code of 30 and the message PlugInCanceled. This most commonly affects Adload scans, and still occurs in beta-releases of macOS 26 Tahoe. According to Koh’s research, the Adload scanning module alone contains over 1,000 Yara detection rules, accounting for the long time it takes whenever XPR runs a set of scans.

Before XPR started terminating its scans as it does now, a full set could take an hour or more, so XPR has started using a timer. If the scan exceeds the time allowed, then it will be abruptly terminated, resulting in this status_code and message. There’s nothing the user can do to avoid it, and we’re surprised that XPR continues to exhibit this behaviour.

Laptop Macs

The other significant limitation in XPR affects those using MacBook Pro, MacBook Air and MacBook models. Because XPR scans take a substantial amount of energy, even when run almost entirely on the E cores of Apple silicon Macs, daily full scans will only be run when those laptops are using mains power, and won’t be run at all on battery.

As XPR scans are also normally run when a Mac is awake but only under a light load, it’s possible for a laptop to go several days without running an XPR scan. The only solution is to leave it connected to mains power, awake and doing little else for an hour or so, when it should seize the opportunity to catch up with that and other important background tasks with similar requirements.

Unfortunately, XPR won’t warn you that it hasn’t run any scans for several days, but SilentKnight and XProCheck will.

In the first of these two articles showing masterly landscape paintings of summer storms, I had reached John Constable in the early 1830s.

Of Constant Troyon’s early paintings the most outstanding must be The Approaching Storm from 1849. Set on a river worthy of Constable, two anglers appear to be readying themselves for the torrential rain heading towards them, while others still wander in the last patch of sunshine on the far bank.

Jules Noel’s Panorama of the Town of Dieppe (c 1865) shows a large picnic party on the cliffs overlooking the town of Dieppe on the coast of northern France. These families seem blissfully unaware of the dark clouds and heavy rain already over the land to the right.

One of the finest and most dramatic of Albert Bierstadt’s paintings from his second expedition to the West in 1863 is this of A Storm in the Rocky Mountains, Mt. Rosalie from 1866. Its foreground shows a pastoral valley floor with a native American camp, in mottled light. Some people and their animals are seen making haste to return from the pastures to the shelter of the camp. A small rocky outcrop has trees straggling over it, which are silhouetted against the brilliant sunlight on the lake behind, in the middle distance.

Behind the lake the land rises sharply, with rock crags also bright in the sunshine. In the background the land is blanketed by indigo and black storm-clouds. Those are piled high, obscuring much of Mount Rosalie, but its ice-clad peaks show proud, high up above the storm, with patches of blue sky above and beyond them. A single large bird, an eagle perhaps, is seen in silhouette, high above the lake.

It was Volodymyr Orlovsky’s painting of Harvest on the steppe in Ukraine, in 1882, that apparently earned the artist’s promotion to Professor in the Imperial Academy.

Few artists ever get to witness tropical storms, but after his time painting winter storms at Cullercoats in England, Winslow Homer witnessed and painted this Hurricane, Bahamas in 1898.

In 1903, Gustav Klimt spent his summer holiday at Attersee with his partner’s family, where he painted this landscape of an Approaching Thunderstorm. Many of his other landscape paintings made during his summers away show no sky at all, but this is an exception.

Thunderstorm at Vernouillet is an atmospheric landscape painted by Pierre Bonnard in 1908, or the following year. Vernouillet is on the southern bank of the river Seine, midway between the centre of Paris and Monet’s property at Giverny.

The young Canadian artist and canoeist Tom Thomson excelled in rapid sketching in oils, with several witnessed accounts of him dashing off a painting in little more than fifteen minutes. As a result he was able to capture many transient effects, such as the passing thunderstorm in Thunderhead from 1912-13.

If you’re fortunate, the storm is soon gone, its humid air blows away, and summer returns.

Arkhyp Kuindzhi specialised in painting in spectacular light. After a Thunderstorm from 1879 is one of his oil sketches capturing the brilliant colour and light following heavy summer rain on the steppe.

According to scientific tradition, we first observe then experiment. If you proceed to the latter before you understand how a system behaves, then you’re likely to labour under misapprehensions and your trials can become tribulations. Only when a system is thoroughly opaque and mysterious can we risk attempting both together.

That’s the case for Spotlight, which despite its name does everything but shine any light on its mechanisms. It presents itself in several guises, as a combination of web and local search (), as local search using terms limited in their logical operators (Finder’s Find), as full-blown predicate-based local search (mdfind), as in-app file search (Core Spotlight), and the coder’s NSMetadataQuery and predicates. It relies on indexes scattered across hundreds of binary files, and runs multiple processes, while writing next to nothing in the log.

Last week’s code-doodling has been devoted to turning the Spotlight features in Mints into a separate app, SpotTest, so I can extend them to allow testing of different volumes, and search for text that has been derived from images. Those are proving thorny because of Spotlight’s unpredictable behaviour across different Macs running Sequoia.

Every week I search for screenshots to illustrate another article on Mac history. When using my old iMac Pro where most of them are stored, Spotlight will find many images containing search terms from the text shown within them, even from ancient QuickDraw PICT images, demonstrating that text is being recovered using Live Text’s optical character recognition. When I try to repeat this using test images on an Apple silicon Mac, Spotlight seems unable to recognise any such recovered text.

Image analysis on Macs has a stormy history. In a well-intentioned gaffe four years ago, Apple shocked us when it declared it was intending to check our images for CSAM content. Although it eventually dropped that idea, there have been rumours ever since about our Macs secretly looking through our images and reporting back to Apple. It didn’t help that at the same time Apple announced Live Text as one of the new features of macOS Monterey, and brought further image analysis in Visual Look Up.

Although I looked at this in detail, it’s hard to prove a negative, and every so often I’m confronted by someone who remains convinced that Apple is monitoring the images on their Mac. I was thus dragged back to reconsider it in macOS Sonoma. What I didn’t consider at that time was how text derived from Live Text and image analysis found its way into Spotlight’s indexes, which forms part of my quest in SpotTest.

This doesn’t of course apply to images in PDF documents. When I looked at those, I concluded: “If you have PDF documents that have been assembled from scans or other images without undergoing any form of text recognition, then macOS currently can’t index any text that you may still be able to extract using Live Text. If you want to make the text content of a PDF document searchable, then you must ensure that it contains its own text content.” I reiterated that in a later overview.

My old images aren’t PDFs but QuickDraw PICTs, TIFFs, PNGs and JPEGs, many from more than 20 years ago. When the circumstances are right, macOS quietly runs Live Text over them and stores any text it recovers in Spotlight’s indexes. It also analyses each image for recognisable objects, and adds those too. These happen more slowly than regular content indexing by mdworker, some considerable time after the image has been created, and have nothing whatsoever to do with our viewing those images in QuickLook or the Finder, or even using Live Text or Visual Look Up ourselves.

There are deeper problems to come. Among them is discovering the results of image recognition as can be revealed in the command line using a search such as
mdfind "(** == 'cattle*'cdw) && (kMDItemContentTypeTree == 'public.image'cd)"
to discover all images that have been recognised as containing cattle. There’s no equivalent of the first part of that when calling NSMetadataQuery from Swift code, and a predicate of
kMDItemTextContent CONTAINS[cd] \"cattle\"
will only discover text recovered by Live Text, not the names of objects recognised within an image.

What started as a quick doodle is now bogged down in the quirks of Spotlight, which defies the scientific method. Perhaps it’s time for a little sorcery.

As we near the grain harvest in the northern hemisphere, so come the summer storms. Just as the farmworkers have ventured out into the fields of dry, ripe wheat, the heavens above become inky black as towering clouds bring torrential rain and rolling thunder. This weekend we’re in for more than our fair share, in the company of many of the great landscape artists.

At the dawn of modern landscape painting, Giorgione’s The Tempest from about 1504-8 centres on an approaching storm. The sky is filled with inky dark clouds, and there’s a bolt of lightning in the distance. The figures here imply an underlying narrative, but today that can only be speculated.

Nicolas Poussin’s setting of a Landscape during a Thunderstorm with Pyramus and Thisbe (1651) shows the city of Babylon in the distance, along a picturesque and pastoral valley. But the peacefulness of this landscape has been transformed by the sudden arrival of a thunderstorm: the gusty wind is already bending the trees, and near the centre of the view a large branch has broken with its force. Two bolts of lightning make their way to the hills below.

There’s frantic activity in response not only to the storm, but to a lioness attacking a horse, whose rider has fallen. An adjacent horseman is about to thrust his spear into the back of the lioness, while another, further ahead, is driving cattle away from the scene. Others on foot, and a fourth horseman, are scurrying away, driven by the combination of the lioness and the imminent storm.

In the foreground, Pyramus lies dying, his sword at his side, and his blood flowing freely on the ground, down to a small pond. Thisbe has just emerged from sheltering in the cave, has run past the bloodied shawl at the right, and is about to reach the body of her lover.

Still attributed to Poussin’s pupil and brother-in-law Gaspard Dughet, this Landscape with Lightning from 1667-69 lacks the subtlety and finesse of the master himself, but shows a bolt of lightning striking ground and setting a fire in the countryside. In the foreground, a couple flee from among trees being shattered by the strong gusts brought by the storm.

The founding fathers of landscape painting in the Northern Renaissance weren’t to be outdone by those of the south: Aelbert Cuyp’s Thunderstorm over Dordrecht from about 1645 is amazingly effective and accurate, considering it was painted more than two centuries before anyone saw high-speed photographic images of lightning.

In Claude-Joseph Vernet’s series The Four Times of Day from 1757, by Midday the clouds of early morning have built into squally showers. While two people are fishing with nets, a couple with an infant and a dog, in the left foreground, are hurrying for shelter before heavy rain starts. Behind them a shepherd has brought their flock under a grove of trees. Seagulls are wheeling and soaring in the strengthening wind.

George Morland’s Before a Thunderstorm (1791) shows well the rising wind and threatening sky just before a summer storm strikes.

When he was only sixteen, in 1821, Samuel Palmer painted this watercolour sketch At Hailsham, Sussex: a Storm Approaching, a faithful representation of Cumulus congestus building in the distance.

Palmer’s watercolour Summer Storm near Pulborough, Sussex from about 1851 refers to Dutch landscape painting, but set in a very Kentish context. A storm is seen approaching the rolling countryside near Pulborough, now in West Sussex, in the south-east of England. On the left, in the middle distance, a small bridge leads across to a hamlet set around a prominent windmill, whose blades are blurred as they’re driven by the wind. Beyond that mill are fields of ripening cereal.

John Constable’s half-size and well-developed study for Salisbury Cathedral from the Meadows places an angler in the foreground, as a thunderstorm builds over the Wiltshire countryside behind. Sadly, the fisherman didn’t survive into Constable’s finished painting.

Here are this weekend’s Mac riddles to entertain you through family time, shopping and recreation.

1: What ET wants is a call coming to the Mac.

2: A glass to enlarge among the liquid.

3: Daybook you might already have started elsewhere.

To help you cross-check your solutions, or confuse you further, there’s a common factor between them.

I’ll post my solutions first thing on Monday morning.

Please don’t post your solutions as comments here: it spoils it for others.