Snapshots are a popular feature of modern file systems like APFS. This article explains what they are, how they come about, and what their benefits and problems are in macOS.

What is a snapshot?

Each volume, whether in HFS+ or APFS, is a complete file system, containing all the information about the files within it, details of directories or folders, and where all the data for those files is to be found on the disk hosting that volume. File system data is constantly changing, as files are created, updated and deleted. When a file is deleted, its entry in the list of files in that volume is removed, and the storage blocks used to contain the file’s data are marked for removal, thus to be returned for reuse.

If you were to make a complete copy of that file system, that would describe the volume at that instant in time. To accompany that you could then preserve all the storage blocks containing its file data. From that moment on, instead of returning storage blocks for reuse, if you retain them, you could revert that volume to the state it was in at that instant. That’s just what a snapshot does.

Concentrating for a moment on a single file, the file system has an inode record containing attributes for that file, such as its time of creation, and those are linked to a list of the storage blocks containing the file’s data, its file extents. At the moment that a snapshot is made of that volume, those inode records and extents are copied to form the snapshot itself, and all the data blocks listed in the extents must be preserved.

This shows the same file in a snapshot and in the current volume, a little after that snapshot had been made. Extents for the data of the earlier version of that file contained in the snapshot are shown at the top, and consist of blocks EA, EB, EC and ED. After that snapshot was made, the file was edited and now consists of the blocks shown at the bottom, EA, FB, FC and ED.

Thus, the extents listed for that file in the snapshot consist of two blocks, EA and ED, that are currently in use and included in its current extents, and two blocks, EB and EC, that were deleted after the snapshot was made. As those are referenced in the snapshot’s extents, those storage blocks are retained to enable the snapshot to restore the volume’s previous state. When that snapshot is deleted, blocks EB and EC will then be returned to the pool of free blocks for erasure and reuse.

Snapshot size

Snapshots are stored within the same container holding the volume, and are linked to the current volume, although not stored inside it (as that would create a recursive volume structure and catastrophe). The size of the snapshot itself, the copy of the file system, is relatively small, but the size of the retained storage, blocks EB and EC in the diagram, can be far larger.

Imagine that, just after making a snapshot, you delete a 100 GB file, like a Virtual Machine. So long as that snapshot remains, the storage occupied by that huge file has to be retained, and can’t be released for reuse. So that snapshot has a minimum effective size of 100 GB until it’s deleted.

If you make a snapshot now and keep it for several days, it grows steadily in size. Each storage block containing deleted file data must be retained as long as the snapshot is kept, so over hours and days, that snapshot accumulates more retained data, and grows. Ultimately, it could come to occupy all the space in that container, unless you delete the snapshot. When you do, all its retained storage is released for reuse, and free space grows as a result.

Because the largest snapshot is normally the oldest, as it contains the most preserved file data, when deleting snapshots it’s usual to delete the oldest first. If you did want to delete a newer snapshot, APFS would work out what file data can be removed without affecting older snapshots, just don’t expect the removal to free up as much space.

Using snapshots

Because HFS+ was designed in the last century for use primarily on rotating hard disks, it doesn’t support snapshots at all. They’re a central feature of APFS, so we have more limited experience of working and living with their peculiarities.

Making a snapshot is so quick as to be almost instant, and typically takes around 0.01 second, but deleting one takes upwards of 0.2 seconds because all it retained data have to be marked for reuse, and any remaining snapshots left intact.

Snapshots can be used like a backup that has been made to the same disk. As they’re a complete file system, they can be mounted like any other volume, and you can use that to copy files, or even to restore the current volume, a process often known as rolling back to that snapshot. Although those are convenient, as they don’t require a separate backup, they depend on much of the contents of the current volume, and can easily be affected by the same corruption or other problems affecting the volume you’re trying to fix. So they’re an additional benefit and not a substitute for proper backups made on separate and independent storage.

Time Machine and third-party backup utilities therefore make and maintain snapshots as well as regular backups. Time Machine does so because it uses the data in snapshots to help create its backups. So every hour, when Time Machine comes to make an automatic backup, it creates a local snapshot of each volume it’s going to back up. To prevent those snapshots from taking ever-increasing amounts of storage space, it automatically deletes those snapshots after 24 hours. Time Machine’s backups are also snapshots, but are specially created on backup storage, not alongside the volume being backed up like its local snapshots.

Scope and limits

There are two other important properties of snapshots in APFS: they’re always whole-volume, and are read-only.

Some modern file systems allow you to create snapshots of only part of a volume, but APFS doesn’t. All its snapshots contain the whole contents of a volume. If you add a folder from that volume to the list of exceptions for TM backups, its local snapshots will still contain that folder, and can’t be excluded from the snapshot.

This is good in some ways, as it means that you can always copy or restore from a snapshot even when some of its contents were excluded from your backups. It’s bad in others if you put very large files into a folder in a volume that’s being backed up: changes in those large files will make that volume’s snapshots very large. If you want to exclude files from taking up space in snapshots, then you have to move them to a separate volume that isn’t backed up at all, so doesn’t have snapshots made of it.

If a snapshot does contain a very large or unwanted file, because snapshots are read-only, there’s no way to delete that file from the snapshot, and it’ll remain there until the snapshot itself is deleted. Other modern file systems may allow you to tamper with a snapshot after it has been made, but APFS doesn’t, so you can always rely on that snapshot remaining faithful to the original volume.

One final limitation at present is that you can’t copy a snapshot, in particular to another storage drive. You can mount that snapshot and copy its contents to another volume, make a snapshot of that volume, and use that, but that’s not the same.

Maintenance

You can maintain and remove snapshots using a range of different utilities, including Disk Utility (where you need to enable their display in the View menu), third-party backup utilities such as Carbon Copy Cloner, and some other tools like BackupLoupe.

Some features in macOS still don’t handle snapshots at all well. For instance, Storage in General settings usually classifies the space occupied by snapshots as ‘system data’, which is vague and unhelpful. Unless you have a third-party utility, it’s best to trust the management of snapshots to Disk Utility, which handles them most reliably.

Summary

• A snapshot is composed of a copy of the file system at an instant in time, together with all preserved file data required to recreate that volume as it was at that instant. It’s stored alongside that volume, in the same container.
• The size of a snapshot is almost entirely determined by the amount of file data preserved by it. As more changes are made to the current volume, so more file data must be kept to be able to recreate the volume as it was when the snapshot was made, and the size of the snapshot grows.
• Snapshots can mounted as a volume, and files copied from them, or the whole volume restored. They’re not independent from the current volume, though, so can’t replace proper backups on separate storage.
• Time Machine makes hourly local snapshots of each volume it’s backing up, and automatically deletes them after 24 hours. Snapshots are also used by other backup utilities.
• Snapshots include everything in a volume, without exception. To ensure files aren’t included in snapshots, move them to a volume that isn’t backed up by Time Machine.
• You can’t remove anything from a snapshot once it has been made, as they’re read-only and immutable.
• You can’t copy snapshots.
• Space occupied by snapshots can grow large. Use Disk Utility or a third-party utility to inspect and maintain them.

References

APFS: Snapshots
Explainer: The arithmetic of snapshot size

Following her story of the transformation of Hippomenes and Atalanta, Venus resumes the account of her affair with Adonis, whom she had warned of the dangers of lions and savage beasts.

John William Waterhouse’s The Awakening of Adonis was completed in 1899 but wasn’t shown to the public until the following year, when it was hung at the Royal Academy’s summer exhibition. One of a series of his works telling stories of classical myths, it received great critical praise. Although Waterhouse shows an early moment in Adonis’s affair with Venus, where she’s the active partner, he hints at the outcome with a small group of red anemone flowers by his side. Those contrast with the white anemones on much of the rest of the grass.

Annibale Carracci’s Venus and Adonis from about 1595, three centuries before Waterhouse’s painting, is a superb painting of Venus, her winged son Cupid, and Adonis. The latter has his bow in his left hand, and his hounds by his side, as if about to go hunting. Carracci shows Cupid with an arrow in his left hand, and there’s a small red wound between Venus’s breasts, implying this is the moment that she fell in love with Adonis.

Paolo Veronese shows a later moment in the relationship between Venus and Adonis (c 1580), with Adonis asleep on his lover’s lap, and Cupid fondling the hounds. You can hear Cupid’s mother whispering forcefully to her son, telling him to restrain the dog from rushing forward, licking the face of Adonis, and waking him up. Veronese, as with most later artists, dresses Adonis in red, symbolising the blood that will be shed when he dies.

Titian takes us further into Ovid’s story, in his earlier painting Venus and Adonis, from about 1555-60. With the young Cupid asleep, cradled in a tree, Adonis wants to go hunting. He has his spear in his right hand, and his hounds on leashes held in his left. But Venus is terrified of what will happen, restraining him and telling the story of Hippomenes and Atalanta.

Peter Paul Rubens skilfully reversed Titian’s composition in his Venus and Adonis from the early seventeenth century. Adonis is now trying to depart to the left with his back to the viewer, bringing the beauty of Venus into full view, and strengthening its triangular composition. It also provides a natural place for Cupid, holding onto Adonis’s leg to stop him from going to his death. Cupid’s quiver, left on the ground behind him, is a reminder of the origin of the relationship.

Once Venus had left in her chariot drawn by swans, Adonis flouted her warning, and took his hounds out to hunt wild boar. They quickly found the scent of one, at which Adonis threw his spear. The spear struck the boar a glancing blow, and it was able to shake the weapon loose. As the young man was running away in fear, the injured boar charged at him, and gored him deeply in his groin.

Adonis lay dying from his wounds on a patch of yellow sand as Venus passed by in her chariot, on her way to Cyprus. She heard his groans of agony, stopped, and found him almost dead in pools of his own blood. She tore her clothes in grief, beat her breast, and cursed the Fates. She resolved to make a permanent memorial to him in the form of the blood-red anemone flower, and his blood was transformed into those flowers.

The manner of Adonis’s fatal wounding is seen as poetic justice: those who live by the sword, die by the sword, and the retribution for his adulterous relationship with the goddess Venus, Vulcan’s wife, is to be gored in the groin. This was clearly no scene for the visual explicitness of a painting.

Hendrik Goltzius painted this breathtakingly foreshortened projection of the Dying Adonis (1609) on a square canvas stood on one corner, to frame the figure tightly. A token splash of blood on his thigh is matched by crimson anemone flowers, although Venus hasn’t yet arrived on the scene, and is at the apex, still in her chariot. Beside Adonis is his spear, although there’s no sign of blood on its tip.

In or just before 1614, Rubens made this oil sketch of Venus Mourning Adonis, a more complex composition with the addition of three Graces, and the young Cupid at the right.

Rubens’ finished Death of Adonis was completed in 1614, and retains the same composition. A rather portly Venus cradles her lover’s head as the Graces weep in grief with her. Rubens has been more generous with the young man’s blood, which is splashed around his crotch and spills out onto the ground, where the hounds are sniffing it. The fateful spear rests under Adonis’s legs.

I particularly like Cornelis Holsteyn’s Venus and Cupid Lamenting the Dead Adonis from 1647. Although he’s coy about showing much blood, his arrangement of Adonis’s body is novel, and his use of colour apt. Venus sheds real tears as she’s about to sweep her lover into her arms, and in the distance is the shadow of a wild boar with the hounds in chase.

Marcantonio Franceschini is one of the few artists to show The Metamorphosis of the Dead Adonis, in this painting from about 1700. Venus is sprinkling a jar of nectar over the corpse of her lover, and anemones are already bursting into bloom.

With that, Ovid closes book ten of his Metamorphoses.

I hope that you enjoyed Saturday’s Mac Riddles, episode 289. Here are my solutions to them.

1: The most affordable Mac ever at under $500 has just shrunk further.

Click for a solution

Mac mini, 2005

The most affordable Mac ever (Apple’s tagline for it) at under $500 (its starting price was $499) has just shrunk further (the original Mac mini, released on 11 January 2005, in its latest M4 incarnation is even smaller).

2: Apple’s most personal device yet came in April with San Francisco Compact.

Click for a solution

Apple Watch, 2015

Apple’s most personal device yet (Apple’s tagline for it) came in April (although announced the previous September, it was released on 24 April 2015) with San Francisco Compact (the face in Apple’s new system font designed for use on it).

3: With four fonts and a canon inside, it co-founded a desktop revolution.

Click for a solution

LaserWriter, 1985

With four fonts (it came with just Times, Helvetica, Courier and Symbol with PostScript) and a canon inside (the print engine was made by Canon), it co-founded a desktop revolution (with the Mac and Aldus PageMaker, it founded the Desktop Publishing revolution when it was released on 1 March 1985).

The common factor

Click for a solution

They are major Apple products first released 10, 20 and 40 years ago.

I look forward to your putting alternative cases.

Some recent Apple silicon Macs offer High and Low Power modes that appear to differ from the Low Power mode offered previously. This article discovers what they do, in particular how these modes affect the GPU.

New Power modes

According to Apple’s most recent explanation of Power modes in Apple silicon Macs, these are restricted to specific models. Low Power mode is apparently only available in:

• MacBook Pro with M1 Max, M2 Max, M3 Max or M4 chips,
• iMac with M3 or M4 chips,
• Mac mini with M2 or M4 chips.

Low Power mode “reduces energy use to increase battery life” and, in macOS Sequoia 15.1 and later reduces fan speeds to minimise generated noise and to reduce power use.

High Power mode is only available in:

• MacBook Pro with M1 Max, M2 Max, M3 Max or M4 chips,
• Mac mini with M4 chips.

High Power mode primarily runs the cooling fans at higher speeds to allow longer sustained high performance, and “can improve performance in graphics-intensive workflows”. Apple gives examples of the latter, including colour grading 8K video, video editing and 3D apps.

If your MacBook Pro doesn’t have an earlier Max variant or an M4, then what it refers to as Low Power mode in its Battery settings doesn’t appear to be Low Power mode according to that article. That might be the Low Power mode apparently introduced for MacBook and MacBook Pro models from early 2016 and later, when running macOS Monterey 12.0 and later. Juli Clover of MacRumors stated that “reduces the system clock speed and the display brightness in order to extend your battery life even further.”

Apple uses the words energy and power interchangeably, and in places refers not to Power Modes, but to Energy Modes, which is surprisingly inconsistent and thoroughly confusing.

Previous results

When recently investigating CPU core power use in the M4 Pro, I examined the effect of Low and High Power modes. As might be expected from Apple’s description, High Power mode had no effect on CPU core frequencies, their control, power use or performance.

However, Low Power mode had substantial effects on core frequency, performance and power use. When running floating point tests in 10 threads, their cluster frequency was reduced from 3,852 to 3,624 MHz, 94% of Automatic and High Power. That reduced power use from a mean of 13.9 W to 11.2 W, and increased the time to complete threads. Time taken by floating point threads increased to 106% of Automatic and High, while that for NEON increased to 135% and vDSP_mmul to 177%.

My previous measurements in M4 Pro CPU cores found peak average CPU power use of 14 W when running floating point instructions, 33 W for NEON, and 36 W for vDSP_mmul.

Assessing the GPU

My previous attempts to find a performance test that will reliably put maximum load on Apple silicon GPUs had limited success, but Blender Benchmark now appears capable, and has been used extensively. This runs three demanding renders using Metal, and reports for each the estimated number of rendered path tracing samples per minute. Running the Blender 4.3.0 version on the GPU using Metal results in consistent 100% active residency and maximum frequency for periods of several seconds. The standard test sequence used here renders three scenes, named monster, junkshop and classroom.

Tests were performed on a Mac mini M4 Pro with 20 GPU cores running macOS 15.2, thus one of the systems able to make use of both High and Low Power modes, and a MacBook Pro M3 Pro with 18 GPU cores running macOS 15.2, one of the models previously claimed to use ‘old’ Low Power mode, but excluded from the list of those capable of either High or Low Power modes.

GPUs were assessed using the powermetrics command tool’s gpu_power sampler for sample periods of 0.1 second over a total of 5 seconds early in each of the test renders. Activity Monitor’s GPU History window was used to check when each of the test renders had reached 100% GPU, at which point the powermetrics samples were collected into a file. Once the three renders had completed, their scores were recorded and the Blender Benchmark app was quitted. Tests were performed for:

• M4 Pro, for Automatic, High Power and Low Power,
• M3 Pro, for Low Power Mode Never and Always.

To ensure the latter had fully engaged, the MacBook Pro was also set to Always and restarted on battery power alone, but that made no difference to render performance.

Power

Differences between GPU performance were most apparent when comparing Automatic and Low Power modes on the M4 Pro, as shown in the chart below.

GPU power measurements given by the gpu_power sampler are shown against time over the 5 second period during the first, monster render. Filled circles and the regression line in black are those with the Automatic setting, and those in red are at Low Power. Thus, the obvious effect of Low Power mode is to reduce GPU power from about 20 to 6 W.

This chart adds measurements made during High Power mode in purple. If anything, power use was slightly lower in High Power than in Automatic mode, but there’s extensive overlap between values.

This adds measurements made with Low Power set to Never on the M3 Pro, shown in blue. Those too overlap with the M4 Pro set to Automatic and High Power, and are about 18 W. No difference was seen with the M3 Pro Low Power mode set to Always.

Blender Benchmark results are compared in the table below.

As expected, performance was almost identical between M4 Pro automatic and High Power modes, and between M3 Pro normal and Low Power modes. The only substantial differences were between M4 Pro automatic and Low Power, and between M4 Pro automatic and M3 Pro Low Power Never modes.

In the M4 Pro, engaging Low Power mode reduced GPU render performance to 65-71% of normal. The 18-core GPU in the M3 Pro achieved 66-72% of the performance of the 20-core GPU in the M4 Pro. Given that the M3 Pro has 90% of the number of cores, that implies that the GPU cores in the M4 Pro are significantly more performant than those in the M3 Pro, as has been claimed.

This table brings together performance and power use for the monster render alone. On the M4 Pro, Low Power mode delivered 69% of the render performance using about a third (32%) of the power. That contrasts with the M3 Pro, whose 90% core count used 90% of the power to deliver 72% of the performance, relative to the M4 Pro.

Settings

In the MacBook Pro M3 Pro, Battery settings explicitly refer to Low Power Mode. As this is completely different from the ‘new’ Low Power mode, that’s misleading.

In the Mac mini M4 Pro, Energy settings explicitly refer to Energy Mode, offering Low Power (at the top of the popup menu) and High Power (at the bottom of the popup menu).

Terms used and Apple’s detailed guidance need to be rationalised and made consistent across all recent Macs.

What Low Power mode does

Detailed comparison between powermetrics measurements in automatic and Low Power modes on the M4 Pro confirm that there are substantial changes to control of GPU cores. Running any of the three renders normally results in GPU cores being run at their maximum frequency of 1,578 MHz with 100% active residency and a software state of P10. In Low Power mode, their frequency is capped at 1,056 MHz (67%), active residency remains at 100%, but with a software state of P4-P5.

powermetrics reports two software ‘states’ for the GPU, one that is requested, which for these renders is invariably P10 (P8 on the M3 Pro), and the other the state apparently applied. Although these appear to be some form of priority, with higher P numbers being higher priority, I’ve been unable to find any explanation.

For comparison, when running on the M3 Pro, active frequency was the maximum of 1,380 MHz (87% of the M4 Pro), 100% active residency, and software states requested and given at P8 throughout.

CPU and GPU power use

Perhaps as a result of many GPUs now using 200-1,000 W of power, we have come to assume that GPUs inevitably consume the lion’s share of power in a computer. While that may be true of many PCs, even of some Intel Macs, it isn’t true of Apple silicon.

Maximum power used by the GPU in any 0.1 second sampling period during these tests was 25.3 W, and measurements on M4 Max chips with 40 GPU cores suggest they can use a maximum of about 50 W. Any PC gamer with a GPU using so little power would hang their head in shame, yet performance of Apple silicon GPUs is by no means poor.

While power used by the GPU during heavy workloads can remain at 14 W or more for sustained periods, when performing scalar floating point calculations, CPU cores generally remain below that. However, vector and matrix calculations in CPU cores and possibly the AMX coprocessor can exceed the maximum for a 20-core GPU, at 33 W for NEON floating point vectors, and 36 W for floating point matrix multiplication.

Summary

• There are two different types of Power Mode in Macs. MacBook Pro models without M1 Max, M2 Max, M3 Max or M4 chips support an older Low Power mode that dims the display to extend battery endurance, but in Apple silicon Macs has no significant effect on their performance.
• New Power Modes are available in MacBook Pros with M1 Max, M2 Max, M3 Max or M4 chips, and Mac minis with M4 chips.
• High Power mode doesn’t alter performance, but makes fan strategy more aggressive to support longer periods of high power use.
• Low Power mode constrains the frequency of CPU and GPU cores to reduce CPU power to about 80% and GPU power to about 33%, so achieving substantial savings and less fan use, at the cost of impaired performance.
• M4 GPU cores achieve better performance over those in M3 chips by a combination of higher frequency and improvements in the core itself.
• Apple needs to correct terms used in System Settings, and in its documentation, which are currently misleading and confusing.
• It’s not clear why Low Power mode is only available in selected models and chips.

In this the second of the pair of articles showing paintings exploring the physical and optical properties of winter ice, I resume my account in 1883, after Impressionism had started to sweep across Europe.

The Norwegian artist Frits Thaulow was one of the Nordic Impressionists who met in Skagen, Denmark. During the 1880s he developed what came to dominate the paintings of his later career, optical effects on the surface of rivers. He painted this scene of Winter at the River Simoa in 1883. A lone woman, dressed quite lightly for the conditions, is rowing her tiny boat over the quietly flowing river, toward the tumbledowns on the other side. The surface of the river shows the glassy ripples so common on semi-turbulent water, and the effect on the reflections is visibly complex. The distant side of the river is also partly frozen, breaking its reflections further.

Thaulow’s Spring Thaw from 1887 captures perfectly the peculiar softness of such scenes in early spring, as the meltwater is still icy cold and ice remains around its edges.

Emile Claus’s dazzling view of a small group of skaters in The Ice Birds (1891) was inspired by a contemporary novella, and shows the flooded swampy area near Waregem when frozen over in winter. Claus draws a distinction here between the less reflective surface of snow, and the ice that’s richly coloured in the winter sunlight.

Another Norwegian artist, Jahn Ekenæs here demonstrates that even in the bitter Nordic winters, the washing still had to be done, and only one of the women in his Women Doing Laundry Through a Hole in the Ice (1891) is wearing anything on her hands. Broken blocks of ice in the right foreground demonstrate its thickness, although that’s barely adequate to support the horse and sledge in safety.

One of Lesser Ury’s more conventional motifs, his beautiful pastel of Tiergarten in Winter from 1892 shows the large park to the west of the Brandenburger Tor in Berlin, with its blue river frozen over and a good covering of snow.

Hans Andersen Brendekilde’s Melting Snow from 1895 is a wonderful depiction of a harsh winter in the country. An elderly couple are doing the outside jobs in typically grey and murky weather, in the backyard of their thatched smallholding. He has walked down to fetch a pail of water from a hole in the ice on the river. Around it the ice is discoloured from contaminants in the water and surely not fit to drink.

During the early New Year of 1898, Eugène Jansson painted Riddarfjärden. A Stockholm Study from his studio, with ghostly blue ice covering much of the water below. A small steam vessel is making its way along the ice-free channel towards the foreground.

When Lovis Corinth lived and worked in Berlin, he too painted the occasional urban landscape of the city, including this wintry Ice Rink in the Berlin Tiergarten from 1909, where Berliners are skating on frozen lakes in the city’s zoo.

A couple of years later, at the other end of the earth, Edward Wilson’s watercolour of The Great Ice Barrier – looking east from Cape Crozier was painted in the austral summer, on 4 January 1911. This shows small groups of penguins on the ice cliffs at the edge of the Ross Ice Shelf in the Antarctic.

Back in the Northern Hemisphere, the young Canadian artist Tom Thomson painted After the Sleet Storm in his studio during the winter of 1915-16, from oil sketches he had made in front of the motif. This shows the beautiful effects not of frost as such but of sleet frozen onto the canopies of birch trees, in the winter half-light. Pale pinks and blues shown on the trees here are reminiscent of spring blossom.

Thomson’s Snow in October (1916-17) is another well-known studio painting that Thomson made the following winter. Its fine geometric reticulations of frozen white canopies are a surprise, and an opportunity for the artist to use subtle colour and patterns in its shadows.

It’s high time to return indoors and warm up with a glass of mulled wine.

Everyone knows that January, the first month of the New Year, is named after Janus the Roman god of transitions. There are a couple of problems with that, as neither the Romans nor the Greeks started the New Year in the middle of winter, not when they could help it. Although it’s true that the Romans named the first month of the year Ianuarius, according to some ancient almanacs that wasn’t in honour of Janus, but of Juno. The more modern assumption that January, now a winter month, was named after Janus, classically depicted as a duality, makes a more plausible story. Janus characteristically has two faces on a single head, one looking backwards to the old year, the other looking forwards to the new: Ianus Bifrons in Latin.

So he appears in Anton Raphael Mengs’ wonderful fresco in the Vatican’s Camera dei Papiri, The Triumph of History over Time (1772). You’ll no doubt recognise Father Time with his long grey beard and scythe in the foreground, behind whom History is busy keeping records. She looks up to the fresh new face of Janus, as the old face looks away to the right.

This New Year I’d like to cast us back to September 2016, when macOS 10.12 Sierra had just been released, six years after Apple had released the iPhone 4, the first with its own A4 chip. Just four days before Sierra, Apple released the iPhone 7, with its two P and two E cores, making it the first Apple silicon design to adopt Arm’s big.LITTLE architecture. Maybe some engineers have been working on a prototype Mac using an A11 (to be released in the iPhone 8 the following year), and the specifications for the first generation of Arm-based Macs are being finalised.

To get from Sierra running on Intel 4-core Skylake processors to macOS 11 running on 4-core M1 chips, there’s a long list of changes to be made, including:

• a modern file system to replace HFS+, designed for SSDs, with support for containers, volumes, sparse files, snapshots, and more;
• running 64-bit code throughout;
• macOS to run from a signed system volume on a mounted snapshot verified by a tree of hashes;
• replacement macOS installers and updates to maintain macOS in the SSV;
• a firmlinked Data volume to be writeable by the user, with FileVault implemented using hardware encryption;
• a secure enclave;
• a fully secure boot process in custom firmware without using EFI.

Engineers have already been working on those, and the first release of the new file system, APFS, is intended for the following year, when intermediate hardware based on the A10 in the iPhone 7 will be released as the T2 chip, providing a secure enclave, hardware encryption and a firmware development platform. The problem now is how to complete the rest of the transition, so enabling the first Apple silicon Macs to be released by the end of 2020.

Although four years might seem a long time, here’s a timeline for those changes:

• 2017: APFS release, first T2 Macs.
• 2018: completion of major APFS features, transition to 64-bit code.
• 2019: 64-bit only, intermediate boot volume group without SSV.
• 2020: SSV and boot volume group, replacement install and update, firmware for a full hardware release late in the year.
• 2021: improved efficiency in macOS updates, paired Recovery volume.

And that’s exactly what happened from macOS 10.13 High Sierra to 12.0 Monterey.

However and whenever those changes were to occur, it was going to be a demanding period for Apple’s engineers, third-party software developers, system administrators and users alike. Was there an alternative that could have completed the same transition at a slower and more comfortable pace?

Merging the changes for any adjacent years would have resulted in at least one upgrade that would have made impossible demands. For those who have wanted major versions of macOS to be released every two years, the consequence would have been that macOS 11.0 would have been released just a few months ago, and only now would we be trying out our new M1 Macs. The next time that someone wishes that macOS had been upgraded at a slower pace over those years, remind them how that would have delayed introduction of Apple silicon Macs by around four years.

With that, it’s time for Janus to swap faces, and look forward to the coming year.

Now we’re into January, the proper winter weather should be here. It’s time to don our duvet jackets, woolly hats and mittens and go out to see lakes and rivers transformed from their usual liquid state into solid ice. This weekend I tour the world in search of those paintings seizing this opportunity to explore the physical and optical properties of ice in nature, in this article up to the advent of Impressionism in the late nineteenth century, and tomorrow from then until the First World War.

Among the best-known of winter paintings, Pieter Bruegel the Elder’s Winter Landscape with Skaters and Bird Trap (1565) was copied repeatedly by his son Pieter, and by others in the family workshop. At least sixty copies are believed to have been made, one dated as late as 1626, sixty years after the original. This is among the early landscapes showing people walking or skating on a frozen river, and to the right of the canoe-like boat a small group is engaged in the popular game of colf. As is usual with many rivers, the ice here has a pale ochre tinge.

Aert van der Neer’s beautifully-lit Sports on a Frozen River (c 1660) includes several playing colf, an antecedent of golf that was also played during the warmer months, but was most distinctively played on frozen rivers and canals. The reflection of the low sun on the ice is particularly well shown here, giving the ice a polished sheen.

Scenes of frozen rivers and canals became increasingly popular during the Golden Age. Although Aelbert Cuyp doesn’t appear to have painted many of these, his Ice Scene Before the Huis te Merwede near Dordrecht from about 1655 is among the finest. Notable here are his foreground reflections on the mirror-like surface, and the wonderful sky with its warm clouds. The castle seen here was built to the south-east of Dordrecht in the early fourteenth century, and ruined a hundred years later.

Jacob van Ruisdael painted several seasonal landscapes, including two similar versions of Winter Landscape (c 1660-70). This is the Mauritshuis version, which is perhaps slightly preferable to that in Birmingham, Alabama, although both show similar finely detailed frost on the trees and vegetation, heightened by the darkness of the ice and sky.

Caspar Wolf painted this finished version of The Geltenbach Falls in the Lauenen Valley with an Ice Bridge in about 1778, from what appears to have been a sketch made en plein air. Although not particularly early for a plein air oil sketch, given the logistic problems associated with working outdoors in oils in this remote rural location, it’s quite an achievement. These falls were little-known at this time, but when nearby Gstaad became an internationally-known spa town in the nineteenth century, they were added to many tourist itineraries.

In 1839, François-Auguste Biard travelled with a French expedition to Spitsbergen and Lappland. The only painting from this expedition that I’ve been able to locate is this view From Magdalena Bay, Spitsbergen, apparently made in oils in front of the motif, despite its considerable detail. Although much of the sea is shown unfrozen, there are several small bluish icebergs and ice covering the shallows along the coast.

Two years later, Biard completed Magdalena Bay; View from the Tombeaux Peninsula, to the North of Spitsbergen, Effect of the Aurora Borealis. This was exhibited in the Salon of that year, and again at the Exposition Universelle in Paris in 1855. Lit by the eery light of the aurora is a small group of survivors, who are not mentioned in the title. Five rest on the snow in the foreground, all but one apparently already dead, and there is wreckage down among the heavier sea ice behind them. One person’s footsteps lead up to the viewpoint of the artist.

Johan Jongkind’s fine View of Maassluis in Winter from 1848 is a good example of his early work. Following the long tradition of landscape painting in the Netherlands, he sets his horizon low and paints a wonderful winter sky. Underneath that, the locals are skating along a frozen canal, which has both rutted areas and some that are more polished.

Jongkind revisited this theme in 1873, when he painted this Canal in Holland in Winter with his mature rough facture.

Although now exceptionally unusual, during the nineteenth century and earlier the River Thames in London often froze solid for long periods most winters. This afforded James Whistler the chance to paint The Thames in Ice in 1860, with its monochrome relieved only by earth browns. It’s thoroughly painterly, and its details appear to have been sketched in quickly, suggesting it might have been painted in front of the motif. However, it’s a relatively large canvas, and Whistler is known to have painted from memory in the studio.

In 1869, the marine artist William Bradford travelled on board the steamship Panther on an expedition to Greenland. An Arctic Summer: Boring Through the Pack in Melville Bay (1871) shows their ship working its way through pack ice close to the west coast of Greenland. Melville Bay is a huge bay on the island’s north-west coast, and an important area for whaling fleets in the nineteenth century.

Here are this weekend’s Mac riddles to entertain you through family time, shopping and recreation.

1: The most affordable Mac ever at under $500 has just shrunk further.

2: Apple’s most personal device yet came in April with San Francisco Compact.

3: With four fonts and a canon inside, it co-founded a desktop revolution.

As this is the first of the New Year, each solution consists of a product name and the year of its release.

I’ll post my solutions first thing on Monday morning.

Please don’t post your solutions as comments here: it spoils it for others.

It might seem extraordinary today, but the first Macs with Motorola 68000 processors couldn’t add two floating point numbers directly in their CPU. As with other early processors, they handled integers, not floating point, and that’s one reason why many features such as display coordinates started off using integers rather than floating point as they do today.

Of course the Mac and other computers could perform floating point calculations, but that required the use of maths routines in software libraries. Others had been implementing floating point support in hardware: for example, Intel started developing its own maths coprocessor the 8087 in 1977, and that became available to accompany its 8086 processor, but at that time Motorola didn’t have any equivalent.

68K Macs

Apple hired a young mathematician to define and implement what became known as the Standard Apple Numerics Environment or SANE, for Apple II, III, Lisa and Mac product lines, and it was SANE that formed the basis for Motorola’s 68881 maths coprocessor for its 68020 CPU in 1984. At the same time, the IEEE was standardising floating point maths for computing, and in 1985 published its first version of IEEE 754.

SANE was built into the first Mac 64K ROM, and when Macs started to come with 68020 CPUs and 68881 coprocessors, in the Macintosh II of 1987, they ran their floating point routines on the 68881 or its successor the 68882. In 1991, the first Quadra came with a Motorola 68040 and its integrated floating point unit, although as late as 1995 Apple was still releasing new Macs that lacked any hardware support for floating point maths. The most complete description of SANE is in a printed account published by Addison-Wesley, the second edition dating from 1988.

Power Macs

The change to PowerPC processors in 1994 brought an end to SANE, replacing it with PowerPC Numerics, which differed in many of its details. Floating point support in PowerPC CPUs included additional instructions to support Apple’s new standard. The period of transition was covered by providing SANE for backward compatibility with apps that had been built for Motorola 68K processors, and encouraging developers to rebuild their apps to use the PowerPC’s new Numerics. Tom Pittman and John Neil produced and marketed PowerFPU, a control panel for Power Macs, that ran 68K floating point code in emulation.

From 1996, the AIM Alliance of Apple, IBM and Motorola developed extensions to the PowerPC instruction set to support vector processing. Known variously as AltiVec, VMX for Vector Multimedia Extension, and Apple’s Velocity Engine, it was used to accelerate QuickTime and Quartz, when it was introduced in Mac OS X. Those extensions handle both integer and floating point in registers that are 128-bit wide to pack in multiple values for its operations. Velocity Engine was supported by Power Macs with G4 and G5 processors, from 1999 onwards.

Intel Macs

When Macs changed architecture to use Intel CPUs, those had integral floating point support, including x87 maths co-processor emulation and Intel’s Streaming SIMD Extensions, SSE, providing a replacement for features in the PowerPC. From 2003, in Mac OS 10.3 Panther, Apple had collected its more advanced numerical and vector support into the Accelerate framework, covering signal processing, image processing, linear algebra with BLAS/LAPACK, vector maths and more.

The transition to Intel wasn’t as seamless as might have appeared though, because of differences that might at first look subtle. For instance, PowerPC floating point support included a single, fused operation to multiply and add, but Intel CPUs performed the operations separately, which could accumulate additional rounding error. Apple warned “that in cases involving catastrophic cancellation, this may give results that are vastly different after the addition or subtraction has completed.”

As Intel Macs developed, they acquired increasingly capable GPUs that offered an alternative for some floating point calculations. OpenCL was introduced in 2009 to facilitate this, and in 2015, with OS X 10.11 El Capitan, Apple added support for its own GPU programming using the Metal API. That has evolved since, with Metal 2 introduced in macOS 10.13 High Sierra, and subsequent enhancements.

Apple silicon

From the first M1 chip, Apple silicon has put floating point performance to the fore. All the old variables that had originally been coded as integers have now become floating point, requiring fast and accurate scalar, vector and matrix support. CPU cores, even Efficiency cores, include extensive scalar instructions, with Arm’s NEON vector processing. GPUs support Metal 3, and matrix operations are catered for in a dedicated neural engine and an undocumented matrix coprocessor, the AMX. The latest M4 chip adds support for Arm’s SME matrix extensions in its ARMv9.2-A instruction set, although those are thought to be executed by the AMX.

While most of those are supported directly, access to the neural engine and (prior to the M4) the AMX coprocessor have been limited. It’s believed that appropriate functions in the Accelerate and related frameworks use whatever hardware is most appropriate.

Floating point calculations, often using very large matrices, are a key part of modern neural networks and both Machine Learning and Apple/Artificial Intelligence. Apple added support for a new floating point format, bfloat16, to Metal in 2023, and in its CPU core instruction set with the M2.

In the 40 years since the 128K Mac, crunching numbers has come a long way, thanks to Apple’s dedicated teams of mathematician-engineers.

Floating point formats

One of the eternal problems when working with floating point numbers in hex is their encoding. Converting IEEE 754 hex format into decimal expressed in engineering notation is fairly arcane. My free Mints includes a floating point explorer, to convert between 32- and 64-bit floating point and decimal engineering/scientific formats.

References

PowerFPU, a brief account by Tom Pittman
IEEE 754 at Wikipedia
Inside Macintosh: PowerPC Numerics on the Internet Archive
Velocity Engine on the Internet Archive
SSE Performance Programming and the early Accelerate framework, on the Internet Archive
Accelerate framework (current)
Metal calculations on a GPU (current)

The magpie in its various species is common throughout much of the world, and in Europe has become associated with various folk tales and behaviours. A member of the family Corvidae (crows), it’s smart and capable of near-human skills such as working in teams and playing games. There are long-held associations with both good and evil, and an old English nursery rhyme starting “One for sorrow, two for joy” to express that ambivalence. They also have a justified reputation for collecting shiny objects, another of their human behaviours.

Although an everyday species, magpies are surprisingly popular in paintings, albeit in cameo appearances rather than as stars. One association in classical myth is with the nine daughters of King Pierus, the Pierides, who were turned into birds after being defeated by the Muses in a contest of song. While they’re often said to have become magpies, that’s now considered erroneous, and they were actually turned into jays.

Hendrick van Balen’s Minerva and the Nine Muses (c 1610) shows all the key figures involved. The nine Muses are seated, forming a small orchestra with their contemporary rather than classical instruments. Minerva, at the left, is being engaged by a tenth woman, whose identity isn’t clear. In the far distance, just beyond a waterfall, Pegasus is about to take off from a high cliff. Above there are two magpies, implying the imminent arrival of the Pierides.

From the early Northern Renaissance onwards, magpies feature in several prominent European paintings.

Out in the garden, midway between their knees, in Jan van Eyck’s Madonna of Chancellor Rolin from about 1435, there are two magpies, presumably here signifying joy. They’re shown in the detail below.

Another appears on the exterior tondo of Hieronymus Bosch’s Wayfarer triptych from 1500-10. This shows the figure of a travelling man in the foreground, against a countryside background with a single tumbledown building. To the right is a small field gate and a tree, behind which is a single magpie on the ground, and a cow. This could be ‘one for sorrow’ given in the rhyme.

In Jacopo Tintoretto’s Susannah and the Elders from about 1555, immediately above her head is a magpie, presumably for its association with mischief and theft. This is clearer in the detail below.

The associations in Pieter Brueghel the Elder’s Magpie on the Gallows (1568) are darker still.

It has been suggested that this painting may allude to popular proverbs, such as ‘dancing on the gallows’ meaning mocking the state, or the folk role of the magpie as a gossip (and Ovid’s story of the Pierides), and gossip as being life-endangering in times of political tension. The magpie is shown in the detail below.

Magpies are capable of speaking, although not as well as parrots. I’m unsure whether that’s Alessandro Magnasco’s reference in his unusual painting of The Tame Magpie (Teaching the Magpie to Sing) from about 1707. Against a backdrop of ruins, a motley assortment of misfits and the poor are seen watching the young man in the centre trying to teach the tame magpie on the barrels to sing.

Around 1870, Monet, Renoir, and Pissarro painted many snow scenes. One of Monet’s best-known is paradoxically The Magpie (1868-9), where the bird is probably the smallest and least conspicuous part of the whole motif.

A magpie also makes a cameo appearance in Luc-Olivier Merson’s marvellous painting of The Wolf of Agubbio from 1877. Set in the town’s central piazza, it’s a cold winter’s day, so cold that the waters of its grand fountain are frozen as they cascade over its stonework. As the townspeople go about their business, there’s the large wolf of its title with a prominent halo, standing at the door of the butcher’s shop. Leaning out from that door, the butcher is handing a piece of meat to the wolf. In the details are a menagerie of creatures, including a magpie in the entrance to the butcher’s, as seen in the detail below.

One of the key features of third-party protection against malicious software is the scanning of executable code and other files. macOS used to have its Malware Removal Tool MRT, but in the summer of 2022 that was replaced in Catalina and later by XProtect Remediator (XPR), a sibling of the on-demand scanning tool XProtect, used by Gatekeeper to check code before it’s launched. That developed rapidly in the latter half of 2022, and is now one of the frontline protections against malicious software in macOS. This article looks at how XPR changed over the last year.

At least once a day, often shortly after startup, XPR scans the Mac for known malicious software. If it identifies any, it reports that as an endpoint security event and attempts to remove or ‘remediate’ it. Scans consist of running a series of executable code modules, named according to the malware they detect and remediate, and each set of scans is run twice, once as root and a second time as user.

Some scanning modules are executed very quickly, but according to the execution time reported for each, none takes longer than a small fraction of a second, and the complete double set used to take just a few minutes. Over the last year, those few minutes have progressively extended, and by the end of 2024, it’s not unusual to see XPR scans taking over half an hour, most of that time apparently looking for Adload. Activity Monitor reports that modules are run one at a time in a single thread in the background, on the E cores, minimising their impact on the user.

Scanning time and Yara rules

Work by Alden confirmed that some XPR modules use Yara detection signatures, similar to those normally supplied for XProtect’s on-demand scans. Scrutiny of log entries for XPR’s components struck gold, in that most scanning modules report that they have initialised a Yara library early during their scanning, with the characteristic log entry
Initialized libYARA version 3.11

To estimate the actual scanning time for each module that initialised libYARA, I therefore measured the time elapsed between that log entry and the module’s final report. Those are wildly different from the execution time reported by the module: for example, that reported for one Adload scan was 0.0000510 s, but measured as over 24 minutes. As that matched observations in Activity Monitor, I think I know which represents the true scanning time.

By their own admission, 17 of the current 24 scanning modules use Yara definitions in their scans. These are detailed, together with measured scanning times, in the table below.

Total time for modules using Yara definitions was 30 minutes 9.99 seconds, matching times recorded by XProCheck and those observed in Activity Monitor.

Modules taking substantial time, including Adload, Bundlore, Crapyrator, Dolittle, DubRobber, Pirrit and SheepSwap, have substantial rules in the current Yara definitions used by XProtect (the on-demand version), and during 2024 those rules have grown considerably as XProtect has targeted them more aggressively. If XPR were to use XProtect’s Yara rules, that would explain the noticeable increase in time taken by its scanning modules. This may also account for XPR being updated less frequently than in the past: if its detections are at least partly based on those rules, often updated every fortnight, then replacing its scanning modules shouldn’t be required as often.

Scanning modules in XPR, 2024

Adload (Yara-based) is an old adware and bundleware loader dating back to 2016 with a track record of rapid change, enabling it to evade static detection. It normally achieves persistence through a bogus service installed in ~/Library/LaunchAgents/, and Phil Stokes gives fuller details here.

BadGacha remains unidentified, but has in the past reported false positives for helper apps in non-malicious apps.

BlueTop (Yara-based) is a bogus WindowServer app that was part of a Trojan-Proxy campaign investigated by Kaspersky in late 2023.

Bundlore (Yara-based) is an old adware dropper from 2015 or earlier that has become more malicious in the software that it installs, and has been reviewed by several researchers, including Jay Vrijenhoek and Joshua Long.

CardboardCutout remains unidentified.

ColdSnap (Yara-based) is known better as POOLRAT or SimpleTea, a cross-platform component that was part of the 3CX supply-chain attack.

Crapyrator (Yara-based) has been identified as BkDr.Activator, found in many torrents of cracked apps such as MarsEdit, DaisyDisk, and SpamSieve. It uses sophisticated methods, characteristically installing Activator.app in the main Applications folder, prompts for a password and uses that to disable Gatekeeper checks, then kills Notification Centre to cover its tracks. Further details are given here.

Dolittle (Yara-based) has been identified as Genieo, see below.

DubRobber (Yara-based) is known more generally as XCSSET, a versatile and troubling Trojan dropper that changes frequently to escape detection.

Eicar (Yara-based) isn’t malware at all, but a standard non-malicious test of detection methods.

FloppyFlipper remains unidentified.

Genieo, also known as MaxOfferDeal, is another old hand that changes frequently to escape detection. This is so well-known that it qualifies for its own page in Wikipedia.

GreenAcre (Yara-based), also known as OSX.Gimmick, is cross-platform spyware used in targeted attacks, discovered by Volexity in late 2021.

KeySteal (Yara-based), as its name suggests, exfiltrates the contents of keychains. Although it first appeared at least four years ago, it seems to have reappeared in autumn/fall 2022, and has been described in full detail by Luis Magisa and Qi Sun of Trend Micro. It has been found as a malicious version of the ResignTool app, used to change code signatures. It can come correctly signed, and has been delivered in a signed Installer package.

MRTv3 is a collection of malware detection and remediation items inherited from Apple’s old Malware Removal Tool, MRT.

Pirrit (Yara-based) has also been known in many different variants and forms since it first appeared in 2016. For a long time it posed as a Flash Player installer, although it has moved on since then. It has been overviewed recently by Paloalto Networks.

RankStank (Yara-based) is another malicious app at the centre of the 3CX supply chain attack, where it’s found in the 3CX Desktop App, and has been attributed to the Lazarus Group.

RedPine (retired in 2024) is believed to cover TriangleDB malware, sophisticated spyware that has been targeted primarily at iOS devices using malicious Messages. Its scanning module has recently been dropped from XPR.

RoachFlight remains unidentified.

SheepSwap (Yara-based) is believed to be other variants of Adload, see above.

SnowBeagle (Yara-based) has been identified as TraderTraitor from the Lazarus group, and targets crypto trading. It has a CISA Advisory giving details.

SnowDrift (Yara-based) is CloudMensis spyware, another sophisticated malicious app that may masquerade as WindowServer.

ToyDrop (Yara-based) appears to be a variant of Adload (see above), according to the rules in XProtect’s Yara file.

Trovi is believed to be a cross-platform browser hijacker that can affect Safari and others.

WaterNet (Yara-based) is thought to be a version of Proxit malware written in Go.

I’d like to thank Alden, Phil Stokes and others who have been kindly decoding Apple’s bizarre names.

After Ovid has told the bizarre myth of the birth of Adonis, he inserts a more straightforward tale about a couple who race against one another, and their unfortunate fate.

Adonis grew up to be a most beautiful young man. When Cupid was kissing his mother Venus, one of his arrows grazed her breast, and set her heart on fire for the young Adonis. Venus shunned her place with the gods, and spent her time on earth with Adonis. She warned him to keep clear of wild beasts, in order to remain safe. When he questioned that she told him the story of the race between Hippomenes and Atalanta.

As a girl, Atalanta always outran the boys, but had been told by an oracle that she shouldn’t marry. If she didn’t refuse a husband’s kisses, then she’d be deprived of her self. She therefore lived alone, and issued the challenge that she would only marry the man who was faster than her, and beat her in a running race.

Hippomenes was the great-grandson of Neptune, a fast runner, and when he saw Atalanta’s lithe body, fancied he might be able to beat her, and so win her hand in marriage. When he saw her run, though, he realised how fast and beautiful she really was, and challenged her. After she had looked him over, Atalanta was no longer sure that she wanted to win, wondering whether she might marry him. But she was mindful of the prophecy, and left in a quandary.

Hippomenes prayed anxiously to Cytherea (Venus), seeking her help in his challenge. She gave him three golden apples from a tree in Cyprus, and instructed him how to use them to gain an advantage over Atalanta.

The race was started with the sound of trumpets, and the two shot off at an astonishing pace. Atalanta slowed every now and again to drop back and look at Hippomenes, but reminding herself of the prophecy she accelerated ahead. Hippomenes then threw the first of his golden apples, which Atalanta stopped to pick up. This allowed Hippomenes to pass her, but she soon caught him up and resumed the lead. He repeated this with the second golden apple, and again Atalanta stopped to retrieve it, lost her lead, and caught it back up.

Tintoretto’s Race of Hippomenes from 1541-42 is the last of the series of myths that he painted early in his career. Although he painted a fine foreshortened figure of Hippomenes, in omitting his opponent and the crucial golden apples, he has only hinted at the original story.

Guido Reni’s Hippomenes and Atalanta from 1618—19 shows Atalanta picking up the second of the golden apples. Devoid of extraneous details, with its spectators shown only as tokens, the artist concentrates on the forms of the runners, specifically the alignment of their limbs and bodies. He includes some wonderful echoes, such as in their right arms, and his right hand with her left hand. There are also some effective contrasts, between their legs and the alignment of torsos, that emphasise their relative motion.

Jacob Peter Gowy’s Hippomenes and Atalanta (1635-37) also chooses this moment, but distracts more with the crowd of onlookers waving and cheering behind. The runners’ body language isn’t as clear, and their juxtaposition has some awkward moments: it looks as if Hippomenes’ left foot is kicking Atalanta’s left side, for example. But there’s more excitement and the atmosphere of a contest here.

Nicolas Colombel, in his Hippomenes and Atalanta from about 1680, has set the pair into an elaborate landscape, and added a winged Cupid to hint at the stakes. Atalanta is again just about to collect the second golden apple, and there’s less ambiguity in the overlap between the two figures.

Noël Hallé’s The Race between Hippomenes and Atalanta (1762-65) goes even further, in almost every respect. The scene is now of almost epic proportions, spread across a panoramic canvas. At the right are the local dignitaries, and a winged Cupid as a statue, watching on. Atalanta is still picking up the second golden apple, with Hippomenes holding the third behind him, in his right hand, as if he’s getting ready to drop it.

On the last lap, Hippomenes threw the third apple even further away. Venus intervened and forced Atalanta to chase the apple further still, and made it heavier to impede her progress. This allowed Hippomenes to win the race, and claim her as his prize.

Hippomenes failed to give thanks to Venus for her intervention, angering the goddess. When the couple were travelling back a few days later, Venus filled Hippomenes with desire for Atalanta, as the couple were passing by a temple to Cybele, beside which was an old shrine in a grotto. There Hippomenes made love to Atalanta, so defiling that shrine and offending Cybele. For their desecration of a holy place, Atalanta and Hippomenes were transformed into the lions that now draw Cybele’s chariot. Venus finally completes her story by telling Adonis that this is the reason to beware of lions and other savage beasts.

In showing the race, none of the artists gives us a hint of the couple’s eventual fate. It takes Antoine-François Callet’s magnificent Spring, or Zephyr and Flora Crowning Cybele (1780-81), now adorning the ceiling of the Galerie d’Apollon in the Louvre, to show the two lions drawing Cybele’s chariot, and bring closure to the story.

Yesterday I showed how macOS has changed over the last five years, from 10.14 Mojave to 15.2 Sequoia, in terms of architecture and numbers. One figure I gave was how /System/Library increased in the number of bundles it contained from just under 4,800 in Mojave to over 9,000 in Sequoia. Within that folder, greatest growth has been in Private Frameworks, which have risen from under 1,800 to more than 4,300.

In fact, to be more precise, the number of real bundles in the Private Frameworks folder isn’t as large, as my directory crawler that analyses each release of macOS counts most of those frameworks twice, because of their structure. Halving the numbers returned still shows great growth in Private Frameworks, though:

• In macOS 10.14.5 there were at least 273 Frameworks and 878 Private Frameworks.
• In macOS 15.2 there are at least 400 Frameworks and 2,154 Private Frameworks.

Thus public Frameworks have risen to 147% of their number in mid-2019, and Private Frameworks have risen to 245%.

This chart provides better detail of these changes, as it gives the percentage of frameworks that were private over time. That percentage is:
PrivateFrameworks x 100 / TotalFrameworks
where PrivateFrameworks is the corrected (halved) number of Private Framework bundles, and TotalFrameworks is the sum of PrivateFrameworks and PublicFrameworks, the corrected number of public Framework bundles.

Each new major version of macOS over this period has brought a substantial increase in the percentage of Private Frameworks, rising from 76% in May 2019 to 84% in December 2024. Over that period, macOS has become increasingly private. Although the greatest increases have largely coincided with the release of new families of M-series chips, the largest rise of all was of 2.1% with the release of macOS 12.0.1, nine months before the release of M2 Macs.

Apple last explained what Frameworks are over a decade ago, in its programming guide for them. They’re bundles providing resources that can be shared across multiple apps at the same time, and typically include at least one dynamic shared library, together with other resources such as images, strings and header files. Those that Apple makes public, in /System/Library/Frameworks, make up much of the macOS app programming interface (API). An invaluable guide to all public Frameworks across macOS and device operating systems is maintained by Marco Eidinger.

One example that I’m becoming increasingly familiar with is the huge Accelerate library, contained in the public Accelerate Framework. That provides a vast range of mathematical functions used when processing media such as audio and images, support for vector and matrix operations, and much more. Those functions are crafted by specialist engineers who may include different techniques optimised for different hardware resources, and deliver a combination of excellent precision and speed.

Look through Marco’s list and you’ll see a single public Framework for Siri, SiriKit. Compare that with those listed in the Private Frameworks for macOS 15.2 Sequoia, where you’ll find a total of 123 for Siri. Apple explains that Private Frameworks “are appropriate for code modules you want to use in your own applications but do not want other developers to use.”

In the past, developers have been able to browse the contents of Private Frameworks directly, and where they expose header files and other information those have been readily accessible, even if they can’t be used by third-party code. Although independently distributed apps can’t be prevented from using Private Frameworks, it’s one of the guaranteed ways of getting an app rejected from an App Store. More recently, dynamic shared libraries (dyld) have been supplied in huge caches within the OS cryptex installed by macOS. Accessing their contents is more complex, and has been explained by Juan Cruz Viotti.

Undoubtedly, much of what’s contained in Apple’s Private Frameworks is of neither use nor interest to third parties, and it’s up to Apple to determine what it exposes in public Frameworks. But this sustained high growth rate in Private Frameworks over the last five years prompts the question as to how much of macOS is now private and proprietary, rather than being accessible and even, where appropriate, open source. Some of us are old enough to remember a time when it was strongly hinted that source code for APFS would be released, but now its documentation isn’t even being maintained.

Each year I celebrate the lives and works of artists with anniversaries. This coming year there’s a host of major artists, from the pioneering woman painter Sofonisba Anguissola to John Singer Sargent. Here’s the crowded calendar for the coming twelve months.

8 January: in 1925, George Wesley Bellows died. Born in 1882 and brought up in Columbus, Ohio, he was a co-founder of the Ashcan School with his gritty views of life in New York during the early twentieth century, and after the First World War became famous for painting boxing contests.

13 January: in 1625, Jan Brueghel the Elder died. He was born in 1568, son of Pieter Bruegel the Elder, and specialised in landscapes and floral still lifes. He collaborated with his friend Peter Paul Rubens in some of the finest paintings of the early seventeenth century.

13 March: in 1825, the Norwegian landscape painter Hans Fredrik Gude was born. He trained in Düsseldorf, and returned there to teach later, and then in Karlsruhe. In addition to magnificent views of Norway, he painted in Wales and Scotland, and died in 1903.

14 April: in 1925, John Singer Sargent died. He was born in 1856, and trained, worked and lived for much of his life in Europe, first as a sought-after portraitist in Paris, then in London. One of the most prolific and brilliant oil and watercolour artists of the nineteenth and early twentieth centuries, he had a particular affection for Venice.

17 April: in 1825, Henry Fuseli died. Born in 1741 as Johann Heinrich Füssli in Zürich, Switzerland, he fled to England in 1765, where he established his reputation. He specialised in ‘Gothic’ narratives, and was appointed Professor of Painting in the Royal Academy.

9 May: in 1825, James Collinson was born. He was a member of the Pre-Raphaelite Brotherhood, but resigned when he considered it was bringing Christianity into disrepute. He remained an outsider afterwards, and died in 1881.

8 July: in 1925, Robert Polhill Bevan died. Born in 1865, he trained in Paris and was invited to join the Camden Town Group by Walter Sickert. He had a particular interest in the remaining working horses in London, and painted their final years.

17 July: in 1925, Lovis Corinth died. Born Franz Heinrich Louis Corinth in 1858, in a village near what’s now Kaliningrad, he trained in Munich, and painted there and in Berlin. He was a founder member of first the Munich Secession then the Berlin Secession. When at the peak of his career in 1911 he suffered a major stroke, but successfully returned to painting.

28 July: in 1925, Léon Augustin Lhermitte died. Born in 1844, he trained in Paris and immediately specialised in painting rural life in realist style, and established an international reputation.

16 October: in 1925, the Norwegian painter Christian Krohg died. Born in 1852, he trained in Karlsruhe under Hans Gude, then in Berlin. He joined the Nordic Impressionists in Skagen, Denmark, and became a prolific social realist. He also wrote and worked as a journalist, and lived much of his career in Oslo, where he became the first director and professor of the State Academy of Art.

16 November: in 1625, Sofonisba Anguissola died. She was born in 1532 in Cremona, Lombardy, and became one of the first women artists to train in Italy. She enjoyed a long and highly successful career as a portrait painter, and even advised the young Anthony van Dyck.

20 November: in 1625, Paulus Potter was baptised. He was born into an artistic family, and was trained in his father’s workshop. He became one of the first specialist animal artists, but died from tuberculosis in 1654 at the age of only 28.

29 December: in 1925, Félix Vallotton died. Born in Lausanne, Switzerland, in 1865, he trained in Paris, and initially painted in a detailed realist style. He joined the Nabis, then afterwards painted a series of strange domestic interiors, followed by transcendental landscapes.

29 December: in 1825, Jacques-Louis David died. He was born in Paris in 1748, where he trained and rose to become the leading Neoclassical artist. He became involved with the French Revolution, and was close to Robespierre and other leaders, for which he was later imprisoned. He then aligned with Napoleon, and following his fall from power, David went into exile in Brussels.

I hope that you’ll join me in celebrating the lives and works of these painters in the coming year, and wish you a happy and successful New Year.

To celebrate the New Year, I’m taking a look back at how macOS has changed over the last five years, from 10.14 Mojave to 15.2 Sequoia. While you can read about many of the details in articles here and elsewhere, in this article I focus on its architecture, in particular the contents of the main system library folder, together with its bundled apps. Tomorrow I’ll look in more detail at one phenomenon, the rise of Private Frameworks, and what that tells us.

Mojave was in many ways the last of the traditional versions of what started out as Mac OS X, and not just for its support for 32-bit code. It was most significantly the last to integrate both the system and user files in a single volume, by default quaintly named Macintosh HD. Within that, most system files were concentrated in /System/Library, but many sprawled out from there, and bundled apps were installed in the single main /Applications folder. Although there was a separate Recovery volume, Macintosh HD was macOS and more.

Catalina changed that, first by requiring all code to be 64-bit, and by separating almost all macOS system files into a System volume, with user files on the Data volume. At that stage, System was a real volume mounted read-only, but that was just an intermediate step to the modern boot volume group, with the system being an immutable snapshot of the System volume, the Signed System Volume, SSV. The latter first appeared in macOS 11 Big Sur, and with the addition of a paired Recovery volume, continues in Sequoia.

Over that period, the contents of /System/Library grew considerably in size.

In Mojave, there were just under 4,800 bundles in that folder. Catalina’s reorganisation increased that to around 5,500, and each new major version of macOS since has added another few hundred, culminating in 15.2 with just over 9,000 in all.

Much of that growth has been in Private Frameworks to support macOS and its bundled apps and tools, shown in purple in the bar chart above. Public Frameworks have grown from 546 to 800, similar to kernel extensions, and all the remaining folders from 2,000 to 3,000.

Because bundled apps were only separated in Catalina, their numbers only start in late 2019, as shown in the next chart.

There was a marked rise for Big Sur, since when the total has risen more slowly, from about 55 to 64 today. Some have been removed over that time, such as Network Utility, and others have been relegated to /System/Library/CoreServices/Applications, as has Keychain Access in Sequoia.

The timeline of growth in the number of bundles in the System Library folder matches milestones in Mac history. The first steep rise occurred with Catalina’s novel version of the boot volume group, and since then there have been further steep rises immediately before the release of the first of each family of M-series chips.

The largest of those rises was for the M3 (900), with the M1 (600) and M4 (600) also being substantial. Strangely, that for the introduction of the M2 seems to have taken place over six months in advance, and was smaller at 500 bundles.

Of all the system components that should reflect changing Mac hardware, effects should be greatest on kernel extensions.

Over this period of more than five years the number of kernel extensions stored in /System/Library/Extensions has risen from a low of 515 in 10.15 to 930 in 15.2, five years and two months later. Almost all of that occurred with the release of Big Sur, the first version of macOS to support Apple silicon Macs, when kernel extensions rose from 535 (10.15.7) to 788 (11.0.1). Most of those were required to support all the new hardware devices in the M1 chip. Subsequent families of new M-series chips have required few additional kernel extensions, although their number has been rising more rapidly since macOS 13.0 in October 2022.

It’s hardly surprising that, when someone makes the leap from an old Mac running Mojave to a new model with Sequoia, they’ll encounter so many fundamental differences in macOS. After nearly twenty years of steady evolution, in the last five macOS has changed beyond all recognition.

Given how many of those changes have been required for the introduction of Apple silicon Macs, it’s hard to see how Apple could have reduced the frequency of major macOS upgrades over that period. Even if it had been possible for engineers to have taken macOS from 10.14 to 11.0 in a single step, I suspect that no user or developer could have survived such as huge change at once. Yet without those changes, Apple wouldn’t have been able to release the M1 in late 2020, and we’d probably still be using Intel Macs. I will revisit that in more detail at the weekend.

Tomorrow I’ll look in more detail at how its APIs have changed.

The second half of 2024 celebrated the bicentenary of the French artist Eugène Boudin, who more than anyone laid the foundations of Impressionism, both in acting as the young Claude Monet’s teacher and mentor, and pioneering its changes.

Boudin’s The Beach at Villerville from 1864 is a wonderful example of his loose oil paintings of beach scenes on the north French coast, set under a dusk sky.

200th anniversary of Eugène Boudin: Pioneer of Impressionism 1
200th anniversary of Eugène Boudin: Pioneer of Impressionism 2

Over these six months I have tried to gather a more accurate overview of rural life and agriculture between 1500-1930, in a series titled The Real Country. This draws together insights into how those changed as cities grew and the countryside became depopulated but increasingly productive. Contemporary paintings have some fascinating stories to tell, as seen in this copy of Brueghel’s Landscape with the Fall of Icarus from about 1558.

Although its landscape is fictitious, the ploughman in the foreground appears true to life, and his plough typical of much of Europe at that time, as shown in the detail below.

At the very front of the plough is a small jockey wheel, behind which is a vertical metal blade, the coulter or skeith, whose task is to cut into the ground just ahead of the share, a wooden board that turns the surface of the earth to one side. The effect on the ground is to cut furrows into its surface and turn the soil onto ridges. When repeated five or more times over the course of the autumn and winter, this could build ridges high enough for the water to drain into the furrows, and coupled with the action of ground frost could break up even heavy clays into a tilth ready for sowing in the Spring.

Another interesting detail revealed in Brueghel’s painting is how the course of the plough curves, swinging wide to make the turn. As tracks alongside those ploughed strips changed into basic roads, and were then paved or tarmacked in the twentieth century, they retained the curved course of the plough in winding country lanes.

1 Under the plough

Later in the series, I showed examples of paintings of what are today unusual crops.

Emile Claus here shows Flax Harvesting in 1904, near his cottage in East Flanders, Belgium. Flax is a crop of particular relevance to painting, as its seeds are crushed and processed to generate linseed oil, the main drying oil used in oil paint, and the fibres of the rest of the plant are turned into linen, to form the canvases on which that paint is applied.

8 Cash and other crops

More recent paintings grant us views deep into history. The Norwegian artist Harriet Backer is little-known outside the Nordic countries, but painted several views inside country churches that merit wider exposure.

Of the many wonderful later paintings that she made of church interiors, the finest must be Uvdal Stave Church (1909).

Stave churches were once numerous throughout Europe, but are now only common in rural Norway. Their construction is based on high internal posts (staves) giving them a characteristic tall, peaked appearance. Uvdal is a particularly good example, dating from around 1168. As with many old churches, its interior has been extensively painted and decorated, and this has been allowed to remain, unlike many painted churches in Britain which suffered removal of all such decoration.

Backer’s richly-coloured view of the interior of the church is lit from windows behind its pulpit, throwing the brightest light on the altar. The walls and ceiling are covered with images and decorations, which she sketches in, manipulating the level of detail to control their distraction. Slightly to the left of centre the main stave is decorated with rich blues, divides the canvas, but affords us the view up to the brightly lit altar. To the left of the stave a woman, dressed in her Sunday finest, sits reading outside the stalls.

Harriet Backer’s Nordic Light: to 1889
Harriet Backer’s Nordic Light: 1890-1932

I had long put off compiling a series covering the multitude of paintings of the canals of Venice, and finally published them for the period 1825-1910.

Grand Canal, the Rialto in the Distance – Sunrise (1828) is one of Richard Parkes Bonington’s finest oil paintings, made in the studio from graphite and other sketches from 1826. This painting has quite commonly been described as showing sunset, but as the view faces almost due east, must have been set in the early morning.

Canals of Venice: 1825-1870
Canals of Venice: 1875-1895
Canals of Venice: 1895-1903
Canals of Venice: 1903-1910

Another outstanding artist who is little-known outside her native country is the Canadian Emily Carr. My small selection of her paintings forms a series of five articles.

In Carr’s late Dancing Sunlight (1937-40), vortexes of brushstrokes have replaced all solid form. Trees, light, foliage, even the sky have been swept into those strokes sweeping across the canvas like a whirlwind. She had earlier been absorbed by abstract art, but had continued to represent real objects using techniques that restructured them rather than abstracting.

First totems 1892-1911
Haida 1912-1913
1914-1930
Sculptural form 1931-1936
Tombstones 1937-1945

Throughout the year I have added more themes to my compendium of articles to aid the reading of visual art. Sometimes these bring surprises, as they did in discovering one of the earliest depictions of a mermaid in European art, in a Christian religious painting by Lucas Cranach the Elder, from 1518-20.

Cranach’s Saint Christopher shows the saint with his back and legs flexed as he bears the infant Christ on his left shoulder. In the foreground is an unusual putto-mermaid with a long coiled fish tail.

170 Mermaid

Late in the year, I commemorated the centenary of the death of the German artist Hans Thoma.

Thoma developed his own distinctive mythology, as seen in this fascinating painting of Wondrous Birds completed in 1892. The birds shown here aren’t storks or cranes, but are based on the grey heron, a common sight across much of the countryside of Europe. There are various myths and legends associated with storks and cranes, but I’m not aware of any for the heron.

Commemorating the centenary of the death of Hans Thoma: 1, to 1885
Commemorating the centenary of the death of Hans Thoma: 2, from 1886

Most recently I marked the centenary of the death of the great French painter of childhood, Henri Jules Jean Geoffroy.

Geoffroy’s undated painting of It’s Hard to Share shows one of the tribulations of childhood. These young boys have just emerged from a sweet shop, and the child in the centre is reluctant to share the paper cone of sweets he has just bought. His face says it all, as he looks with great suspicion at his less fortunate friend, and a dog also looks up expectantly.

Commemorating the centenary of the death of Henri Jules Jean Geoffroy, painter of childhood

Finally, over a weekend I showed some of the many paintings of the Bay (or Gulf) of Naples, a location that has been justly popular with landscape artists for well over two centuries.

JMW Turner painted the same location and mythological theme in several of his narrative landscapes, including The Bay of Baiae, with Apollo and the Sibyl from 1823. Apollo is on the left, with his lyre, and the dark-haired Sibyl has adopted an odd kneeling position. She’s holding some sand in the palm of her right hand, asking Apollo to grant her as many years of life as there are grains. Opposite the couple, on the other side of the path, under the trees, is a white rabbit.

Paintings of the Bay of Naples: 79 CE to 1857

I leave 2024 pondering why that white rabbit?

There has been at least one fresh article about Macs and macOS published here every day through 2024. Here’s a small selection of articles that you might have missed the first time, or that repay a second reading. Enjoy!

macOS Sequoia

Boot volume layout and structure in macOS Sequoia

Sequoia introduces pinning to iCloud Drive with a detailed account of xattr copying and persistence flags

How Sequoia has changed QuickLook and its thumbnails and why some may no longer work

Using and troubleshooting Spotlight in Sequoia: summary

Apple silicon Macs

Why you shouldn’t try cloning your Apple silicon Mac’s startup disk

How virtualisation came to Apple silicon Macs

Inside M4 chips: CPU core management with links to all the other articles in this series

Security

Securing the modern Mac: an overview

Controlling System Integrity Protection using csrutil: a reference and all about SIP

What do XProtect BehaviourService and Bastion rules do?

Practical tips

What to do when offered a new FileVault Recovery Key

What performance should you get from different types of storage?

How big a backup store do you need?

Is it worth storing Time Machine backups on a faster drive? with a detailed account of I/O throttling policy

Planning complex Time Machine backups for efficiency

Explainers

Ownership means two different things in Macs: how to tell them apart permissions and LocalPolicy meanings

Where has Safari gone, and why are macOS updates larger for Apple silicon? and all about cryptexes

Why % CPU in Activity Monitor isn’t what you think

History, general

The World According to Macintosh (in 1994)

Graphing Calculator and Grapher

Miscellaneous, fun

Mints version 1.18 now shows floating-point numbers in hex

I started 2024 with a new series telling the myths of Ovid’s Metamorphoses in paintings, and that continues into next year. While some of its stories are well-known, others may be less familiar if not obscure. The first episode includes the story of Jupiter and Lycaon, who tries to trick the god into cannibalism, for which he’s transformed into a wolf.

Jan Cossiers’ impressive Jupiter and Lycaon from about 1640 shows Jupiter’s eagle vomiting thunderbolts at Lycaon, who sits opposite the god. Lycaon’s head is thoroughly wolf-like already, as he hurriedly gets up from the table. Thunderbolts are seen behind the pillar in the background, and on the table is something resembling a modern burger bun.

Mediaeval folk mythology developed other tales of humans turning into wolves, although most were temporary transformations associated with cannibalistic episodes. They became progressively refined and popularised into the Gothic ‘horror’ stories of werewolves feeding on human blood, making Ovid’s account the origin of the werewolf.

1 Creation and Lycaon’s cannibalism

The year brought many artistic anniversaries, among them the bicentenary of the death of Théodore Géricault, famous for his vast painting of The Raft of the Medusa.

Towards the end of his brief life, Géricault compiled a series of ten portraits of people suffering from mental illness, then described as monomanias. He was introduced to these patients by one of the early practitioners of psychiatry, his friend Doctor Étienne-Jean Georget (1795-1828), who commissioned him to paint them to show to students as examples.

At the time, the pseudoscience of physiognomy remained popular, even among medical professionals. It claims that you can assess personality or character from a person’s outward appearance, particularly their face. In 1772, Johann Lavater codified what was at heart a pseudoscientific basis for racism and other forms of prejudice. Unfortunately, his writings were widely translated, and were enthusiastically adopted by many artists. Among more recent artists who used physiognomy in their painting are Joshua Reynolds, Henry Fuseli, William Blake and William Powell Frith.

Although intended as a finished portrait, Géricault’s Monomaniac of Envy (The Hyena), from about 1821-23, is surprisingly painterly beyond the woman’s face.

Commemorating the Death of Théodore Géricault: 3 Madness and Death

Another anniversary of note was the centenary of the death of Maurice Prendergast, whose paintings from his visit to Venice are vivacious and colourful.

Towards the end of his visit, Prendergast found a jostle of Umbrellas in the Rain (1899). They’re of any colour but dark grey, and form a brilliant arc across the painting.

In memoriam Maurice Prendergast who died a century ago

Jean-François Raffaëlli was nearly an Impressionist, but incurred the disapproval of Claude Monet by swamping their exhibitions with his paintings. In 1880, Raffaëlli showed thirty-seven, and Monet withdrew in response. The centenary of his death was an opportunity to look at his work with open mind and eye.

Although best-known for his portraits of the urban poor, The Abandoned Road (1904) is one of Raffaëlli’s finest paintings, showing where an old road running along the top of a sea cliff had been lost in a large landslip. The whaleback ridge in the foreground has an almost animal feel to it, and his use of figures and the village church gives the scene a grander scale.

Almost an Impressionist: Commemorating the death of Jean-François Raffaëlli 1
Almost an Impressionist: Commemorating the death of Jean-François Raffaëlli 2

Researching series is often a most rewarding experience, and in 2024 one of the most fascinating has been Sea of Mists, covering the paintings of Caspar David Friedrich and the German Romantics.

Friedrich’s dark Seashore by Moonlight from 1835–6 is full of foreboding, perhaps of his own death. Three small fishing boats are shown at different distances from a rocky shore. Two small rowing boats are just visible in the gloom of the foreground, and there are black shadows of fishing gear. The horizon is lined by the bright reflection of the moon, the brightest tone in the whole painting, and moonlight glints on the central area of sea. The clouds are deep indigo, in smooth folds and curves threatening rain.

German Romantic painters, overview, including contents of this series

Another series came from a personal challenge to compile an alphabet of landscape paintings. Although this grew increasingly difficult towards the end, I think I got there without being over-ingenious. My personal favourite among them is F for flowers.

For Dennis Miller Bunker flowers were an integral part of the country fields he loved to paint. Wild Asters (1889) is a brilliant assembly of different types of mark, from the sinuous curves in the stream to the fine blotches of the aster flowers. Yet the following year the artist was dead from meningitis at the age of only 29.

Contents of the whole series
Flowers

Although I had shown several of JC Dahl’s paintings here previously, Sea of Mists was my first opportunity to look at his work more systematically, alongside that of his colleague and friend Friedrich.

Throughout his career, Dahl made copious oil sketches in front of the motif. He painted this tiny plein air sketch of Dresden at Night in 1845. How he did this in the dark without the aid of modern lighting I have absolutely no idea, but it’s one of the greatest technical accomplishments of nineteenth century painting.

JC Dahl 1818-1827
JC Dahl 1829-1856

Many artists struggle for years until they achieve greatness in a single painting. For Anna Palm de Rosa, who died a century ago, that came in a late night game of cards.

In the summer of 1885, the young Swedish painter Anna Palm visited the artist’s colony at Skagen in Denmark. One night she sketched two of the couples staying in the local hotel as they played cards by candlelight, in A game of L’hombre in Brøndum’s Hotel. There’s a silent tension as all four study their cards amid dense tobacco smoke making it literally atmospheric.

In memoriam Anna Palm de Rosa: painting the card game

Two hundred years ago, there were relatively few major collections of paintings that were open to the public. In Britain, John Julius Angerstein had assembled an art collection, and on 2 April 1824, the British government bought that for £60,000 to establish a national public collection housed in Angerstein’s former town house in London. On 10 May that year, London’s National Gallery first opened to the public, and two articles here celebrate that.

If you’re ever in London, the Wilton Diptych is a must-see. Painted some time between 1395-99, probably as a personal devotional for the king, it’s a jewel fashioned from egg tempera, probably some oils, and gold leaf. It’s one of those few paintings that’s truly breathtaking.

The National Gallery also has nine paintings by Vincent van Gogh.

Perhaps the most popular of all its paintings is his Still Life: Vase with 15 Sunflowers, known as the fourth version of this series, which has the most remarkable background of them all, with a unique metallic sheen that again has to be seen in the flesh.

Celebrating the 200th birthday of London’s National Gallery 1
Celebrating the 200th birthday of London’s National Gallery 2

Another high point of the year was the bicentenary of the birth of Jean-Léon Gérôme, whose paintings illustrate his quest for truth in art.

In The Artist’s Model from 1895, Gérôme attempts the ultimate introspection: he painted himself making a sculpture he had previously painted in a painting as a sculpture. Visual references in the props, paintings seen within the painting, and polychrome sculpture provide a visual summary of his professional career.

His final painting of the personification of Truth, completed in 1896 as his reputation was fast vanishing, is his manifesto not only for his art, but for the new art of photography. He saw visual truth, as demonstrated in his meticulous realism, as the objective for painting. In that, he differed fundamentally from Impressionism, which he viewed as misrepresentation of the way that we see the world, thus visual untruth, unlike photography.

The Quest for Visual Truth: the bicentary of Jean-Léon Gérôme

One artist whose death I will be commemorating in 2025 was the subject of a pair of articles over a weekend, Lovis Corinth. For some years I had an unread copy of a monograph on his painting. As I have explored that more I have come to realise what a great master he was, and how close he came to death when he suffered a major stroke in December 1911. At first his doctors weren’t even confident that he would survive, and when he did regain consciousness, he couldn’t recognise his wife Charlotte. His left arm and leg were completely paralysed; as he had painted his entire professional career with his left hand, it looked as if that career was over.

His first major painting following his stroke returned to an earlier theme of Samson. This autobiographical portrait of The Blinded Samson (1912) expressed his feelings about his own battle against the sequelae of his stroke. In the Samson story, it shows the once-mighty man reduced to a feeble prisoner, forced to grope his way around. No doubt Corinth didn’t intend referring to its conclusion: with the aid of God, he pulled down the two central columns of the Philistines’ temple to Dagon, and brought the whole building down on top of its occupants.

Corinth’s successful rehabilitation and the resumption of his career was largely dependent on his wife Charlotte.

Lovis Corinth and Charlotte Berend: 1 Painting days of wine and roses
Lovis Corinth and Charlotte Berend: 2 Recovering from disaster

My final selection from the first half of the year is from another centenary, this time of the death of Emile Claus.

The Old Gardener (1885) is another of those paintings in which every last detail is perfect, from the backlighting against the darkness of the trees to his gnarled feet.

In Memoriam Emile Claus: Into the light 1
In Memoriam Emile Claus: Into the light 2

I hope that you enjoyed Saturday’s Mac Riddles, episode 288. Here are my solutions to them.

1: Rubberised cloth from Issigonis in 1959 is the smallest.

Click for a solution

Mac mini

Rubberised cloth (Mac, or Macintosh) from Issigonis in 1959 (Sir Alec Issigonis designed the Mini car, launched in 1959) is the smallest (the Mac mini is).

2: Waterproof cloak is in favour of the tower.

Click for a solution

Mac Pro

Waterproof cloak (a mac) is in favour of (pro, as in pros and cons) the tower (the Mac Pro is).

3: Scot with an atelier in between them.

Click for a solution

Mac Studio

Scot (Mac, from the common prefix to Scottish names) with an atelier (a studio) in between them (it’s in between the mini and Pro).

The common factor

Click for a solution

They are all current desktop Macs.

I look forward to your putting alternative cases.

The performance of local drives is complicated enough, but networked storage is even worse. Just over three months ago I published a brief guide to what you should expect from several types of storage, including a little information from network-attached storage (NAS) systems. This article adds more data points to that, to help you decide which NAS to use.

Performance will vary across different NAS manufacturers and models, and figures here are based on those measured on a range of products, with a single system providing those for 10 GbE. However, I believe these should be realistic targets that all better models should be able to achieve if not exceed. All connections were made using recent versions of macOS with their respective SMB support, and no special features like iSCSI were used, to ensure these should be readily achievable during backup and file sharing.

This table compares performance of two types of local storage, hard disks and SSDs, connected via USB 3.2 Gen 2 at 10 Gb/s, with those achieved with five different NAS configurations, all using SMB. Hard disks in NAS systems were configured in RAID 1 (mirror) arrays, while those for SSDs are individual or as JBOD. Write speeds are given for:

• the single 50 MB write test performed by Time Machine before each backup;
• 500 multiple concurrent writes of 4 KB each, performed in those same Time Machine tests;
• calculated net write speed over a first full backup to APFS of at least 180 GB;
• general write speed measurement using my app Stibium, which gives broadly similar results to other leading benchmarking apps.

General read speeds are also obtained using Stibium, and similar to other apps. All speeds are given as MB/s for consistency.

Storage medium

As you’d expect, hard disks are substantially slower than SSDs, although their difference isn’t as clear-cut when the effects of connection speed are taken into account. For example, overall backup speed to SSDs over 2.5 GbE was significantly slower than that to hard disks over 10 GbE.

Connection speed

The other dominant effect is that of connection speed, and the use of SMB over Ethernet. These are clearest when comparing NVMe SSD performance.

In general read/write testing, a local SSD achieves close to the maximum expected performance of 10 Gb/s at just under 1 GB/s. With 10GbE and SMB, write performance is about 60% of that, but 115% for reading. General performance of 2.5GbE is roughly a quarter of that of 10GbE and a local SSD.

Thus, overall performance is determined by a combination of medium, connection speed and type, each of which is rate-limiting. To get best performance improvement, you need to use both a fast storage medium (SSD) and fast networking (10GbE), in a NAS capable of delivering such good performance (processor, memory).

I/O Throttling

Behind all these performance figures lurks the mystery of how much they are affected by throttling by macOS. There would seem little point in spending good money for a higher-end NAS with 10GbE support, buying expensive network switches, and filling that NAS with costly SSDs, if macOS were then to throttle away those gains.

As I’ve explained, prior to changes in the documentation in 2019, I/O policy on throttling explicitly excluded remote volumes mounted through networks, but they’re now explicitly included in currently policy. However, throttling only comes into play when higher-priority I/O is competing for a share of the same disk bandwidth, and it isn’t a general restriction in transfer rate. There’s also evidence, presented there, that macOS runs first full backups at higher Quality of Service (QoS) to allow them to complete faster than scheduled automatic backups.

Unless a client Mac is simultaneously accessing a share on the same NAS or network, it therefore appears unlikely that I/O throttling should significantly reduce the speed of backups.

Recommendations

To improve performance of networked storage, particularly in Time Machine backups to a NAS:

1. Replace the NAS with a system designed for high performance, with processor, memory, 10GbE network connections and SSD slots capable of delivering that.
2. Upgrade your network to support 10GbE between clients and NAS.
3. Add SSDs initially to support caching for hard disk arrays, and eventually as primary backup storage.

Although suitable NAS systems will cost upwards of $/€/£ 1000, they should provide support for ample clients for years to come, and prove a worthwhile investment. Potential for improvement is greater than an order of magnitude: backups that previously had to be left running overnight, taking several hours, could take minutes, such as 180 GB in 8 minutes.

My sincere apologies – the table was omitted from the original version of this article. I have now restored that and hope it makes better sense as a result.

In the first of these two articles tracing the history of paintings of the Bay (or Gulf) of Naples, I reached the late work of Clarkson Frederick Stanfield in the 1850s. Just to recap and save you from having to look back, the Bay sweeps anti-clockwise through three-quarters of circle, from the island of Ischia in the north-west, through the great city of Naples in the north, past the slopes of Mount Vesuvius with the remains of Pompeii, to Sorrento in the south-east, and ends with the island of Capri in the south.

When Edgar Degas was in Italy between 1856-59, he made a number of landscape sketches, some in oil on paper, others like this View of Naples (1860) in watercolour. None seems to have been developed into anything more substantial, though, and he then switched to history painting and portraiture for the next decade or so.

After the rejection of his masterwork Florence from Bellosguardo, the Pre-Raphaelite landscape painter John Brett didn’t hang around in England, but went out to Italy again for the summer of 1863.

Massa, Bay of Naples (1863-64) is perhaps the most spectacular of the oil paintings that Brett completed during this Mediterranean campaign, and appears to have been painted from a vessel on the water.

He had travelled there on board the SS Scotia, although it’s unclear whether that ship served as his floating studio, or he may have transferred to another. The Scotia arrived in the Bay of Naples by 9 September, following which he went to stay in Sorrento, then Capri by November. It’s therefore likely that he continued to work on this finely detailed painting during the winter of 1863-64.

His work wasn’t in vain, as this transformed his career. Alfred Morrison bought this painting for the substantial sum of £250, and Brett was to benefit further from his generous patronage. By August the following year Brett could afford to buy his own yacht, and tried a change of tack: painting the British coast using studies made in front of the motif, and working on his finished paintings in his studio.

Alfred William Hunt’s Bay of Naples – A Land of Smouldering Fire (1871) was probably based on sketches and studies made during his tour of the Mediterranean during the winter of 1869-70. This view is taken from the top of the Vómero, a hill to the west of Naples. In the left foreground is a wall from the fortifications. In the far distance, across the bay, is Vesuvius, still partially lit by the rays of the setting sun.

The Italian Impressionist Giuseppe De Nittis painted this Seascape near Naples in 1873, early in his career.

The following year the Catalan artist Marià Fortuny painted Portici Beach on the waterfront of Naples. Tragically, he contracted malaria while painting there en plein air, and died from that when he was in Rome just a few months later.

Alessandro la Volpe was a local landscape painter, whose View of Capri from 1875 shows the island in a heat haze, from the hills above Sorrento.

Oswald Achenbach’s View of Capri (1884) shows the island from a similar vantage point in the hills above Sorrento. Achenbach was one of several members of the Düsseldorf School who visited Italy on multiple occasions during his career, ending with this extended visit that started in 1882.

Pierre-Auguste Renoir painted Bay of Naples, Evening during his stay of several weeks in Naples in 1881. He had been unable to paint when in Rome earlier, but once he arrived in this city was able to complete figurative works and two matching landscapes of the bay. Although it was recognised that these two views represent morning and evening, for some years they were confused, and this painting was thought incorrectly to show the bay in the morning.

In this painting of Sorrento from 1899, Ukrainian artist Mykhaylo Berkos shows trees growing in an old ruined building facing the Bay of Naples, on the Sorrentine Peninsula closest to Capri.

In his later years, the American landscape artist Charles Caryl Coleman lived on the nearby island of Capri. In 1906, at the start of Vesuvius’ eruption in April, he travelled to the mainland to paint A Shower of Ashes Upon Ottaviano in pastels. This shows the dust- and smoke-laden air of the Naples suburb Ottaviano at ten o’clock in the morning. Although Ottaviano was spared anything worse than dust and smoke in 1906, it was badly damaged during the volcano’s last substantial eruption in 1944.

My last two paintings are both by the Italian-American artist Joseph Stella, who came from the city of Muro Lucano, inland and to the east of Naples.

Stella’s Purissima from 1927 places a mystical woman between the two sacred Ibis birds. In the background is the Bay of Naples, with Mount Vesuvius at the right.

This undated landscape sketch of Vesuvius III probably dates from the same period, and looks south-east across the Bay of Naples, with Castel dell’Ovo nearest.

In the year that we celebrated the fortieth birthday of the original 128K Mac, Apple has ensured we’ve got plenty more to remember in the future. Just as we were starting to get to grips with its third cycle of Apple silicon Macs, it leaped into the start of the fourth, in the first M4 models. We’ve also just about survived the annual purgative macOS upgrade, and even updated the firmware in our Magic Keyboards.

For once, the release of Macs featuring the next family in the M-series was heralded by their appearance in iPads in May. By that stage I had just about worked out what had changed in the CPU cores of the M3 from the previous November. Perhaps my most lasting impression is that code running in a virtual machine on an M3 host is often faster than running native on an M1 from four years ago.

Apple then delivered the smallest Mac ever in the Mac mini, a product line that didn’t even have time for an M3 version. Perhaps inevitably, I and a great many others recognised a new classic in the making, and my Mac mini M4 Pro has displaced my Mac Studio M1 Max from its connection to my Studio Display since it arrived on 8 November. Since then I’ve been stealing a little time to look inside its CPU core management, and have been surprised at how different it is from all the previous Apple silicon Macs I’ve examined.

I’ve also been delighted at how many using older Macs, some as far back as High Sierra, have decided the time is right to migrate to an M4. Leaping forward through all the changes in macOS over those seven hectic years isn’t straightforward, and learning that every one of your apps needs to be replaced must be disquieting. Those of us who have endured the annual pain of architectural changes brought by each new version of macOS can see how concentrating all that into a single migration is going to be intense agony. It’s like having your blisters treated with tincture of benzoin and its couple of minutes of excruciating pain, compared with the prolonged discomfort of leaving the blisters to heal naturally.

While Apple distracted almost everyone with its delayed introduction of AI tools, macOS Sequoia brought plenty of new and changed features that have had greater immediate impact.

Virtualisation of macOS on Apple silicon Macs has for too long been almost wonderful. Sequoia has nudged it slightly closer, but left it even more tantalisingly close, with the addition of limited support for what’s now known as Apple Account. The most obvious missing feature in macOS VMs has been support for App Store apps. Given Apple’s emphasis on their value, it’s extraordinary that VMs can enjoy good iCloud support, but still can’t run any third-party App Store apps. The underlying reason is most likely the authorisation scheme for the use of App Store apps, a tragic example of Apple’s business model thwarting its engineering aims. As far as I can tell, VMs aren’t eligible to use AI either, although for some that may be a blessing.

Sequoia lays the foundations and builds the first storey of a password manager that deserves further development. Its success is going to depend on whether Apple can integrate a modern solution for the login and other traditional keychains, a problem that the Keychain app currently ducks and leaves to Keychain Access, but hiding that still essential utility away in CoreServices won’t make it go away.

iCloud Drive has at last gained the ability to ‘pin’ files and folders to prevent them from being evicted from local storage. However, what at first sight appeared perfect paled when we discovered its idiosyncratic human interface that behaves like nothing else in the Finder, if not the earth. Hopefully an engineer will be along later next year to improve that.

In other ways Sequoia wasn’t so marvellous. One of its smaller changes that has rightly offended many has been the removal of support for third-party qlgenerators, responsible for QuickLook thumbnails and previews of custom document types. Apple had deprecated them way back in Catalina, so we had been warned, but quite a few good apps have lost QuickLook features as their developers haven’t yet implemented the App Extensions required to replace their now non-functional qlgenerators.

There has been a great deal more going on underneath the interface of macOS. As I’ve already explained in more detail, 2024 has been the year of XProtect, not only for its new update mechanism, but for Apple’s heavy assaults on malware including Adload, the subject of a hefty campaign of new detection signatures back in April.

In May, following unsubstantiated reports of the reappearance of old files, there was speculation as to the effectiveness of one of macOS’s more recent boons, Erase All Content and Settings, or EACAS. As so often happens, the rumours failed to stand up to careful scrutiny, and many former owners of Macs breathed easier that they hadn’t passed on all their personal data when they disposed of their previous Macs.

Notable by their absence over the whole of the year have been RSRs, the Rapid Security Responses we had been led to believe would spare us urgent macOS security updates. Although they may have fallen out of favour, the cryptexes they rely on have proved more useful in other ways.

Finally, the fortieth anniversary of the 128K Mac has been marked in another nearly unique event, a firmware update for Apple’s Bluetooth Magic Keyboards that was so stealthy most of us aren’t aware that our keyboards were updated, or maybe they weren’t and it was all a dream. And I managed to get to the end of this review of 2024 without looking in detail at AI. I’m sure there’ll be time for that next year.

I wish you all a peaceful and prosperous New Year.

This weekend we’re not off skiing, but seeking the mild winter in the Bay (or Gulf) of Naples, on the western coast of south Italy. This sweeps anti-clockwise through three-quarters of circle, from the island of Ischia in the north-west, through the great city of Naples in the north, past the slopes of Mount Vesuvius with the remains of Pompeii, to Sorrento in the south-east, and ends with the island of Capri in the south.

Over the centuries it has been visited frequently by artists, many of whom have overwintered here, and on the island of Capri. In this article I show landscape paintings starting from before the catastrophic destruction of the Roman city of Pompeii, and ending just before the birth of Impressionism. I conclude tomorrow with paintings well into the first decades of the twentieth century.

Although it took nearly 1500 years before Giorgione made one of the first ‘proper’ landscape paintings in modern European art, by the first century CE the Romans of Pompeii were only too pleased to see pure landscapes with no discernible narrative content on the walls of their villas.

Above is a port scene found as a fresco in Stabiae, near Pompeii, presumably showing that port at its height just before it was destroyed by the eruption of Vesuvius in 79 CE.

Seventeen hundred years later in Naples, a pioneering Welsh artist created one of the gems now in the National Gallery in London.

Thomas Jones started making landscape sketches in oils in the 1770s. He worked in Italy from 1776 to 1782, around Rome and Naples, where he completed many plein air paintings in oils, including this tiny Wall in Naples from about 1782. He’s now recognised as being the father of Welsh painting, and one of the first painters to make oil sketches in front of the motif.

A little later, a local landscape painter Giovanni Battista Lusieri became one of the first to create true panoramas in his watercolour views of the city. For this View of the Bay of Naples, Looking Southwest from the Pizzofalcone Toward Capo di Posilippo from 1791 he joined several sheets of paper together to depict the northern shore of the bay.

JMW Turner’s second version of Lake Avernus: Aeneas and the Cumaean Sybil, dates from 1814 or 1815, and is true to the spirit of Claude’s earlier landscapes. This is a beautiful setting of Lake Avernus, near Pozzuoli, to the west of the city of Naples. In the distance is Baiae and the cliffs of Cape Miseno. The Sibyl is seen holding aloft a golden sprig rather than a bough, and Aeneas stands with his back to the viewer, as if he too is enjoying the view.

Shortly afterwards, the great French landscape artist Achille Etna Michallon painted this Sea View, Salerno (1822), showing the coast to the south-east of Naples.

At about the same time, the Bay became a focus of attention for JC Dahl and some of the German Romantic artists. Dahl had aroused the interest of Prince Christian Frederik of Denmark, who had become his patron and friend while he was still in Copenhagen. In 1820, the prince invited Dahl to join him in the Bay of Naples to paint there for him.

Dahl’s The Gulf of Naples. Moonlight (1820-21) is deeply influenced by Caspar David Friedrich, with its Rückenfigur wearing a top hat looking out to sea, fishing boats and nets, and the bright moonlight.

His visit to the Bay coincided with an active phase for the local volcano Vesuvius, during which JMW Turner visited and painted an eruption. Although Dahl was sufficiently enthused to make several oil sketches and take some to completion as finished works, he didn’t become as obsessed as others did.

In The Bay of Naples by Moonlight, painted the following year, he has used the warm red light from a more modest eruption to provide colour contrast, and enhance fine details of fishing nets in the foreground.

In 1828 Carl Gustav Carus visited the Bay, where he painted this wonderful view of Castel dell’Ovo in Naples. Given that it was made in oils over a pencil drawing on paper, this appears to have been painted in front of the motif.

Carus appears to have visited Naples on other occasions too. In about 1829-30, he stayed close to Castel dell’Ovo and framed a view from sea level in his Balcony Room with a View of the Bay of Naples (via Santa Lucia and the Castel dell’Ovo). The district of Santa Lucia consists of the waterfront buildings seen here between Carus’ accommodation and the Castel dell’Ovo.

JMW Turner returned to the same location and mythological theme in The Bay of Baiae, with Apollo and the Sibyl in 1823. Apollo is on the left, with his lyre, and the dark-haired Sibyl has adopted an odd kneeling position. She’s holding some sand in the palm of her right hand, asking Apollo to grant her as many years of life as there are grains. Opposite the couple, on the other side of the path, under the trees, is a white rabbit.

When Ivan Aivazovsky was sponsored by the Imperial Academy to study in Europe, he travelled to Italy, where he visited Florence, Amalfi, and Sorrento, then stayed in Naples and Rome until 1842. During this period he painted many beautiful views of the Italian coast, and of Venice.

The Bay of Naples (1841) is a good example of Aivazovsky’s early paintings from Italy, in which he often sought the rich colours of sunrise and sunset. These aren’t large canvases, but he shows fine details such as the rivulets of water falling from the oars.

A later visitor was the accomplished British coastal painter Clarkson Frederick Stanfield.

This view of Ischia and the Castello d’Ischia, near Naples, from 1857, shows how subtle Stanfield could be when depicting the distant snow-capped mountains of Ischia.

This undated view of The Gulf of Pozzuoli appears to be one of his few coastal views in which there is not a breath of wind, and the sea is calm.

Here are this weekend’s Mac riddles to entertain you through family time, shopping and recreation.

1: Rubberised cloth from Issigonis in 1959 is the smallest.

2: Waterproof cloak is in favour of the tower.

3: Scot with an atelier in between them.

To help you cross-check your solutions, or confuse you further, there’s a common factor between them.

I’ll post my solutions first thing on Monday morning.

Please don’t post your solutions as comments here: it spoils it for others.

Over the last few years the way that Apple and its official authorised service providers handle your Mac has changed. When you take or send in your Mac for repair or service, they no longer start it up in the way that you would, so don’t need to log into it the way that you do. This is why there are hidden FieldService folders or volumes in /System/Volumes, as they will be used during its service. In the past, technicians often needed access to your user account, and you may have been asked to provide your password; now it’s the exact opposite.

Back up

The first and most essential step in preparing your Mac to go away, even for a brief battery replacement, is to ensure that you’ve got at least one full and complete backup on storage that will remain with you. If you use Time Machine, its backups should do fine, but you should check that they don’t exclude folders or volumes that you can’t readily restore. Open Time Machine settings and click on the Options… button to ensure that no significant data are excluded from your Mac’s final backup.

Some repairs will inevitably lead to all your documents and files being wiped. Any that requires the main logic board to be replaced is almost certain to do that, but so can other procedures that you wouldn’t expect to be as radical in effect. Technicians generally work on the assumption that you have already taken care of your own files, so if they do need to erase or replace internal storage, don’t be caught out and lose all your data.

Enable FileVault

Once you’ve backed your Mac up, if FileVault isn’t enabled, turn it on, if your Mac will cope with that. Intel Macs with a T2 chip and Apple silicon Macs don’t encrypt the contents of their internal storage when you do that, as the Data volume is always fully encrypted. All they do is use your password to protect the encryption key that’s already being used to encrypt your data. That’s more than sufficient to prevent anyone who doesn’t know your password from gaining access to anything on your Mac’s Data volume. Although it’s most unlikely that any technician might try to abuse that, FileVault ensures they can’t.

For Intel Macs without a T2 chip, enabling FileVault does require the entire contents of the Data volume to be encrypted, which can take many hours or even days. If you have sufficient advance notice, it’s still worth considering.

If your Mac has a T2 or Apple silicon chip and is going to have its internal storage, or its main logic board, replaced, then you can safely assume that you’ll be restoring it from your backup when that Mac has been repaired. For an extra touch of security, immediately before parting with it you can use the Erase All Content and Settings (EACAS) feature in System Settings > General > Transfer or Reset. That will destroy the encryption keys to its Data volume and ensure that no one will ever be able to access its contents.

Firmware password, Find My Mac

There are a couple of things that you need to do to help the technician:

• If it’s an Intel Mac and you have enabled the Firmware Password feature in Recovery Mode, disable that, or no one will be able to do anything with your Mac.
• If it has a T2 or Apple silicon chip, disable Activation Lock by turning off Find My Mac. This control is buried away in Apple Account in System Settings: click on iCloud, then in the Saved to iCloud section near the top, click on the See All button. The Find My Mac control is about seventh from the top in that list. If you can’t find it, you should be able to remove that Mac from iCloud online in iCloud.com, but that’s more draconian in effect.

Final preparations

If you’re sending your Mac in, you’ll probably receive detailed instructions as how to prepare and package it ready. If you’re taking it in, then technicians normally appreciate it if you bring its power cable. Once it’s ready and shut down, give it a quick clean. That’s important if it’s being repaired under AppleCare+, when signs of neglect or abuse might count against you. Macs that have been used in smoky areas usually accumulate tar deposits that should be carefully removed from around their ports. In more serious cases a deep clean may be needed: a technician told me of an iMac that had been the perch for its owner’s parrot, and had become heavily soiled by the bird’s droppings.

When you’re taking your Mac in, remember to take evidence of its purchase in case that’s needed, and a written record of your user name and password, in case you’re asked to start it up. There’s nothing worse than struggling to remember them when under pressure.

These apply to Macs to be serviced or repaired by Apple technicians, or those of Apple Authorised Service Providers. If your Mac is being maintained by an independent repair shop, then they may require different, so ask them what they need you to do.

Summary

• Back it up fully, as if the internal storage is going to be wiped or replaced.
• Enable FileVault, if feasible.
• Disable any firmware password.
• Turn Find My Mac off.
• Clean it.
• Remember any receipt or other documents, and its power cable.

In the final quarter of the nineteenth century, paintings followed the literary trend into detective stories, first posing the viewer an open-ended narrative, then inviting them to be a detective for problem pictures. Although now remembered for just one of these paintings, William Frederick Yeames was among the leaders, who even depicted a notorious suspicious death.

Yeames was the son of a British consul in Russia and was born in Taganrog, on the shore of the Sea of Azov, to the north of the Black Sea, when it was part of the Russian Empire. His father died when he was only seven, so he was bundled off to Dresden in Germany to be educated, and to start learning to draw and paint. His family brought him back to Britain, where he received private tuition before travelling to Florence at the age of only 17. He studied there, copied the Masters, and finally returned to London in 1859.

He took up residence in Saint John’s Wood, then an affluent and leafy suburb of the city, and formed what became known as the Saint John’s Wood Clique, with Philip Hermogenes Calderon, Frederick Goodall and George Adolphus Storey.

Yeames’ particular interest, and the basis for many of his best paintings, was the Tudor and Stuart period in English history. In Hiding the Priest (1868-74), he shows a ‘priest hole’ used to hide Catholic priests during several purges that took place during the reign of Queen Elizabeth I. A priest is shown ascending into the hidden chamber by ladder, as one of the family, at the left, watches for the arrival of pursuivants who pursued Catholic priests during a purge. The room shown here is now known as the Punch Room, in Cotehele House, a superb sixteenth century manor house on the border between Devon and Cornwall, to the north of Plymouth, England.

For the Poor from about 1875 shows two nuns collecting food door-to-door to feed the poor during a bitter winter, probably on the edge of Dartmoor, Devon.

Yeames became fascinated by the macabre story of Amy Robsart, who had died in suspicious circumstances in 1560.

He introduces her in his 1877 narrative painting. She married Robert Dudley, son of the Duke of Northumberland, shortly before she reached the age of eighteen. He was then condemned to death after his father failed to stop Mary I’s accession as queen in 1553, but was released the following year. Dudley was called to court as Master of the Horse to Queen Elizabeth I when she acceded to the throne in 1558, became a favourite of hers, and allegedly one of her loves if not lovers.

Amy didn’t follow her husband to court, and hardly ever saw him. On the morning of 8 September 1560, when she was staying at a country house near Oxford, she dismissed all her servants, and was later found, as shown here, dead with a broken neck at the foot of the stairs. Although an inquest found no evidence of foul play and returned a verdict of accidental death, Amy’s husband was widely suspected of having arranged her death.

In the gloom above Amy’s body, Yeames shows Anthony Forster, one of Dudley’s men, leading his manservant down the stairs when they discover Amy’s body. The implication here is that Forster murdered Amy on Dudley’s orders, one of many speculative accounts of her sudden death.

In 1884, Yeames painted this portrait of Amy Robsart.

Like most of Yeames’ history paintings, And when did you last see your Father? (1878) is plausible but imaginary rather than based on historical records. It shows a Royalist household during the English Civil War between 1642-51. The men present are Roundheads, Parliamentarians, who are trying to locate and capture the head of the household, the small boy’s father.

The boy shown is based on Gainsborough’s famous portrait of The Blue Boy (1779), and modelled here by the artist’s nephew. Although he’s being questioned amicably if not sympathetically, the question put to him in the title of the painting exploits the openness of childhood in an effort to get the boy to betray his father’s whereabouts, an unpleasantly adult trick. Next in line for a grilling is an older girl, who is being comforted by a Roundhead soldier, but is already upset. Their mother and an older daughter wait anxiously at the far left.

Towards the end of the century, Yeames turned these open narratives into increasingly popular problem pictures, culminating in one of the finest of the sub-genre.

Defendant and Counsel (1895) would have been exhibited in London, illustrated as an engraving in newspapers, and no doubt generated a flurry of opinionated letters completing its story, and passing judgement on its subject. It shows an affluent married woman wearing an expensive fur coat, sat with a popular newspaper open in front of her, as a team of three barristers and their clerk look at her intensely, presumably waiting for her to speak.

As she is the defendant, the viewer is encouraged to speculate what she is defending: a divorce claim, or a criminal charge? This also opens the thorny issue of counsel who discover that a defendant is lying, but still mount their defence in court, and may succeed in persuading the court to believe what they know to be false. Like And when did you last see your Father? this may be an exploration of truth and the problems posed by it.

Yeames died at the age of 82, on 3 May 1918, in the Devon Riviera resort of Teignmouth. And when did you last see your Father? was bought by the Walker Gallery in Liverpool shortly after it opened in 1877. A tableau of the painting has also been in Madame Tussaud’s wax museum in London for many of the intervening years. But no one knows who killed Amy Robsart, or whether it was just a tragic accident.

Wikipedia

William Frederick Yeames
Amy Robsart

As the threat landscape and strategies change, different parts of macOS security have been more actively developed. When Java and Flash vulnerabilities were dominant, XProtect’s metadata became vital for blocking older unpatched versions. Then in 2020, Apple grew XProtect’s Yara signatures to detect more malicious software, in 27 updates released that year. That campaign had finished by 2023, when it was only updated once each month, and all eyes were on the youthful XProtect Remediator maturing rapidly in its 18 updates. This article outlines what changed in macOS security protection during 2024, and how Apple has shifted emphasis back to XProtect, together with the importance of CDHashes and notarization.

XProtect

This has definitely been the year of XProtect, which performs on-demand checks of code that’s about to be launched, using a set of Yara rules to detect known malware. Our Macs started 2024 with version 2177, and after a record total of 29 updates for all macOS and a sudden change in version numbering, by the year’s end that has reached 5284. Even more impressive is the growth of XProtect’s Yara detection rules: at the start of 2024 there were about 195 rules taking 167 KB of text; as we pass into 2025, there are now about 328 rules in 921 KB of text. That’s 170% of the number of rules, and over five times the size.

macOS Sequoia has also brought the most substantial change to XProtect itself, in the introduction of a new medium for delivery of updates to its data, suggesting that XProtect is being forked. When macOS 15.0 was first released, XProtect could receive updates via either the old mechanism of Software Update, or through a new connection to iCloud using CloudKit. After a transition period, updates switched to iCloud only with effect from macOS 15.2.

Apple released two test updates for Sequoia only during September, one of which brought a huge increase in Yara rules in a file of 1.2 MB in size. This suggests that Sequoia’s XProtect is likely to see more frequent and larger updates now that this new mechanism has been tried and tested. How that will run alongside updates for older macOS has yet to be demonstrated, and none of this has been documented by Apple.

XProtect Remediator

This runs daily or more frequent background scans looking for the presence of malicious software and remediating it whenever it can. Although most of its scans are brief, those for Adload can now take several seconds or longer. Our Macs started the year with version 122 containing 22 scanning modules. Since then there have been 18 updates, bringing new modules for Bundlore (also the subject of a campaign in XProtect), and the newer Crapyrator and Dolittle (covered by extensive rules in XProtect), while RedPine has been dropped. We end the year with version 149.

For much of the year updates have been released every two weeks, but have reduced to one update each month since the summer. It’s thought that XProtect Remediator also uses XProtect’s Yara rules for detection purposes, so it should have benefitted from all those updates as well.

XProtect Behavioural and Bastion

The most recent of the XProtect trio, this watches for code that breaks its Bastion rules of behaviour by accessing files in specific sensitive locations, and similar. Apple states in its Platform Security Guide that this isn’t used to block apps or for local detection: “In addition, XProtect contains an advanced engine to detect unknown malware based on behavioral analysis. Information about malware detected by this engine, including what software was ultimately responsible for downloading it, is used to improve XProtect signatures and macOS security.”

Its Bastion rules have grown from 7 to 12, adding watched locations in ~/Library and /Users/Shared and more. Apple doesn’t provide any information as to how useful this intelligence is proving.

Gatekeeper

As all those using macOS Sequoia will have discovered by now, it brings a major change to way that Gatekeeper’s checks for notarization can be bypassed. In recent versions of macOS, this has been simple to accomplish using the Finder’s Open command, so simple that malware developers commonly coach the user through this to ensure their unsigned code is run without the defences of macOS. The new procedure requires permission to be granted explicitly in Privacy & Security settings.

This has proved controversial, with some who distribute code that isn’t notarized complaining that it’s getting in the way of users running perfectly benign software. However, it’s an important part of the transition to reliance on CDHashes known to Apple. It has already posed a problem to those distributing malicious code, for which no simple workaround has yet emerged. This has also led to a few legitimate apps being blocked, typically when they have been updated in place without fully updating their CDHashes and notarization ticket.

MRT

The old macOS Malware Removal Tool MRT has been superseded in Catalina and later by a scanner module in XProtect Remediator. MRT was last updated nearly three years ago, with version 1.93 from 29 April 2022 being the last. It hasn’t been entirely forgotten, though, and may still be installed on the latest Apple silicon Macs.

Threat

Fuller accounts of changes in the threat landscape are given by independent security researchers. Moonlock’s was published earlier this month, and I’d expect to see reviews from Patrick Wardle at the Objective-See Foundation and others in the coming days.

The year has seen continuing increase in the number and variety of malicious products for macOS. It’s surprising how many old names like Adload and Bundlore are apparently still thriving, and the emphasis remains on stealers. Recent directed attacks have demonstrated increasing ingenuity and technical skills, and at least one managed to sneak its way through screening by Apple and became notarized, although that has since been revoked.

As ever, threats are most immediate for those who engage in high-risk activities, including downloading cracked commercial products, and dealing in cryptocurrency.

The year ahead

Given that there’s no sign yet that Apple has driven away those who develop and deploy malware, 2025 isn’t likely to be any easier. Most malware has yet to respond to the change brought in bypassing notarization requirements. While there are bound to be more attempts to get malware notarized by Apple, the chances of a notarized app being malicious are likely to remain as close to zero as possible. Greatest risks will continue for those who run unnotarized code from uncontrolled sources.

Apple has put a lot of effort into the changes it has made in XProtect, and will expect to see results in the coming months.

The full festival of Christmas runs on to Twelfth Night on 5 or 6 January, the latter being the Epiphany, celebrating the second of the traditional Adorations, that of the three wise men or magi. For the sake of brevity and simplicity, I bring that forward to this article, together with the Adoration of the shepherds. Twelfth Night is also well known as the play by William Shakespeare, written to serve as entertainment to close the festival of Christmas. As you might expect, that play has nothing whatsoever to do with Christmas.

The three foreign kings or wise men are of particular interest, as the word magi implies their wisdom involves astrology and possibly darker arts, a strange association for the birth of Christ. Most visual artists have therefore opted for the less controversial interpretation as kings, while still showing the star that guided them to Bethlehem.

William Blake’s version of the Adoration of the Kings is more conventional than his Nativity shown in yesterday’s article. It has also retained more of its original beauty, with the three wise men presenting their gifts to Jesus and his parents. At the left, shepherds are outside tending to their flocks of sheep beneath a stylised star, and at the right are the traditional ox and ass.

In the account of the nativity of Christ in the Gospel of Luke, chapter 2, verses 8-15, an angel appeared to shepherds around Bethlehem and announced the nearby birth, the scene shown in Jules Bastien-Lepage’s The Annunciation to the Shepherds of 1875.

This could have been Bastien’s painted manifesto, showing how he builds on tradition rather than discarding it. It strikes a compromise between the gilding and Renaissance look of the angel, the rural realism of the shepherds who have come from Millet rather than Bethlehem, and the controlled looseness and gesture of its darkened landscape. He wastes not a brushstroke in telling its simple story, in the almost averted facial expressions, arms frozen in surprise, hands that have just been tending sheep, even down to the shepherds’ bare and filthy feet.

This exquisite tapestry was designed in 1888 by Edward Burne-Jones, William Morris and the lesser-known John Henry Dearle. This version was woven six years later for the Corporation of Manchester, and is one of ten known examples. The composition was taken from a watercolour by Burne-Jones from 1887, photographically enlarged into cartoons, and finally coloured and decorated with flowers by Morris and Dearle.

In the early twentieth century, the British Impressionist artist Edward Stott painted a few religious motifs, including this undated pastel nocturne of the Adoration of the Shepherds.

Albin Egger-Lienz’s Christmas Eve from 1903 is a reinterpretation of the Adoration of the shepherds set in a Tyrolean cowshed, with skilful use of light. I suspect its title has been mistranslated, and should instead refer to Christmas Night.

Henry Ossawa Tanner’s Angels Appearing before the Shepherds from about 1910 adopts a more radical approach in his mixture of loose brushstrokes, rubbings, and scumbled passages akin to Symbolism. Its colours are constrained, with a single patch of orange at the lower right indicating a small open fire, amid an abundance of blues and greens. The angels at the left are so ethereal that they could at any moment dissipate into a puff of smoke, and the three shepherds look almost insignificant by comparison.

In 1913, Kazimierz Sichulski painted one of his mixed media triptychs showing the Adoration of the Magi. The centre panel is a conventional Nativity, complete with the Holy Family and a regulation ox. The left panel has two of the magi and the ass, and the right completes the set of three magi.

Sichulski also painted this later triptych of Adoration of the Shepherds in 1938, using oils in freer style. This is perhaps set among the Hutsul people of the Carpathian Mountains, one of the artist’s favourite locations.

With those we roll on to the New Year.

Before Apple launched the Macintosh Portable in September 1989, the only way to lug a Mac around was in a hefty case. Although it broke new ground, unless you enjoyed weight-training the Portable’s 7.2 kg mass wasn’t at all convenient. Some of that weight and bulk resulted from its internal lead-acid battery, which Apple claimed was capable of providing its power for 6-12 hours. In practice, unless you flew supersonic on Concorde, it wasn’t likely to last a transatlantic flight.

Two years later, Apple replaced that with PowerBook 100, 140 and 170 Macs, the first that were truly laptops rather than just luggables. Although the 100 still relied on a lead-acid battery, the 140 and 170 introduced 2.5 amp-hour NiCads. This was also the start of much confusion among users over battery care.

Lead-acid batteries live longest when kept fairly fully charged, and like to be trickle-charged whenever possible. At the time, conventional wisdom was that nickel-cadmium (NiCad) batteries were prone to a ‘memory effect’ whereby repeated charge-discharge cycles would somehow result in falling charge capacity until the battery was incapable of delivering any useful working time. As a result, users resorted to all kinds of magic tricks to try to maintain their 2-3 hour battery endurance, the period they could run off battery alone. While these new PowerBooks were less than half the weight of the original Portable, their useful working time on battery was still insufficient for many internal flights within the US or Europe.

In 1992, Apple started introducing new PowerBook models featuring the next generation of batteries, nickel-metal hydride or NiMH, pushing their endurance to as long as 6 hours if you were lucky. Their charge and use characteristics were different from NiCads and lead-acid, and although Apple provided battery management software, many seemed to distrust it and preferred their own routines. Given that at this time a PowerBook could have any of five different battery types (as there were Type I, II and III NiMH), some confusion was inevitable.

This proved just the right market for expensive battery conditioners, aimed at organisations with many PowerBooks, and costing significantly less than all the replacement batteries they claimed to save. To this day I don’t know whether any of their proprietary charge-discharge sequences ever improved either endurance or overall working life, but they seemed a good idea at the time. The PowerBook 520 of May 1994 supported one or two “Intelligent” NiMH batteries with a claimed endurance of up to 5 hours each, and had at last reached the capacity needed to operate a Mac for the duration of a transatlantic flight, so long as you went no further than the East Coast.

Just over a year later, in the PowerBook 190cs, Apple brought the first of the new generation with lithium ion batteries, although in that case it resulted in a small reduction in endurance compared with the NiMH battery in the 190. From 1997. LiIon became standard for almost all the remaining PowerBook models until 2006, when the first MacBook Pro with its shiny new Intel Core Duo processor also brought lithium-polymer, as used today.

Battery capacities had been rising slowly, and that MacBook Pro’s battery provided 60 watt-hours, giving an endurance of ‘up to’ 4.5 hours on a full charge. For the first time, Apple felt confident enough to forecast the working life of a maximum (that ‘up to’ again) of 300 charge cycles.

In the years since, battery capacity has increased further, as has endurance. For example, the 17-inch MacBook Pro from early 2009 had a 95 watt-hour lithium polymer battery claimed to run for ‘up to’ 8 hours from a full charge, and to have a working life of a maximum of 1,000 cycles.

Users were provided with basic power management features in the Energy Saver pane in System Preferences.

There was also an active market in third-party monitoring and management software, here Battery Health Monitor from Sonora Graphics.

This is Energy Saver a couple of years later, in 2011.

This shows the Energy Saver pane, detailed information in System Information, and another third-party utility, coconutBattery Plus by Coconut-Flavour, in 2020.

The next big step up came not with better batteries, but in 2020 with the switch from Intel CPUs to Apple silicon chips. The following year, the 16-inch MacBook Pro with a capacity of nearly 8.7 amp-hours (99.6 watt-hours) was claimed to run for up to 14 hours browsing over Wi-Fi, with the same 1,000 cycle battery working life.

The chart above shows how capacity, expressed here in watt-hours, has increased in major new PowerBook and MacBook Pro models over this period. The most substantial increases occurred in 1997-98 and 2007-08, coinciding with the introduction of LiIon batteries and Intel MacBook Pros.

Claimed endurance on a fully-charged battery has risen exponentially over time, but I doubt whether that will be sustained for much longer.

As you might expect, there’s also a looser non-linear relationship between battery capacity and claimed endurance, although that has altered with the transition to low-power Apple silicon chips.

As many have discovered, even using battery management software in macOS, some batteries die young, and others can swell alarmingly. Over this period of 35 years, Apple has operated various extended battery support schemes, and faced criticism over battery working life. Some have even alleged that battery replacement is a profitable service for Apple. But in the long run, many of us have made increasing use of battery-powered Macs, and they have transformed many lives.