Apps are getting ever more flexible, and in doing so they’re also becoming increasingly complex. Gone are the days when they mostly opened files, did things to them, and saved them again. We now expect to be able to use our favourite image editor from inside the Photos app, and to share documents between multiple apps, using features as services in reusable components.

For those of us who used OpenDoc back in the 1990s this is all familiar territory. Intended as Apple’s response to Microsoft’s OLE (Object Linking and Embedding), OpenDoc broke apps down to single-task components that worked together. This was best exemplified in the suite of Internet tools provided collectively as Cyberdog for a brief period in 1996-97. Those included a web browser, FTP and email clients, and a newsreader, that could be embedded in other apps that supported OpenDoc’s Bento format.

When Steve Jobs killed OpenDoc in 1997, few could have envisaged what was to come later in app extensions, or appexes, nor how extensively they have become used by macOS. From speech synthesisers and Blu-ray encoders to wallpapers and widgets, appexes have proliferated far beyond the wildest dreams of the OpenDoc designers, but so little is known about they’re managed by macOS.

macOS Sequoia keeps extensive registries of apps and appexes. The most detailed is the grand database maintained by LaunchServices, only visible through its hidden lsregister command tool. Appexes are the preserve of the PlugInKit registry, which can be dumped using the pluginkit tool. Resource management is performed by RunningBoard and appears inaccessible, as do the activity schedules managed by Duet Activity Scheduler (DAS).

All four registries appear to be constructed afresh during startup, in the case of LaunchServices and PlugInKit by a process of discovery, something I’ll be looking at in more detail in the near future. For PlugInKit, it’s discovery that determines which appex services are offered, whether they’re generators of QuickLook thumbnails or previews, Safari extensions, or file systems such as ExFAT or MS-DOS. The latter are refugees from their former existence as kernel extensions, a route now being followed by macFuse 5.0.

Although the user has limited control over those in System Settings and, in the case of Safari extensions, in Safari’s settings, the PlugInKit registry is designed to operate automatically. If the user does try making changes using pluginkit those are likely to be undone when the registry is next updated, and in any case following reboot.

There are some differences obvious between LaunchServices’ database and PlugInKit’s registry. While LaunchServices comfortably accommodates as many versions of apps that it can find, and offers them as choices for opening documents in the Finder’s contextual menu, PlugInKit makes the user’s life simpler by only offering the latest version of each appex. Given that appexes now include replacements for QuickLook’s qlgenerators, and Spotlight importers, that’s hardly surprising, and the prospect of being offered multiple versions in the Share menu would be overwhelming for any user.

PlugInKit and appexes aren’t recent, and probably date back to OS X 10.9 Mavericks, with their NSExtension property list definitions appearing a year later in Yosemite. In macOS 13 Ventura, Apple augmented that with ExtensionKit and ExtensionFoundations both for creating extensions and the extension points offered by host apps. Appexes now cover many different domains, and have become increasingly popular in third-party products, with some like Eternal Storms’ Yoink relying on them for their tight integration with macOS.

Improving our understanding of appexes and their management by PlugInKit isn’t an academic exercise. Host apps and their extensions don’t always work in perfect harmony. Whether you’re developing either of them, or just trying to cope with their disagreements, insight can be important. Now that Sequoia requires QuickLook thumbnail and preview generation to occur in appexes rather than qlgenerators, the qlmanage command tool is of limited value, and you have to rely on PlugInKit instead.

Once upon a time, Apple used to provide extensive and well-written conceptual documentation, where it explained how Mac OS worked, so that when we came to tackle problems we could fall back on understanding. Now we’re largely left to fend for ourselves, so armed with a forthcoming new version of AppexIndexer, I’m off to discover PlugInKit discovery.

Few nineteenth century novels were featured in as many paintings and prints as Victor Hugo’s story of Quasimodo and Esmeralda, told in his Notre Dame de Paris, most popularly known as the Hunchback of Notre Dame.

Hugo’s book has a curious origin. In the 1820s, the great cathedral of Notre Dame in Paris, probably the city’s most visible and distinctive building, underwent restoration to repair the damage that had occurred during the Revolution. One of the foremen of the stonemasons working on the building was a ‘hunchback’ with a spinal deformity. Hugo became greatly interested in the cathedral’s Gothic architecture, and was keen to raise awareness of its importance and beauty. In 1829, he started work on this novel.

After an intense final few months of writing, Notre Dame de Paris was published in early 1831. It became enormously popular, and has been the basis for over a dozen movies since 1905, TV series, plays, operas and musicals, and ballets. As a result, its hunchback hero Quasimodo has developed a life of his own in modern legend.

Set in Paris in 1482, its central characters are Quasimodo, the bell-ringer of the cathedral who not only has a spinal deformity, but is nearly blind and largely inarticulate, and Esmeralda, a beautiful young dancer, thought (incorrectly, it turns out) to be a gypsy, who is the object of much male lust, and has a pet goat Djali who performs tricks.

Quasimodo’s guardian, the Archdeacon Frollo, lusts after Esmeralda and orders the bell-ringer to kidnap her for him. Quasimodo’s attempt fails, and the following day he is punished by a flogging and being put in the pillory. While there, he is badly dehydrated and calls for water, provided by Esmeralda. She’s later arrested and falsely charged of attempted murder, for which she is sentenced to death by hanging.

As Esmeralda is being led to the gallows, Quasimodo swings down on a bell-rope and carries her off to sanctuary inside the cathedral. However, the court of parliament then decides to remove her right of sanctuary, making her liable to arrest. Local gypsies rally to this, and charge the cathedral to rescue her.

When Quasimodo sees the gypsies, he assumes that they want to hurt Esmeralda, so drives them away; when the king’s men arrive, he misunderstands their purpose, and tries to help them. Esmeralda is then ‘rescued’ by the Archdeacon, who tries to seduce her, then to betray her when she rejects him.

Esmeralda is finally taken to the gallows, where the Archdeacon laughs as she is killed. Quasimodo gets his revenge by pushing the Archdeacon from the height of the cathedral, then goes to the cemetery where he dies of starvation while hugging Esmeralda’s corpse. Much later, they are discovered still in their embrace; when their bones are separated, Quasimodo’s turn to dust.

Probably one of the earliest paintings to show Victor Hugo’s story is this undated work by a Mademoiselle Henry who is claimed to have lived between 1790-1873. It shows Quasimodo Saving Esmeralda from the Hands of her Executioners: the bell-ringer has just swept the young woman from the gallows, and she has swooned away on his shoulder. He carries her in through the main entrance of the cathedral, to claim sanctuary for her. Her pet goat Djali is at the top of the steps. The rope running down the steps is the bell-rope on which Quasimodo swung down onto the gallows.

The strange Belgian narrative painter Antoine Wiertz painted a pair of portraits in 1839 showing the novel’s male and female leads. This is his Quasimodo, who resembles the figure in the painting above. Wiertz doesn’t appear to have been happy with this work, and labeled it a bad study.

For his portrait of Esmeralda, Wiertz used his favourite model, and an affectionate goat. The letters on her lap spell Phɶbus, the name of the captain of the King’s Archers, who she is convicted of attempting to murder.

Louis Boulanger painted this fascinating and painterly group of Six of Victor Hugo’s Characters in 1853, apparently for a friend. Clockwise from the top left they are Don Ruy Gomez, Don César de Bazan, Don Salluste, Hernani, Esméralda and De Saverny, but there’s no goat.

Jozef Van Lerius’ portrait of Esmeralda and Djali, which must have been completed before the artist contracted meningitis in 1875, is startlingly realist and gently erotic. Djali is shown with gold horns and hooves, and in front of the girl are, once again, the letters forming the name Phɶbus.

William-Adolphe Bouguereau’s Little Esmeralda from 1874 conforms less to Hugo’s character. She is fair and would never be taken for a ‘gypsy’, and is seen carrying wild flowers out in the country, perhaps on the coast of Normandy. She does, though, have Djali as her companion.

There have been many illustrated editions of Notre Dame de Paris, in its original French, English and other translations. Among them is an edition published in 1889, with engravings based on a series of drawings made by the Naturalist Luc-Olivier Merson between 1881 and 1889, three of which I show here.

This shows Esmeralda taking pity on Quasimodo when he had been flogged and put in the pillory, by giving him a drink of water. Naturally she is accompanied by Djali.

Esmeralda and Djali are here seen with Phɶbus, I think.

This is Merson’s treatment of Quasimodo carrying the swooning Esmeralda from her first brief visit to the gallows up into the sanctuary of the cathedral.

Here are this weekend’s Mac riddles to entertain you through family time, shopping and recreation.

1: Harvard or Yale cipher brought emoji and Ugaritic.

2: US standard for 128 Roman characters now over 60.

3: Two plus 128 more came in 1989, gained a euro in 1998, and still supported.

To help you cross-check your solutions, or confuse you further, there’s a common factor between them.

I’ll post my solutions first thing on Monday morning.

Please don’t post your solutions as comments here: it spoils it for others.

The first file system for Macintosh computers wasn’t HFS+ or even its predecessor HFS, but Macintosh File System, MFS. This was introduced in System 1 on the 128K Mac just over 41 years ago, to support its 400 KB floppy disks. Although it was fairly primitive, it incorporated some visionary features, including forks. Each file had two sets of data: a data fork as in other file systems, and a resource fork for storing structured blobs of data or resources.

File naming was liberal compared with MS-DOS, allowing names up to 255 characters long, although that was restricted to 63 by the Finder. Names could consist of any printable character except the colon :, a limitation that persists in the Finder today. As there was no directory hierarchy, folders were an illusion and couldn’t be created directly by the user. Instead there was always an Empty Folder available, and when that was used, a fresh Empty Folder was created. As this was a single-user file system, there were no permissions.

MFS was still supported until it was finally discontinued 13 years later in System 8, in 1997.

Hierarchical File System, HFS

MFS had been designed for the low-capacity floppy disks of the time, and not for use on hard disks, where its limitations would have been only too apparent. For the release of the Macintosh Hard Disk 20 in September 1985, and in anticipation of the Macintosh SE 18 months later, a new Hierarchical File System had to be released to replace MFS in System 2.1. HFS remained fully supported until the arrival of Mac OS X 10.6 Snow Leopard in 2009, and finally dropped altogether in macOS Catalina a decade later.

Developed by Patrick Dirks and Bill Bruffey, HFS maintained many of the novel features in MFS, with resource forks, long file names up to a maximum of 31 characters, still excluding the colon, and in its standard single-user version didn’t support permissions. The latter were incorporated into AppleShare later. File and folder names were case-preserving but case-insensitive.

Larger storage capacities brought the need for a hierarchical directory structure, implemented using B-trees in a Catalog File that made the display of even large directories very quick. Although much of HFS used 32-bit integers, that didn’t apply to the number of files in a logical disk, which was limited to 65,535, which must have seemed sufficient at the time, and given the maximum volume size of 2 TB. With early hard disks being measured in tens of MB, that may have seemed in the distant future.

Mac OS Extended, HFS+

With the growth in capacity of hard disks, HFS had to be updated to address its limitations, in a project with the internal name of Sequoia, delivering HFS+ in Mac OS 8.1 in 1998. Switching to 32-bit fields to identify allocation blocks allowed more efficient use to be made of storage and a larger number of files in each volume. File names were increased in maximum length to 255 characters, and changed from MacRoman encoding to Unicode UTF-16 to accommodate a broader range of languages. Support for additional forks beyond data and resource paved the way for the switch to extended attributes, and OS startup support was improved to allow alien operating systems to boot from HFS+ volumes.

This screenshot shows a set of custom icons in a BNDL resource, in the QuarkXPress app in about 2000.

This shows file information available in HFS+ in Classic Mac OS in 2002.

HFS+ and its predecessors were prone to develop errors as a result of operating system crashes and other unexpected events, and those could be cumulative, leading to data loss. This was addressed with the introduction of journalling, designed and implemented by Dominic Giampaolo, who came to Apple from implementing the file system for BeOS. This was tentatively introduced as an option in Mac OS X 10.2.2 in late 2002, and made a standard feature in 10.3 the following October. Alongside that came an optional wrapper for case-sensitivity in what was dubbed HFSX, and a change in Unicode decomposition to Normalisation Form D (NFD).

Mac OS X 10.4 augmented Posix permissions with Access Control Lists (ACLs), although they were little-used outside server environments for some years. Prior to 10.5, as with most other file systems, HFS+ supported file but not directory hard-links. With the introduction of Time Machine in 10.5 Leopard, directory hard-links were added to support the structure and illusions of Time Machine backup stores.

File system support for encryption was a bit more troubled. The original FileVault, introduced in 2003 with Mac OS X 10.3 Panther, located user Home folders in an encrypted sparse disk image, which was improved in 10.5 by moving to sparse bundles. This suffered several shortcomings and vulnerabilities, and was replaced by whole-volume encryption in FileVault 2 in Mac OS X 10.7 Lion. That required the addition of a logical volume manager, Core Storage, which was then used for Fusion Drives introduced in 2012.

Apple File System, APFS

HFS+ had been designed for computers with hard disks. It lacks some of the features of more modern file systems such as snapshots, special files such as sparse files, and concurrent access. It’s also not well-suited to use with SSDs and storage in smaller, mobile devices, although when the first iPhone shipped with iOS 1.0 in 2007, it used HFSX, the case-sensitive variant of HFS+. That was until the release of iOS 10.3 on 27 March 2017, which silently converted its file system to APFS.

In 2014, Apple had decided to write its own file system from scratch, and Dominic Giampaolo, responsible for journalling in HFS+, and Mike Mackovitch became its lead engineers. APFS was announced two years later at WWDC in 2016, when it was expected to be released in another 18 months if development and testing went smoothly. Those who had hoped for ZFS were disappointed and many remain so today. macOS Sierra already had a pre-release version for those who wanted to preview it, but as we discovered when we upgraded to High Sierra, that was a far cry from what was to come.

After a promising period in beta, Apple discovered fundamental problems between APFS and its popular Fusion Drives. The first release of macOS 10.13 shipped with APFS version 748.1.46, but abruptly dropped support for those, so converted only those startup volumes on SSDs and hard disks. Snapshots were wobbly at first, and it quickly became clear that APFS was never going to perform well on rotating disks.

High Sierra had a stormy early release history, marred by a series of security gaffes. Vulnerabilities were fixed in the Supplemental Update released less than two weeks after 10.13, leaving snapshots to be improved in 10.13.1 on 31 October. Many expected problems with Fusion Drives would be fixed quickly, but those weren’t ready for release until the following September. Another problem that troubled the introduction of APFS to all platforms was the refusal during beta-testing to incorporate Unicode normalisation; this had to be resolved in later versions of macOS 10.13 and iOS 10, as explained here and here.

In September 2018, Apple at last released Mojave 10.14 with support for Fusion Drives, accompanied by the first version of the Apple File System Reference. Although a long and detailed document, developers soon realised how incomplete it was, in spite of the long delay in its publication. At last third-party file system developers had some hard information to work with, and users started assuming that third-party disk maintenance and repair tools were imminent.

Catalina brought major changes to APFS, with the use of expanded volume roles to form System Volume Groups, with their separate but firmlinked System and Data volumes. macOS 10.15.5 fixed a serious bug preventing the transfer of very large amounts of data to RAID volumes. At that time, Apple released an updated version of the Apple File System Reference, building expectations that third-party tools were just round the corner, at least among those who weren’t aware of how much information was still missing. Nearly five years later, it’s still that same edition dated 22 June 2020 that remains the latest information released by Apple about APFS.

Further major changes came with Big Sur 11.0.1 when it was released in November 2020, introducing the sealed and signed snapshot now used to boot macOS. This was also the first release to support making Time Machine backups to APFS volumes, and to support Apple silicon Macs.

Although Apple dropped early hints that APFS might be released as open source, unlike its predecessors, after eight years, information about its internals released by Apple still appears to be insufficient to allow third-party developers to create maintenance tools independent of those bundled in macOS. This reluctance may stem from the deep involvement between the file system and macOS security.

Summary timeline

• MFS Jan 1984 – Sep 1985, end of support 1997
• HFS Sep 1985 – Jan 1988, end of support 2019
• HFS+ Jan 1988 – present, still supported
• APFS Sep 2017 (iOS March) – present, still supported

References

Inside Macintosh: Files, Chapter 2 – File Manager, on HFS
MacCyclopedia critical account of HFS and HFS+. 25 May 2003
Apple TN1150 HFS Plus Volume Format, 5 March 2004
Apple’s APFS Reference (PDF), last revised 22 June 2020.

Wikipedia on
MFS
HFS
HFS+

Although few of those who migrated to the towns and cities from the countryside prospered as a result, there were sufficient examples to lure others to take their chances. For a young woman, success could come through the growing world of fashion.

The foot of the ladder was the greatest challenge: how to make the break from the worn-out worker shown in Christian Krohg’s Tired from 1885. This young seamstress was one of the many thousands who worked at home at that time, toiling for long hours by lamplight for a pittance. A few of them had the good fortune to be discovered and taken up into a small dressmaker’s.

They might then enter the world of Moritz Stifter’s New Dress from 1889. Every face is smiling here, some perhaps a little vacuously, as an affluent young woman tries on a new dress, with its incredibly small waist. Although this room is full of fabric and the trappings of dressmaking, including the mandatory sewing machine, no one actually appears to be making anything.

A few specialised in making hats, as shown in Edgar Degas’ The Millinery Shop (1879/86). While husbands and partners were expected to pay for a woman’s hats, their choice was hers, and hers alone.

Jean Béraud’s fashionably-dressed Milliner on the Champs Elysées is enjoying her success, and carrying her work in two large hatboxes. She has also attracted the attention of the well-dressed man in a top hat behind and to the left of her.

Les Modistes (Two Milliners in the Rue du Caire, Paris) from 1885-86 is one of Paul Signac’s transitional paintings to Seurat’s Divisionism. These two young milliners are busy making fashionable hats and making their way into bourgeois life.

Pierre-Georges Jeanniot’s At the Milliner (1901) shows the milliner in a mirror at the right.

Millinery was one of the staples of fashion houses like that of Paquin, whose success was characteristic of the late nineteenth century, and shown in Henri Gervex’s Five Hours at Paquin’s from 1906.

The purpose of these expensive hand-made hats was for show, when the lady was seen in appropriate surroundings. Jeanniot’s painting of the patrons of one of the most fashionable hotels in Paris shows all the hats out on parade in the inner garden of the Paris Ritz in fine weather.

Béraud’s Workers leaving the Maison Paquin (1907) shows the ladies who worked in Jeanne Paquin’s highly successful fashion house in the Rue de la Paix, as they left work at the end of the day.

A select few were fortunate enough to marry into the middle class and forge a more secure future for themselves.

Béraud’s After the Service at the Church of Sainte-Trinité (the ‘American Cathedral’) (c 1900) shows affluent Franco-American society at the turn of the century, and the prominence of hats and clothes.

Recent updates to macOS Sequoia 15.4, Sonoma 14.7.5 and Ventura 13.7.5 brought firmware updates for some Macs, but not others. As I have now analysed those, and they’re reflected in the databases accessed by SilentKnight, and in my reference articles here (listed at the end), this article explains which are still being maintained by Apple.

Intel Macs without T2 chips

There are only two models of Mac without a T2 or Apple silicon chip whose firmware is still supported for updates: the iMac19,1 and 19,2, respectively the 2019 Retina 5K 27-inch and Retina 4K 21.5-inch. In this round of updates, they moved up to an EFI version of 2075.100.3.0.3, dated as recently as 3 March 2025. As they can run Sequoia, they’re expected to have continuing macOS security updates until at least the summer of 2027.

Older models of iMacs, MacBook Pros, and a single MacBook, remain with EFI firmware that was last updated in June 2024, and is unlikely ever to be updated any further. macOS support for them is expected to end when security updates for Ventura are discontinued at the end of the summer this year.

T2 Macs

For the 20 days between the release of 15.3.2 and 15.4, Intel Macs with T2 chips that were running Sequoia had a slightly more recent release of iBridge firmware. In 15.3.1, 14.7.4 and 13.7.4, that was 22.16.13051.0.0,0, but 15.3.2 brought version 22.16.13060.0.0,0. This is one of very few occasions in which T2 Macs running supported versions of macOS have had different firmware versions installed.

Thankfully, this last round of updates has rectified that, and all Macs with T2 chips should now be running 2075.101.2.0.0 (iBridge 22.16.14248.0.0,0). This is encouraging, not only for simplicity, but because it demonstrates that Apple is continuing to support not only the ‘Bridge’ Arm chip, but EFI as well. How much longer that will continue depends on whether there is Intel support in macOS 16, expected to be announced at WWDC in early June, and released in September or October this year.

At a minimum, macOS support for T2 Macs should last at least until summer 2027, and that should be extended to the following year if macOS 16 comes with Intel support.

Apple silicon Macs

All Apple silicon Macs should now be using iBoot version 11881.101.1, which was installed with these updates. The most recent MacBook Air and Mac Studio models with M4 family (or M3 Ultra) chips had their own update to 15.3.2, but 15.4 covers all current models in the single distribution, with the same firmware version.

There’s a growing number of reports of Apple silicon Macs experiencing problems updating to Sequoia 15.4, either on their internal SSD or on bootable external disks. This seems most likely in models with M1 family chips, and suggests that changes made in the installer might be responsible. As this doesn’t appear to affect 14.7.5 or 13.7.5 updates, it’s unlikely to lie in the firmware. There are several strategies you can adopt to work around this, including:

• Try updating in Safe mode. This is a longstanding function of Safe mode, described here.
• Start up in the correct paired Recovery system, and install Sequoia there. This should be attempted conservatively, without creating a fresh Data volume, but you must ensure that you have at least one complete backup ready in case anything goes wrong and the whole boot volume group has to be replaced.

Provided the Mac is already running at Full Security, there shouldn’t be any value in changing that. Performing a full Restore in DFU Mode isn’t as daunting as it might seem, but is a drastic solution requiring a recent second Mac, and full restore from your backup. If you’re getting to that stage, contact Apple Support who hopefully will now be only too familiar with these problems.

Summary

• Intel Macs without T2 chips: iMac19,1 and 19,2: EFI 2075.100.3.0.3; no change in other models.
• Intel Macs with T2 chips: 2075.101.2.0.0 (iBridge 22.16.14248.0.0,0).
• Apple silicon Macs: 11881.101.1.

Reference data

Which firmware should your Mac be using? (version 9, Sequoia)
Which firmware should your Mac be using? (version 8) – for Sonoma
Which firmware should your Mac be using? (version 7) – for Ventura

Folding screens were first recorded in ancient China, where they were used as portable room dividers and as decorative furniture. They’re thought to have made their way to Europe in the late Middle Ages, and started to spread more widely during the seventeenth and eighteenth centuries.

Early screens were made of wood, but were soon covered with painted paper or silk. Kanō Hideyori’s magnificent Maple Viewers (紙本著色観楓図) (Muromachi, early 1500s) is painted on paper in the classical style of the Kanō school, then applied to a six-section folding screen.

In Europe, screens served several purposes in addition to dividing a larger space into two. They could be used to keep drafts away, provide privacy, hide a feature like a servant’s entrance to a kitchen, or purely for decoration.

In the fourth painting in William Hogarth’s moralising narrative series Marriage A-la-Mode, The Toilette (c 1743), Countess Squander is being entertained while completing her dressing and preparations for the day. In the background at the right is a painted screen showing a masquerade ball.

It was the popularity of East Asian artefacts in the latter half of the nineteenth century that put folding screens in many homes and quite a few paintings. They featured in at least two of James Abbott McNeill Whistler’s works from the mid-1860s.

Behind Whistler’s Princess from the Land of Porcelain (1863-65), from his Peacock Room, is a painted screen from Japan.

A more elaborately painted screen forms the backdrop to Whistler’s Caprice in Purple and Gold: The Golden Screen from 1864.

Lucy Madox Brown Rossetti’s The Duet (1870) attracted favourable reviews when exhibited at the Royal Academy. This features a decorated folding screen from East Asia in the left background. The artist was the daughter of the Pre-Raphaelite painter Ford Madox Brown, and was Dante Gabriel Rossetti’s sister-in-law.

In 1872 William Quiller-Orchardson completed Dolce Far Niente, incorporating in its painted screen a contemporary flavour of Japonisme. His woman, dressed in sober black, reclines on a thoroughly European chaise longue, her open book and fan beside her as she stares idly out of an unseen window.

Like other artists of the day, Elihu Vedder developed a fascination for objets d’art from the Far East, which he assembled in this Japanese Still Life in 1879. This unusual collection may have been assisted by the fact that his brother was a US Navy doctor who was stationed in Japan as it was being re-opened to the West.

Bouderie, which means sulking, is a splendid and intimate portrait of Pascal Dagnan-Bouveret’s friend and colleague Gustave Courtois, painted in 1880. Courtois is seen at one end of a large sofa, smiling wryly and staring into the distance. He holds his palette and brushes in his left hand, and what may be a long mahlstick in the right. At the opposite end of the sofa, turned with her back towards Courtois, is a young woman dressed in fashionable clothing, in black throughout, apart from white lace trim at the foot of her skirts. Also shown is a screen decorated with Japanese imagery, and on the floor the skin of a big cat, perhaps a lioness.

Pierre Bonnard developed his earlier Man and Woman in an Interior into his Man and Woman in about 1900. Marthe isn’t getting dressed here, but sits up in the sunshine. A folded wooden screen divides the painting into two. Bonnard stands at the right edge of the painting, his legs looking skeletal in the sunlight.

William McGregor Paxton’s Tea Leaves (1909) show two well-dressed young women taking tea together. The woman in the blue-trimmed hat seems to be staring into the leaves at the bottom of her cup, a traditional means of fortune-telling, and behind them is a large folding screen, whose details are intentionally blurred and vague.

The New Necklace from the following year is one of Paxton’s best-known paintings, and perhaps his most intriguing open narrative. A younger woman is sat at a narrow bureau writing. She has turned her chair to reach behind and hold out her left hand to receive the new necklace from a slightly older woman in a dark blue-green dress. Their backdrop is another folding screen, this time with its East Asian painting clearly visible.

My final screen is the painting itself.

Pierre Bonnard’s exquisite three-panelled Japoniste screen of The Stork and Four Frogs was painted at the outset of his career, in about 1889. Its story is contrastingly European, and based on one of Aesop’s fables retold by Jean de La Fontaine’s The Frogs who Demand a King.

The version retold by La Fontaine centres on a colony of frogs, who ask Jupiter for a king. The god’s first response to their request is a laid-back and gentle leader, whom the frogs reject as being too weak to rule them. Jupiter’s second attempt is a crane, who kills and eats the frogs for his pleasure. When the frogs complain to Jupiter, he then responds that they had better be happy with what they have got this time, or they could be given something even worse. Bonnard’s magnificent panel is traditionally interpreted not as showing the evil crane of the second attempt, but the first and gentle ruler.

App extensions, appexes, have become plentiful and widely used by macOS and third-party software, yet discovering and controlling them is patchy and limited. The most coherent access is in System Settings > General > Login Items & Extensions, where some are gathered in the list of Extensions at the end. Others like Safari extensions are controlled in app settings, while most remain hidden out of sight.

To take stock of all these appexes, I turned to the pluginkit command tool, but the lists it generates are seemingly ordered at random, and so extensive that it would require some serious scripting to make any sense. Instead, it’s easier and more effective to put together a little app to do that. So I present you with AppexIndexer, an exploratory utility that displays key information about all appexes recognised by macOS.

Click on its button to Get Appexes and the window below will fill with well over 400 items, arranged in alphabetical order by the first entry in each line, the SDK or NSExtensionPointIdentifier. Some of those should be fairly obvious: for instance, those appexes listed in Photos Editing settings use the com.apple.photo-editing SDK. In a future article I will explore the relationships between settings categories and SDKs given.

Following that comes the display name of that appex, again ordered alphabetically within that SDK group, which should be the same as that used in System Settings. Next comes the path to that appex, so you can inspect it and its Info.plist for further information.

Many appexes also have a parent, so the last two entries given are the name and path to that parent, when they’re available. One quick way to recognise third-party appexes is to glance down the right side of the list, as they invariably have a familiar parent. Appexes built into macOS are far less likely to have parents (and you can read into that what you like!).

Even in a modest installation, you’re likely to see well over 400 in your Mac’s list, from SpamSieve, an Email Extension with the SDK of com.apple.email.extension, through to QuickLook thumbnail previewers, screensavers and wallpaper. I’ve already explained in general terms what these are and how they work, in this article.

One significant feature missing at this stage is Find/Search, which I’m still working on, for LogUI as well. There’s also additional information given by the pluginkit command tool, and more still that’s available from each appex’s Info.plist file inside its bundle. This initial release lets you save the window’s contents using the Save as RTF button, and you can copy any selected entries and paste them as text. Row selection can be continuous using the Shift key, and discontinuous using Command.

Appexes are not only growing in number, but also becoming increasingly important in macOS. In some cases, they include background processes that could be used maliciously as a method of persistence. Although appexes still need to comply with TCC’s strict rules for accessing protected services and data, they can be an effective way to fly under a user’s radar.

AppexIndexer 1.0 build 5 is now available from here: appindexer105
I’m afraid that it requires macOS Sonoma 14.6 or later, to support the features it uses in SwiftUI.

I hope that you find this information of use. Please let me know what features you’d like the app to support, whether you’d like it to access appex property lists, or other useful data, and how you might want to use a future version. While I’ve got my own ideas, I’m interested in yours, and will try to accommodate them.

In 1907, after over twenty years of lucrative work painting portraits, John Singer Sargent closed his studio in London, and cut himself adrift to travel where and when he wanted.

The American artists Jane de Glehn and her husband Wilfrid (1870-1951) were long-standing friends. Sargent first met Wilfrid around 1895 when he was working on murals in Boston Public Library, and Wilfrid married Jane Emmet (1873-1961), sister of Lydia Field Emmet, in 1904. The Fountain, Villa Torlonia, Frascati, Italy (1907) shows Jane working at a lightweight wooden easel in the grounds of the villa.

The composition in his Dolce Far Niente (1907) is complex, with five of the figures staggered and slightly out of line along the gentle curve of the bank crossing this unusually wide canvas, its aspect ratio being more typical of marine views and panoramas. Against this are steep diagonals in the middle of the painting, formed by the edge of the brown reflection on the water, the male in the left pair of figures, and the closest female. The cropping of the horizon and any background beyond the immediate meadow and stream gives a sense of space and recession, aided by the foreshortening of the closest figure, despite the proximity of the individuals to one another.

The painting consists of a multitude of daubs, strokes, and dabs of colour, those marks composed to provide just enough information for the viewer to assemble them into the whole, which as a result ‘pops’ out in a vivid reality.

It’s thought that all three male figures were modelled by Nicola d’Inverno, the painter’s manservant, and the woman seen asleep appears to be his friend Jane de Glehn. Sargent had purchased the costumes in the Middle East during his travels there, and they were transported in trunks to this site, believed to be the brook at Peuterey in the Val d’Aosta, most probably in the summer of 1907.

This painting was hung in the summer exhibition of the New English Art Club, London, in 1909, and was favourably received by the critics. It was sold within an hour of the opening of the press view, to Augustus Healy, founder of the Brooklyn Museum, where it has hung ever since.

Sargent’s bravura watercolour sketch of Grand Canal, Venice (1907) is composed of a sparse, even minimalist, collection of brushstrokes of watercolour assembled into a detailed view of the motif. He views Venice from the level of a gondola, the bows of which are also shown. His palette for these sketches is generally centred on earth colours for the buildings, with blue for the sky, water, and usually the shadows.

The following year, his Flotsam and Jetsam follows in the same style, with the figures of young boys in the foreground sketched in roughly to suggest movement.

Sargent was an early adopter of cadmium yellow pigment in watercolours such as Olive Trees, Corfu from 1909, where it ensured that his greens remained lightfast.

He wasn’t dependent on sophisticated techniques, though: Rio dei Mendicanti, Venice from about 1909 works its magic almost entirely using a combination of passages using wet on dry and wet on wet. There isn’t even much in the way of a graphite drawing under its thin washes.

Sargent met up with the plein air specialist Ambrogio Raffele again when he returned to the Alps during the summers of 1909 to 1911, and painted this watercolour of him as an Artist in the Simplon at some time in those years. Raffele is painting a view of the Fletschhorn, to the south-west of the Simplon Pass, using an improvised easel formed from two crossed poles.

In the summers of 1909-11, Sargent stayed with various friends in the Bellevue Hotel at the top of the Simplon Pass, enjoying the cool mountain air at a time when much of the rest of Europe would have been stiflingly hot. While his family and friends whiled away their days in leisure, Sargent got them to pose for a unique series of informal portraits. They may have been reclining at leisure, but Sargent took those watercolours very seriously, and deployed an amazing array of techniques. Among the finest is his Simplon Pass: The Tease from the summer of 1911. For any watercolour artist, it is a lexicon of advanced techniques.

One of the most unusual, used here extensively, is wax resist. Before applying paint, Sargent scribbled over areas that were intended to be vegetation, using a soft wax crayon, probably made from beeswax. On a fairly rough paper, the wax is deposited unevenly, and when painted over using watercolour it shows the white paper through. This creates disruptive patterns of near-white in the midst of the greens, and a superb effect.

Most of the paint used is transparent watercolour, applied as a wash in small areas, and in gestural marks elsewhere. In the upper third of this detail, he has applied white gouache (opaque watercolour) sufficiently thickly for it to now have fine cracks. The large pale blue area crossing the middle appears to have been rewetted and some of its colour lifted to reduce its intensity, although most of his applications of paint over existing paint have been made wet on dry.

Complex details such as the faces and hands of the figures have undergone multiple repainting, starting with the palest flesh of the face, and progressively darkening to near-black. In most cases, the clean edges of the marks demonstrate that these were applied wet on dry, with as many as six different layers in the hair.

In the midst of this complex assembly of layers, Sargent still keeps to the lines of his original graphite sketch, which he uses to give the parasol form, and maintains small reserved areas, here forming the spectacle frames in the white of the paper. He could have used wax resist here, but if using pure beeswax it’s hard to keep the soft wax to fine lines.

Sargent is the Chess Grand Master, the strategist whose moves at times might almost seem random or abstract, but in the end they all come together to bring this masterly watercolour to life.

For many years, most types of disk image were inefficient in their use of storage space, as they occupied their full size on disk. Until recently, when you created a 5 GB read-write UDIF disk image, one of the most popular, it invariably took up 5 GB in storage, even when empty. This also applied to the raw disk images used by Virtual Machines: give a VM 100 GB, and that’s just what it took on disk. With the introduction of sparse files in APFS, this has changed, and many disk images now only take the space they need. I’m not sure exactly when this change occurred, as Apple still doesn’t appear to have documented it, but it seems to have changed with macOS Monterey.

This is easiest to see with a plain read-write disk image, created using DropDMG or Disk Utility.

Disk image

Here’s one I made earlier, a whole 350 GB in size. When it’s created, it’s automatically attached and mounted at full size. For the sake of example, I then copied a large IPSW to it, so it wasn’t entirely empty.

Unmount it and Get Info on the disk image and you’ll see it does still take up a full 350 GB on disk. Mount it again, though, and APFS works its magic. You can see this in LogUI, or the custom log extract provided by Mints.

When unmounted again it has shrunk down to take little more than the size of the IPSW file in it, at just over 17 GB. That’s less than 5% of its nominal size, without using any compression.

It’s worth looking through entries in the log made by APFS for the mount process. First, APFS checks whether the data store for the disk image is already sparse:
01.470 container_backingstore_is_sparse:1652: Image url file:///Volumes/LaCie2tb/350gbudif.dmg Image path /Volumes/LaCie2tb/350gbudif.dmg
01.470 container_backingstore_is_sparse:1659: Image /Volumes/LaCie2tb/350gbudif.dmg is a flat file, do not consider as sparse

It then sets it to sparse, ready for sparsification:
01.475 handle_apfs_set_backingstore:6207: disk9s1 Set backing store as sparse
01.475 handle_apfs_set_backingstore:6240: disk9 Backing storage is a raw file

Space Manager performs an initial scan for free blocks without any Trimming:
01.479 spaceman_scan_free_blocks:4136: disk9 scan took 0.004272 s (no trims)
01.479 spaceman_fxc_print_stats:477: disk9 dev 0 smfree 81258479/85398014 table 4/452 blocks 81258479 32766:20314619:79974226 100.00% range 35869:85362145 99.95% scans 1

Space Manager then scans and Trims free storage blocks, taking just over 0.7 second to complete:
02.196 spaceman_scan_free_blocks:4106: disk9 scan took 0.717433 s, trims took 0.715705 s
02.196 spaceman_scan_free_blocks:4110: disk9 81258479 blocks free in 25 extents, avg 3250339.16
02.196 spaceman_scan_free_blocks:4119: disk9 81258479 blocks trimmed in 25 extents (28628 us/trim, 34 trims/s)
02.196 spaceman_scan_free_blocks:4122: disk9 trim distribution 1:0 2+:0 4+:0 16+:0 64+:0 256+:25

VM

What happens with an Apple silicon VM is a bit more complicated, and harder to observe. This time the virtualisation app should create the disk image inside the VM bundle as a sparse file to begin with, then copy into that what’s needed for the VM, so skipping the first mount stage and Trimming during the second mount.

The result is the same, though, with a 350 GB VM taking just 22 GB on disk. Inspect that disk image using my free utility Precize, and you’ll see that economy confirmed, and the Sparse File flag set.

Conclusions

For plain read-write disk images and those inside VMs to be sparse files:

• they must contain a suitable raw disk image, such as UDIF read-write;
• the host file system must be APFS, as HFS+ doesn’t support sparse files;
• for normal disk images, they must be stored on an SSD that supports Trimming;
• there must be sufficient free space in the disk image;
• the guest file system can be APFS, either plain or encrypted, or HFS+J;
• for normal disk images, they must have been mounted at least once since first being created.

Apple has just released an update to XProtect for all supported versions of macOS, bringing it to version 5293. As usual, Apple doesn’t release information about what security issues this update might add or change.

This version adds a single new rule for MACOS.SOMA.J.

You can check whether this update has been installed by opening System Information via About This Mac, and selecting the Installations item under Software.

A full listing of security data file versions is given by SilentKnight, LockRattler and SystHist for El Capitan to Sequoia available from their product page. If your Mac hasn’t yet installed this update, you can force it using SilentKnight, LockRattler, or at the command line.

If you want to install this as a named update in SilentKnight, its label is XProtectPlistConfigData_10_15-5293.

Sequoia systems only

This update has also been released for Sequoia via iCloud. If you want to check that manually, use the Terminal command
sudo xprotect check
then enter your admin password. If that returns version 5293 but your Mac still reports an older version is installed, you can force the update using
sudo xprotect update

I have updated the reference pages here which are accessed directly from LockRattler 4.2 and later using its Check blog button.

John Singer Sargent’s move to London in 1886 had proved a commercial success, and he painted portraits of the rich and famous until he closed his studio there in 1907.

His group portrait of The Ladies Alexandra, Mary, and Theo Acheson, normally simply known as The Acheson Sisters, was exhibited at the Royal Academy in 1902, where it was both very popular and favourably received. And at first sight, it is indeed a delight, as they sit around the front of a huge urn decorated with floral garlands, one of the ladies reaching up to pick oranges from a tree just above the urn. Even the late Queen Victoria would, I am sure, have approved. However, there are hidden references that link back through earlier portraits by Sir Joshua Reynolds to Nicolas Poussin’s previous paintings of bacchanalian orgies.

Meanwhile, the other John Singer Sargent continued his travels across Europe and beyond. A visit to Venice in 1902 brought this stunning watercolour of Rio dell Angelo, where he provides his response to the Impressionists’ question on the colour of shadows.

The same year, Sargent visited New York, where he painted this portrait of his friend and fellow artist William Merritt Chase in his fifties. He’s immaculately dressed with a carnation in his button-hole, and the tools of his art in hand.

The following year, Sargent was back in Venice to paint this watercolour of Scuola di San Rocco assembled from a virtuoso series of marks and gestural strokes of the brush.

When he broke free of his studio for the summer of 1904, Sargent travelled to the Alps for his first season of serious plein air painting there. He stayed in the Italian mountain town of Purtud, to the south-west of Mont Blanc, where there was a group of Italian artists doing the same thing. Among them was Ambrogio Raffele (1845-1928), probably the best and most experienced of the group; Sargent became particularly friendly with him, and in An Artist in His Studio (1904) shows Raffele at work in his room there.

This painting is a paradox, in that Sargent shows an accomplished plein air painter working not in front of his motif, but in his bedroom. It’s plausible that Raffele is painting a larger version of the small sketch seen at the lower left of the large canvas.

When he reached Venice, Sargent’s watercolours became even more gestural, as shown in this view of Unloading Boats in Venice (1904).

The following summer Sargent turned his attention to his fellow travellers as they crossed the Alps on their way south. He sketched his friends during their siesta, in this Group with Parasols painted in oils in about 1905.

Here they are again in watercolour, in Siesta from the same year.

A decade after her dancing career had gone into decline, and fifteen years after his first painting of her, Sargent produced a completely different portrait of La Carmencita (c 1905). Now his virtuoso brushstrokes capture her motion. His inspiration was no longer Manet, but Giovanni Boldini and his ‘swish’.

In further time out of his studio, Sargent travelled to North Africa, where he painted this Bedouin Camp in 1905-6.

This portrait of an Arab Woman from 1905-06 is another fine example of his watercolour sketching.

At times, Sargent’s brushstrokes appear so casual that it’s almost as if he was just doodling with pigment, as in the blue shadows In a Levantine Port (1905-6). But they coalesce into the image that Sargent clearly had in his mind all the way along, and pop out at the viewer.

Open System Settings, then General, and Login Items & Extensions. Scroll to the end of that list and you’ll see a section titled Extensions. All looks tidy there and in order, but you’re looking at the tip of the iceberg. Click on the ⓘ button at the right of any of those entries, and prepare to be thoroughly confused. These aren’t, of course, kernel extensions, nor are they only system extensions (although some may be), they’re app extensions, conveniently shortened to appexes, the subject of this article.

System Settings

That section in System Settings is unusual as its list depends entirely on what you have installed on your Mac. Among those you’re most likely to see are:

• Actions allow access to an app’s functions from within other apps, such as Markup provided by macOS.
• Dock Tiles customise the Dock and normally run in the background (although not listed in Background items above), including several phantom ‘apps’ added by macOS.
• File Providers allow you to see both local and remote-storage files together in the Finder, and normally run in the background (although not listed in Background items above). Note this isn’t confined to ‘file providers’ in the sense of cloud services like iCloud Drive.
• File System Extensions, userland file systems, including ExFAT and MSDOS in macOS 15.4, which are intended to replace kernel extensions.
• Finder provides enhanced search and other functions for files and more. These can also be accessed directly through the Quick Actions item in the Finder’s contextual menu.
• Photos Editing provides enhanced editing in the Photos app. This also includes Markup provided by macOS.
• Quick Look includes custom QuickLook thumbnail and preview extensions, replacing qlgenerators.
• Sharing includes features provided in the Share menu. These include some from macOS that can’t be disabled, such as Mail and Messages, others that are optional, as well as third-party apps.
• Spotlight includes custom mdimporter modules to extract indexable content from custom file types not supported by macOS.

To add to the uncertainty, not all those available in Sequoia 15.4 are listed in the Mac User Guide’s total of 17 classes, or Apple’s list of 25 for developers.

Where are appexes?

Most of these are installed as .appex bundles inside a PlugIns folder inside the bundle of an app, although some can instead be in a Library folder inside the app. The best information about each is in the Info.plist file in their appex bundle. In that, the nested dictionary of NSExtensionAttributes is most informative. That gives the NSExtensionPointIdentifier type, which for a QuickLook appex might be com.apple.quicklook.preview, indicating that it generates custom previews for QuickLook, in the way that qlgenerators used to. That type corresponds to the SDK entry listed by pluginkit, described below.

Not all appexes are exposed in System Settings, though. New-style drivers supplied in .dext bundles, that are listed as extensions, aren’t included despite there being 17 bundled in macOS 15.4. There’s also no mention of nearly 200 appexes provided in /System/Library/ExtensionKit/Extensions.

pluginkit

In addition to their control in System Settings, the command tool for working with appexes is pluginkit. Most of its options are aimed at those developing and debugging their own appexes, but there’s one command that will dump details of all managed appexes to a lengthy text file, with a form like
pluginkit -m -vv > ~/Documents/pluginkitOut.text
which pipes its output to the file at ~/Documents/pluginkitOut.text. You can add another v to the options for greater details.

The output from pluginkit reveals just how many appexes there are, possibly as many as 500 or more installed in your Mac. Most are system components that aren’t exposed in System Settings, and many have SDK names, specifying their type, that fall outside the categories listed by Apple. For instance, there’s a com.apple.CloudDocs.iCloudDriveFileProvider appex buried deep in the CloudDocs private framework that has an SDK type of com.apple.fileprovider-nonui for iCloud Drive.

Anomalies

Extensions settings currently appears to be a work in progress. It’s among the most opaque sections in System Settings, with all of its controls accessed through ⓘ buttons and floating windows, rather than being laid out clearly. It’s riddled with inconsistencies, and some sections don’t appear to work properly, most notably Quick Look.

This screenshot shows that Apparency’s Quick Look appex is currently disabled, but at the right is a QuickLook preview demonstrating Apparency’s customisation. This applies to other custom Quick Look appexes in Sequoia 15.4: when apparently disabled, they continue to work normally.

As system qlgenerators aren’t included in the Quick Look list, it can’t be used to disable those to allow third-party appexes to generate thumbnails and previews instead, which might have been a useful function.

Summary

• Appexes are app extensions, now found in the PlugIns or Library folders within app bundles.
• Although some appexes are also system extensions, or their relatives, most aren’t, and simply extend that app’s features.
• Many appexes are controlled in System Settings > General > Login Items & Extensions, at the end.
• Lists shown there vary according to which types of appex are installed. Click on the ⓘ button to view and control them.
• Some system appexes are listed but can’t be disabled, while others can be.
• They can also be controlled and listed using the pluginkit command tool, although that’s not straightforward.
• In Sequoia 15.4, Quick Look appex controls appear dysfunctional.

References

man pluginkit
Apple’s developer master page with links to documentation
QuickLook and its appexes
Dock tile appexes.

Aeneas has been rowed through the Straits of Messina, avoiding the rock pinnacle that Scylla had been transformed into. From there he heads north-west until he meets a fierce northerly storm that blows him and his crew south to the city of Carthage, on the Libyan coast. Ovid breezes through what takes Virgil almost a whole book in the Aeneid, in a brief summary of the affair between Aeneas and Dido, Queen of Carthage. This ends with him abandoning her to fall upon the sword he had given her, and her body to be consumed on her funeral pyre.

Pierre-Narcisse Guérin’s Aeneas tells Dido the misfortunes of the City of Troy, painted in about 1815, is probably the standard work showing the beginnings of their romance. Unfortunately it doesn’t give any clues to its tragic outcome.

In about 1875, when Paul Cézanne was still experimenting with narrative genres, he first drew a compositional study, then painted Aeneas Meeting Dido at Carthage. The queen is at the left, surrounded by her court. The warrior figure of Aeneas stands to the right of centre, and to the right of him is the shrouded spectre of Aeneas’ wife, Creusa, who had been abandoned by Aeneas as the family fled the burning city of Troy.

Normally titled The Death of Dido, Tiepolo’s painting from 1757-70 shows an odd composite scene in which Aeneas, packed and ready to sail with his ship, watches on as Dido suffers the agony of their separation, lying on the bed of her funeral pyre. A portentous puff of black smoke has just risen to the left, although it’s surely far too early for anyone to think of setting the timbers alight.

Dido’s spectacular death is shown best in what is perhaps Henry Fuseli’s most conventional history painting, known simply as Dido (1781). Dido has just been abandoned by Aeneas, has mounted her funeral pyre, and is on the couch on which she and Aeneas made love. She then falls on the sword Aeneas had given her, and that rests, covered with her blood, beside her, its tip pointing up towards her right breast. Her sister Anna rushes in to embrace her during her dying moments, and Jupiter sends Iris (shown above, wielding a golden sickle) to release Dido’s spirit from her body. Already smoke seems to be rising up from the pyre, confirming visually to Aeneas that she has killed herself, as he sails away from Carthage.

After a close call with the Sirens, Aeneas reaches the land of the Cercopes, who had been transformed into apes by Jupiter because of their treachery. The ship continues to the north-west along the coast of Italy, passing Naples.

This has been shown only by those like Antonio Tempesta who engraved for illustrated editions of the Metamorphoses. Tempesta’s Jupiter Changing the Cercopians into Monkeys from around 1600 shows Jupiter at the right, accompanied as ever by his huge eagle, with the transformed monkeys.

Once past Naples, Aeneas and his crew land at Cumae to visit the Sibyl there in her cave. He needs her assistance to go to the underworld to speak to the ghost of his father Anchises. The Sibyl reassures Aeneas that he will achieve his goals, and to that end she takes him to Proserpine’s sacred glade. Finding a golden bough there, she tells Aeneas to break that from the tree. The two of them travel to the underworld bearing that golden bough, make contact with the ghost of Anchises, and return safely.

During their walk back, Aeneas thanks the Sibyl for her help and guidance, and offers to build a temple to her, assuming she is a goddess. The Sibyl points out that she is no goddess, and explains how she had once been offered immortality if she were to let the god Apollo take her virginity. When Apollo had invited her to wish for anything, she had pointed to a pile of sand, and asked to live as many years as there were grains, but forgot to wish for eternal youth to accompany that.

Apollo offered her eternal youth as well, but she declined and remained a virgin. After seven hundred years, with another three hundred still to go, she is well into old age, infirm, and steadily vanishing as her body wastes away until only her voice will remain. With that, the pair reach Cumae, and Aeneas sets sail.

This is depicted in one of Claude Lorrain’s most wonderful coastal landscapes, his Coast View with Apollo and the Cumaean Sibyl from about 1645-49. Although their figures are small, Apollo on the left is holding his lyre in his left arm, trying to persuade the seated Sibyl, to the right, to let him take her virginity. Around them are the ruins of classical buildings and a stand of tall trees, as the land drops away to an idealised view of the coast of Italy. In the small bay immediately below them are some ships, which may be a forward reference to Aeneas’ future visit, although that would have been seven centuries later according to the Sibyl’s account.

JMW Turner didn’t tackle the first part of this story until 1823, when he painted The Bay of Baiae, with Apollo and the Sibyl. His view appears to have been loosely based on Claude’s, but is set at Baiae, in the Bay of Naples. Apollo is again on the left, with his lyre, but the dark-haired Sibyl has adopted an odd kneeling position. She is holding some sand in the palm of her right hand, asking Apollo to grant her as many years of life as there are grains.

When Claude was painting his coastal view, François Perrier was painting a more conventional figurative account of Aeneas and the Cumaean Sibyl (c 1646). Aeneas, stood to the left of the incense burner, appears to be offering to burn incense in honour of the Sibyl, who stands at the right in front of her cave, and is just about to tell him her life-story. Behind Aeneas is a queue of people, including a king, bearing gifts and waiting to consult with the Sibyl. At the top left corner is a temple, and in the clouds above it the god Apollo, I believe.

JMW Turner’s first version of this later scene is thought to have been his first mythological painting, in about 1798. This second version, Lake Avernus: Aeneas and the Cumaean Sybil, dates from 1814 or 1815, and is both an improvement on the original and in better condition. True to the spirit of Claude’s landscape, this too is a mythological landscape showing the beautiful setting of Lake Avernus, near Pozzuoli, to the west of the city of Naples. In the distance are Baiae and the cliffs of Cape Miseno. The Sibyl, who doesn’t show her years, holds aloft a golden sprig rather than a bough, and Aeneas stands with his back to the viewer, as if he too is enjoying the view.

Turner’s last account is The Golden Bough, exhibited in 1834. It shows well how much his style had changed, although it retains compositional features from his earlier paintings. The Sibyl stands on the left, radiant in white light, and holding aloft a more substantial golden branch, with the golden sickle used to cut that branch, in her right hand. Down towards Lake Avernus are the Fates, dancing around a white glow. A couple of female companions of the Sibyl rest under the tree, but Aeneas is nowhere to be seen, although he might be in the middle of the Fates, perhaps. In the right foreground is a snake, a symbol of the underworld.

I hope that you enjoyed Saturday’s Mac Riddles, episode 302. Here are my solutions to them.

1: Shortened characters into the most common extension, formerly ASCII.

2: Medical practitioner at the end of word files until gaining a cross in 2002.

3: At the end of real estate inventory, most commonly for Info and preferences.

The common factor

I look forward to your putting alternative cases.

APFS has two special file types designed to economise on storage space: clone and sparse files. Clone files are two or more distinct files within the same volume whose data is shared; sparse files save space by skipping empty data and only storing data containing information. This article explores how they behave in use, with particular emphasis on Time Machine backups and iCloud Drive. The latter also involves a third type of special file, dataless files.

Clone files

In contrast to hard-linked files, clone files are two or more distinct files within the same file system (volume) whose file extents are identical, so share the same data, as shown below. They’re created by variants of normal file copying, including duplicating in the Finder (and drag-copying within the same volume), and the cp -c command.

Instead of duplicating everything, only the inode and its attributes (blue and pink) are duplicated, together with their file extent information. You can verify this by inspecting the numbers of those inodes, as they’re different, and information in the attributes such as the file’s name will also be different. There’s a flag in the file’s attributes to indicate that cloning has taken place. At first, the two cloned files share the same data blocks and extended attributes, but as the two files are changed by editing, they start to drift apart and become uncloned.

Clone files are becoming more popular thanks to the Hyperspace app, which deduplicates files within the same volume by replacing copies with clones.

Because they can only exist within the same file system, clone files are fragile. Any copy or move to another file system is invariably accompanied by the copying of their full data, and their economy of storage can only remain as long as they stay within the same volume.

Backups

One notable exception to this same-volume rule is in Time Machine backups. As clone files are preserved in local snapshots, when Time Machine constructs a backup as a snapshot in the backup storage volume, shared file extents are retained, so preserving clones. This is reflected in the size of the backup snapshot, and in the report written to the log. For example, when backing up three distinct files and ten clones of one of those, that report included:
14 Total Items in Backup (l: 16 GB p: 11.02 GB)
3 Files Copied (l: 6 GB p: 1.02 GB)
1 Directories Copied (l: Zero KB p: Zero KB)
10 Files Cloned (l: 10 GB p: 10 GB)

Backups made by other utilities are unlikely to reproduce this behaviour, though, as they can’t synthesise snapshots in the way that Time Machine does. To preserve clone files in their backups, they’d have to identify clones in the source and explicitly perform cloning in their backup store. Although Carbon Copy Cloner claims that “in some cases CCC may clone a file on the destination prior to updating its contents”, it doesn’t appear to attempt to preserve clone files in the backups it makes. I’m not aware of any third-party utility that does.

Unfortunately, Time Machine appears unable to restore directly from backup snapshots in the backup store, and performs Finder copies when restoring. That saves each of those clone files as a completely separate file, without any sharing of data. As a result, the space occupied on disk for a restored volume can be substantially greater than the original or its backup. Extensive use of clone files could thus cause problems when restoring from backups.

Of course, rolling a volume back to a local snapshot, such as one made during Time Machine backups, preserves all clone files within that volume.

iCloud Drive

Clone files created within the same volume as local iCloud Drive storage on the Data volume, or cloned when within a folder in iCloud Drive, remain within the same file system and clones are therefore preserved, and when the file is moved to other folders in the same volume.

However, clone files are treated as simple copies as far as iCloud Drive’s remote storage is concerned. While a pair of cloned 5 GB files only use a total of 5 GB local storage, they require a full 10 GB of your iCloud allocation, indicating that their cloud storage is separate and not common to both. Although the effects of eviction (removing local data) and materialisation (restoring local data from cloud storage) are difficult to observe directly, they appear to lose the benefits of cloning.

When the local copy of a file also stored remotely in the cloud is evicted, its data is removed from local storage, rendering it dataless, as shown below.

When that file is to be used locally again, its data has to be downloaded from the cloud service, and the local dataless file is materialised by adding its data back. As far as I can tell, that doesn’t result in the reconstruction of the shared file extents, so changes cloned files into normal copies with different file extents. You would then need to use Hyperspace to restore them as clone files. Other Macs sharing the same iCloud Drive also see them as full copies rather than clones.

These behaviours could also catch the user by surprise.

Sparse files

Unlike clone files, the structure of sparse files in APFS is conventional, as shown below.

They achieve their economy in storage by only including file extents containing non-null data, and thus aren’t dependent on remaining within the same file system (volume), making them more robust. Their primary requirement is that they’re created and maintained using specific file system operations, and are only copied or moved to other APFS file systems.

Backups

When backed up by Time Machine to another APFS volume, sparse files are preserved reliably, and are also restored as sparse files. That isn’t likely to hold, though, if the file is transferred using a network file system such as SMB, as all network transfers currently appear to explode sparse files to full size prior to transfer. Because of the way in which they have to be created, only the app maintaining that file could restore its sparse format. In the case of disk images, this should normally occur the next time they’re mounted in the Finder and Trimmed by APFS.

iCloud Drive

Assessing what happens with sparse files in iCloud Drive is considerably simpler than with clone files. As long as they remain downloaded to local storage, they are preserved, and can be moved in and out of iCloud Drive storage without exploding in size. However, they too are stored in full when in iCloud storage, requiring their full size in your iCloud allocation, and the eviction-materialisation cycle explodes them to full size, and their sparse file flag is removed.

The only way to return a former sparse file to its original economical format is then to open and save it using the app that creates and maintains it. In the case of disk images, this should occur when they’re next mounted and Trimmed.

Conclusions

Clone files:

• are only preserved when moved within the same file system (volume);
• are preserved and restored from local snapshots;
• are preserved in Time Machine backups, but aren’t restored from them;
• aren’t preserved in other backups;
• could result in a restored volume being substantially larger than its original;
• occupy their full space in your iCloud allocation;
• are only preserved in iCloud Drive when they aren’t evicted from local storage;
• can be regenerated using Hyperspace.

Sparse files:

• are only preserved when copied or moved directly between APFS volumes;
• aren’t preserved when copied or moved over network connections, or using SMB;
• aren’t preserved when copied or moved to different file systems, including HFS+;
• are preserved in and restored from local Time Machine backups;
• should be preserved in and restored from other local backups;
• occupy their full space in your iCloud allocation;
• are only preserved in iCloud Drive when they aren’t evicted from local storage;
• can only be regenerated by the app that creates and maintains them.

Both clone and sparse files can result in substantial savings in storage space. However, because that’s fragile, their greatest value is in minimising erase-write cycles in SSDs, hence slowing their ageing.

References

Apple’s APFS Reference (PDF), last revised 22 June 2020.
Dataless files are explained here.
How sparse files work
Files and clones
Special file types, including dataless files

In the first of these two articles tracing the first century of railways in paintings from the early 1840s, I had reached Claude Monet’s views of the Gare Saint-Lazare in Paris before 1880. By this time few countries in Europe had no railways, and trains frequently conveyed artists from their studios in the cities out to the beaches and mountains, journeys that a few years earlier could have taken days rather than hours.

Although Norway was a greater challenge for the railway engineers, Frits Thaulow seized the opportunity to show the results in The Train is Arriving from 1881. The country’s first public steam-hauled railway was developed by the son of George Stephenson, whose Rocket locomotive had inaugurated the first steam railway in the world. Norway’s line opened in 1854, and during the 1870s progressively made its way to Trondheim.

In 1888, Vincent van Gogh gave us The Blue Train (Viaduct in Arles).

Volodymyr Orlovsky’s undated Steppe shows a river in summer, with water levels at their minimum. Cattle are taking the opportunity to drink and cool off in the water. In the distance is the plume of smoke from a railway train, probably carrying grain and other produce from the Ukrainian countryside to one of the growing coastal cities for export.

The twentieth century brought the beginning of the end of the power of steam, marked in an unexpected twist of history. Between 1898 and 1900, a new railway station, initially known as the Gare d’Orléans, was built on the bank of the Seine at Quai d’Orsay, Paris. The first electrified urban railway terminal in the world, it was a star of the Exposition Universelle in 1900, where many Impressionist paintings were exhibited.

Victor Marec’s painting shows construction work being progressed in 1899, with a steam locomotive hauling construction trucks.

The Gare d’Orsay, as it became, started to suffer physical limitations in 1939, and its upper levels closed from 1973. In 1986 it re-opened as the most extensive collection of Impressionist art in the world, the Musée d’Orsay.

Maximilien Luce was one of the most expressive artists, who wasn’t an official war artist, to show scenes relating to the First World War. In his La Gare de l’Est (1917), a collection of wounded and battle-weary soldiers are shown at the entrance to this large Paris railway station.

The Gare de l’Est in Snow (1917) is even better-known, and a classic painting of falling snow in a large city.

Lesser Ury’s Nollendorfplatz Station at Night from 1925 shows the brilliant electric lighting around this busy railway station to the south of the Tiergarten, in one of Berlin’s shopping districts.

By this time, painting trains was becoming something of a sub-genre, particularly as steam trains were being replaced throughout Europe.

Eric Ravilious is one example of a twentieth century artist who painted motifs deeply embedded in the railway, in his Train Landscape from 1940.

A few narrative artists, including Joaquín Sorolla, set their stories inside railway carriages. My favourite among these is Berthold Woltze’s Der lästige Kavalier (1874), rendered into English as The Annoying Bloke, from 1874.

This is set in a railway carriage where there are two men and a young woman. She is dressed completely in black, and stares towards the viewer with tears in her eyes. Beside her is a carpet-bag, and opposite is a small wooden box and grey drapes.

Leaning over the back of her seat, and leering at her, is a middle-aged dandy with a brash moustache and mutton-chop whiskers, brandishing a lit cigar. He appears to be trying to chat her up, quite inappropriately, and very much against her wishes. Behind him, and almost cropped off the left edge of the canvas, is an older man with a dour, drawn face.

The young woman has apparently suffered a recent bereavement, and may even be travelling back after the funeral. She looks too young to have just buried a husband, so I think it more likely that she has just lost her last parent, and is now living alone, prey to the likes of this annoying and abusive bloke.

Lambing dates remain one of life’s great mysteries. Here in the UK, farmers in the north usually lamb earliest, often only just after Christmas when it’s usually bitter cold and snowy up there. Down here in the balmy south, lambs are born three months or more later, typically in April, when they’re often struggling to keep cool in the sunshine. Last week we saw the first of this year’s lambs, and Apple’s Spring OS fest, including Sequoia 15.4.

Size

That update was large, but that isn’t exactly unusual:

• 7 March 2024, Sonoma 14.4 was 3.6 GB (Apple silicon) with 64 vulnerabilities fixed, “the most substantial update of this cycle so far”;
• 27 March 2023, Ventura 13.3 was 4.5 GB with 49 vulnerabilities fixed, being “substantial, and brings many improvements and fixes”;
• 14 March 2022, Monterey 12.3 was 5.3 GB with 45 vulnerabilities fixed, being “very substantial, introducing major new features like Universal Control and Spatial Audio, changing several bundled apps, and fixing many bugs”;
• 26 April 2021, Big Sur 11.3 was 6.62 GB with over 50 vulnerabilities fixed, “the largest update to macOS since Mojave, and quite possibly the largest ever”.

(Figures and quotations from links here.)

Although the 15.4 update wasn’t quite as large as 11.3, at 6.2 GB for Apple silicon, it has comfortably surpassed it in the number of vulnerabilities fixed, 131 in all, and came close to the size of the 15.0 upgrade at 6.6 GB. What’s most disappointing is that, while the first release of Sequoia merited long and detailed accounts of much of what had changed, for 15.4 there’s precious little information beyond its lengthy security release notes.

A stroll through the version numbers of its bundled apps and /System/Library confirms the extent of changes. There was no point in my trying to compile an article listing them, as it might have been briefer to report what hasn’t changed. What’s more to the point is what’s new in 15.4, what are its Spring lambs?

Novelties

Among the new kernel extensions is the first version of AppleProcessorTrace, and there’s a brace to support hardware in Apple silicon chips including a T6020 and T8103 for PCIe, and a T6032. Those appear to be for M2 Pro, M1 and M3 Ultra chips, respectively. There are two new public frameworks, one named CLLogEntry that is presumably for Core Location log entries, the other tantalisingly named SecurityUI. Neither seems to align to anything in Apple’s developer documentation, so might be preparing the ground for what we’ll hear about in early June at WWDC, when the lambs have grown a bit.

I keep a track of the total number of bundles in several of the folders in /System/Library. Since the release of Sequoia 15.0, that containing Private Frameworks has grown from 4,255 to 4,398. Because of their layout, this total overestimates the real change in numbers, and that probably represents a true growth of around 70 Private Frameworks in Sequoia so far.

These Private Frameworks contain code features used privately by Apple’s apps, but not exposed to third-party developers. Although much is of little or no use or advantage, they also contain much that supports changing features in macOS. Using Private Frameworks is a sure way to madness, and something explicitly forbidden in the App Store, but, like the unaffordable car or boat we like to gloat at, there’s no harm in wondering what they will bring in the future.

The list of new Private Frameworks in Sequoia 15.4 is long, and includes: AUSettings, Bosporus, ComputationalGraph, CoreAudioOrchestration, CryptexKit, CryptexServer, DailyBriefing, DeepVideoProcessingCore, Dyld, ExclaveFDRDecode, FPFS, FindMyPairing, various GameServices, GenerativePlaygroundUI, MCCFoundation, MLIR_ML, MobileAssetExclaveServices, Morpheus, MorpheusExtensions, an OnDeviceStorage group, OpenAPIRuntimeInternal, OpenAPIURLSessionInternal, PIRGeoProtos, RapidResourceDelivery, SecureVoiceTriggerAssets, SecurityUICore, and VideoEffect.

While many of those names can inform speculation about what we’re about to see in macOS 16, three merit a little more decoding.

Cryptexes are secure disk images loaded during boot that currently deliver Safari and its supporting components, and the dynamic libraries for all those frameworks, public and private. Accessing them from user-level code isn’t something you’d expect to happen, so those two Private Frameworks, CryptexKit and CryptexServer, hint at further expansion in their use and support.

Bosporus

The Bosporus Strait in Turkey connects the Black Sea to the Sea of Marmara, thence through the Dardanelles to the eastern Mediterranean. It’s a busy thoroughfare formerly used heavily by ships carrying grain and other bulk cargoes from Ukraine and Russia.

View of Constantinople and the Bosphorus (1856) is one of many views that Ivan Aivazovsky made of this great city, which he visited on many occasions. The artist kept his studio in Crimea, on the opposite (northern) shore of the Black Sea.

Morpheus

Morpheus is the god of dreams, whose name is the source of the word morphine. Although usually distinct from Hypnos, god of sleep, he’s sometimes associated with Nyx, goddess of the night, most famously in reference to a passage from Virgil’s Aeneid, painted below by Evelyn De Morgan.

She pairs Nyx with Morpheus in her Night and Sleep, from 1878. The further figure is a young woman wearing long red robes, her eyes closed, clutching a large brown cloak with her right hand, and most likely Nyx. Her left arm is intertwined with a young man’s right arm. He also has his eyes closed, and is most probably Morpheus. He clutches a large bunch of poppies to his chest with his left arm, while his right scatters them, so they fall to the ground below.

Virgil’s lines in Book 4, line 486 read:
hinc mihi Massylae gentis monstrata sacerdos,
Hesperidum templi custos, epulasque draconi
quae dabat et sacros servabat in arbore ramos,
spargens umida mella soporiferumque papaver.
haec se carminibus promittit solvere mentes
quas velit, ast aliis duras immittere curas…

Translated (at Perseus at Tufts University), this reads:
From thence is come
a witch, a priestess, a Numidian crone,
who guards the shrine of the Hesperides
and feeds the dragon; she protects the fruit
of that enchanting tree, and scatters there
her slumb’rous poppies mixed with honey-dew.
Her spells and magic promise to set free
what hearts she will, or visit cruel woes
on men afar.

Spargens umida mella soporiferumque papaver, one of Virgil’s greatest lines, is conventionally translated as “scattering moist honey and sleep-inducing poppy”, and describes well the effects of the opiate drugs derived from opium poppies, including morphine.

I look forward to watching the lambs grow up through the coming summer, and learning about those lambs that came with Sequoia 15.4 at WWDC.

The nineteenth century brought huge changes in technology and society. Some, like telegraphy, telephones and radio, haven’t featured in many paintings, and even the bicycle has largely escaped the canvas. But the advent of railways, and later motor cars, had greater impact on visual art. In this weekend’s two articles, I trace the first century of railways in paintings from the early 1840s.

JMW Turner was among the first painters to capture this in his Rain, Steam, and Speed – The Great Western Railway in 1844. This pioneering railway connected London with rich farming country across the south of England, down into western counties, eventually reaching Cornwall in 1859, fifteen years after Turner completed this painting, and eight years after his death.

William Powell Frith’s The Railway Station (1862) captures the atmosphere of a major railway station in a capital city, here Paddington Station in London, by coincidence Brunel’s terminus for his Great Western Railway. Stations like this became a focus of activity, emotional partings and arrivals, migration, and a fair bit of crime too, everything the narrative painter might wish for.

Britain may have been the first to build railways, but the mania spread like wildfire across Europe and North America.

As the railroad, it started to cover the far greater distances of the USA and Canada. William Hahn’s Southern Pacific R.R. Station at Sacramento (c 1873-4) shows its rapid growth there.

Smoke, steam and other atmospheric effects brought inspiration to the French artists who were developing painting from where Turner’s death had left it.

France had been an early innovator and adopter, although such post-classical motifs wouldn’t have been appropriate for the Salon, of course. It took Édouard Manet painting his favourite model Victorine Meurent, in Le chemin de fer (The Railway) (1873), to break the ice. Its background is the Gare Saint Lazare in Paris. This painting was completed and sold in 1873 to the singer and avid collector Jean-Baptiste Faure, and astonishingly was the only painting accepted of three submitted to the Salon by Manet the following year, where it provoked outrage and ridicule, and a torrent of sarcastic cartoons in the press.

Near Manet’s painting in the Salon, a couple of works by Giuseppe De Nittis were given a warmer reception. Yet sometime between 1869 and 1880, De Nittis painted The Passing of a Train, his unashamed comment on the coming of the train.

As De Nittis, Monet, Pissarro, and the other Impressionists started painting in even more unacceptable styles around Paris, trains and railways came to appear even more.

Claude Monet’s The Railway Bridge at Argenteuil (1873) is one of his several landscapes centred on the railway from the years immediately after the Franco-Prussian War. At this time, Monet was a regular commuter by train: when he, Camille and his son moved out to Argenteuil at the end of 1871, he travelled the short distance into Paris by train.

Monet liked this bridge so much that he painted it again the following year, in The Railway Bridge at Argenteuil (1874).

By the last quarter of the nineteenth century, steam power had become so essential to modern life it was assimilated into the everyday. Paul Cézanne’s family estate in Aix-en-Provence was connected by rail to Paris by 1856, and express trains to the Mediterranean coast enabled many artists whose studios were in the capital to paint in the remarkable light of the Midi. The prominent light ochre structure sweeping across many of Cézanne’s views of Mont Saint-Victoire is the long viaduct built to accommodate the railway that transported artists between Paris and the coast of the Midi.

In 1877, Claude Monet became the most painterly railway buff of them all. By then, he was becoming detached from Argenteuil, and sought a new radically modern urban theme. Where more appropriate than the steaming hubbub of the Gare Saint Lazare? Caillebotte paid the rent for him on a small studio nearby, and Monet gained approval to paint in the station. By the third Impressionist Exhibition of April 1877, Monet had assembled seven views of the station, including one that even seemed to please the critics. Among the paintings from that campaign is his Arrival of the Normandy Train, Gare Saint-Lazare (1877).

Monet was too smitten to stop in the station, though. In his Train Tracks at the Saint-Lazare Station (1877) he reversed the view and started showing railway signalling.

He went even further in his Saint-Lazare Station, the Western Region Goods Sheds (1877), showing the working parts with the smoky city beyond.

Here are this weekend’s Mac riddles to entertain you through family time, shopping and recreation.

1: Shortened characters into the most common extension, formerly ASCII.

2: Medical practitioner at the end of word files until gaining a cross in 2002.

3: At the end of real estate inventory, most commonly for Info and preferences.

To help you cross-check your solutions, or confuse you further, there’s a common factor between them.

I’ll post my solutions first thing on Monday morning.

Please don’t post your solutions as comments here: it spoils it for others.

Disk images, files that contain the contents of a physical storage medium, go back long before the first Mac. Among other tasks, they were originally used to contain representations of floppy disks for replication in manufacture.

Today disk images are at the heart of macOS, and widely used by third-parties. They’re an essential part of macOS installers, home to Recovery mode, and the basis for cryptexes. They’ve been used to burn and replicate optical disks, to archive disk contents, extensively for network backups, and for the distribution of software.

Classic Mac OS

In Classic Mac OS there were two utilities that worked with different formats: Disk Copy used replicas later in DC42 format, after Disk Copy version 4.2, while compressed formats known as DART were handled by the Disk Archive/Retrieval Tool, hence their name.

Mac OS 9 brought Disk Copy 6.0 with added support for the New Disk Image Format (NDIF), which supported resource forks, and ended with its last release version 6.3.3. This also supported read-only Rdxx formats.

By this time, variants of formats had become complex. Here, Disk Copy is configured to create a read-only compressed .img file containing the contents of a standard 1.4 MB floppy disk. In the upper window, it has completed validating the checksum on a self-mounting .smi disk image that’s part of a DiskSet. These could also be signed, using certificates issued not by Apple but by DigiSign.

Here’s Disk Copy saving an image of a hard disk using a similar read-only compressed format, this time to accommodate 1.5 GB.

Mac OS X

The release of Mac OS X 10.1 Puma in 2001 brought Apple’s new Universal Disk Image Format (UDIF), used in DMG disk images, which only had a single fork as its resource fork was embedded in the data fork. Although pre-release versions of Disk Copy 6.4 and 6.5 were available with UDIF support for Mac OS 9, neither was ever released, leaving Classic Mac OS without access to UDIF images. Its support for compression options in Apple Data Compression (ADC) unified the two disk image types, and extended support for images larger than a floppy disk. This new format enabled disk images to represent whole storage devices, complete with a partition map and disk-based drivers.

Tools provided in Mac OS X for working with disk images include Disk Utility and the command tool hdiutil.

On 21 January 2002, the first version of DropDMG, a third-party substitute for creating disk images, was released by C-Command Software. This quickly enabled developers to create disk images with artwork, licences and other features that weren’t accessible from the tools bundled in Mac OS X. DropDMG has flourished over the last 23 years, and remains popular today.

DropDMG’s options for creating a new disk image far exceed those in Disk Utility. Particularly helpful are the compatible version hints shown on various options, to remind you of which file systems are available in different macOS versions, and which types of disk image container are supported. DropDMG will even convert old NDIF disk images last used in Mac OS 9 to more modern formats. It will also change the password of an encrypted disk image from a menu command.

In Mac OS X 10.2 (2002), UDIF and most other supported formats were served from a kernel extension without requiring a helper process. The following year, 10.3 Panther started using a faceless utility DiskImageMounter to mount disk images. Apple then dropped support for embedded resource forks in disk images in Mac OS X 10.4.7, and newly created disk images became less compatible with older Mac OS versions.

Sparse bundles

Until Mac OS X 10.5 Leopard in 2007, all disk images had used single-file formats, although some could be segmented across file sets. Leopard introduced the sparse bundle with its folder of smaller band files containing data. These enabled the image to grow and shrink in size, and became popular means of storing mountable Mac file systems on servers using different file systems.

This is another third-party tool that improved access to disk images from the GUI, DMG Packager, seen in 2009. Unlike DropDMG, this appears to have vanished without trace.

In 2011, with the release of Mac OS X 10.7 Lion, Apple removed more support for old disk image formats. DiskImageMounter no longer opened NDIF .img, .smi self-mounting, .dc42 and .dart compressed formats, although the hdiutil command tool still retained some access to them.

Disk Utility, seen here in 2011, has provided basic access to many disk image formats, but these are only a small selection of options available in the hdiutil command tool, or in DropDMG.

This shows the complex set of options available when creating a new disk image in Disk Utility in OS X 10.10 Yosemite, before the advent of APFS.

Support for compression was enhanced in OS X 10.11 El Capitan with the addition of lzfse in a new ULFO format, and macOS 10.15 Catalina added lzma in ULMO. In both cases, these new formats aren’t accessible in older versions of macOS.

APFS support

The arrival of a pre-release version of the new APFS file system in macOS 10.12 Sierra brought its support in disk images, although only for experimental purposes, and Apple cautioned users to ensure their contents were well backed up.

In addition to adding the more efficient ULMO compressed format, macOS 10.15 Catalina is the last to support many Classic Mac OS disk image formats, including those from DiskCopy42, DART and NDIF from Disk Copy 6.x. Support for AppleSingle and MacBinary encodings, and dual-fork file support, were also removed in macOS 11.0 Big Sur in 2020.

This ‘warning’ alert from 2020 illustrates one of the longstanding issues with disk images. Although integrity checking of disk images using checksums has been valuable, when an error is found there’s no possibility of repair or recovery as the image can’t be ‘attached’, so its file system can’t be mounted.

macOS 12 Monterey in 2021 brought multiple deprecations of older formats, including UDBZ using bzip2 compression, segmented UDIF images, and embedded resources. It’s also thought to be the first version of macOS in which UDIF read/write images (UDRW) have been stored in APFS sparse file format, although Apple has nowhere mentioned that. This has transformed what had previously been space-inefficient disk images that retained empty storage into a format that can prove almost as efficient as sparse bundles. This results from the Trim on mounting HFS+ and APFS file systems within the image freeing unused space, enabling that to be saved in the sparse file format.

Disk images have never been glamorous, but have remained at the heart of every Mac.

References

man hdiutil
Introduction
Tools
How read-write disk images have gone sparse
Performance
Bands, Compaction and Space Efficiency

Appendix: Disk image formats

Supported

• UDRW – UDIF read/write
• UDRO – UDIF read-only
• UDCO – UDIF ADC-compressed
• UDZO – UDIF zlib-compressed
• ULFO – UDIF lzfse-compressed (OS X 10.11)
• ULMO – UDIF lzma-compressed (macOS 10.15)
• UDTO – DVD/CD-R master for export
• UDSP – sparse image, grows with content
• UDSB – sparse bundle, grows with content, bundle-backed, Mac OS X 10.5
• UFBI – UDIF entire image with MD5 checksum.

Unsupported

• DC42 – Disk Copy 4.2 (Classic)
• DART – compressed, for Disk Archive/Retrieval Tool (Classic)
• Rdxx – read-only Disk Copy 6.0 formats
• NDIF – Disk Copy 6.0, including IMG and self-mounting SMI
• IDME – ‘Internet enabled’, on downloading post-processed to automatically copy visible contents into a folder, then move the image to the Trash. Now deemed highly insecure.
• UDBZ – UDIF bzip2-compressed image (deprecated).

Originally known as a toilet table, or simply a toilet, dressing tables or vanities featured near the beds of ladies from the late seventeenth century. They are a fusion of storage boxes used for cosmetics and jewellery, a small flat surface on which to place their contents, and the inevitable mirror to check that she looked right. By the eighteenth century they were made popular by royal mistresses including the Marquise de Pompadour, and became integrated into the morning reception phase of the lady’s day.

William Hogarth even titles the fourth painting in his moralising narrative series Marriage A-la-Mode, The Toilette (c 1743). The Countess Squander is being entertained while completing her dressing and preparations for the day. To the right of the Countess, Silvertongue rests at ease, his feet uncouthly laid on the sofa, clearly intimate with her. He is offering her a ticket to a masquerade ball, where no doubt he will meet her. His left hand gestures towards a painted screen showing such a masquerade.

At the left an Italian castrato (by his wig and jewellery) sings to a flute accompaniment. The rest of the room are disinterested, apart from a woman in white, who is swooning at the singer. The Countess’s bedchamber is behind the pale red drapes at the rear left, and to the right of centre is a typical dressing table with a mirror.

Herman Frederik Carel ten Kate’s Chaperone (1858) recreates an interior from a similar period. A suitor clutching his tricorn hat and walking stick is chatting up a young woman with her companion and moral guard. Behind her chair is a dressing table with a similar layout to Hogarth’s.

Over the next century, dressing tables were modernised and adopted by even the middle classes.

Edgar Degas’ Woman Drying Herself after the Bath is one his first works showing a woman bathing, dating from 1876-77. It’s also one of the few in this series setting the woman in a broader context, here a plain and simple bedroom with a single bed. The woman, wearing only bright red ‘mule’ slippers, stands just behind the shallow metal tub, watching herself in the mirror of her dressing table, as she dries her body with a towel. On its shelf is a small range of cosmetics, with the mandatory mirror behind.

Félix Vallotton affords us a glimpse into the private life of one of the most influential patrons and muses of the day, in his Misia at Her Dressing Table from 1898. Her first marriage was to her cousin Thadée Natanson, who had socialist ideals and lived in artistic circles. The Natansons entertained Marcel Proust, Stéphane Mallarmé, André Gide, and Claude Debussy, but they were closest to their painter friends: Claude Monet, Pierre-Auguste Renoir, Odilon Redon, Paul Signac, and Henri de Toulouse-Lautrec.

For Frederick Carl Frieseke a Nude Seated at Her Dressing Table (1909) is an opportunity for mirror-play. This vanity is more decorative than functional, with curves, a glass top and a painted porcelain figure.

Pierre Bonnard’s domestic interiors are rich with dressing tables, and inventive mirror-play. I show here just two examples.

In Bonnard’s El Tocador, which means The Dressing Table (1908), his partner Marthe’s headless torso is seen only in reflection. The direct view is of the large bowl and pitcher she used to wash herself.

In 1914, Bonnard moved back for a wider view in The Bathroom Mirror. Marthe’s reflection is now but a small image within the image, showing her sat on the side of the bed, with a bedspread matching the red floral pattern of the drapes around her dressing table. Bonnard has worked his usual vanishing trick for himself, and a vertical mirror at the right adds a curiously dark reflection of the room.

Henry Tonks’ The Toilet from the same year separates his nude from her dressing table, and shuns mirror-play altogether.

Félix Vallotton’s Coquèterie (Sauciness) from 1911 shows a young woman still undressed in her white chemise, her unmade bed behind. She looks at herself in the mirror of a small dressing table with that mirror mounted in its lift-up lid, thinking what clothing she should wear from those scattered around.

Have you been able to update an existing lightweight macOS Virtual Machine on Apple silicon to Sequoia 15.4? So far, I’ve had three failures ending in kernel panics, and no successes. Maybe I’m holding it wrong?

Good news …

I’ve had no problems updating VMs from Sonoma 14.7.4 to 14.7.5, or Ventura 13.7.4 to 13.7.5. Those updates went quickly and without a glitch, but Sequoia has been another matter.

… bad news

I’ve now tried to update from Sequoia 15.x to 15.4 with three different VMs:

• freshly installed 15.2
• freshly installed 15.3.2
• lightly used 15.3.2.

None of them had iCloud enabled, but they were each fairly standard in other respects, and all running in Full Security mode, in my virtualisers Vimy and Viable.

Each has failed early, just a minute or two after the update started to install. That was terminated, and the VM briskly rebooted back into its existing version of Sequoia. Shortly after logging back in, they displayed the panic alert.

One VM was so sick at that stage it couldn’t go any further, so had to be humanely destroyed. However, I managed to capture panic logs for the other two. In both cases, the panicked task was com.apple.Mobile, with com.apple.iokit.AppleVirtIOStorage(1.0) at the top of the kernel extensions in the backtrace. The panic occurred on different cores, and its cause was given as “Kernel data abort”.

And a more innocent bug

In the course of looking at this, I happened to notice that creation dates of files in Shared Folders were all incorrect, giving a standard date of Monday, 1 January 2001 at 00:00. All other creation dates in VM folders, the SSV, and even in iCloud Drive folders, were as expected, but none of those in Shared Folders.

However, when any of those mis-dated files or apps were copied into the VM’s local storage, the expected date of creation returned like magic.

I have checked this in VMs running 15.2, 15.3.2, 15.4, 14.7.5 and 13.7.5, and it’s identical in every one. I suspect this may have been going on for some time. Am I holding this one wrong too?

Over to you

• Have you been able to update a Sequoia VM to 15.4?
• Are file creation dates wrong in your VM’s Shared Folders?

Postscript

Thank you all for your responses. I’ve now confirmed that failure to update to 15.4 appears confined to M4 models, and doesn’t afflict my MBP M3 Pro at all. However, the shared folder creation date bug seems just the same there.

By 1880, just two years after he had completed his training under Carolus-Duran in Paris, John Singer Sargent was in the ascendant. His skills were in growing demand for the portraits of the rich and famous, and he also took time to travel and paint abroad, mainly in Spain and Italy.

When he was in Spain in around 1880-81, he painted this Spanish Dancer.

During a visit to Italy in the period 1880-82, he painted these Venetian Glass Workers.

In early 1883, Sargent made overtures to one of the best-known young socialites in Paris, Virginie Amélie Avegno Gautreau, a French creole immigrant from New Orleans, who had married the French banker Pierre Gautreau. Her beauty was the talk of the town, and numerous artists had asked to paint her portrait as a means of promoting their own careers. The first request that she accepted was Sargent’s, in February 1883. She proved a reluctant sitter, and it wasn’t until June of the following year that Sargent was able to pin her down in her estate in Brittany to start preparatory studies. He didn’t complete the finished work until well into the autumn.

We can’t see his original version of Madame X, as its reception drove him to make alterations to tone down its overt eroticism. Her pose was considered sexually suggestive, and one strap of her gown had fallen down her shoulder adding to the image’s sexuality. It caused a scandal when exhibited at the Salon, and was lampooned mercilessly in the press.

Sargent sought temporary solace flirting with the fashion for Impressionism.

He had first met Claude Monet in 1876, but it’s thought that this painting of Claude Monet Painting by the Edge of a Wood was made in 1885, when they were painting together at Monet’s house in Giverny. At the right is Alice, Monet’s wife.

That year Sargent decided to move his portraiture studio away from the scandal in Paris, to London.

By 1886, Sargent had fully settled into his London studio, and the following year had established his reputation, which was reinforced when he exhibited Carnation, Lily, Lily, Rose at the Royal Academy. This was bought immediately by the Tate Gallery. From then until he closed his studio in 1907, he was the leading portrait painter in London. In spite of his obvious success, he was among those who were unhappy with the Royal Academy, and was a founding member of the New English Art Club in 1886.

His uncommissioned work often took him plein air and with progressively loosening style. He visited France frequently, attended Impressionist exhibitions, and developed his friendship with Monet. His informal works were often loose bravura gatherings of marks that appear to have been painted very quickly indeed.

This is shown well in Sargent’s virtuoso Gust of Wind from about 1886-7, which compares with Claude Monet’s La Promenade from 1875.

By the end of the 1880s, his critics in England considered him an Impressionist, but Monet thought he was still under too much influence from Carolus-Duran to be considered Impressionist. His portrait business prospered: in 1887-8 he toured the US and gained over twenty important commissions, including that of Isabella Stewart Gardner, a major patron of the arts in Boston, where twenty-two of his paintings were shown in his first solo exhibition.

Sargent met Dennis Miller Bunker (1861-1890) in November 1887, during that visit to the USA, when Bunker was a rising star of American Impressionism. Like Sargent, Bunker had trained in Paris, and the two became good friends. Bunker stayed with Sargent in England in the summer of 1888, when Sargent painted him at work, in Dennis Miller Bunker Painting at Calcot. Bunker tragically died of meningitis just two years later, at the age of only 29.

Sargent painted this Morning Walk in 1888.

Paul César Helleu (1859–1927) first met Sargent when the former was a precocious student at the École des Beaux-Arts in 1876. Sargent was the first person to buy one of Helleu’s paintings, for which he paid the huge sum of a thousand francs. Helleu and his wife Alice remained close friends with Sargent, and the couple often appear in his paintings. When he painted them in An Out-of-Doors Study in about 1889, they had been married three years.

On the evening of 1 April 1890, when Sargent was back in New York, he, William Merritt Chase and the famous Spanish dancer Carmencita met in Chase’s Tenth Street studio; she danced for them, and they sketched. On this occasion, Sargent opted for a more static pose in his La Carmencita (1890), with her hands at her hips, driving her bust out and her chin high, in assertive pride.

Demand for Sargent’s portraiture skills remained high during the 1890s.

In 1895, two notable young residents of New York City married. He was Isaac Newton Phelps Stokes (1867-1944), a recent graduate of Harvard who studied architecture for three years at the École des Beaux-Arts in Paris, Sargent’s alma mater. He went on to co-found the architectural firm of Howells & Stokes, and was a pioneer in social housing. She was Edith Minturn (1867-1937), daughter of the shipping magnate Robert Bowne Minturn, Jr., and destined to become a philanthropist, socialite, and artistic muse.

A close friend decided that a good wedding gift would be a portrait of Mrs Stokes painted by the greatest of the age, John Singer Sargent. For various reasons this was delayed, but in 1897 the artist and the couple got together and Sargent started work. His original intention had been to paint Mrs Stokes wearing formal evening dress sitting next to an Empire table. However, he changed his mind and decided to paint her standing in informal walking attire next to a Great Dane. As he was reconceiving this in his mind, he turned to a portrait that had been donated to the Metropolitan Museum of Art by Sargent’s patron Henry Marquand in 1889: that of James Stuart, by van Dyck.

Unfortunately, Sargent was unable to find a suitable dog. Mr Stokes then “offered to assume the role of the Great Dane in the picture”, as he put it in his memoirs. The result puts Mrs Stokes in charge, as an example of ‘The New Woman,’ and her husband as a surrogate dog.

All good log browsers provide tools to narrow down the log entries they display. Without those, it would be easy to waste all day wandering through tens of thousands of entries. One common tool provided by macOS, directly and in the log command tool, is filtering using predicates. Although LogUI provides easy access to simple predicates, to get the best from them, it’s worth digging a little deeper, as I do here.

Instant predicates

LogUI’s instant predicates filter log entries according to any of four basic predicate types:

• subsystem, such as com.apple.sharing, the field shown in yellow in log extracts;
• eventMessage, the text message listed in white/black at the end of each entry;
• processImagePath, such as mediaanalysisd, shown in blue, the name of the process making that entry;
• senderImagePath, such as libxpc.dylib, shown in red, the name of the process sending that entry.

These are quick to enter in the text box to the right of the popup menu in the window’s toolbar, but in many circumstances can prove too broad, and need narrowing down further. In other situations, you want to browse entries from two subsystems, or using a combination of criteria. The best way to do that is to write a short predicate. For single use, you can do that in the one-off predicate editor using the Set button.

When you want to reuse that, you can add it to the predicate popup menu using Settings Predicate (currently a bit kludgy).

Predicates

macOS can use predicates in other situations, most commonly for Spotlight search. If you’re interested in those, see Apple’s Predicate Programming Guide. Here I’ll describe predicates as they’re more commonly used to filter log entries, as they’re usually much simpler.

Each simple predicate consist of three parts:

• the name of one of the fields in a log entry, such as subsystem or eventMessage. This sets where the filter looks in each entry;
• an operator, which might be == for ‘equals’ exactly, or for text is commonly CONTAINS[c] for case-insensitive contains;
• text or a numeric value to look for, such as “error” or 513. Only those entries equalling or containing (or whatever the operator means) this in the specified field will then be returned from the log and displayed.

Here are some basic examples.

eventMessage CONTAINS[c] "error"
entries will only be those with the text error in their message field.

subsystem == "com.apple.duetactivityscheduler"
entries will all have that text, ignoring case, but only that text, as the name of their subsystem.

subsystem CONTAINS[c] "com.apple.xpc"
entries will have any subsystem containing that text, which also includes com.apple.xpc.activity.

Fields

Although you can use any of the fields shown in LogUI (and some that aren’t), the most commonly used are, in order as they are shown in LogUI’s window:

• eventType (red) – matches the type of event, such as logEvent (1024), traceEvent (768), activityCreateEvent (513), or activityTransitionEvent (514). Can be given as characters (case-sensitive) without quotation marks, or using the digits given in parentheses. Use these only with the operators == or !=, as they are treated as numbers rather than text.
• category (green) – this matches the category, and varies according to subsystem. This is given as text in quotation marks, and is normally lower-case.
• messageType (white/black) – matches the type of message for logEvent and traceEvent, and includes default (0), release (0), info (1), debug (2), error (16), and fault (17). Can be given as characters (case-sensitive) without quotation marks, or digits as shown in parentheses. Use these only with the operators == or !=, as they are treated as numbers rather than text.
• senderImagePath (red) – this matches the text pattern in the name of the sender, which might be the name of a library, extension, or executable.
• processImagePath (blue) – this matches the text pattern in the name of the process that originated the event.
• subsystem (yellow) – this matches the subsystem specifier, e.g. com.apple.TimeMachine, given as text in quotation marks. You may find it best to use CONTAINS[c] rather than ==, to allow for differences in case and extended subsystem specifiers.
• eventMessage (white/black) – for this, you specify a text pattern, or text, within the message, given as text in quotation marks.

Operators

The following comparisons and other operators are available:

• == (two equals signs) for equality
• != or <> for inequality
• >= or => for greater than or equal to
• <= or =< for less than or equal to
• > for greater than
• < for less than
• AND or && for logical and
• OR or || for logical or
• NOT or ! for logical not
• BEGINSWITH, CONTAINS, ENDSWITH, LIKE, MATCHES for string comparisons, using regex expressions when desired; strings can be compared with case insensitivity and diacritic insensitivity by appending [cd] to the operator, e.g. CONTAINS[c] means case-insensitive comparison
• FALSE, TRUE, NULL have their expected literal meanings.

There are others as well, but you’ll seldom use them to filter log entries.

Building complex predicates

To see the scheduling and dispatch of background activities by DAS-CTS, you need to look at log extracts showing both their entries. Use the predicate
subsystem == "com.apple.duetactivityscheduler" OR subsystem CONTAINS "com.apple.xpc"
to do that. The first part of it includes those entries from DAS, and the second includes those for XPC and its relatives that run CTS. Using an OR between the two parts combines both sets of entries in the one extract.

To see the reports posted by XProtect Remediator, you need to look at those entries made by its subsystem that have the right category, using the predicate
subsystem == "com.apple.XProtectFramework.PluginAPI" AND category == "XPEvent.structured"
Using the AND operator ensures that the only entries shown come from that one subsystem, and they are given just that category.

Time Machine involves a combination of different subsystems and messages. To get a good overview of relevant entries, you can use
subsystem == "com.apple.TimeMachine" OR
(subsystem == "com.apple.duetactivityscheduler" AND eventMessage CONTAINS[c] "Rescoring all") OR
(subsystem == "com.apple.xpc.activity" AND eventMessage CONTAINS[c] "com.apple.backupd-auto") OR
eventMessage CONTAINS[c] "backup" OR
eventMessage CONTAINS[c] "Time Machine" OR eventMessage CONTAINS[c] "TimeMachine"
I’ve broken this down into separate lines, but you shouldn’t do that in the predicate. Taking it line by line it becomes simpler to understand. Use parentheses () to group each part of the predicate carefully as shown.

You can see other examples in the Help book for my free utility Mints: the Further Information pages towards the end give each of the predicates that Mints uses for its log extracts.

Quick summary

• [field name] [operator] [text or numeric value]
• common field names: senderImagePath, processImagePath, subsystem, eventMessage
• common operators: ==, CONTAINS[c]
• filter info: “text”
• combine filters using AND, OR.

In the late nineteenth and early twentieth centuries, there were three dominant painters who flirted with Impressionism but retained conventional styles: Anders Zorn from Sweden, Joaquín Sorolla from Spain, and John Singer Sargent, an American expatriate who worked from studios in Paris and London. All three died in the 1920s, and this year we commemorate the centenary of Sargent’s death on 14 April 1925. This is the first in a series of six articles outlining his career with but a small and personal selection of his paintings.

Sargent was born to American expatriate parents in Florence, Italy, in 1856. He was educated at home and showed early skill in drawing. Already competent in watercolour at the age of 14, he saw many of the works of the great Masters during travels around Europe with his family. In 1874 he succeeded in gaining admission to the École des Beaux-Arts in Paris, where he was taught mainly by Carolus-Duran, and less by Léon Bonnat.

Although his initial enthusiasm was for landscapes, Carolus-Duran encouraged him towards portraiture, and his first significant portrait was accepted by the Salon in 1877. His talent was recognised by the critics, and he made friends with Julian Alden Weir and Paul César Helleu, who in turn introduced him to other leading artists of the day, including Degas, Rodin, Monet, and Whistler.

Sargent’s early style was realist, particularly in portraiture, and leaned towards Impressionism as seen in this painting of Fishing for Oysters at Cançale from 1878, but was quite distinct from the work of the leading Impressionists at that time. In the summer of 1878, John Singer Sargent had just completed his studies with Carolus-Duran, and went off on a working holiday to Capri, staying in the village of Anacapri, as was popular with other artists at the time.

Capri was still quite a select holiday destination then, and unspoilt. But getting a local model was tricky, because of the warnings that women were given by priests. History has proved those priests only too right in their advice. One young local woman, Rosina Ferrara, seemed happy to pose for him, though. She was only 17, and Sargent a mere 22 and just developing his skills in portraiture. Over the course of that summer, Sargent painted at least a dozen works featuring young Rosina, who seems to have become almost an obsession with him.

One, Dans les Oliviers, à Capri, above, he exhibited at the Salon the following year. A near-identical copy A Capriote, below, he sent back for the annual exhibition of the Society of American Artists in New York, in March 1879. The latter is now in the Museum of Fine Arts in Boston.

He also painted a pair of views of what was probably the roof of his hotel. In View of Capri, above, made on cardboard, Rosina stands looking away, her hands at her hips. In the other, Capri Girl on a Rooftop, below, she dances a tarantella to the beat of a friend’s tambourine. The latter painting Sargent dedicated “to my friend Fanny”, presumably Fanny Watts, who modelled for the first portrait that Sargent had exhibited at the Salon the previous year.

Rosina appears to have danced for Sargent again, for him to paint her in Portrait of Rosina Ferrara, above, as a precursor to his later paintings of Spanish dancers. But of all Sargent’s paintings of Rosina, the finest portrait, possibly one of the finest of all his ‘quick’ portraits from early in his career, is another painted in oils on cardboard: Rosina Ferrara, Head of a Capri Girl, below.

This he dedicated to “Hyde” (the artist Frank Hyde), and signed in 1878, while he was still on Capri. There are another couple of portraits he painted of a young woman during that summer on Capri. Although she’s in more serious mood, possibly even a little surly with ennui, I wonder if they also show Rosina Ferrara.

Sargent left Capri, eventually returning to Paris and his inexorable rise to greatness, fortune and success. But that wasn’t the end of Rosina’s modelling career, not by a long way. Frank Hyde, to whom Sargent had dedicated a portrait of her, painted his own version a couple of years later.

Sargent’s famous Portrait of Carolus-Duran (1879) is not only his personal tribute to his teacher, but when it was shown at the Salon proved the foundation of Sargent’s own career as a portraitist.

He continued to travel in Italy and Spain, where in 1880 he painted Smoke of Ambergris, demonstrating what was to come beyond mere portraits.

I’ve long been critical of some of the best-selling utilities for the Mac, that set out to perform deduplication of files by detecting which appear to be identical, and removing ‘spare’ copies. This is because APFS introduced clone files, and in the right circumstances those take up no space in storage, as their data is common and not duplicated at all. As it’s practically difficult to tell whether two files are clones, any utility or command tool that claims to save space by removing duplicates can’t tell you the truth, and in most cases won’t save as much space as it claims.

Claims made by those utilities are often exaggerated. This is because they calculate how much space they think they’ve saved by adding the sizes of the potential duplicates they have deleted. That’s not correct when a clone file is deleted, as that doesn’t actually free any space at all, even though the clone file has exactly the same nominal size as the original.

Benefitting from clone files

I’m delighted to see the eminent John Siracusa turn this on its head and finally make better use of clone files in his app Hyperspace, available from the App Store. Instead of deleting clones, his app can replace duplicate copies with clones, and so achieve real space savings. This comes down to simple arithmetic:

• if you have two copies (not clones) of a file in the same APFS volume, the total size they take on disk is twice the size of one of them;
• if you have two clones (not copies) of a file in the same APFS volume, the total size they take on disk is only the size of one of them, as its clone takes no additional space at all.

Hyperspace thus checks all the files in a selected folder, identifies which are identical copies, and (where suitable) will replace those copies (except an original) with clones, so saving real storage space.

I also think it has the most user-friendly payment scheme: download Hyperspace free of charge and check your Mac with it. If it doesn’t find sufficient savings, and you decide not to use it to replace any duplicates with clones, then it costs you nothing. If you want to reclaim that space, then you can opt to pay according to the amount of space it saves, by subscription, or with a one-time payment. On that basis, I unhesitatingly recommend everyone to download it from the App Store, and at least check their Home folder to see if it’s worth paying to reclaim space. You have absolutely nothing to lose.

In my case, perhaps because I tend to clone files using the Finder’s Duplicate command, the savings that it offered were of little benefit, but your Home folder could be different and release 100 GB or more.

Sparse files

The other space-saving special file type in APFS is the sparse file. Although it can bring great savings in storage space, that’s largely up to the app(s) that create and maintain the file, rather than the user. Devising an app that could go round converting plain to sparse files is harder, and risks incompatibility with those apps that access those files.

Fitting 285 GB into 16.5 GB

As a demonstration of how effective APFS special files are in saving disk space, I built myself a 100 GB partition (APFS Container) on an SSD and tried to fill it with clone and sparse files until I got bored.

At this stage, the 100 GB partition contains:

• One 16.5 GB IPSW image file, with nine clones of it, created using the Duplicate command.
• Eleven 10 GB sparse files and one clone, created using my app Sparsity.

Add those file sizes together and they come to 285 GB, yet the 100 GB partition only has 16.5 GB stored on it, and still has over 83 GB free. No compression is involved here, of course.

As the saying goes, there ain’t such as thing as a free lunch, and that free space could vanish quickly depending on what happens to those files. The worst case is for an app not to recognise sparse files, and write one to disk in plain format, so swallowing 10 GB at once. Editing the cloned files would be a more gradual way of their growing in size. Only changed data would then need to be saved, so free disk space would steadily fall as more changes were made to the clone.

Clone and sparse files are by no means unique to APFS, but they can be impressive, and above all they’re effective at reducing excess erase-write cycles that age SSDs, whatever you do with the storage they free.

I’m very grateful to Duncan for drawing my attention to Hyperspace, and to John Siracusa for an outstanding app.

Apple has just released an update to XProtect for all supported versions of macOS, bringing it to version 5292. As usual, Apple doesn’t release information about what security issues this update might add or change.

This version removes the macos_toydrop_b rule for MACOS.ADLOAD, and amends the rules for MACOS.ADLOAD.I, MACOS.BUNDLORE.MDPLST and MACOS.ADLOAD.IN.

You can check whether this update has been installed by opening System Information via About This Mac, and selecting the Installations item under Software.

A full listing of security data file versions is given by SilentKnight, LockRattler and SystHist for El Capitan to Sequoia available from their product page. If your Mac hasn’t yet installed this update, you can force it using SilentKnight, LockRattler, or at the command line.

If you want to install this as a named update in SilentKnight, its label is XProtectPlistConfigData_10_15-5292.

Sequoia systems only

This update has now been released for Sequoia via iCloud. If you want to check that manually, use the Terminal command
sudo xprotect check
then enter your admin password. If that returns version 5292 but your Mac still reports an older version is installed, you can force the update using
sudo xprotect update

I have updated the reference pages here which are accessed directly from LockRattler 4.2 and later using its Check blog button.

As today is the first day of April, it’s a double danger: as the first of the month you should say rabbit or white rabbit when you first wake up, and it’s All Fools’ Day as well. I have no hoaxes for you this year, I promise, but I do have rabbits, some of them white, and a few hares as well. Rabbits and hares are relatively infrequent in paintings, and where they do occur they seldom have any deeper reading.

Because they’re so familiar, they appear in animal gatherings.

In the left panel of Hieronymus Bosch’s Garden of Earthly Delights (c 1495-1505) is a curious mixture of real and imaginary creatures. There’s an elephant and a giraffe, both early depictions of those species, together with monkeys, brown bears, rabbits, and more, even a white unicorn drinking at the lake on the left.

Among the many superb animal paintings of Paulus Potter, Orpheus and Animals from 1650 is one of his most unusual, showing a wide range of different animal species, some of which weren’t well-known at that time, and one of which (the unicorn) didn’t even exist. Those seen include a Bactrian camel (two humps), donkey, cattle, ox, wild pig, sheep, dog, goat, rabbit, lions, dromedary (one hump), horse, elephant, snake, deer, unicorn, lizard, wolf, and monkey.

In Tintoretto’s Creation of the Animals, the first of his Old Testament cycle for the Scuola della Trinità in Venice, God flies along as he creates pairs of different species of bird, fish, and animal, from cormorants to rabbits.

Among their leading roles is in Elihu Vedder’s delightful painting of the unfortunate Marsyas.

Late in 1877, Carrie Vedder, the artist’s wife, recorded in a letter that her husband had been thinking about Marsyas, and considered that, before the contest with Apollo, Marsyas must have proved his skill with the aulos. He therefore came up with the idea that this must have at least been charming hares with the instrument. He started this painting early in 1878, setting it in the New England winter. This was shipped to Paris for show at the Exposition Universelle later that year, but Vedder was disappointed that it didn’t do well there.

The hare is known from fable for its speed, although not so much when racing against a tortoise.

At some time during the first half of the seventeenth century, Frans Snyders painted the still popular Fable of the Hare and the Tortoise. The tortoise and the hare disputed which of the two was the faster, so agreed to run a race against one another. Although the hare was much faster when running, he laid down beside the path and slept. The tortoise, being aware of his relative slowness, ran as fast as he could, past the sleeping hare, until he won. Snyders shows the hare at full pelt, and the tortoise crawling away in the distance, giving little clue as to the surprising outcome or its cause.

JMW Turner alludes to this fable in his Rain, Steam and Speed – The Great Western Railway from 1844.

Running ahead of this very early steam locomotive as it crosses the River Thames at Maidenhead is a hare, barely visible at the lower right.

Perhaps the most famous painted hare appears in one of Albrecht Dürer’s watercolour masterpieces, dated to 1502.

Following this tradition, one of Bruno Liljefors’ favourite species was the elusive hare. This page of Hare Studies from 1885 shows a tiny part of the image library he assembled, as well as their spring antics.

Unlike the common rabbit, some hares become white for the winter. This is one of the many paintings that Liljefors made of a Winter Hare, here from 1910.

Both hares and rabbits have been traditional meats, and there are several still life and hunting paintings depicting them dead and being prepared for a meal.

Several of Chardin’s small output of about 200 paintings included hanging game, here an undated Rabbit and Copper Pot, elsewhere hares and others.

The rise of the sciences during the nineteenth century didn’t spare rabbits from being used in physiological experiments.

Following the death of the physiologist Claude Bernard, the Sorbonne (where he had taught) commissioned Léon Lhermitte to paint his portrait in 1886. Sadly I’ve been unable to trace an image of the original, but Claude Bernard and His Pupils is a faithful copy of the painting that Lhermitte exhibited at the Salon in 1889. This shows Bernard in the midst of performing an experiment on a rabbit, his students discussing its results, and one writing the experimental observations in the laboratory daybook.

Rabbits have been favourites with children, and kept as domestic pets. From there they appear in some of the most surprising places.

Johann Eleazar Zeissig shows A Family Making Chinese Shadows in his painting from the late 1700s. A family are entertaining themselves late in the evening with the aid of a lamp as a point source of light. An older boy is tracing the silhouette of his mother on a sheet of paper which he holds on the wall behind her. At the upper right are examples of his ‘shadowgraph’ drawings. Three younger children are holding up their hands to form the silhouettes of a rabbit and a cat, clichés of childhood.

August Macke’s Little Walter’s Toys from 1912 includes two of the favourite family pets, a rabbit and guinea pig.

My last guest appearance of a white rabbit is the most curious of all.

JMW Turner painted this narrative landscape of The Bay of Baiae, with Apollo and the Sibyl in 1823. Apollo is on the left, with his lyre, and the dark-haired Sibyl has adopted an odd kneeling position. She’s holding some sand in the palm of her right hand, asking Apollo to grant her as many years of life as there are grains. Opposite the couple, on the other side of the path, under the trees, is a white rabbit.

Maybe it was just the first day of the month.