Apple has just released an update to XProtect for all supported versions of macOS, bringing it to version 5295. As usual, Apple doesn’t release information about what security issues this update might add or change.

This version adds a single new rule for MACOS.SOMA.BYTE.SEQUENCE.B.

You can check whether this update has been installed by opening System Information via About This Mac, and selecting the Installations item under Software.

A full listing of security data file versions is given by SilentKnight, LockRattler and SystHist for El Capitan to Sequoia available from their product page. If your Mac hasn’t yet installed this update, you can force it using SilentKnight, LockRattler, or at the command line.

If you want to install this as a named update in SilentKnight, its label is XProtectPlistConfigData_10_15-5295.

Sequoia systems only

This update has also been released for Sequoia via iCloud. If you want to check that manually, use the Terminal command
sudo xprotect check
then enter your admin password. If that returns version 5295 but your Mac still reports an older version is installed, you can force the update using
sudo xprotect update

I have updated the reference pages here which are accessed directly from LockRattler 4.2 and later using its Check blog button.

Two hundred years ago, on either 16 or 17 April 1825, the Swiss artist Henry Fuseli died in his adopted country Britain, where he had been one of the leading narrative painters, and an important figure in the Royal Academy. In this article and tomorrow’s sequel, I outline his career with the support of a small selection of his paintings. The uncertainty over the date of his death results from a conflict with Wikipedia, which claims it was a day later than the Royal Academy does.

He was born in 1741 as Johann Heinrich Füssli in Zürich, Switzerland, to a large artistic family. Expecting to train to paint, he was surprised when his father sent him instead to start theological training, with the intention of him becoming a priest. He took up orders in 1761, but fled Switzerland shortly afterwards because of his involvement in exposing an unjust magistrate. He travelled through Germany, and in 1765 arrived in England.

At first, he made a precarious living in England by writing and translating. He seized the chance to show Sir Joshua Reynolds his drawings, and was advised to devote himself to painting. To further this goal, as he had received little formal training at this stage, he went to Italy in 1770, where he studied painting, and changed his last name to Fuseli.

On his return to England in 1779 he found his reputation already building, and was commissioned to paint for Boydell’s new Shakespeare Gallery, a bold scheme to develop an English school of history painting, based largely on income generated from prints.

His Thetis Lamenting the Death of Achilles from 1780 isn’t easy to read. In the foreground, Achilles’ body lies like a fallen statue on his shield, his great spear by his left side. There’s no sign of any wound, arrow, or injury. At the water’s edge, his mother Thetis is waving her arms in lament for her dead son. Another deity is flying past in the distance, and is seen white against the dark and funereal sea and sky.

He painted The Two Murderers of the Duke of Clarence in 1780-82, probably for Boydell’s gallery. It shows a scene from William Shakespeare’s historical play Richard III, where the King has sent this pair to kill Clarence in the Tower of London.

Fuseli became a prolific painter of literary narrative. His Tiresias Appears to Ulysses During the Sacrifice from 1780-85 is perhaps the only painting that shows Odysseus summoning the ghost of the blind seer Tiresias, after he had spent a year with Circe. In Book 11 of Homer’s Odyssey, Odysseus was instructed to consult Tiresias about his means of returning home to Ithaca, and does so using a process known as nekyia, with the sacrifice of a ram and a ewe as shown here.

Fuseli’s transformative year was 1781, when he painted no less than three masterpieces.

Dido has here mounted her funeral pyre, and is on the couch on which she and Aeneas had earlier made love. She then fell on the sword that Aeneas had given her, and that rests, covered with her blood, beside her, its tip pointing up towards her right breast. Her sister Anna rushes in to embrace her during her dying moments, and Jupiter sends Iris (wielding a golden sickle) to release Dido’s spirit from her body. Already smoke seems to be rising from the pyre, confirming to Aeneas that she has killed herself, as he heads towards the horizon, and the eventual founding of Rome.

The Nightmare was exhibited at the Royal Academy in 1782, and remains the work by which Fuseli is best known today. It shows a daemonic incubus squatting on the torso of a young woman, who is laid out as if in a deep sleep in bed, her head thrown back, and her arms above her head. Lurking in the darkness to the left is the head of a black horse, whose eyes appear unseeing. The incubus stares directly at the viewer in a manner that arouses discomfort. Fuseli also painted a second version with a slightly different composition, which is as well-known.

Dream of Queen Katherine, above, is a remarkable fragment of a larger painting intended to show this scene from Shakespeare’s Henry VIII, and was commissioned by Thomas Macklin in 1779 for his Poets’ Gallery. It’s most likely to have been cut down from a copy of a painting similar to The Vision of Catherine of Aragon, below, which was commissioned by Sir Robert Smith and exhibited at the Royal Academy in 1781.

Queen Katherine of Aragon, wife of King Henry VIII of England, is on her deathbed. After her attendant has told her about the death of Cardinal Wolsey, the queen falls asleep and has a remarkable dream, for which Fletcher’s stage directions read:
The vision. Enter, solemnly tripping one after another, six personages, clad in white robes, wearing on their heads garlands of bays, and golden vizards on their faces; branches of bays or palm in their hands. They first congee unto her, then dance; and, at certain changes, the first two hold a spare garland over her head; at which the other four make reverent curtsies; then the two that held the garland deliver the same to the other next two, who observe the same order in their changes, and holding the garland over her head: which done, they deliver the same garland to the last two, who likewise observe the same order: at which, as it were by inspiration, she makes in her sleep signs of rejoicing, and holdeth up her hands to heaven: and so in their dancing vanish, carrying the garland with them. The music continues.

Fuseli’s painting from another play by Shakespeare, King John, Act III, scene 1 (1783), shows the young Arthur with his mother distraught at the compromise for peace, which dropped his claim to the throne.

His painting of Percival Delivering Belisane from the Enchantment of Urma (1783) shows a narrative that the artist had invented for this painting. It appears to be one of a series, although only one other work has been identified as part of that, and that precursor is only known from a print of 1782. He also preceded this series with a single painting of Ezzelin and Meduna (1779), referring to another unique narrative, but doesn’t appear to have any associated works.

Fuseli provides the viewer with a rich array of ‘Gothic’ narrative elements to form their own account of the story. There are visions of faces in the distance on the left, chains leading to an unseen figure apparently manacled into a bed at the right, Percival swinging a sword above his head, to strike the cloaked figure of Urma in the left foreground, and a beautiful young woman (presumably Belisane) embraced by Percival’s left arm, kneeling on the floor.

The Shepherd’s Dream from 1786 is an elaborate drawing made in preparation for the oil painting below. As it shows many of the elements within Fuseli’s composition more clearly than the painting, it is probably more useful for understanding their narrative.

John Milton’s (1608-1674) Paradise Lost held a special appeal for Fuseli since he had been introduced to it when a student. These works show a scene in the poem when the fallen angels in the Hall of Pandemonium (in Hell) are compared to the fairies who bewitch a peasant with their music and dancing:
… fairy elves,
Whose midnight revels by a forest side
Or fountain some belated peasant sees,
Or dreams he sees, while over head the moon
Sits arbitress, and nearer to the earth
Wheels her pale course, they on their mirth and dance
Intent, with jocund music charm his ear;
At once with joy and fear his heart rebounds.

Fuseli transforms the convention of these fairies dancing on the ground, and instead they swirl through the air above the sleeping shepherd. One of the fairies is touching the shepherd with his wand, to keep him asleep. At the lower left, a fairy has pulled a mandrake root, which has transformed into a tiny homunculus, and is now standing. At the far right, sat on the steps, is the small figure of Queen Mabs (or Mab), responsible for bringing nightmares.

The Battle Between Thor and the Snake of Midgard (1788) shows one of Thor’s many exploits: his battle with the monstrous Jörmungandr, a sea serpent born of the giant Angrboða and Loki. This celebrated battle occurred when Thor went fishing with the giant Hymir. Thor baited a strong line with an ox head, which the serpent bit. When Thor pulled it from the water, Hymir shied away, as shown here. When Thor reached for his hammer to kill Jörmungandr, Hymir cut the line, letting the serpent escape, only to face a further battle with Thor at Ragnarök, the end of the world.

I believe this was the painting that Fuseli presented as his diploma work when he was elected a full academician in the Royal Academy in 1790.

His painting of Prince Arthur and the Fairy Queen from about 1788 crosses into Arthurian legend in showing Arthur, son of Uther Pendragon, here the bearer of a magic shield that blinds his enemies and turns them to stone.

Macs should never shut down or restart of their own accord, nor should they ever freeze. If yours does any of those, you should assume it’s the result of a kernel panic, and that’s not something you should ignore. The most important evidence as to what happened in a kernel panic, and clues as to why it happened, comes in the panic log, shown shortly after you’ve logged back into your Mac. Don’t dismiss that dialog until you’ve saved its contents for future reference.

Save the panic log

Panic logs used to be saved in /Library/Logs/DiagnosticReports, from where you could open them in Console, but more recently were found somewhere closer to /var/db/PanicReporter, but now seem to vanish into thin air. You therefore need to copy its contents as soon as it appears and before sending it to Apple.

If the alert isn’t already showing the panic log, click on its Report… button, then open a text editor like TextEdit. Copy the whole contents of the panic log into a new text document and save it somewhere safe before clicking on the button to send the report to Apple. Once you’ve done that, the alert is dismissed and can’t be brought back.

Unlike app crash logs, panic logs are normally brief and to the point. Although they may be non-specific and not help much, in many cases they contain obvious clues as to what caused the panic. Formats have changed over the years, and the current Paniclog version is 14, but the following sections are likely to prove worthwhile examining.

Immediate cause

At the very top, following the first word panic, the log gives summary information and may suggest a cause:
panic(cpu 0 caller 0xfffffe002f4e48bc): cannot find IOAESAccelerator
tells you that the panic occurred on CPU core 0, because a key kernel extension couldn’t be found, a cause that isn’t particularly useful in discovering why the panic occurred.

Other non-specific examples include:
panic(cpu 0 caller 0xffffff80015efa76): Kernel trap at 0xffffff7fa047645c, type 14=page fault, registers:
panic(cpu 4 caller 0xfffffe001b91de94): Kernel data abort. at pc 0xfffffe001c2b2538, lr 0x65a4fe001c2b28ec (saved state: 0xfffffe402ecdb310)

Sometimes you strike lucky at the start:
panic(cpu 1 caller 0xfffffff01731bd68): SEP Panic: :SEPD/MDMA: 0x0000b72d 0x0002791b 0x0000971f 0x00003a91 0x00003bb7 0x00000000 0x00000000 0x00000000 [rnit]
reveals that it was the SEP, Secure Enclave Processor, that panicked. That’s likely to result in a boot-loop panic, where every time the Mac tries to start up, it panics immediately, and continues to cycle through booting and panicking until you or your Mac force it to shut down.

panic(cpu 8 caller 0xffffff80017729eb): "zalloc: zone map exhausted while allocating from zone kalloc.12288, likely due to memory leak in zone kalloc.48 (6586956000 total bytes, 137228148 elements allocated)"@/AppleInternal/BuildRoot/Library/Caches/com.apple.xbs/Sources/xnu/xnu-6153.141.1/osfmk/kern/zalloc.c:3627
is pure gold, as it reveals a probable memory leak as the cause.

Exceptions mentioned here can include page faults, in which something has tried to access an invalid memory address, invalid instruction codes for the processor, and general protection faults which include a wide variety of other bugs. As far as the user is concerned, all exceptions indicate a bug or problem in the code that’s being run.

Further down you should see confirmation that this was a kernel panic, in a line like
Debugger message: panic

OS details

Normally you’ll see a couple of lines reporting the version number of macOS running at the time. For example
OS version: 24C101
Kernel version: Darwin Kernel Version 24.2.0: Fri Dec 6 18:57:59 PST 2024; root:xnu-11215.61.5~2/RELEASE_ARM64_VMAPPLE
You can compare those with the build number of macOS shown in System Information / Software, and in Mints. This is an unusual situation, as RELEASE_ARM64_VMAPPLE means this is from a virtual machine running on an Apple silicon Mac.

Sometimes you might see a line like
OS version: Not set yet
simply indicating that the version hasn’t been recorded yet.

On Apple silicon Macs, you should also see the iBoot version, and the current level of boot security:
iBoot version: iBoot-11881.61.3
secure boot?: YES
The latter is important, as running in Secure Boot means that no third-party kernel extensions have been loaded.

Memory leak

If there has been a memory leak, the panic log may well contain a breakdown of system memory zones giving more detailed clues.
Zone Name Cur Size Free Size
vm objects 78041088 26795008
…
Zone Name Cur Size Free Size
kalloc.32 280834048 3040
kalloc.48 6586956000 4896
kalloc.64 4241453056 5000896
…
Note how the Free Sizes of kalloc.32 and kalloc.48 are very small, and that of kalloc.64 is fairly low too. This is consistent with the kernel running out of memory in one of those zones. Further information may follow:
Backtrace suspected of leaking: (outstanding bytes: 288)

Because there’s the suspicion of memory leakage, the panic log also gives a detailed backtrace of where it suspects that leakage is occurring, and details of the kexts involved in that. Note that those may not coincide with any kexts identified earlier as possible culprits.

Panicked task

It’s worth looking through the log to discover the task that was running at the time of the panic. That might simply be the kernel
Panicked task 0xfffffe166cff1f18: 10735 pages, 374 threads: pid 0: kernel_task
or may give more specific information
BSD process name corresponding to current thread: WindowServer
Boot args: chunklist-security-epoch=0 -chunklist-no-rev2-dev
or
Panicked task 0xfffffe1b55369798: 24964 pages, 8 threads: pid 800: com.apple.Mobile
alternatively
Process name corresponding to current thread: mediaanalysisd

This is the name of the process running its code at the time, and can give another clue as to where the problem lies.

You may also be given a list of kernel extensions that might be involved:
Kernel Extensions in backtrace:
com.apple.filesystems.apfs(1412.141.1)[6DA33D13-4501-3D48-B4D8-0329E6AEC86D]@0xffffff7f84e7d000->0xffffff7f84fa4fff
dependency: com.apple.kec.corecrypto(1.0)[804DD660-F561-3444-A076-05D7A52D65E3]@0xffffff7f82746000
…

Third-party kexts

Whatever the cause, you should next look at the list of unloaded and loaded kexts forming the rest of the panic log. These are listed in the order that they were loaded, with the most recent kext at the top. As third-party kexts are the last to be loaded, the top of the lists start with any third-party kexts installed on that system and loaded at the time of the panic:
last loaded kext at 939128480512562: >!UAudio 323.4 (addr 0xffffff7f86baa000, size 434176)
last unloaded kext at 948795488738566: >usb.IOUSBHostHIDDevice 1.2 (addr 0xffffff7f8556c000, size 45056)
loaded kexts:
>!ATopCaseHIDEventDriver 3430.1
…
In most cases, the name of the kext as you’ll find it in /System/Library/Extensions is the last part of the ID given. For example, the kext with the ID of com.apple.driver.AppleMobileFileIntegrity is named AppleMobileFileIntegrity.kext.

If those lists contain any third-party kexts, they should be immediately suspected as being the cause of that panic, unless another cause is apparent.

Keep your Mac’s panic logs

Although you’ll want to get on with whatever you were going to do when you were so rudely interrupted by that kernel panic, put that record of the panic log somewhere safe. If your Mac does suffer another panic, you can then refer back to it for any common features that might indicate they had the same cause. Panic logs are also invaluable for others who might assist you in discovering what was wrong. I’m very grateful to those who send me their panic logs, and here wish to acknowledge Joe, who kindly sent me my first SEP panic, a real collector’s item.

There’s more information about dealing with kernel panics in the following articles here:
Crashes, panics, freezes and other unexpected events
How to deal with a kernel panic

A century ago today, on 14 April 1925, John Singer Sargent died in London. This last article celebrating his career and art resumes in the final months of the First World War, when Sargent had returned to Britain.

In 1918, John Singer Sargent was commissioned by the War Memorials Committee of the Ministry of Information in Britain to paint a large work showing Anglo-American co-operation in the war. This was originally destined for a Hall of Remembrance, which was never built, but required a very large if not monumental painting. He set off for the Western Front with Henry Tonks, a distinguished British artist and teacher, in July 1918, and they visited units near Arras and Ypres.

According to Tonks’ recollections recorded in a letter two years later, they both witnessed the result of a mustard gas attack during the opening of the Second Battle of the Somme on 21 August 1918 (although records suggest that may have been on 26 August). In the late afternoon, they heard that many casualties were arriving at a Corps dressing station at le Bac-du-Sud, so went there. Lines of gassed casualties were being led in, in parties of about half a dozen with a medical orderly in front. Apparently, Sargent was “struck by the scene and immediately made a lot of notes.”

This change to his commission required the approval of the War Memorials Committee, which he obtained before he started work on the painting in his studio in Fulham, London, in late 1918. I don’t know exactly when Sargent made each of the pencil sketches for his painting, but some may have been made near Arras, while others were clearly based on the professional models who he employed in his studio.

Many, like Study for Gassed Soldiers (1918), show details of different passages for the final painting, and could have been made in Arras or Fulham.

The most interesting, though, are his assemblies of figures, such as this Study for ‘Gassed’ (1918). This particular group was turned into the more distant line of casualties, at the right of the finished work.

These Two Studies for “Gassed” (1918) in the Fogg Museum are more compositional in purpose, and show the shape of the final painting starting to form. Note, though, that the nearer line of casualties consists of only six (or seven) figures. In the finished painting, this becomes eleven, and forms most of the width of his panoramic canvas.

There are several fascinating details in the finished painting, including the game of soccer taking place in the distance, seen in the detail above. Sargent probably added that as a reference to the activities of normal life, contrasting with the horror that is taking place throughout the rest of the painting.

Most remarkably, there’s only one pair of eyes visible in all the soldiers present, in the medical orderly near the head of the second line at the right. He even turned the orderly who is tending to the nearer line of casualties so that he faces away from the viewer. This emphasises the blinding effects of the mustard gas, and develops the painting’s theme of vision and art.

Inevitably, Sargent faced increasing criticism of his outdated style and refusal to embrace the new styles of Cubism or Futurism. After the war he spent more time in the USA working on his series of murals in the Boston area.

This large masterpiece Orestes Pursued by the Furies was started in 1922, and completed in 1925, just prior to his death. Over the 100 square feet of its canvas, it shows a young and naked Orestes cowering under the attacks of the Furies as he tries to run from them. The swarm of no less than a dozen fearsome Furies have daemonic mask-like faces, blond hair swept back, and hold out burning brands and fistfuls of small snakes.

Sargent has gilded the flames on the brands to make them shine proud like fire. The isolated woman who stands in Orestes’ way is no Fury, though: she wears a gilded crown, and with the clean incision of a stab wound above her left breast can only be his mother Clytemnestra. There’s a profusion of arms, eight of them clutching snakes and thrust in Orestes’ direction.

This vast canvas of The Danaïdes (c 1922-25) decorates the entrance to the Library of the Museum of Fine Arts in Boston.

Atlas and the Hesperides, painted over a similar period, shows the giant still carrying the heavens on his shoulders, as seven naked Hesperides sleep on the ground around him.

In 1922, Sargent co-founded Grand Central Art Galleries and its associated academy the Grand Central School of Art, in New York City. The former held a major exhibition of his work in 1924, following which he returned to London, where he died on 14 March 1925.

By this time, the avant garde had moved on, and Sargent’s art was becoming increasingly reviled. At the 1926 London retrospective exhibition to commemorate his death, critics led by Roger Fry dismissed him as not even being an artist. It wasn’t until the latter half of the twentieth century that his art was recognised again, and his paintings are still in the throes of that revival.

Previous articles in this series

1 Pupil
2 London
3 Venice
4 Travels
5 War

References

Wikipedia
Murals at Boston Public Library
Carnation, Lily, Lily, Rose on Wikipedia

The nine volumes of his catalogue raisonné are probably the finest and largest of any catalogue raisonné to date. Volumes particularly recommended are:
Ormond R and Kilmurrary E (2012) John Singer Sargent. Figures and Landscapes, 1900-1907. Complete Paintings, volume VII, Yale UP. ISBN 978 0 300 17736 0.
Ormond R and Kilmurrary E (2014) John Singer Sargent. Figures and Landscapes, 1908-1913. Complete Paintings, volume VIII, Yale UP. ISBN 978 0 300 17736 7.

Redford, B (2016) John Singer Sargent and the Art of Allusion, Yale UP, ISBN 978 0 300 21930 2.

There are several large format and excellently illustrated selections of his oil paintings available. However his watercolours are best covered by:
Little C (1998) The Watercolors of John Singer Sargent, University of California Press. ISBN 978 0 520 21970 0.
Hirshler EE and Carbone TA (2012) John Singer Sargent Watercolors, Museum of Fine Arts Boston and Brooklyn Museum. ISBN 978 0 8784 6791 4.
Erica E Hirschler and Teresa A Carbone (2012) John Singer Sargent, Watercolors, MFA Boston and Brooklyn Museum. ISBN 978 0 8784 6791 4.

I hope that you enjoyed Saturday’s Mac Riddles, episode 303. Here are my solutions to them.

1: Harvard or Yale cipher brought emoji and Ugaritic.

2: US standard for 128 Roman characters now over 60.

3: Two plus 128 more came in 1989, gained a euro in 1998, and still supported.

The common factor

I look forward to your putting alternative cases.

I’m very grateful to all of you who looked at my little AppexIndexer, and particularly to those who commented and made suggestions. I’m delighted to come back with version 1.0 build 8, which I hope gets closer to what you’ll enjoy using. Its changes include:

• Adding support for appex UUIDs. Although the log tends to censor most clues about which appex an entry is referring to, it’s more likely to give its UUID, and armed with AppexIndexer you can use that to identify the appex in question.
• Providing a range of four sort orders. These are the SDK or type, the name of its parent app, the UUID, and the appex’s display name. Once you have loaded up the list of appexes, you can switch instantly between these sort orders.
• ‘Live’ search for UUIDs, explained below.

Tools at the top of each window include the UUID search box at the top right, four radio buttons at the left to switch between sort orders, and checkboxes for the two content options of showing appex and parent paths, and UUIDs. Start by clicking on the Get Appexes button to populate the window, then you can set it up how you want.

To help distinguish the name of parent apps, there’s a ‘parent’ emoji preceding each. You’ll also notice that SDKs shown now omit the standard com.apple. opening, as that is universal.

As before, AppexIndexer supports mixtures of continuous and discontinuous selection. Copy those you want, and they’ll paste as text containing all the available fields, not just those being displayed at the time.

Search was quite a challenge, and my solution is inspired by that explained by Tiago Gomes Pereira in his Create with Swift blog.

SwiftUI Search on Lists and similar is nothing like macOS Find, and is better-suited to displaying those entries that match in a single field rather than in all their text content. With its new sort options, AppexIndexer should be quick and simple to locate appexes by all criteria except UUID. Rather than requiring the user to paste in the UUID they want to find, this ‘live’ search should produce perfect matches when you’ve only typed in a few characters from the target UUID. Those don’t have to be characters from the start, but can be any from within the UUID. For example, to find the appex with a UUID of E1366424-89DD-4CEB-85D8-C8E00928313F, you could start typing in e1366, or c8e00, etc., as you wish. You don’t need to use capitals either.

Typing the first couple of characters should narrow the list down quickly, and by the third or fourth you should have a perfect match. If you want to return to the full list of appexes, select that appex entry and empty the search box by clicking on the X button at its right and just that single entry will be selected in the full list.

If you type in an incorrect character, you’ll be informed that no results could be found.

AppexIndexer 1.0 build 8 is now available from here: appexindexer108
I’m afraid that it still requires Sonoma 14.6 or later, but hope that you find it efficient in use and a good tool for exploring appexes.

Enjoy!

During the second decade of the twentieth century, John Singer Sargent continued his travels through Europe and in the USA. He painted some notable portraits of Americans, and progressed series of large murals in the Boston area of Massachusetts.

His larger oil paintings from this period often show finer details, that were almost certainly developed later in the studio. But even in those he retained a distinct painterliness, as shown in this view of workers Bringing Down Marble from the Quarries in Carrara which Sargent painted in 1911. These marble quarries in the north of Tuscany, Italy, provided most of the fine white and blue-grey marble for classical Roman buildings and statuary, and that for Michelangelo’s famous statue of David in 1501-04.

One of Sargent’s frequent companions during these travels was his sister, Emily, who was also a keen artist. In the Generalife (1912) shows her sketching in the gardens of the Generalife in Granada, Spain. She’s using a low metal easel with telescopic legs, and kneels sideways to work at it. Behind her is his friend Jane de Glehn, and to the right is a Spanish friend known only as Dolores. The unusual highlight effect seen in bushes above them, and on parts of the ground, was produced by scribbling with a colourless beeswax crayon, which resists the watercolour paint.

His oil painting of this Hospital at Granada from the same year shows the sick scattered haphazardly outside the wards and clinics, apparently awaiting medical attention.

The following year, Sargent visited Italy’s largest lake, at the southern edge of the Italian Alps, where he painted this tiny harbour of San Vigilio, Lake Garda, with its intricate broken reflections and underwater details.

In the summer of 1914, Sargent was back in the cooler mountain air of the Alpine passes, this time in the company of the British artist Adrian Stokes (1854–1935) and his equally talented Austrian wife Marianne (1855-1927).

The Master and His Pupils (1914) shows Adrian Stokes and Sargent’s sister Emily engaged in a painting lesson in the Alps.

The Sketchers (1914) shows another artistic couple, probably the de Glehns or the Stokes, painting en plein air.

Sargent travelled through much of the summer of that year, and by July had reached Austria in the company of Adrian and Marianne Stokes. When the First World War broke out at the end of that month, they found themselves in a country that was suddenly at war with Britain. The Austrian authorities forbade them from leaving the country, but by the middle of December they had managed to reach Switzerland, from where they were able to return home safely.

Sargent spent the latter part of the First World War in the USA, where he painted this magnificent watercolour of Muddy Alligators (1917) when staying on the Miami estate of James Deering, whose wealth came from farm machinery.

When he returned to Britain in 1918, Sargent was commissioned as a British War Artist. One of the most famous paintings of aviation during that war is his Crashed Aeroplane (1918). While two farmers get on with their harvest, there’s a crashed British biplane planted in the hillside behind.

Sargent went on to paint scenes in military medical facilities, including this watercolour of the Interior of a Hospital Tent in 1918. Although makeshift and temporary, this appears more orderly and modern than that hospital in Granada.

Apps are getting ever more flexible, and in doing so they’re also becoming increasingly complex. Gone are the days when they mostly opened files, did things to them, and saved them again. We now expect to be able to use our favourite image editor from inside the Photos app, and to share documents between multiple apps, using features as services in reusable components.

For those of us who used OpenDoc back in the 1990s this is all familiar territory. Intended as Apple’s response to Microsoft’s OLE (Object Linking and Embedding), OpenDoc broke apps down to single-task components that worked together. This was best exemplified in the suite of Internet tools provided collectively as Cyberdog for a brief period in 1996-97. Those included a web browser, FTP and email clients, and a newsreader, that could be embedded in other apps that supported OpenDoc’s Bento format.

When Steve Jobs killed OpenDoc in 1997, few could have envisaged what was to come later in app extensions, or appexes, nor how extensively they have become used by macOS. From speech synthesisers and Blu-ray encoders to wallpapers and widgets, appexes have proliferated far beyond the wildest dreams of the OpenDoc designers, but so little is known about they’re managed by macOS.

macOS Sequoia keeps extensive registries of apps and appexes. The most detailed is the grand database maintained by LaunchServices, only visible through its hidden lsregister command tool. Appexes are the preserve of the PlugInKit registry, which can be dumped using the pluginkit tool. Resource management is performed by RunningBoard and appears inaccessible, as do the activity schedules managed by Duet Activity Scheduler (DAS).

All four registries appear to be constructed afresh during startup, in the case of LaunchServices and PlugInKit by a process of discovery, something I’ll be looking at in more detail in the near future. For PlugInKit, it’s discovery that determines which appex services are offered, whether they’re generators of QuickLook thumbnails or previews, Safari extensions, or file systems such as ExFAT or MS-DOS. The latter are refugees from their former existence as kernel extensions, a route now being followed by macFuse 5.0.

Although the user has limited control over those in System Settings and, in the case of Safari extensions, in Safari’s settings, the PlugInKit registry is designed to operate automatically. If the user does try making changes using pluginkit those are likely to be undone when the registry is next updated, and in any case following reboot.

There are some differences obvious between LaunchServices’ database and PlugInKit’s registry. While LaunchServices comfortably accommodates as many versions of apps that it can find, and offers them as choices for opening documents in the Finder’s contextual menu, PlugInKit makes the user’s life simpler by only offering the latest version of each appex. Given that appexes now include replacements for QuickLook’s qlgenerators, and Spotlight importers, that’s hardly surprising, and the prospect of being offered multiple versions in the Share menu would be overwhelming for any user.

PlugInKit and appexes aren’t recent, and probably date back to OS X 10.9 Mavericks, with their NSExtension property list definitions appearing a year later in Yosemite. In macOS 13 Ventura, Apple augmented that with ExtensionKit and ExtensionFoundations both for creating extensions and the extension points offered by host apps. Appexes now cover many different domains, and have become increasingly popular in third-party products, with some like Eternal Storms’ Yoink relying on them for their tight integration with macOS.

Improving our understanding of appexes and their management by PlugInKit isn’t an academic exercise. Host apps and their extensions don’t always work in perfect harmony. Whether you’re developing either of them, or just trying to cope with their disagreements, insight can be important. Now that Sequoia requires QuickLook thumbnail and preview generation to occur in appexes rather than qlgenerators, the qlmanage command tool is of limited value, and you have to rely on PlugInKit instead.

Once upon a time, Apple used to provide extensive and well-written conceptual documentation, where it explained how Mac OS worked, so that when we came to tackle problems we could fall back on understanding. Now we’re largely left to fend for ourselves, so armed with a forthcoming new version of AppexIndexer, I’m off to discover PlugInKit discovery.

Few nineteenth century novels were featured in as many paintings and prints as Victor Hugo’s story of Quasimodo and Esmeralda, told in his Notre Dame de Paris, most popularly known as the Hunchback of Notre Dame.

Hugo’s book has a curious origin. In the 1820s, the great cathedral of Notre Dame in Paris, probably the city’s most visible and distinctive building, underwent restoration to repair the damage that had occurred during the Revolution. One of the foremen of the stonemasons working on the building was a ‘hunchback’ with a spinal deformity. Hugo became greatly interested in the cathedral’s Gothic architecture, and was keen to raise awareness of its importance and beauty. In 1829, he started work on this novel.

After an intense final few months of writing, Notre Dame de Paris was published in early 1831. It became enormously popular, and has been the basis for over a dozen movies since 1905, TV series, plays, operas and musicals, and ballets. As a result, its hunchback hero Quasimodo has developed a life of his own in modern legend.

Set in Paris in 1482, its central characters are Quasimodo, the bell-ringer of the cathedral who not only has a spinal deformity, but is nearly blind and largely inarticulate, and Esmeralda, a beautiful young dancer, thought (incorrectly, it turns out) to be a gypsy, who is the object of much male lust, and has a pet goat Djali who performs tricks.

Quasimodo’s guardian, the Archdeacon Frollo, lusts after Esmeralda and orders the bell-ringer to kidnap her for him. Quasimodo’s attempt fails, and the following day he is punished by a flogging and being put in the pillory. While there, he is badly dehydrated and calls for water, provided by Esmeralda. She’s later arrested and falsely charged of attempted murder, for which she is sentenced to death by hanging.

As Esmeralda is being led to the gallows, Quasimodo swings down on a bell-rope and carries her off to sanctuary inside the cathedral. However, the court of parliament then decides to remove her right of sanctuary, making her liable to arrest. Local gypsies rally to this, and charge the cathedral to rescue her.

When Quasimodo sees the gypsies, he assumes that they want to hurt Esmeralda, so drives them away; when the king’s men arrive, he misunderstands their purpose, and tries to help them. Esmeralda is then ‘rescued’ by the Archdeacon, who tries to seduce her, then to betray her when she rejects him.

Esmeralda is finally taken to the gallows, where the Archdeacon laughs as she is killed. Quasimodo gets his revenge by pushing the Archdeacon from the height of the cathedral, then goes to the cemetery where he dies of starvation while hugging Esmeralda’s corpse. Much later, they are discovered still in their embrace; when their bones are separated, Quasimodo’s turn to dust.

Probably one of the earliest paintings to show Victor Hugo’s story is this undated work by a Mademoiselle Henry who is claimed to have lived between 1790-1873. It shows Quasimodo Saving Esmeralda from the Hands of her Executioners: the bell-ringer has just swept the young woman from the gallows, and she has swooned away on his shoulder. He carries her in through the main entrance of the cathedral, to claim sanctuary for her. Her pet goat Djali is at the top of the steps. The rope running down the steps is the bell-rope on which Quasimodo swung down onto the gallows.

The strange Belgian narrative painter Antoine Wiertz painted a pair of portraits in 1839 showing the novel’s male and female leads. This is his Quasimodo, who resembles the figure in the painting above. Wiertz doesn’t appear to have been happy with this work, and labeled it a bad study.

For his portrait of Esmeralda, Wiertz used his favourite model, and an affectionate goat. The letters on her lap spell Phɶbus, the name of the captain of the King’s Archers, who she is convicted of attempting to murder.

Louis Boulanger painted this fascinating and painterly group of Six of Victor Hugo’s Characters in 1853, apparently for a friend. Clockwise from the top left they are Don Ruy Gomez, Don César de Bazan, Don Salluste, Hernani, Esméralda and De Saverny, but there’s no goat.

Jozef Van Lerius’ portrait of Esmeralda and Djali, which must have been completed before the artist contracted meningitis in 1875, is startlingly realist and gently erotic. Djali is shown with gold horns and hooves, and in front of the girl are, once again, the letters forming the name Phɶbus.

William-Adolphe Bouguereau’s Little Esmeralda from 1874 conforms less to Hugo’s character. She is fair and would never be taken for a ‘gypsy’, and is seen carrying wild flowers out in the country, perhaps on the coast of Normandy. She does, though, have Djali as her companion.

There have been many illustrated editions of Notre Dame de Paris, in its original French, English and other translations. Among them is an edition published in 1889, with engravings based on a series of drawings made by the Naturalist Luc-Olivier Merson between 1881 and 1889, three of which I show here.

This shows Esmeralda taking pity on Quasimodo when he had been flogged and put in the pillory, by giving him a drink of water. Naturally she is accompanied by Djali.

Esmeralda and Djali are here seen with Phɶbus, I think.

This is Merson’s treatment of Quasimodo carrying the swooning Esmeralda from her first brief visit to the gallows up into the sanctuary of the cathedral.

Here are this weekend’s Mac riddles to entertain you through family time, shopping and recreation.

1: Harvard or Yale cipher brought emoji and Ugaritic.

2: US standard for 128 Roman characters now over 60.

3: Two plus 128 more came in 1989, gained a euro in 1998, and still supported.

To help you cross-check your solutions, or confuse you further, there’s a common factor between them.

I’ll post my solutions first thing on Monday morning.

Please don’t post your solutions as comments here: it spoils it for others.

The first file system for Macintosh computers wasn’t HFS+ or even its predecessor HFS, but Macintosh File System, MFS. This was introduced in System 1 on the 128K Mac just over 41 years ago, to support its 400 KB floppy disks. Although it was fairly primitive, it incorporated some visionary features, including forks. Each file had two sets of data: a data fork as in other file systems, and a resource fork for storing structured blobs of data or resources.

File naming was liberal compared with MS-DOS, allowing names up to 255 characters long, although that was restricted to 63 by the Finder. Names could consist of any printable character except the colon :, a limitation that persists in the Finder today. As there was no directory hierarchy, folders were an illusion and couldn’t be created directly by the user. Instead there was always an Empty Folder available, and when that was used, a fresh Empty Folder was created. As this was a single-user file system, there were no permissions.

MFS was still supported until it was finally discontinued 13 years later in System 8, in 1997.

Hierarchical File System, HFS

MFS had been designed for the low-capacity floppy disks of the time, and not for use on hard disks, where its limitations would have been only too apparent. For the release of the Macintosh Hard Disk 20 in September 1985, and in anticipation of the Macintosh SE 18 months later, a new Hierarchical File System had to be released to replace MFS in System 2.1. HFS remained fully supported until the arrival of Mac OS X 10.6 Snow Leopard in 2009, and finally dropped altogether in macOS Catalina a decade later.

Developed by Patrick Dirks and Bill Bruffey, HFS maintained many of the novel features in MFS, with resource forks, long file names up to a maximum of 31 characters, still excluding the colon, and in its standard single-user version didn’t support permissions. The latter were incorporated into AppleShare later. File and folder names were case-preserving but case-insensitive.

Larger storage capacities brought the need for a hierarchical directory structure, implemented using B-trees in a Catalog File that made the display of even large directories very quick. Although much of HFS used 32-bit integers, that didn’t apply to the number of files in a logical disk, which was limited to 65,535, which must have seemed sufficient at the time, and given the maximum volume size of 2 TB. With early hard disks being measured in tens of MB, that may have seemed in the distant future.

Mac OS Extended, HFS+

With the growth in capacity of hard disks, HFS had to be updated to address its limitations, in a project with the internal name of Sequoia, delivering HFS+ in Mac OS 8.1 in 1998. Switching to 32-bit fields to identify allocation blocks allowed more efficient use to be made of storage and a larger number of files in each volume. File names were increased in maximum length to 255 characters, and changed from MacRoman encoding to Unicode UTF-16 to accommodate a broader range of languages. Support for additional forks beyond data and resource paved the way for the switch to extended attributes, and OS startup support was improved to allow alien operating systems to boot from HFS+ volumes.

This screenshot shows a set of custom icons in a BNDL resource, in the QuarkXPress app in about 2000.

This shows file information available in HFS+ in Classic Mac OS in 2002.

HFS+ and its predecessors were prone to develop errors as a result of operating system crashes and other unexpected events, and those could be cumulative, leading to data loss. This was addressed with the introduction of journalling, designed and implemented by Dominic Giampaolo, who came to Apple from implementing the file system for BeOS. This was tentatively introduced as an option in Mac OS X 10.2.2 in late 2002, and made a standard feature in 10.3 the following October. Alongside that came an optional wrapper for case-sensitivity in what was dubbed HFSX, and a change in Unicode decomposition to Normalisation Form D (NFD).

Mac OS X 10.4 augmented Posix permissions with Access Control Lists (ACLs), although they were little-used outside server environments for some years. Prior to 10.5, as with most other file systems, HFS+ supported file but not directory hard-links. With the introduction of Time Machine in 10.5 Leopard, directory hard-links were added to support the structure and illusions of Time Machine backup stores.

File system support for encryption was a bit more troubled. The original FileVault, introduced in 2003 with Mac OS X 10.3 Panther, located user Home folders in an encrypted sparse disk image, which was improved in 10.5 by moving to sparse bundles. This suffered several shortcomings and vulnerabilities, and was replaced by whole-volume encryption in FileVault 2 in Mac OS X 10.7 Lion. That required the addition of a logical volume manager, Core Storage, which was then used for Fusion Drives introduced in 2012.

Apple File System, APFS

HFS+ had been designed for computers with hard disks. It lacks some of the features of more modern file systems such as snapshots, special files such as sparse files, and concurrent access. It’s also not well-suited to use with SSDs and storage in smaller, mobile devices, although when the first iPhone shipped with iOS 1.0 in 2007, it used HFSX, the case-sensitive variant of HFS+. That was until the release of iOS 10.3 on 27 March 2017, which silently converted its file system to APFS.

In 2014, Apple had decided to write its own file system from scratch, and Dominic Giampaolo, responsible for journalling in HFS+, and Mike Mackovitch became its lead engineers. APFS was announced two years later at WWDC in 2016, when it was expected to be released in another 18 months if development and testing went smoothly. Those who had hoped for ZFS were disappointed and many remain so today. macOS Sierra already had a pre-release version for those who wanted to preview it, but as we discovered when we upgraded to High Sierra, that was a far cry from what was to come.

After a promising period in beta, Apple discovered fundamental problems between APFS and its popular Fusion Drives. The first release of macOS 10.13 shipped with APFS version 748.1.46, but abruptly dropped support for those, so converted only those startup volumes on SSDs and hard disks. Snapshots were wobbly at first, and it quickly became clear that APFS was never going to perform well on rotating disks.

High Sierra had a stormy early release history, marred by a series of security gaffes. Vulnerabilities were fixed in the Supplemental Update released less than two weeks after 10.13, leaving snapshots to be improved in 10.13.1 on 31 October. Many expected problems with Fusion Drives would be fixed quickly, but those weren’t ready for release until the following September. Another problem that troubled the introduction of APFS to all platforms was the refusal during beta-testing to incorporate Unicode normalisation; this had to be resolved in later versions of macOS 10.13 and iOS 10, as explained here and here.

In September 2018, Apple at last released Mojave 10.14 with support for Fusion Drives, accompanied by the first version of the Apple File System Reference. Although a long and detailed document, developers soon realised how incomplete it was, in spite of the long delay in its publication. At last third-party file system developers had some hard information to work with, and users started assuming that third-party disk maintenance and repair tools were imminent.

Catalina brought major changes to APFS, with the use of expanded volume roles to form System Volume Groups, with their separate but firmlinked System and Data volumes. macOS 10.15.5 fixed a serious bug preventing the transfer of very large amounts of data to RAID volumes. At that time, Apple released an updated version of the Apple File System Reference, building expectations that third-party tools were just round the corner, at least among those who weren’t aware of how much information was still missing. Nearly five years later, it’s still that same edition dated 22 June 2020 that remains the latest information released by Apple about APFS.

Further major changes came with Big Sur 11.0.1 when it was released in November 2020, introducing the sealed and signed snapshot now used to boot macOS. This was also the first release to support making Time Machine backups to APFS volumes, and to support Apple silicon Macs.

Although Apple dropped early hints that APFS might be released as open source, unlike its predecessors, after eight years, information about its internals released by Apple still appears to be insufficient to allow third-party developers to create maintenance tools independent of those bundled in macOS. This reluctance may stem from the deep involvement between the file system and macOS security.

Summary timeline

• MFS Jan 1984 – Sep 1985, end of support 1997
• HFS Sep 1985 – Jan 1988, end of support 2019
• HFS+ Jan 1988 – present, still supported
• APFS Sep 2017 (iOS March) – present, still supported

References

Inside Macintosh: Files, Chapter 2 – File Manager, on HFS
MacCyclopedia critical account of HFS and HFS+. 25 May 2003
Apple TN1150 HFS Plus Volume Format, 5 March 2004
Apple’s APFS Reference (PDF), last revised 22 June 2020.

Wikipedia on
MFS
HFS
HFS+

Although few of those who migrated to the towns and cities from the countryside prospered as a result, there were sufficient examples to lure others to take their chances. For a young woman, success could come through the growing world of fashion.

The foot of the ladder was the greatest challenge: how to make the break from the worn-out worker shown in Christian Krohg’s Tired from 1885. This young seamstress was one of the many thousands who worked at home at that time, toiling for long hours by lamplight for a pittance. A few of them had the good fortune to be discovered and taken up into a small dressmaker’s.

They might then enter the world of Moritz Stifter’s New Dress from 1889. Every face is smiling here, some perhaps a little vacuously, as an affluent young woman tries on a new dress, with its incredibly small waist. Although this room is full of fabric and the trappings of dressmaking, including the mandatory sewing machine, no one actually appears to be making anything.

A few specialised in making hats, as shown in Edgar Degas’ The Millinery Shop (1879/86). While husbands and partners were expected to pay for a woman’s hats, their choice was hers, and hers alone.

Jean Béraud’s fashionably-dressed Milliner on the Champs Elysées is enjoying her success, and carrying her work in two large hatboxes. She has also attracted the attention of the well-dressed man in a top hat behind and to the left of her.

Les Modistes (Two Milliners in the Rue du Caire, Paris) from 1885-86 is one of Paul Signac’s transitional paintings to Seurat’s Divisionism. These two young milliners are busy making fashionable hats and making their way into bourgeois life.

Pierre-Georges Jeanniot’s At the Milliner (1901) shows the milliner in a mirror at the right.

Millinery was one of the staples of fashion houses like that of Paquin, whose success was characteristic of the late nineteenth century, and shown in Henri Gervex’s Five Hours at Paquin’s from 1906.

The purpose of these expensive hand-made hats was for show, when the lady was seen in appropriate surroundings. Jeanniot’s painting of the patrons of one of the most fashionable hotels in Paris shows all the hats out on parade in the inner garden of the Paris Ritz in fine weather.

Béraud’s Workers leaving the Maison Paquin (1907) shows the ladies who worked in Jeanne Paquin’s highly successful fashion house in the Rue de la Paix, as they left work at the end of the day.

A select few were fortunate enough to marry into the middle class and forge a more secure future for themselves.

Béraud’s After the Service at the Church of Sainte-Trinité (the ‘American Cathedral’) (c 1900) shows affluent Franco-American society at the turn of the century, and the prominence of hats and clothes.

Recent updates to macOS Sequoia 15.4, Sonoma 14.7.5 and Ventura 13.7.5 brought firmware updates for some Macs, but not others. As I have now analysed those, and they’re reflected in the databases accessed by SilentKnight, and in my reference articles here (listed at the end), this article explains which are still being maintained by Apple.

Intel Macs without T2 chips

There are only two models of Mac without a T2 or Apple silicon chip whose firmware is still supported for updates: the iMac19,1 and 19,2, respectively the 2019 Retina 5K 27-inch and Retina 4K 21.5-inch. In this round of updates, they moved up to an EFI version of 2075.100.3.0.3, dated as recently as 3 March 2025. As they can run Sequoia, they’re expected to have continuing macOS security updates until at least the summer of 2027.

Older models of iMacs, MacBook Pros, and a single MacBook, remain with EFI firmware that was last updated in June 2024, and is unlikely ever to be updated any further. macOS support for them is expected to end when security updates for Ventura are discontinued at the end of the summer this year.

T2 Macs

For the 20 days between the release of 15.3.2 and 15.4, Intel Macs with T2 chips that were running Sequoia had a slightly more recent release of iBridge firmware. In 15.3.1, 14.7.4 and 13.7.4, that was 22.16.13051.0.0,0, but 15.3.2 brought version 22.16.13060.0.0,0. This is one of very few occasions in which T2 Macs running supported versions of macOS have had different firmware versions installed.

Thankfully, this last round of updates has rectified that, and all Macs with T2 chips should now be running 2075.101.2.0.0 (iBridge 22.16.14248.0.0,0). This is encouraging, not only for simplicity, but because it demonstrates that Apple is continuing to support not only the ‘Bridge’ Arm chip, but EFI as well. How much longer that will continue depends on whether there is Intel support in macOS 16, expected to be announced at WWDC in early June, and released in September or October this year.

At a minimum, macOS support for T2 Macs should last at least until summer 2027, and that should be extended to the following year if macOS 16 comes with Intel support.

Apple silicon Macs

All Apple silicon Macs should now be using iBoot version 11881.101.1, which was installed with these updates. The most recent MacBook Air and Mac Studio models with M4 family (or M3 Ultra) chips had their own update to 15.3.2, but 15.4 covers all current models in the single distribution, with the same firmware version.

There’s a growing number of reports of Apple silicon Macs experiencing problems updating to Sequoia 15.4, either on their internal SSD or on bootable external disks. This seems most likely in models with M1 family chips, and suggests that changes made in the installer might be responsible. As this doesn’t appear to affect 14.7.5 or 13.7.5 updates, it’s unlikely to lie in the firmware. There are several strategies you can adopt to work around this, including:

• Try updating in Safe mode. This is a longstanding function of Safe mode, described here.
• Start up in the correct paired Recovery system, and install Sequoia there. This should be attempted conservatively, without creating a fresh Data volume, but you must ensure that you have at least one complete backup ready in case anything goes wrong and the whole boot volume group has to be replaced.

Provided the Mac is already running at Full Security, there shouldn’t be any value in changing that. Performing a full Restore in DFU Mode isn’t as daunting as it might seem, but is a drastic solution requiring a recent second Mac, and full restore from your backup. If you’re getting to that stage, contact Apple Support who hopefully will now be only too familiar with these problems.

Summary

• Intel Macs without T2 chips: iMac19,1 and 19,2: EFI 2075.100.3.0.3; no change in other models.
• Intel Macs with T2 chips: 2075.101.2.0.0 (iBridge 22.16.14248.0.0,0).
• Apple silicon Macs: 11881.101.1.

Reference data

Which firmware should your Mac be using? (version 9, Sequoia)
Which firmware should your Mac be using? (version 8) – for Sonoma
Which firmware should your Mac be using? (version 7) – for Ventura

Folding screens were first recorded in ancient China, where they were used as portable room dividers and as decorative furniture. They’re thought to have made their way to Europe in the late Middle Ages, and started to spread more widely during the seventeenth and eighteenth centuries.

Early screens were made of wood, but were soon covered with painted paper or silk. Kanō Hideyori’s magnificent Maple Viewers (紙本著色観楓図) (Muromachi, early 1500s) is painted on paper in the classical style of the Kanō school, then applied to a six-section folding screen.

In Europe, screens served several purposes in addition to dividing a larger space into two. They could be used to keep drafts away, provide privacy, hide a feature like a servant’s entrance to a kitchen, or purely for decoration.

In the fourth painting in William Hogarth’s moralising narrative series Marriage A-la-Mode, The Toilette (c 1743), Countess Squander is being entertained while completing her dressing and preparations for the day. In the background at the right is a painted screen showing a masquerade ball.

It was the popularity of East Asian artefacts in the latter half of the nineteenth century that put folding screens in many homes and quite a few paintings. They featured in at least two of James Abbott McNeill Whistler’s works from the mid-1860s.

Behind Whistler’s Princess from the Land of Porcelain (1863-65), from his Peacock Room, is a painted screen from Japan.

A more elaborately painted screen forms the backdrop to Whistler’s Caprice in Purple and Gold: The Golden Screen from 1864.

Lucy Madox Brown Rossetti’s The Duet (1870) attracted favourable reviews when exhibited at the Royal Academy. This features a decorated folding screen from East Asia in the left background. The artist was the daughter of the Pre-Raphaelite painter Ford Madox Brown, and was Dante Gabriel Rossetti’s sister-in-law.

In 1872 William Quiller-Orchardson completed Dolce Far Niente, incorporating in its painted screen a contemporary flavour of Japonisme. His woman, dressed in sober black, reclines on a thoroughly European chaise longue, her open book and fan beside her as she stares idly out of an unseen window.

Like other artists of the day, Elihu Vedder developed a fascination for objets d’art from the Far East, which he assembled in this Japanese Still Life in 1879. This unusual collection may have been assisted by the fact that his brother was a US Navy doctor who was stationed in Japan as it was being re-opened to the West.

Bouderie, which means sulking, is a splendid and intimate portrait of Pascal Dagnan-Bouveret’s friend and colleague Gustave Courtois, painted in 1880. Courtois is seen at one end of a large sofa, smiling wryly and staring into the distance. He holds his palette and brushes in his left hand, and what may be a long mahlstick in the right. At the opposite end of the sofa, turned with her back towards Courtois, is a young woman dressed in fashionable clothing, in black throughout, apart from white lace trim at the foot of her skirts. Also shown is a screen decorated with Japanese imagery, and on the floor the skin of a big cat, perhaps a lioness.

Pierre Bonnard developed his earlier Man and Woman in an Interior into his Man and Woman in about 1900. Marthe isn’t getting dressed here, but sits up in the sunshine. A folded wooden screen divides the painting into two. Bonnard stands at the right edge of the painting, his legs looking skeletal in the sunlight.

William McGregor Paxton’s Tea Leaves (1909) show two well-dressed young women taking tea together. The woman in the blue-trimmed hat seems to be staring into the leaves at the bottom of her cup, a traditional means of fortune-telling, and behind them is a large folding screen, whose details are intentionally blurred and vague.

The New Necklace from the following year is one of Paxton’s best-known paintings, and perhaps his most intriguing open narrative. A younger woman is sat at a narrow bureau writing. She has turned her chair to reach behind and hold out her left hand to receive the new necklace from a slightly older woman in a dark blue-green dress. Their backdrop is another folding screen, this time with its East Asian painting clearly visible.

My final screen is the painting itself.

Pierre Bonnard’s exquisite three-panelled Japoniste screen of The Stork and Four Frogs was painted at the outset of his career, in about 1889. Its story is contrastingly European, and based on one of Aesop’s fables retold by Jean de La Fontaine’s The Frogs who Demand a King.

The version retold by La Fontaine centres on a colony of frogs, who ask Jupiter for a king. The god’s first response to their request is a laid-back and gentle leader, whom the frogs reject as being too weak to rule them. Jupiter’s second attempt is a crane, who kills and eats the frogs for his pleasure. When the frogs complain to Jupiter, he then responds that they had better be happy with what they have got this time, or they could be given something even worse. Bonnard’s magnificent panel is traditionally interpreted not as showing the evil crane of the second attempt, but the first and gentle ruler.

App extensions, appexes, have become plentiful and widely used by macOS and third-party software, yet discovering and controlling them is patchy and limited. The most coherent access is in System Settings > General > Login Items & Extensions, where some are gathered in the list of Extensions at the end. Others like Safari extensions are controlled in app settings, while most remain hidden out of sight.

To take stock of all these appexes, I turned to the pluginkit command tool, but the lists it generates are seemingly ordered at random, and so extensive that it would require some serious scripting to make any sense. Instead, it’s easier and more effective to put together a little app to do that. So I present you with AppexIndexer, an exploratory utility that displays key information about all appexes recognised by macOS.

Click on its button to Get Appexes and the window below will fill with well over 400 items, arranged in alphabetical order by the first entry in each line, the SDK or NSExtensionPointIdentifier. Some of those should be fairly obvious: for instance, those appexes listed in Photos Editing settings use the com.apple.photo-editing SDK. In a future article I will explore the relationships between settings categories and SDKs given.

Following that comes the display name of that appex, again ordered alphabetically within that SDK group, which should be the same as that used in System Settings. Next comes the path to that appex, so you can inspect it and its Info.plist for further information.

Many appexes also have a parent, so the last two entries given are the name and path to that parent, when they’re available. One quick way to recognise third-party appexes is to glance down the right side of the list, as they invariably have a familiar parent. Appexes built into macOS are far less likely to have parents (and you can read into that what you like!).

Even in a modest installation, you’re likely to see well over 400 in your Mac’s list, from SpamSieve, an Email Extension with the SDK of com.apple.email.extension, through to QuickLook thumbnail previewers, screensavers and wallpaper. I’ve already explained in general terms what these are and how they work, in this article.

One significant feature missing at this stage is Find/Search, which I’m still working on, for LogUI as well. There’s also additional information given by the pluginkit command tool, and more still that’s available from each appex’s Info.plist file inside its bundle. This initial release lets you save the window’s contents using the Save as RTF button, and you can copy any selected entries and paste them as text. Row selection can be continuous using the Shift key, and discontinuous using Command.

Appexes are not only growing in number, but also becoming increasingly important in macOS. In some cases, they include background processes that could be used maliciously as a method of persistence. Although appexes still need to comply with TCC’s strict rules for accessing protected services and data, they can be an effective way to fly under a user’s radar.

AppexIndexer 1.0 build 5 is now available from here: appindexer105
I’m afraid that it requires macOS Sonoma 14.6 or later, to support the features it uses in SwiftUI.

I hope that you find this information of use. Please let me know what features you’d like the app to support, whether you’d like it to access appex property lists, or other useful data, and how you might want to use a future version. While I’ve got my own ideas, I’m interested in yours, and will try to accommodate them.

In 1907, after over twenty years of lucrative work painting portraits, John Singer Sargent closed his studio in London, and cut himself adrift to travel where and when he wanted.

The American artists Jane de Glehn and her husband Wilfrid (1870-1951) were long-standing friends. Sargent first met Wilfrid around 1895 when he was working on murals in Boston Public Library, and Wilfrid married Jane Emmet (1873-1961), sister of Lydia Field Emmet, in 1904. The Fountain, Villa Torlonia, Frascati, Italy (1907) shows Jane working at a lightweight wooden easel in the grounds of the villa.

The composition in his Dolce Far Niente (1907) is complex, with five of the figures staggered and slightly out of line along the gentle curve of the bank crossing this unusually wide canvas, its aspect ratio being more typical of marine views and panoramas. Against this are steep diagonals in the middle of the painting, formed by the edge of the brown reflection on the water, the male in the left pair of figures, and the closest female. The cropping of the horizon and any background beyond the immediate meadow and stream gives a sense of space and recession, aided by the foreshortening of the closest figure, despite the proximity of the individuals to one another.

The painting consists of a multitude of daubs, strokes, and dabs of colour, those marks composed to provide just enough information for the viewer to assemble them into the whole, which as a result ‘pops’ out in a vivid reality.

It’s thought that all three male figures were modelled by Nicola d’Inverno, the painter’s manservant, and the woman seen asleep appears to be his friend Jane de Glehn. Sargent had purchased the costumes in the Middle East during his travels there, and they were transported in trunks to this site, believed to be the brook at Peuterey in the Val d’Aosta, most probably in the summer of 1907.

This painting was hung in the summer exhibition of the New English Art Club, London, in 1909, and was favourably received by the critics. It was sold within an hour of the opening of the press view, to Augustus Healy, founder of the Brooklyn Museum, where it has hung ever since.

Sargent’s bravura watercolour sketch of Grand Canal, Venice (1907) is composed of a sparse, even minimalist, collection of brushstrokes of watercolour assembled into a detailed view of the motif. He views Venice from the level of a gondola, the bows of which are also shown. His palette for these sketches is generally centred on earth colours for the buildings, with blue for the sky, water, and usually the shadows.

The following year, his Flotsam and Jetsam follows in the same style, with the figures of young boys in the foreground sketched in roughly to suggest movement.

Sargent was an early adopter of cadmium yellow pigment in watercolours such as Olive Trees, Corfu from 1909, where it ensured that his greens remained lightfast.

He wasn’t dependent on sophisticated techniques, though: Rio dei Mendicanti, Venice from about 1909 works its magic almost entirely using a combination of passages using wet on dry and wet on wet. There isn’t even much in the way of a graphite drawing under its thin washes.

Sargent met up with the plein air specialist Ambrogio Raffele again when he returned to the Alps during the summers of 1909 to 1911, and painted this watercolour of him as an Artist in the Simplon at some time in those years. Raffele is painting a view of the Fletschhorn, to the south-west of the Simplon Pass, using an improvised easel formed from two crossed poles.

In the summers of 1909-11, Sargent stayed with various friends in the Bellevue Hotel at the top of the Simplon Pass, enjoying the cool mountain air at a time when much of the rest of Europe would have been stiflingly hot. While his family and friends whiled away their days in leisure, Sargent got them to pose for a unique series of informal portraits. They may have been reclining at leisure, but Sargent took those watercolours very seriously, and deployed an amazing array of techniques. Among the finest is his Simplon Pass: The Tease from the summer of 1911. For any watercolour artist, it is a lexicon of advanced techniques.

One of the most unusual, used here extensively, is wax resist. Before applying paint, Sargent scribbled over areas that were intended to be vegetation, using a soft wax crayon, probably made from beeswax. On a fairly rough paper, the wax is deposited unevenly, and when painted over using watercolour it shows the white paper through. This creates disruptive patterns of near-white in the midst of the greens, and a superb effect.

Most of the paint used is transparent watercolour, applied as a wash in small areas, and in gestural marks elsewhere. In the upper third of this detail, he has applied white gouache (opaque watercolour) sufficiently thickly for it to now have fine cracks. The large pale blue area crossing the middle appears to have been rewetted and some of its colour lifted to reduce its intensity, although most of his applications of paint over existing paint have been made wet on dry.

Complex details such as the faces and hands of the figures have undergone multiple repainting, starting with the palest flesh of the face, and progressively darkening to near-black. In most cases, the clean edges of the marks demonstrate that these were applied wet on dry, with as many as six different layers in the hair.

In the midst of this complex assembly of layers, Sargent still keeps to the lines of his original graphite sketch, which he uses to give the parasol form, and maintains small reserved areas, here forming the spectacle frames in the white of the paper. He could have used wax resist here, but if using pure beeswax it’s hard to keep the soft wax to fine lines.

Sargent is the Chess Grand Master, the strategist whose moves at times might almost seem random or abstract, but in the end they all come together to bring this masterly watercolour to life.

For many years, most types of disk image were inefficient in their use of storage space, as they occupied their full size on disk. Until recently, when you created a 5 GB read-write UDIF disk image, one of the most popular, it invariably took up 5 GB in storage, even when empty. This also applied to the raw disk images used by Virtual Machines: give a VM 100 GB, and that’s just what it took on disk. With the introduction of sparse files in APFS, this has changed, and many disk images now only take the space they need. I’m not sure exactly when this change occurred, as Apple still doesn’t appear to have documented it, but it seems to have changed with macOS Monterey.

This is easiest to see with a plain read-write disk image, created using DropDMG or Disk Utility.

Disk image

Here’s one I made earlier, a whole 350 GB in size. When it’s created, it’s automatically attached and mounted at full size. For the sake of example, I then copied a large IPSW to it, so it wasn’t entirely empty.

Unmount it and Get Info on the disk image and you’ll see it does still take up a full 350 GB on disk. Mount it again, though, and APFS works its magic. You can see this in LogUI, or the custom log extract provided by Mints.

When unmounted again it has shrunk down to take little more than the size of the IPSW file in it, at just over 17 GB. That’s less than 5% of its nominal size, without using any compression.

It’s worth looking through entries in the log made by APFS for the mount process. First, APFS checks whether the data store for the disk image is already sparse:
01.470 container_backingstore_is_sparse:1652: Image url file:///Volumes/LaCie2tb/350gbudif.dmg Image path /Volumes/LaCie2tb/350gbudif.dmg
01.470 container_backingstore_is_sparse:1659: Image /Volumes/LaCie2tb/350gbudif.dmg is a flat file, do not consider as sparse

It then sets it to sparse, ready for sparsification:
01.475 handle_apfs_set_backingstore:6207: disk9s1 Set backing store as sparse
01.475 handle_apfs_set_backingstore:6240: disk9 Backing storage is a raw file

Space Manager performs an initial scan for free blocks without any Trimming:
01.479 spaceman_scan_free_blocks:4136: disk9 scan took 0.004272 s (no trims)
01.479 spaceman_fxc_print_stats:477: disk9 dev 0 smfree 81258479/85398014 table 4/452 blocks 81258479 32766:20314619:79974226 100.00% range 35869:85362145 99.95% scans 1

Space Manager then scans and Trims free storage blocks, taking just over 0.7 second to complete:
02.196 spaceman_scan_free_blocks:4106: disk9 scan took 0.717433 s, trims took 0.715705 s
02.196 spaceman_scan_free_blocks:4110: disk9 81258479 blocks free in 25 extents, avg 3250339.16
02.196 spaceman_scan_free_blocks:4119: disk9 81258479 blocks trimmed in 25 extents (28628 us/trim, 34 trims/s)
02.196 spaceman_scan_free_blocks:4122: disk9 trim distribution 1:0 2+:0 4+:0 16+:0 64+:0 256+:25

VM

What happens with an Apple silicon VM is a bit more complicated, and harder to observe. This time the virtualisation app should create the disk image inside the VM bundle as a sparse file to begin with, then copy into that what’s needed for the VM, so skipping the first mount stage and Trimming during the second mount.

The result is the same, though, with a 350 GB VM taking just 22 GB on disk. Inspect that disk image using my free utility Precize, and you’ll see that economy confirmed, and the Sparse File flag set.

Conclusions

For plain read-write disk images and those inside VMs to be sparse files:

• they must contain a suitable raw disk image, such as UDIF read-write;
• the host file system must be APFS, as HFS+ doesn’t support sparse files;
• for normal disk images, they must be stored on an SSD that supports Trimming;
• there must be sufficient free space in the disk image;
• the guest file system can be APFS, either plain or encrypted, or HFS+J;
• for normal disk images, they must have been mounted at least once since first being created.

Apple has just released an update to XProtect for all supported versions of macOS, bringing it to version 5293. As usual, Apple doesn’t release information about what security issues this update might add or change.

This version adds a single new rule for MACOS.SOMA.J.

You can check whether this update has been installed by opening System Information via About This Mac, and selecting the Installations item under Software.

A full listing of security data file versions is given by SilentKnight, LockRattler and SystHist for El Capitan to Sequoia available from their product page. If your Mac hasn’t yet installed this update, you can force it using SilentKnight, LockRattler, or at the command line.

If you want to install this as a named update in SilentKnight, its label is XProtectPlistConfigData_10_15-5293.

Sequoia systems only

This update has also been released for Sequoia via iCloud. If you want to check that manually, use the Terminal command
sudo xprotect check
then enter your admin password. If that returns version 5293 but your Mac still reports an older version is installed, you can force the update using
sudo xprotect update

I have updated the reference pages here which are accessed directly from LockRattler 4.2 and later using its Check blog button.

John Singer Sargent’s move to London in 1886 had proved a commercial success, and he painted portraits of the rich and famous until he closed his studio there in 1907.

His group portrait of The Ladies Alexandra, Mary, and Theo Acheson, normally simply known as The Acheson Sisters, was exhibited at the Royal Academy in 1902, where it was both very popular and favourably received. And at first sight, it is indeed a delight, as they sit around the front of a huge urn decorated with floral garlands, one of the ladies reaching up to pick oranges from a tree just above the urn. Even the late Queen Victoria would, I am sure, have approved. However, there are hidden references that link back through earlier portraits by Sir Joshua Reynolds to Nicolas Poussin’s previous paintings of bacchanalian orgies.

Meanwhile, the other John Singer Sargent continued his travels across Europe and beyond. A visit to Venice in 1902 brought this stunning watercolour of Rio dell Angelo, where he provides his response to the Impressionists’ question on the colour of shadows.

The same year, Sargent visited New York, where he painted this portrait of his friend and fellow artist William Merritt Chase in his fifties. He’s immaculately dressed with a carnation in his button-hole, and the tools of his art in hand.

The following year, Sargent was back in Venice to paint this watercolour of Scuola di San Rocco assembled from a virtuoso series of marks and gestural strokes of the brush.

When he broke free of his studio for the summer of 1904, Sargent travelled to the Alps for his first season of serious plein air painting there. He stayed in the Italian mountain town of Purtud, to the south-west of Mont Blanc, where there was a group of Italian artists doing the same thing. Among them was Ambrogio Raffele (1845-1928), probably the best and most experienced of the group; Sargent became particularly friendly with him, and in An Artist in His Studio (1904) shows Raffele at work in his room there.

This painting is a paradox, in that Sargent shows an accomplished plein air painter working not in front of his motif, but in his bedroom. It’s plausible that Raffele is painting a larger version of the small sketch seen at the lower left of the large canvas.

When he reached Venice, Sargent’s watercolours became even more gestural, as shown in this view of Unloading Boats in Venice (1904).

The following summer Sargent turned his attention to his fellow travellers as they crossed the Alps on their way south. He sketched his friends during their siesta, in this Group with Parasols painted in oils in about 1905.

Here they are again in watercolour, in Siesta from the same year.

A decade after her dancing career had gone into decline, and fifteen years after his first painting of her, Sargent produced a completely different portrait of La Carmencita (c 1905). Now his virtuoso brushstrokes capture her motion. His inspiration was no longer Manet, but Giovanni Boldini and his ‘swish’.

In further time out of his studio, Sargent travelled to North Africa, where he painted this Bedouin Camp in 1905-6.

This portrait of an Arab Woman from 1905-06 is another fine example of his watercolour sketching.

At times, Sargent’s brushstrokes appear so casual that it’s almost as if he was just doodling with pigment, as in the blue shadows In a Levantine Port (1905-6). But they coalesce into the image that Sargent clearly had in his mind all the way along, and pop out at the viewer.

Open System Settings, then General, and Login Items & Extensions. Scroll to the end of that list and you’ll see a section titled Extensions. All looks tidy there and in order, but you’re looking at the tip of the iceberg. Click on the ⓘ button at the right of any of those entries, and prepare to be thoroughly confused. These aren’t, of course, kernel extensions, nor are they only system extensions (although some may be), they’re app extensions, conveniently shortened to appexes, the subject of this article.

System Settings

That section in System Settings is unusual as its list depends entirely on what you have installed on your Mac. Among those you’re most likely to see are:

• Actions allow access to an app’s functions from within other apps, such as Markup provided by macOS.
• Dock Tiles customise the Dock and normally run in the background (although not listed in Background items above), including several phantom ‘apps’ added by macOS.
• File Providers allow you to see both local and remote-storage files together in the Finder, and normally run in the background (although not listed in Background items above). Note this isn’t confined to ‘file providers’ in the sense of cloud services like iCloud Drive.
• File System Extensions, userland file systems, including ExFAT and MSDOS in macOS 15.4, which are intended to replace kernel extensions.
• Finder provides enhanced search and other functions for files and more. These can also be accessed directly through the Quick Actions item in the Finder’s contextual menu.
• Photos Editing provides enhanced editing in the Photos app. This also includes Markup provided by macOS.
• Quick Look includes custom QuickLook thumbnail and preview extensions, replacing qlgenerators.
• Sharing includes features provided in the Share menu. These include some from macOS that can’t be disabled, such as Mail and Messages, others that are optional, as well as third-party apps.
• Spotlight includes custom mdimporter modules to extract indexable content from custom file types not supported by macOS.

To add to the uncertainty, not all those available in Sequoia 15.4 are listed in the Mac User Guide’s total of 17 classes, or Apple’s list of 25 for developers.

Where are appexes?

Most of these are installed as .appex bundles inside a PlugIns folder inside the bundle of an app, although some can instead be in a Library folder inside the app. The best information about each is in the Info.plist file in their appex bundle. In that, the nested dictionary of NSExtensionAttributes is most informative. That gives the NSExtensionPointIdentifier type, which for a QuickLook appex might be com.apple.quicklook.preview, indicating that it generates custom previews for QuickLook, in the way that qlgenerators used to. That type corresponds to the SDK entry listed by pluginkit, described below.

Not all appexes are exposed in System Settings, though. New-style drivers supplied in .dext bundles, that are listed as extensions, aren’t included despite there being 17 bundled in macOS 15.4. There’s also no mention of nearly 200 appexes provided in /System/Library/ExtensionKit/Extensions.

pluginkit

In addition to their control in System Settings, the command tool for working with appexes is pluginkit. Most of its options are aimed at those developing and debugging their own appexes, but there’s one command that will dump details of all managed appexes to a lengthy text file, with a form like
pluginkit -m -vv > ~/Documents/pluginkitOut.text
which pipes its output to the file at ~/Documents/pluginkitOut.text. You can add another v to the options for greater details.

The output from pluginkit reveals just how many appexes there are, possibly as many as 500 or more installed in your Mac. Most are system components that aren’t exposed in System Settings, and many have SDK names, specifying their type, that fall outside the categories listed by Apple. For instance, there’s a com.apple.CloudDocs.iCloudDriveFileProvider appex buried deep in the CloudDocs private framework that has an SDK type of com.apple.fileprovider-nonui for iCloud Drive.

Anomalies

Extensions settings currently appears to be a work in progress. It’s among the most opaque sections in System Settings, with all of its controls accessed through ⓘ buttons and floating windows, rather than being laid out clearly. It’s riddled with inconsistencies, and some sections don’t appear to work properly, most notably Quick Look.

This screenshot shows that Apparency’s Quick Look appex is currently disabled, but at the right is a QuickLook preview demonstrating Apparency’s customisation. This applies to other custom Quick Look appexes in Sequoia 15.4: when apparently disabled, they continue to work normally.

As system qlgenerators aren’t included in the Quick Look list, it can’t be used to disable those to allow third-party appexes to generate thumbnails and previews instead, which might have been a useful function.

Summary

• Appexes are app extensions, now found in the PlugIns or Library folders within app bundles.
• Although some appexes are also system extensions, or their relatives, most aren’t, and simply extend that app’s features.
• Many appexes are controlled in System Settings > General > Login Items & Extensions, at the end.
• Lists shown there vary according to which types of appex are installed. Click on the ⓘ button to view and control them.
• Some system appexes are listed but can’t be disabled, while others can be.
• They can also be controlled and listed using the pluginkit command tool, although that’s not straightforward.
• In Sequoia 15.4, Quick Look appex controls appear dysfunctional.

References

man pluginkit
Apple’s developer master page with links to documentation
QuickLook and its appexes
Dock tile appexes.

Aeneas has been rowed through the Straits of Messina, avoiding the rock pinnacle that Scylla had been transformed into. From there he heads north-west until he meets a fierce northerly storm that blows him and his crew south to the city of Carthage, on the Libyan coast. Ovid breezes through what takes Virgil almost a whole book in the Aeneid, in a brief summary of the affair between Aeneas and Dido, Queen of Carthage. This ends with him abandoning her to fall upon the sword he had given her, and her body to be consumed on her funeral pyre.

Pierre-Narcisse Guérin’s Aeneas tells Dido the misfortunes of the City of Troy, painted in about 1815, is probably the standard work showing the beginnings of their romance. Unfortunately it doesn’t give any clues to its tragic outcome.

In about 1875, when Paul Cézanne was still experimenting with narrative genres, he first drew a compositional study, then painted Aeneas Meeting Dido at Carthage. The queen is at the left, surrounded by her court. The warrior figure of Aeneas stands to the right of centre, and to the right of him is the shrouded spectre of Aeneas’ wife, Creusa, who had been abandoned by Aeneas as the family fled the burning city of Troy.

Normally titled The Death of Dido, Tiepolo’s painting from 1757-70 shows an odd composite scene in which Aeneas, packed and ready to sail with his ship, watches on as Dido suffers the agony of their separation, lying on the bed of her funeral pyre. A portentous puff of black smoke has just risen to the left, although it’s surely far too early for anyone to think of setting the timbers alight.

Dido’s spectacular death is shown best in what is perhaps Henry Fuseli’s most conventional history painting, known simply as Dido (1781). Dido has just been abandoned by Aeneas, has mounted her funeral pyre, and is on the couch on which she and Aeneas made love. She then falls on the sword Aeneas had given her, and that rests, covered with her blood, beside her, its tip pointing up towards her right breast. Her sister Anna rushes in to embrace her during her dying moments, and Jupiter sends Iris (shown above, wielding a golden sickle) to release Dido’s spirit from her body. Already smoke seems to be rising up from the pyre, confirming visually to Aeneas that she has killed herself, as he sails away from Carthage.

After a close call with the Sirens, Aeneas reaches the land of the Cercopes, who had been transformed into apes by Jupiter because of their treachery. The ship continues to the north-west along the coast of Italy, passing Naples.

This has been shown only by those like Antonio Tempesta who engraved for illustrated editions of the Metamorphoses. Tempesta’s Jupiter Changing the Cercopians into Monkeys from around 1600 shows Jupiter at the right, accompanied as ever by his huge eagle, with the transformed monkeys.

Once past Naples, Aeneas and his crew land at Cumae to visit the Sibyl there in her cave. He needs her assistance to go to the underworld to speak to the ghost of his father Anchises. The Sibyl reassures Aeneas that he will achieve his goals, and to that end she takes him to Proserpine’s sacred glade. Finding a golden bough there, she tells Aeneas to break that from the tree. The two of them travel to the underworld bearing that golden bough, make contact with the ghost of Anchises, and return safely.

During their walk back, Aeneas thanks the Sibyl for her help and guidance, and offers to build a temple to her, assuming she is a goddess. The Sibyl points out that she is no goddess, and explains how she had once been offered immortality if she were to let the god Apollo take her virginity. When Apollo had invited her to wish for anything, she had pointed to a pile of sand, and asked to live as many years as there were grains, but forgot to wish for eternal youth to accompany that.

Apollo offered her eternal youth as well, but she declined and remained a virgin. After seven hundred years, with another three hundred still to go, she is well into old age, infirm, and steadily vanishing as her body wastes away until only her voice will remain. With that, the pair reach Cumae, and Aeneas sets sail.

This is depicted in one of Claude Lorrain’s most wonderful coastal landscapes, his Coast View with Apollo and the Cumaean Sibyl from about 1645-49. Although their figures are small, Apollo on the left is holding his lyre in his left arm, trying to persuade the seated Sibyl, to the right, to let him take her virginity. Around them are the ruins of classical buildings and a stand of tall trees, as the land drops away to an idealised view of the coast of Italy. In the small bay immediately below them are some ships, which may be a forward reference to Aeneas’ future visit, although that would have been seven centuries later according to the Sibyl’s account.

JMW Turner didn’t tackle the first part of this story until 1823, when he painted The Bay of Baiae, with Apollo and the Sibyl. His view appears to have been loosely based on Claude’s, but is set at Baiae, in the Bay of Naples. Apollo is again on the left, with his lyre, but the dark-haired Sibyl has adopted an odd kneeling position. She is holding some sand in the palm of her right hand, asking Apollo to grant her as many years of life as there are grains.

When Claude was painting his coastal view, François Perrier was painting a more conventional figurative account of Aeneas and the Cumaean Sibyl (c 1646). Aeneas, stood to the left of the incense burner, appears to be offering to burn incense in honour of the Sibyl, who stands at the right in front of her cave, and is just about to tell him her life-story. Behind Aeneas is a queue of people, including a king, bearing gifts and waiting to consult with the Sibyl. At the top left corner is a temple, and in the clouds above it the god Apollo, I believe.

JMW Turner’s first version of this later scene is thought to have been his first mythological painting, in about 1798. This second version, Lake Avernus: Aeneas and the Cumaean Sybil, dates from 1814 or 1815, and is both an improvement on the original and in better condition. True to the spirit of Claude’s landscape, this too is a mythological landscape showing the beautiful setting of Lake Avernus, near Pozzuoli, to the west of the city of Naples. In the distance are Baiae and the cliffs of Cape Miseno. The Sibyl, who doesn’t show her years, holds aloft a golden sprig rather than a bough, and Aeneas stands with his back to the viewer, as if he too is enjoying the view.

Turner’s last account is The Golden Bough, exhibited in 1834. It shows well how much his style had changed, although it retains compositional features from his earlier paintings. The Sibyl stands on the left, radiant in white light, and holding aloft a more substantial golden branch, with the golden sickle used to cut that branch, in her right hand. Down towards Lake Avernus are the Fates, dancing around a white glow. A couple of female companions of the Sibyl rest under the tree, but Aeneas is nowhere to be seen, although he might be in the middle of the Fates, perhaps. In the right foreground is a snake, a symbol of the underworld.

I hope that you enjoyed Saturday’s Mac Riddles, episode 302. Here are my solutions to them.

1: Shortened characters into the most common extension, formerly ASCII.

2: Medical practitioner at the end of word files until gaining a cross in 2002.

3: At the end of real estate inventory, most commonly for Info and preferences.

The common factor

I look forward to your putting alternative cases.

APFS has two special file types designed to economise on storage space: clone and sparse files. Clone files are two or more distinct files within the same volume whose data is shared; sparse files save space by skipping empty data and only storing data containing information. This article explores how they behave in use, with particular emphasis on Time Machine backups and iCloud Drive. The latter also involves a third type of special file, dataless files.

Clone files

In contrast to hard-linked files, clone files are two or more distinct files within the same file system (volume) whose file extents are identical, so share the same data, as shown below. They’re created by variants of normal file copying, including duplicating in the Finder (and drag-copying within the same volume), and the cp -c command.

Instead of duplicating everything, only the inode and its attributes (blue and pink) are duplicated, together with their file extent information. You can verify this by inspecting the numbers of those inodes, as they’re different, and information in the attributes such as the file’s name will also be different. There’s a flag in the file’s attributes to indicate that cloning has taken place. At first, the two cloned files share the same data blocks and extended attributes, but as the two files are changed by editing, they start to drift apart and become uncloned.

Clone files are becoming more popular thanks to the Hyperspace app, which deduplicates files within the same volume by replacing copies with clones.

Because they can only exist within the same file system, clone files are fragile. Any copy or move to another file system is invariably accompanied by the copying of their full data, and their economy of storage can only remain as long as they stay within the same volume.

Backups

One notable exception to this same-volume rule is in Time Machine backups. As clone files are preserved in local snapshots, when Time Machine constructs a backup as a snapshot in the backup storage volume, shared file extents are retained, so preserving clones. This is reflected in the size of the backup snapshot, and in the report written to the log. For example, when backing up three distinct files and ten clones of one of those, that report included:
14 Total Items in Backup (l: 16 GB p: 11.02 GB)
3 Files Copied (l: 6 GB p: 1.02 GB)
1 Directories Copied (l: Zero KB p: Zero KB)
10 Files Cloned (l: 10 GB p: 10 GB)

Backups made by other utilities are unlikely to reproduce this behaviour, though, as they can’t synthesise snapshots in the way that Time Machine does. To preserve clone files in their backups, they’d have to identify clones in the source and explicitly perform cloning in their backup store. Although Carbon Copy Cloner claims that “in some cases CCC may clone a file on the destination prior to updating its contents”, it doesn’t appear to attempt to preserve clone files in the backups it makes. I’m not aware of any third-party utility that does.

Unfortunately, Time Machine appears unable to restore directly from backup snapshots in the backup store, and performs Finder copies when restoring. That saves each of those clone files as a completely separate file, without any sharing of data. As a result, the space occupied on disk for a restored volume can be substantially greater than the original or its backup. Extensive use of clone files could thus cause problems when restoring from backups.

Of course, rolling a volume back to a local snapshot, such as one made during Time Machine backups, preserves all clone files within that volume.

iCloud Drive

Clone files created within the same volume as local iCloud Drive storage on the Data volume, or cloned when within a folder in iCloud Drive, remain within the same file system and clones are therefore preserved, and when the file is moved to other folders in the same volume.

However, clone files are treated as simple copies as far as iCloud Drive’s remote storage is concerned. While a pair of cloned 5 GB files only use a total of 5 GB local storage, they require a full 10 GB of your iCloud allocation, indicating that their cloud storage is separate and not common to both. Although the effects of eviction (removing local data) and materialisation (restoring local data from cloud storage) are difficult to observe directly, they appear to lose the benefits of cloning.

When the local copy of a file also stored remotely in the cloud is evicted, its data is removed from local storage, rendering it dataless, as shown below.

When that file is to be used locally again, its data has to be downloaded from the cloud service, and the local dataless file is materialised by adding its data back. As far as I can tell, that doesn’t result in the reconstruction of the shared file extents, so changes cloned files into normal copies with different file extents. You would then need to use Hyperspace to restore them as clone files. Other Macs sharing the same iCloud Drive also see them as full copies rather than clones.

These behaviours could also catch the user by surprise.

Sparse files

Unlike clone files, the structure of sparse files in APFS is conventional, as shown below.

They achieve their economy in storage by only including file extents containing non-null data, and thus aren’t dependent on remaining within the same file system (volume), making them more robust. Their primary requirement is that they’re created and maintained using specific file system operations, and are only copied or moved to other APFS file systems.

Backups

When backed up by Time Machine to another APFS volume, sparse files are preserved reliably, and are also restored as sparse files. That isn’t likely to hold, though, if the file is transferred using a network file system such as SMB, as all network transfers currently appear to explode sparse files to full size prior to transfer. Because of the way in which they have to be created, only the app maintaining that file could restore its sparse format. In the case of disk images, this should normally occur the next time they’re mounted in the Finder and Trimmed by APFS.

iCloud Drive

Assessing what happens with sparse files in iCloud Drive is considerably simpler than with clone files. As long as they remain downloaded to local storage, they are preserved, and can be moved in and out of iCloud Drive storage without exploding in size. However, they too are stored in full when in iCloud storage, requiring their full size in your iCloud allocation, and the eviction-materialisation cycle explodes them to full size, and their sparse file flag is removed.

The only way to return a former sparse file to its original economical format is then to open and save it using the app that creates and maintains it. In the case of disk images, this should occur when they’re next mounted and Trimmed.

Conclusions

Clone files:

• are only preserved when moved within the same file system (volume);
• are preserved and restored from local snapshots;
• are preserved in Time Machine backups, but aren’t restored from them;
• aren’t preserved in other backups;
• could result in a restored volume being substantially larger than its original;
• occupy their full space in your iCloud allocation;
• are only preserved in iCloud Drive when they aren’t evicted from local storage;
• can be regenerated using Hyperspace.

Sparse files:

• are only preserved when copied or moved directly between APFS volumes;
• aren’t preserved when copied or moved over network connections, or using SMB;
• aren’t preserved when copied or moved to different file systems, including HFS+;
• are preserved in and restored from local Time Machine backups;
• should be preserved in and restored from other local backups;
• occupy their full space in your iCloud allocation;
• are only preserved in iCloud Drive when they aren’t evicted from local storage;
• can only be regenerated by the app that creates and maintains them.

Both clone and sparse files can result in substantial savings in storage space. However, because that’s fragile, their greatest value is in minimising erase-write cycles in SSDs, hence slowing their ageing.

References

Apple’s APFS Reference (PDF), last revised 22 June 2020.
Dataless files are explained here.
How sparse files work
Files and clones
Special file types, including dataless files

In the first of these two articles tracing the first century of railways in paintings from the early 1840s, I had reached Claude Monet’s views of the Gare Saint-Lazare in Paris before 1880. By this time few countries in Europe had no railways, and trains frequently conveyed artists from their studios in the cities out to the beaches and mountains, journeys that a few years earlier could have taken days rather than hours.

Although Norway was a greater challenge for the railway engineers, Frits Thaulow seized the opportunity to show the results in The Train is Arriving from 1881. The country’s first public steam-hauled railway was developed by the son of George Stephenson, whose Rocket locomotive had inaugurated the first steam railway in the world. Norway’s line opened in 1854, and during the 1870s progressively made its way to Trondheim.

In 1888, Vincent van Gogh gave us The Blue Train (Viaduct in Arles).

Volodymyr Orlovsky’s undated Steppe shows a river in summer, with water levels at their minimum. Cattle are taking the opportunity to drink and cool off in the water. In the distance is the plume of smoke from a railway train, probably carrying grain and other produce from the Ukrainian countryside to one of the growing coastal cities for export.

The twentieth century brought the beginning of the end of the power of steam, marked in an unexpected twist of history. Between 1898 and 1900, a new railway station, initially known as the Gare d’Orléans, was built on the bank of the Seine at Quai d’Orsay, Paris. The first electrified urban railway terminal in the world, it was a star of the Exposition Universelle in 1900, where many Impressionist paintings were exhibited.

Victor Marec’s painting shows construction work being progressed in 1899, with a steam locomotive hauling construction trucks.

The Gare d’Orsay, as it became, started to suffer physical limitations in 1939, and its upper levels closed from 1973. In 1986 it re-opened as the most extensive collection of Impressionist art in the world, the Musée d’Orsay.

Maximilien Luce was one of the most expressive artists, who wasn’t an official war artist, to show scenes relating to the First World War. In his La Gare de l’Est (1917), a collection of wounded and battle-weary soldiers are shown at the entrance to this large Paris railway station.

The Gare de l’Est in Snow (1917) is even better-known, and a classic painting of falling snow in a large city.

Lesser Ury’s Nollendorfplatz Station at Night from 1925 shows the brilliant electric lighting around this busy railway station to the south of the Tiergarten, in one of Berlin’s shopping districts.

By this time, painting trains was becoming something of a sub-genre, particularly as steam trains were being replaced throughout Europe.

Eric Ravilious is one example of a twentieth century artist who painted motifs deeply embedded in the railway, in his Train Landscape from 1940.

A few narrative artists, including Joaquín Sorolla, set their stories inside railway carriages. My favourite among these is Berthold Woltze’s Der lästige Kavalier (1874), rendered into English as The Annoying Bloke, from 1874.

This is set in a railway carriage where there are two men and a young woman. She is dressed completely in black, and stares towards the viewer with tears in her eyes. Beside her is a carpet-bag, and opposite is a small wooden box and grey drapes.

Leaning over the back of her seat, and leering at her, is a middle-aged dandy with a brash moustache and mutton-chop whiskers, brandishing a lit cigar. He appears to be trying to chat her up, quite inappropriately, and very much against her wishes. Behind him, and almost cropped off the left edge of the canvas, is an older man with a dour, drawn face.

The young woman has apparently suffered a recent bereavement, and may even be travelling back after the funeral. She looks too young to have just buried a husband, so I think it more likely that she has just lost her last parent, and is now living alone, prey to the likes of this annoying and abusive bloke.

Lambing dates remain one of life’s great mysteries. Here in the UK, farmers in the north usually lamb earliest, often only just after Christmas when it’s usually bitter cold and snowy up there. Down here in the balmy south, lambs are born three months or more later, typically in April, when they’re often struggling to keep cool in the sunshine. Last week we saw the first of this year’s lambs, and Apple’s Spring OS fest, including Sequoia 15.4.

Size

That update was large, but that isn’t exactly unusual:

• 7 March 2024, Sonoma 14.4 was 3.6 GB (Apple silicon) with 64 vulnerabilities fixed, “the most substantial update of this cycle so far”;
• 27 March 2023, Ventura 13.3 was 4.5 GB with 49 vulnerabilities fixed, being “substantial, and brings many improvements and fixes”;
• 14 March 2022, Monterey 12.3 was 5.3 GB with 45 vulnerabilities fixed, being “very substantial, introducing major new features like Universal Control and Spatial Audio, changing several bundled apps, and fixing many bugs”;
• 26 April 2021, Big Sur 11.3 was 6.62 GB with over 50 vulnerabilities fixed, “the largest update to macOS since Mojave, and quite possibly the largest ever”.

(Figures and quotations from links here.)

Although the 15.4 update wasn’t quite as large as 11.3, at 6.2 GB for Apple silicon, it has comfortably surpassed it in the number of vulnerabilities fixed, 131 in all, and came close to the size of the 15.0 upgrade at 6.6 GB. What’s most disappointing is that, while the first release of Sequoia merited long and detailed accounts of much of what had changed, for 15.4 there’s precious little information beyond its lengthy security release notes.

A stroll through the version numbers of its bundled apps and /System/Library confirms the extent of changes. There was no point in my trying to compile an article listing them, as it might have been briefer to report what hasn’t changed. What’s more to the point is what’s new in 15.4, what are its Spring lambs?

Novelties

Among the new kernel extensions is the first version of AppleProcessorTrace, and there’s a brace to support hardware in Apple silicon chips including a T6020 and T8103 for PCIe, and a T6032. Those appear to be for M2 Pro, M1 and M3 Ultra chips, respectively. There are two new public frameworks, one named CLLogEntry that is presumably for Core Location log entries, the other tantalisingly named SecurityUI. Neither seems to align to anything in Apple’s developer documentation, so might be preparing the ground for what we’ll hear about in early June at WWDC, when the lambs have grown a bit.

I keep a track of the total number of bundles in several of the folders in /System/Library. Since the release of Sequoia 15.0, that containing Private Frameworks has grown from 4,255 to 4,398. Because of their layout, this total overestimates the real change in numbers, and that probably represents a true growth of around 70 Private Frameworks in Sequoia so far.

These Private Frameworks contain code features used privately by Apple’s apps, but not exposed to third-party developers. Although much is of little or no use or advantage, they also contain much that supports changing features in macOS. Using Private Frameworks is a sure way to madness, and something explicitly forbidden in the App Store, but, like the unaffordable car or boat we like to gloat at, there’s no harm in wondering what they will bring in the future.

The list of new Private Frameworks in Sequoia 15.4 is long, and includes: AUSettings, Bosporus, ComputationalGraph, CoreAudioOrchestration, CryptexKit, CryptexServer, DailyBriefing, DeepVideoProcessingCore, Dyld, ExclaveFDRDecode, FPFS, FindMyPairing, various GameServices, GenerativePlaygroundUI, MCCFoundation, MLIR_ML, MobileAssetExclaveServices, Morpheus, MorpheusExtensions, an OnDeviceStorage group, OpenAPIRuntimeInternal, OpenAPIURLSessionInternal, PIRGeoProtos, RapidResourceDelivery, SecureVoiceTriggerAssets, SecurityUICore, and VideoEffect.

While many of those names can inform speculation about what we’re about to see in macOS 16, three merit a little more decoding.

Cryptexes are secure disk images loaded during boot that currently deliver Safari and its supporting components, and the dynamic libraries for all those frameworks, public and private. Accessing them from user-level code isn’t something you’d expect to happen, so those two Private Frameworks, CryptexKit and CryptexServer, hint at further expansion in their use and support.

Bosporus

The Bosporus Strait in Turkey connects the Black Sea to the Sea of Marmara, thence through the Dardanelles to the eastern Mediterranean. It’s a busy thoroughfare formerly used heavily by ships carrying grain and other bulk cargoes from Ukraine and Russia.

View of Constantinople and the Bosphorus (1856) is one of many views that Ivan Aivazovsky made of this great city, which he visited on many occasions. The artist kept his studio in Crimea, on the opposite (northern) shore of the Black Sea.

Morpheus

Morpheus is the god of dreams, whose name is the source of the word morphine. Although usually distinct from Hypnos, god of sleep, he’s sometimes associated with Nyx, goddess of the night, most famously in reference to a passage from Virgil’s Aeneid, painted below by Evelyn De Morgan.

She pairs Nyx with Morpheus in her Night and Sleep, from 1878. The further figure is a young woman wearing long red robes, her eyes closed, clutching a large brown cloak with her right hand, and most likely Nyx. Her left arm is intertwined with a young man’s right arm. He also has his eyes closed, and is most probably Morpheus. He clutches a large bunch of poppies to his chest with his left arm, while his right scatters them, so they fall to the ground below.

Virgil’s lines in Book 4, line 486 read:
hinc mihi Massylae gentis monstrata sacerdos,
Hesperidum templi custos, epulasque draconi
quae dabat et sacros servabat in arbore ramos,
spargens umida mella soporiferumque papaver.
haec se carminibus promittit solvere mentes
quas velit, ast aliis duras immittere curas…

Translated (at Perseus at Tufts University), this reads:
From thence is come
a witch, a priestess, a Numidian crone,
who guards the shrine of the Hesperides
and feeds the dragon; she protects the fruit
of that enchanting tree, and scatters there
her slumb’rous poppies mixed with honey-dew.
Her spells and magic promise to set free
what hearts she will, or visit cruel woes
on men afar.

Spargens umida mella soporiferumque papaver, one of Virgil’s greatest lines, is conventionally translated as “scattering moist honey and sleep-inducing poppy”, and describes well the effects of the opiate drugs derived from opium poppies, including morphine.

I look forward to watching the lambs grow up through the coming summer, and learning about those lambs that came with Sequoia 15.4 at WWDC.

The nineteenth century brought huge changes in technology and society. Some, like telegraphy, telephones and radio, haven’t featured in many paintings, and even the bicycle has largely escaped the canvas. But the advent of railways, and later motor cars, had greater impact on visual art. In this weekend’s two articles, I trace the first century of railways in paintings from the early 1840s.

JMW Turner was among the first painters to capture this in his Rain, Steam, and Speed – The Great Western Railway in 1844. This pioneering railway connected London with rich farming country across the south of England, down into western counties, eventually reaching Cornwall in 1859, fifteen years after Turner completed this painting, and eight years after his death.

William Powell Frith’s The Railway Station (1862) captures the atmosphere of a major railway station in a capital city, here Paddington Station in London, by coincidence Brunel’s terminus for his Great Western Railway. Stations like this became a focus of activity, emotional partings and arrivals, migration, and a fair bit of crime too, everything the narrative painter might wish for.

Britain may have been the first to build railways, but the mania spread like wildfire across Europe and North America.

As the railroad, it started to cover the far greater distances of the USA and Canada. William Hahn’s Southern Pacific R.R. Station at Sacramento (c 1873-4) shows its rapid growth there.

Smoke, steam and other atmospheric effects brought inspiration to the French artists who were developing painting from where Turner’s death had left it.

France had been an early innovator and adopter, although such post-classical motifs wouldn’t have been appropriate for the Salon, of course. It took Édouard Manet painting his favourite model Victorine Meurent, in Le chemin de fer (The Railway) (1873), to break the ice. Its background is the Gare Saint Lazare in Paris. This painting was completed and sold in 1873 to the singer and avid collector Jean-Baptiste Faure, and astonishingly was the only painting accepted of three submitted to the Salon by Manet the following year, where it provoked outrage and ridicule, and a torrent of sarcastic cartoons in the press.

Near Manet’s painting in the Salon, a couple of works by Giuseppe De Nittis were given a warmer reception. Yet sometime between 1869 and 1880, De Nittis painted The Passing of a Train, his unashamed comment on the coming of the train.

As De Nittis, Monet, Pissarro, and the other Impressionists started painting in even more unacceptable styles around Paris, trains and railways came to appear even more.

Claude Monet’s The Railway Bridge at Argenteuil (1873) is one of his several landscapes centred on the railway from the years immediately after the Franco-Prussian War. At this time, Monet was a regular commuter by train: when he, Camille and his son moved out to Argenteuil at the end of 1871, he travelled the short distance into Paris by train.

Monet liked this bridge so much that he painted it again the following year, in The Railway Bridge at Argenteuil (1874).

By the last quarter of the nineteenth century, steam power had become so essential to modern life it was assimilated into the everyday. Paul Cézanne’s family estate in Aix-en-Provence was connected by rail to Paris by 1856, and express trains to the Mediterranean coast enabled many artists whose studios were in the capital to paint in the remarkable light of the Midi. The prominent light ochre structure sweeping across many of Cézanne’s views of Mont Saint-Victoire is the long viaduct built to accommodate the railway that transported artists between Paris and the coast of the Midi.

In 1877, Claude Monet became the most painterly railway buff of them all. By then, he was becoming detached from Argenteuil, and sought a new radically modern urban theme. Where more appropriate than the steaming hubbub of the Gare Saint Lazare? Caillebotte paid the rent for him on a small studio nearby, and Monet gained approval to paint in the station. By the third Impressionist Exhibition of April 1877, Monet had assembled seven views of the station, including one that even seemed to please the critics. Among the paintings from that campaign is his Arrival of the Normandy Train, Gare Saint-Lazare (1877).

Monet was too smitten to stop in the station, though. In his Train Tracks at the Saint-Lazare Station (1877) he reversed the view and started showing railway signalling.

He went even further in his Saint-Lazare Station, the Western Region Goods Sheds (1877), showing the working parts with the smoky city beyond.

Here are this weekend’s Mac riddles to entertain you through family time, shopping and recreation.

1: Shortened characters into the most common extension, formerly ASCII.

2: Medical practitioner at the end of word files until gaining a cross in 2002.

3: At the end of real estate inventory, most commonly for Info and preferences.

To help you cross-check your solutions, or confuse you further, there’s a common factor between them.

I’ll post my solutions first thing on Monday morning.

Please don’t post your solutions as comments here: it spoils it for others.

Disk images, files that contain the contents of a physical storage medium, go back long before the first Mac. Among other tasks, they were originally used to contain representations of floppy disks for replication in manufacture.

Today disk images are at the heart of macOS, and widely used by third-parties. They’re an essential part of macOS installers, home to Recovery mode, and the basis for cryptexes. They’ve been used to burn and replicate optical disks, to archive disk contents, extensively for network backups, and for the distribution of software.

Classic Mac OS

In Classic Mac OS there were two utilities that worked with different formats: Disk Copy used replicas later in DC42 format, after Disk Copy version 4.2, while compressed formats known as DART were handled by the Disk Archive/Retrieval Tool, hence their name.

Mac OS 9 brought Disk Copy 6.0 with added support for the New Disk Image Format (NDIF), which supported resource forks, and ended with its last release version 6.3.3. This also supported read-only Rdxx formats.

By this time, variants of formats had become complex. Here, Disk Copy is configured to create a read-only compressed .img file containing the contents of a standard 1.4 MB floppy disk. In the upper window, it has completed validating the checksum on a self-mounting .smi disk image that’s part of a DiskSet. These could also be signed, using certificates issued not by Apple but by DigiSign.

Here’s Disk Copy saving an image of a hard disk using a similar read-only compressed format, this time to accommodate 1.5 GB.

Mac OS X

The release of Mac OS X 10.1 Puma in 2001 brought Apple’s new Universal Disk Image Format (UDIF), used in DMG disk images, which only had a single fork as its resource fork was embedded in the data fork. Although pre-release versions of Disk Copy 6.4 and 6.5 were available with UDIF support for Mac OS 9, neither was ever released, leaving Classic Mac OS without access to UDIF images. Its support for compression options in Apple Data Compression (ADC) unified the two disk image types, and extended support for images larger than a floppy disk. This new format enabled disk images to represent whole storage devices, complete with a partition map and disk-based drivers.

Tools provided in Mac OS X for working with disk images include Disk Utility and the command tool hdiutil.

On 21 January 2002, the first version of DropDMG, a third-party substitute for creating disk images, was released by C-Command Software. This quickly enabled developers to create disk images with artwork, licences and other features that weren’t accessible from the tools bundled in Mac OS X. DropDMG has flourished over the last 23 years, and remains popular today.

DropDMG’s options for creating a new disk image far exceed those in Disk Utility. Particularly helpful are the compatible version hints shown on various options, to remind you of which file systems are available in different macOS versions, and which types of disk image container are supported. DropDMG will even convert old NDIF disk images last used in Mac OS 9 to more modern formats. It will also change the password of an encrypted disk image from a menu command.

In Mac OS X 10.2 (2002), UDIF and most other supported formats were served from a kernel extension without requiring a helper process. The following year, 10.3 Panther started using a faceless utility DiskImageMounter to mount disk images. Apple then dropped support for embedded resource forks in disk images in Mac OS X 10.4.7, and newly created disk images became less compatible with older Mac OS versions.

Sparse bundles

Until Mac OS X 10.5 Leopard in 2007, all disk images had used single-file formats, although some could be segmented across file sets. Leopard introduced the sparse bundle with its folder of smaller band files containing data. These enabled the image to grow and shrink in size, and became popular means of storing mountable Mac file systems on servers using different file systems.

This is another third-party tool that improved access to disk images from the GUI, DMG Packager, seen in 2009. Unlike DropDMG, this appears to have vanished without trace.

In 2011, with the release of Mac OS X 10.7 Lion, Apple removed more support for old disk image formats. DiskImageMounter no longer opened NDIF .img, .smi self-mounting, .dc42 and .dart compressed formats, although the hdiutil command tool still retained some access to them.

Disk Utility, seen here in 2011, has provided basic access to many disk image formats, but these are only a small selection of options available in the hdiutil command tool, or in DropDMG.

This shows the complex set of options available when creating a new disk image in Disk Utility in OS X 10.10 Yosemite, before the advent of APFS.

Support for compression was enhanced in OS X 10.11 El Capitan with the addition of lzfse in a new ULFO format, and macOS 10.15 Catalina added lzma in ULMO. In both cases, these new formats aren’t accessible in older versions of macOS.

APFS support

The arrival of a pre-release version of the new APFS file system in macOS 10.12 Sierra brought its support in disk images, although only for experimental purposes, and Apple cautioned users to ensure their contents were well backed up.

In addition to adding the more efficient ULMO compressed format, macOS 10.15 Catalina is the last to support many Classic Mac OS disk image formats, including those from DiskCopy42, DART and NDIF from Disk Copy 6.x. Support for AppleSingle and MacBinary encodings, and dual-fork file support, were also removed in macOS 11.0 Big Sur in 2020.

This ‘warning’ alert from 2020 illustrates one of the longstanding issues with disk images. Although integrity checking of disk images using checksums has been valuable, when an error is found there’s no possibility of repair or recovery as the image can’t be ‘attached’, so its file system can’t be mounted.

macOS 12 Monterey in 2021 brought multiple deprecations of older formats, including UDBZ using bzip2 compression, segmented UDIF images, and embedded resources. It’s also thought to be the first version of macOS in which UDIF read/write images (UDRW) have been stored in APFS sparse file format, although Apple has nowhere mentioned that. This has transformed what had previously been space-inefficient disk images that retained empty storage into a format that can prove almost as efficient as sparse bundles. This results from the Trim on mounting HFS+ and APFS file systems within the image freeing unused space, enabling that to be saved in the sparse file format.

Disk images have never been glamorous, but have remained at the heart of every Mac.

References

man hdiutil
Introduction
Tools
How read-write disk images have gone sparse
Performance
Bands, Compaction and Space Efficiency

Appendix: Disk image formats

Supported

• UDRW – UDIF read/write
• UDRO – UDIF read-only
• UDCO – UDIF ADC-compressed
• UDZO – UDIF zlib-compressed
• ULFO – UDIF lzfse-compressed (OS X 10.11)
• ULMO – UDIF lzma-compressed (macOS 10.15)
• UDTO – DVD/CD-R master for export
• UDSP – sparse image, grows with content
• UDSB – sparse bundle, grows with content, bundle-backed, Mac OS X 10.5
• UFBI – UDIF entire image with MD5 checksum.

Unsupported

• DC42 – Disk Copy 4.2 (Classic)
• DART – compressed, for Disk Archive/Retrieval Tool (Classic)
• Rdxx – read-only Disk Copy 6.0 formats
• NDIF – Disk Copy 6.0, including IMG and self-mounting SMI
• IDME – ‘Internet enabled’, on downloading post-processed to automatically copy visible contents into a folder, then move the image to the Trash. Now deemed highly insecure.
• UDBZ – UDIF bzip2-compressed image (deprecated).

Originally known as a toilet table, or simply a toilet, dressing tables or vanities featured near the beds of ladies from the late seventeenth century. They are a fusion of storage boxes used for cosmetics and jewellery, a small flat surface on which to place their contents, and the inevitable mirror to check that she looked right. By the eighteenth century they were made popular by royal mistresses including the Marquise de Pompadour, and became integrated into the morning reception phase of the lady’s day.

William Hogarth even titles the fourth painting in his moralising narrative series Marriage A-la-Mode, The Toilette (c 1743). The Countess Squander is being entertained while completing her dressing and preparations for the day. To the right of the Countess, Silvertongue rests at ease, his feet uncouthly laid on the sofa, clearly intimate with her. He is offering her a ticket to a masquerade ball, where no doubt he will meet her. His left hand gestures towards a painted screen showing such a masquerade.

At the left an Italian castrato (by his wig and jewellery) sings to a flute accompaniment. The rest of the room are disinterested, apart from a woman in white, who is swooning at the singer. The Countess’s bedchamber is behind the pale red drapes at the rear left, and to the right of centre is a typical dressing table with a mirror.

Herman Frederik Carel ten Kate’s Chaperone (1858) recreates an interior from a similar period. A suitor clutching his tricorn hat and walking stick is chatting up a young woman with her companion and moral guard. Behind her chair is a dressing table with a similar layout to Hogarth’s.

Over the next century, dressing tables were modernised and adopted by even the middle classes.

Edgar Degas’ Woman Drying Herself after the Bath is one his first works showing a woman bathing, dating from 1876-77. It’s also one of the few in this series setting the woman in a broader context, here a plain and simple bedroom with a single bed. The woman, wearing only bright red ‘mule’ slippers, stands just behind the shallow metal tub, watching herself in the mirror of her dressing table, as she dries her body with a towel. On its shelf is a small range of cosmetics, with the mandatory mirror behind.

Félix Vallotton affords us a glimpse into the private life of one of the most influential patrons and muses of the day, in his Misia at Her Dressing Table from 1898. Her first marriage was to her cousin Thadée Natanson, who had socialist ideals and lived in artistic circles. The Natansons entertained Marcel Proust, Stéphane Mallarmé, André Gide, and Claude Debussy, but they were closest to their painter friends: Claude Monet, Pierre-Auguste Renoir, Odilon Redon, Paul Signac, and Henri de Toulouse-Lautrec.

For Frederick Carl Frieseke a Nude Seated at Her Dressing Table (1909) is an opportunity for mirror-play. This vanity is more decorative than functional, with curves, a glass top and a painted porcelain figure.

Pierre Bonnard’s domestic interiors are rich with dressing tables, and inventive mirror-play. I show here just two examples.

In Bonnard’s El Tocador, which means The Dressing Table (1908), his partner Marthe’s headless torso is seen only in reflection. The direct view is of the large bowl and pitcher she used to wash herself.

In 1914, Bonnard moved back for a wider view in The Bathroom Mirror. Marthe’s reflection is now but a small image within the image, showing her sat on the side of the bed, with a bedspread matching the red floral pattern of the drapes around her dressing table. Bonnard has worked his usual vanishing trick for himself, and a vertical mirror at the right adds a curiously dark reflection of the room.

Henry Tonks’ The Toilet from the same year separates his nude from her dressing table, and shuns mirror-play altogether.

Félix Vallotton’s Coquèterie (Sauciness) from 1911 shows a young woman still undressed in her white chemise, her unmade bed behind. She looks at herself in the mirror of a small dressing table with that mirror mounted in its lift-up lid, thinking what clothing she should wear from those scattered around.