Apps are getting ever more flexible, and in doing so they’re also becoming increasingly complex. Gone are the days when they mostly opened files, did things to them, and saved them again. We now expect to be able to use our favourite image editor from inside the Photos app, and to share documents between multiple apps, using features as services in reusable components.
For those of us who used OpenDoc back in the 1990s this is all familiar territory. Intended as Apple’s response to Microsoft’s OLE (Object Linking and Embedding), OpenDoc broke apps down to single-task components that worked together. This was best exemplified in the suite of Internet tools provided collectively as Cyberdog for a brief period in 1996-97. Those included a web browser, FTP and email clients, and a newsreader, that could be embedded in other apps that supported OpenDoc’s Bento format.
When Steve Jobs killed OpenDoc in 1997, few could have envisaged what was to come later in app extensions, or appexes, nor how extensively they have become used by macOS. From speech synthesisers and Blu-ray encoders to wallpapers and widgets, appexes have proliferated far beyond the wildest dreams of the OpenDoc designers, but so little is known about they’re managed by macOS.
macOS Sequoia keeps extensive registries of apps and appexes. The most detailed is the grand database maintained by LaunchServices, only visible through its hidden lsregister command tool. Appexes are the preserve of the PlugInKit registry, which can be dumped using the pluginkit tool. Resource management is performed by RunningBoard and appears inaccessible, as do the activity schedules managed by Duet Activity Scheduler (DAS).
All four registries appear to be constructed afresh during startup, in the case of LaunchServices and PlugInKit by a process of discovery, something I’ll be looking at in more detail in the near future. For PlugInKit, it’s discovery that determines which appex services are offered, whether they’re generators of QuickLook thumbnails or previews, Safari extensions, or file systems such as ExFAT or MS-DOS. The latter are refugees from their former existence as kernel extensions, a route now being followed by macFuse 5.0.
Although the user has limited control over those in System Settings and, in the case of Safari extensions, in Safari’s settings, the PlugInKit registry is designed to operate automatically. If the user does try making changes using pluginkit those are likely to be undone when the registry is next updated, and in any case following reboot.
There are some differences obvious between LaunchServices’ database and PlugInKit’s registry. While LaunchServices comfortably accommodates as many versions of apps that it can find, and offers them as choices for opening documents in the Finder’s contextual menu, PlugInKit makes the user’s life simpler by only offering the latest version of each appex. Given that appexes now include replacements for QuickLook’s qlgenerators, and Spotlight importers, that’s hardly surprising, and the prospect of being offered multiple versions in the Share menu would be overwhelming for any user.
PlugInKit and appexes aren’t recent, and probably date back to OS X 10.9 Mavericks, with their NSExtension property list definitions appearing a year later in Yosemite. In macOS 13 Ventura, Apple augmented that with ExtensionKit and ExtensionFoundations both for creating extensions and the extension points offered by host apps. Appexes now cover many different domains, and have become increasingly popular in third-party products, with some like Eternal Storms’ Yoink relying on them for their tight integration with macOS.
Improving our understanding of appexes and their management by PlugInKit isn’t an academic exercise. Host apps and their extensions don’t always work in perfect harmony. Whether you’re developing either of them, or just trying to cope with their disagreements, insight can be important. Now that Sequoia requires QuickLook thumbnail and preview generation to occur in appexes rather than qlgenerators, the qlmanage command tool is of limited value, and you have to rely on PlugInKit instead.
Once upon a time, Apple used to provide extensive and well-written conceptual documentation, where it explained how Mac OS worked, so that when we came to tackle problems we could fall back on understanding. Now we’re largely left to fend for ourselves, so armed with a forthcoming new version of AppexIndexer, I’m off to discover PlugInKit discovery.
In 1907, after over twenty years of lucrative work painting portraits, John Singer Sargent closed his studio in London, and cut himself adrift to travel where and when he wanted.
John Singer Sargent (1856–1925), The Fountain, Villa Torlonia, Frascati, Italy (1907), oil on canvas, 71.4 x 56.5 cm, The Art Institute of Chicago, Chicago, IL. Wikimedia Commons.
The American artists Jane de Glehn and her husband Wilfrid (1870-1951) were long-standing friends. Sargent first met Wilfrid around 1895 when he was working on murals in Boston Public Library, and Wilfrid married Jane Emmet (1873-1961), sister of Lydia Field Emmet, in 1904. The Fountain, Villa Torlonia, Frascati, Italy (1907) shows Jane working at a lightweight wooden easel in the grounds of the villa.
John Singer Sargent (1856-1925), Dolce Far Niente (Sweet Nothing, Pleasant Idleness) (1907), oil on canvas, 41.3 x 71.8 cm, Brooklyn Museum, New York. WikiArt.
The composition in his Dolce Far Niente (1907) is complex, with five of the figures staggered and slightly out of line along the gentle curve of the bank crossing this unusually wide canvas, its aspect ratio being more typical of marine views and panoramas. Against this are steep diagonals in the middle of the painting, formed by the edge of the brown reflection on the water, the male in the left pair of figures, and the closest female. The cropping of the horizon and any background beyond the immediate meadow and stream gives a sense of space and recession, aided by the foreshortening of the closest figure, despite the proximity of the individuals to one another.
The painting consists of a multitude of daubs, strokes, and dabs of colour, those marks composed to provide just enough information for the viewer to assemble them into the whole, which as a result ‘pops’ out in a vivid reality.
It’s thought that all three male figures were modelled by Nicola d’Inverno, the painter’s manservant, and the woman seen asleep appears to be his friend Jane de Glehn. Sargent had purchased the costumes in the Middle East during his travels there, and they were transported in trunks to this site, believed to be the brook at Peuterey in the Val d’Aosta, most probably in the summer of 1907.
This painting was hung in the summer exhibition of the New English Art Club, London, in 1909, and was favourably received by the critics. It was sold within an hour of the opening of the press view, to Augustus Healy, founder of the Brooklyn Museum, where it has hung ever since.
John Singer Sargent (1856-1925), Grand Canal, Venice (1907), watercolour on paper, 40.6 x 45.4 cm, The National Gallery of Art, Washingon, DC. WikiArt.
Sargent’s bravura watercolour sketch of Grand Canal, Venice (1907) is composed of a sparse, even minimalist, collection of brushstrokes of watercolour assembled into a detailed view of the motif. He views Venice from the level of a gondola, the bows of which are also shown. His palette for these sketches is generally centred on earth colours for the buildings, with blue for the sky, water, and usually the shadows.
John Singer Sargent (1856-1925), Flotsam and Jetsam (1908), watercolour on paper, 34.6 x 47.3 cm, Portland Museum of Art, Portland, Maine. WikiArt.
The following year, his Flotsam and Jetsam follows in the same style, with the figures of young boys in the foreground sketched in roughly to suggest movement.
John Singer Sargent (1856-1925), Olive Trees, Corfu (1909), watercolour and gouache over pen and blue ink on paper, 35.6 x 50.8 cm, The Art Institute of Chicago, Chicago, IL. The Athenaeum.
Sargent was an early adopter of cadmium yellow pigment in watercolours such as Olive Trees, Corfu from 1909, where it ensured that his greens remained lightfast.
John Singer Sargent (1856-1925), Rio dei Mendicanti, Venice (c 1909), watercolour and pencil on off-white paper, dimensions not known, Indianapolis Museum of Art, Indianapolis, IN. Wikimedia Commons.
He wasn’t dependent on sophisticated techniques, though: Rio dei Mendicanti, Venice from about 1909 works its magic almost entirely using a combination of passages using wet on dry and wet on wet. There isn’t even much in the way of a graphite drawing under its thin washes.
John Singer Sargent (1856–1925), Artist in the Simplon (c 1909-11), watercolour and graphite on paper, 40.5 x 53.2 cm, Fogg Art Museum, Cambridge, MA. Wikimedia Commons.
Sargent met up with the plein air specialist Ambrogio Raffele again when he returned to the Alps during the summers of 1909 to 1911, and painted this watercolour of him as an Artist in the Simplon at some time in those years. Raffele is painting a view of the Fletschhorn, to the south-west of the Simplon Pass, using an improvised easel formed from two crossed poles.
John Singer Sargent (1856-1925), Simplon Pass: The Tease (1911), transparent watercolour, opaque watercolour and wax over graphite pencil on paper, 40 x 52.4 cm, Museum of Fine Arts, Boston, MA. Wikimedia Commons.
In the summers of 1909-11, Sargent stayed with various friends in the Bellevue Hotel at the top of the Simplon Pass, enjoying the cool mountain air at a time when much of the rest of Europe would have been stiflingly hot. While his family and friends whiled away their days in leisure, Sargent got them to pose for a unique series of informal portraits. They may have been reclining at leisure, but Sargent took those watercolours very seriously, and deployed an amazing array of techniques. Among the finest is his Simplon Pass: The Tease from the summer of 1911. For any watercolour artist, it is a lexicon of advanced techniques.
John Singer Sargent (1856-1925), Simplon Pass: The Tease (detail) (1911), transparent watercolour, opaque watercolour and wax over graphite pencil on paper, 40 x 52.4 cm, Museum of Fine Arts, Boston, MA. Wikimedia Commons.
One of the most unusual, used here extensively, is wax resist. Before applying paint, Sargent scribbled over areas that were intended to be vegetation, using a soft wax crayon, probably made from beeswax. On a fairly rough paper, the wax is deposited unevenly, and when painted over using watercolour it shows the white paper through. This creates disruptive patterns of near-white in the midst of the greens, and a superb effect.
John Singer Sargent (1856-1925), Simplon Pass: The Tease (detail) (1911), transparent watercolour, opaque watercolour and wax over graphite pencil on paper, 40 x 52.4 cm, Museum of Fine Arts, Boston, MA. Wikimedia Commons.
Most of the paint used is transparent watercolour, applied as a wash in small areas, and in gestural marks elsewhere. In the upper third of this detail, he has applied white gouache (opaque watercolour) sufficiently thickly for it to now have fine cracks. The large pale blue area crossing the middle appears to have been rewetted and some of its colour lifted to reduce its intensity, although most of his applications of paint over existing paint have been made wet on dry.
John Singer Sargent (1856-1925), Simplon Pass: The Tease (detail) (1911), transparent watercolour, opaque watercolour and wax over graphite pencil on paper, 40 x 52.4 cm, Museum of Fine Arts, Boston, MA. Wikimedia Commons.
Complex details such as the faces and hands of the figures have undergone multiple repainting, starting with the palest flesh of the face, and progressively darkening to near-black. In most cases, the clean edges of the marks demonstrate that these were applied wet on dry, with as many as six different layers in the hair.
John Singer Sargent (1856-1925), Simplon Pass: The Tease (detail) (1911), transparent watercolour, opaque watercolour and wax over graphite pencil on paper, 40 x 52.4 cm, Museum of Fine Arts, Boston, MA. Wikimedia Commons.
In the midst of this complex assembly of layers, Sargent still keeps to the lines of his original graphite sketch, which he uses to give the parasol form, and maintains small reserved areas, here forming the spectacle frames in the white of the paper. He could have used wax resist here, but if using pure beeswax it’s hard to keep the soft wax to fine lines.
John Singer Sargent (1856-1925), Simplon Pass: The Tease (1911), transparent watercolour, opaque watercolour and wax over graphite pencil on paper, 40 x 52.4 cm, Museum of Fine Arts, Boston, MA. Wikimedia Commons.
Sargent is the Chess Grand Master, the strategist whose moves at times might almost seem random or abstract, but in the end they all come together to bring this masterly watercolour to life.
John Singer Sargent’s move to London in 1886 had proved a commercial success, and he painted portraits of the rich and famous until he closed his studio there in 1907.
John Singer Sargent (1856–1925), The Ladies Alexandra, Mary, and Theo Acheson (The Acheson Sisters) (1902), oil on canvas, 273.6 x 200.6 cm, The Devonshire Collection, Chatsworth House, Derbyshire, England. Wikimedia Commons.
His group portrait of The Ladies Alexandra, Mary, and Theo Acheson, normally simply known as The Acheson Sisters, was exhibited at the Royal Academy in 1902, where it was both very popular and favourably received. And at first sight, it is indeed a delight, as they sit around the front of a huge urn decorated with floral garlands, one of the ladies reaching up to pick oranges from a tree just above the urn. Even the late Queen Victoria would, I am sure, have approved. However, there are hidden references that link back through earlier portraits by Sir Joshua Reynolds to Nicolas Poussin’s previous paintings of bacchanalian orgies.
John Singer Sargent (1856–1925), Rio dell Angelo (1902), watercolour, 24.8 x 34.9 cm, Private collection. WikiArt.
Meanwhile, the other John Singer Sargent continued his travels across Europe and beyond. A visit to Venice in 1902 brought this stunning watercolour of Rio dell Angelo, where he provides his response to the Impressionists’ question on the colour of shadows.
John Singer Sargent (1856–1925), William M. Chase (1902), oil on canvas, 158.8 × 105.1 cm, The Metropolitan Museum of Art, New York, NY. Wikimedia Commons.
The same year, Sargent visited New York, where he painted this portrait of his friend and fellow artist William Merritt Chase in his fifties. He’s immaculately dressed with a carnation in his button-hole, and the tools of his art in hand.
John Singer Sargent (1856-1925), Scuola di San Rocco (c 1903), watercolour on paper, 35.6 x 50.8 cm, Private collection. WikiArt.
The following year, Sargent was back in Venice to paint this watercolour of Scuola di San Rocco assembled from a virtuoso series of marks and gestural strokes of the brush.
John Singer Sargent (1856–1925), An Artist in His Studio (1904), oil on canvas, 56.2 x 72.1 cm, Museum of Fine Arts, Boston, MA. Wikimedia Commons.
When he broke free of his studio for the summer of 1904, Sargent travelled to the Alps for his first season of serious plein air painting there. He stayed in the Italian mountain town of Purtud, to the south-west of Mont Blanc, where there was a group of Italian artists doing the same thing. Among them was Ambrogio Raffele (1845-1928), probably the best and most experienced of the group; Sargent became particularly friendly with him, and in An Artist in His Studio (1904) shows Raffele at work in his room there.
This painting is a paradox, in that Sargent shows an accomplished plein air painter working not in front of his motif, but in his bedroom. It’s plausible that Raffele is painting a larger version of the small sketch seen at the lower left of the large canvas.
John Singer Sargent (1856–1925), Unloading Boats in Venice (1904), watercolour on paper, 25.4 x 35.3 cm, Private collection. WikiArt.
When he reached Venice, Sargent’s watercolours became even more gestural, as shown in this view of Unloading Boats in Venice (1904).
John Singer Sargent (1856–1925), Group with Parasols (A Siesta) (c 1905), oil on canvas, 55.2 x 70.8 cm, Private collection (sold in 2004 for $23.5 million). WikiArt.
The following summer Sargent turned his attention to his fellow travellers as they crossed the Alps on their way south. He sketched his friends during their siesta, in this Group with Parasols painted in oils in about 1905.
John Singer Sargent (1856–1925), Siesta (1905), watercolour, gouache and pencil on paper, dimensions not known, Private collection. WikiArt.
Here they are again in watercolour, in Siesta from the same year.
John Singer Sargent (1856–1925), La Carmencita (c 1905), other details not known. Wikimedia Commons.
A decade after her dancing career had gone into decline, and fifteen years after his first painting of her, Sargent produced a completely different portrait of La Carmencita (c 1905). Now his virtuoso brushstrokes capture her motion. His inspiration was no longer Manet, but Giovanni Boldini and his ‘swish’.
John Singer Sargent (1856–1925), Bedouin Camp (1905-6), watercolour on paper, 25.4 x 35.7 cm, Brooklyn Museum, New York. WikiArt.
In further time out of his studio, Sargent travelled to North Africa, where he painted this Bedouin Camp in 1905-6.
John Singer Sargent (1856–1925), Arab Woman (1905-06), watercolour and gouache on off-white wove paper, 45.7 x 30.5 cm, The Metropolitan Museum of Art, New York, NY. Wikimedia Commons.
This portrait of an Arab Woman from 1905-06 is another fine example of his watercolour sketching.
John Singer Sargent (1856-1925), In a Levantine Port (1905-6), watercolour and graphite on paper, 30.6 x 46 cm, Brooklyn Museum, New York. WikiArt.
At times, Sargent’s brushstrokes appear so casual that it’s almost as if he was just doodling with pigment, as in the blue shadows In a Levantine Port (1905-6). But they coalesce into the image that Sargent clearly had in his mind all the way along, and pop out at the viewer.
The barges, which link up to form a bridge, could give China a way to land large numbers of vehicles and troops on Taiwan, solving a major logistical problem.
Given that it was over three years before Apple first shipped a Mac with an internal hard disk, it’s not surprising that one of its early shareware apps was Harry Chesley’s PackIt III for compressing archives of files, in 1986. At that time, the emphasis was more on working out how to archive both forks of Mac files and how to restore them, and less on achieving efficient compression.
The following year, 16 year-old Raymond Lau, then still a high school student, developed and marketed its replacement, Stuffit, which rapidly established itself as the standard, and probably the most popular shareware utility for the Mac. From 1987 until the release of Mac OS X in 2001, Stuffit had few rivals and its .sit archives were widespread across Macs, but didn’t make it to PCs or Windows until much later.
In 1988, Aladdin Systems was formed to take over development and sales of Stuffit, and in 2004 it changed name to Allume Systems, and was bought by IMSI. The following year, Allume was bought by Smith Micro Software, Inc.
Aladdin continued a shareware version as Stuffit Classic, and launched a commercial version as Stuffit Deluxe. This line-up was later augmented with a freeware decompressor Stuffit Expander that was bundled in Mac OS X until 10.4 Tiger.
Less known today are Stuffit’s self-expanding archive apps, with built-in decompressors and the extension .sea, that enabled the few Macs without a copy of Stuffit to open them with a double-click.
Until more powerful Macs of the mid-1990s, compression was performed in software and painfully slow. One of the more popular add-in cards for expandable Macs like the Macintosh II was Sigma Designs’ DoubleUp NuBus card that compressed in real time using Salient Software’s DiskDoubler.
This is Stuffit Deluxe version 8.0.2 from 2003, the year before Aladdin was renamed Allume.
Stuffit Deluxe included support for conversion to and from BinHex encoding, used for sending binary files via email without the risk of data corruption.
DropStuff was a drag-and-drop tool or droplet for compressing files into Stuffit, Zip or Tar archives, with support for encryption, and segmentation for use where file sizes were limited.
Its Zip option also preserved resource forks.
Archives in a range of formats, including RAR, could be managed in Stuffit Archive Manager, which could even schedule automatic creation of archives.
Although Aladdin launched a Mac OS X version with a new archive format, .sitx, and support for additional compression methods beyond its own proprietary formats, Stuffit entered decline by the time it was acquired by Smith Micro. Compression requirements had changed in Mac OS X, with decreasing use of resource forks, and free availability of bundled cross-platform compression tools such as GNU Gzip.
In 2007, BetterZip supported a standard set of compression formats, including 7-Zip, but never really caught on.
This is cross-platform WinZip seen in 2015, five years after its first release for the Mac. This originated as a graphical interface for PKZIP.
Apple started including compression tools in /System/Library/CoreServices, initially with BOMArchiveHelper in Mac OS X 10.3 Jaguar, which became Archive Utility that lives on today, supporting the Compress command in the Finder’s contextual menu. This uses a modified implementation of the Zip method that preserves extended attributes, successor to the resource forks of Classic Mac OS.
For many years, Mac OS X has had access to compression at a system level, but Apple has unaccountably not opened that up to developers. In modern Macs, compression is extensively used both on disk and in memory. However, in macOS Big Sur in 2020 Apple introduced AppleArchive with its system-level support for LZ4, LZMA, zlib and a proprietary implementation of LZFSE, and those are available in a new command tool aa.
Archive Utility offers a few options, and from 2020 has included support for plain and encrypted AppleArchive format.
The arrival of Apple silicon Macs has expanded options available for compression utilities to make better use of their two core types and energy efficiency. Freeware Keka now gives the user the choice.
Legacy copies of Stuffit are still available from here.
Apple has gone to great lengths to make the transition to its new Arm-based Macs as seamless as possible. However, there are some major differences that most need to take into account before making their leap of faith from a cherished but now-ageing Intel Mac to a sleek and glitzy new M-series Mac. This article clarifies what are often points of confusion about what you can’t or shouldn’t do with a new Apple silicon Mac.
You can’t run any macOS before Monterey (or possibly Big Sur)
There are two ways to run macOS on Apple silicon Macs: natively, or in a virtual machine (VM). The oldest version of macOS your Mac can run natively is that current at the time that model was released. Models released before October 2021 can run macOS 11 Big Sur, and are the only Apple silicon Macs that can do so. Those released from October 2021 onwards can only run the version of macOS that was current at the time of their release, but can run older versions back to macOS 12 Monterey in a VM. Current models with M4 chips are even more restricted, as the earliest version they can run is macOS 15 Sequoia, although their VMs can still stretch back to Monterey if you need.
Catalina, Mojave and earlier were never released with support for Apple silicon Macs, so can’t be run on them, and will never be able to without emulating Intel processors in software, which is slow and unreliable.
A VM running on an Apple silicon Mac can’t run Big Sur, because the Virtio driver support required for virtualisation wasn’t complete then, and didn’t work until macOS 12 Monterey, although even there it offers fewer features than in Ventura. Full details are given here.
You can’t virtualise or run Intel macOS or 32-bit apps
Bundled in macOS is Rosetta 2, enabling you to run 64-bit Intel code and apps that are compatible with macOS 10.15 Catalina. Rosetta isn’t an emulation engine, but translates code from Intel to Arm instructions. However, it can’t translate 32-bit code, and it can’t translate operating systems like macOS. It does run 64-bit Intel apps amazingly quickly, though.
A VM running macOS on Apple silicon can therefore use Rosetta 2 to translate and run 64-bit Intel code in apps that are compatible with macOS 10.15 Catalina, but is subject to the same limitations as any version of macOS on Apple silicon, in that it can’t handle older or 32-bit apps. Neither can it be used on the host Mac to run a VM of any Intel version of macOS.
If you need access to older or 32-bit Intel software, then the only practical way of doing that is on an Intel Mac that’s able to run Mojave or earlier.
You can’t install Intel kernel extensions
Rosetta 2 translation can’t support the privileged level of execution required for kernel extensions, so if you need your Mac to be able to load and use kernel extensions that are only available for Intel Macs, you can’t do that on an Apple silicon Mac. The great majority of more recent kernel extensions are now available as Universal versions that can also run native on M-series chips, but if your Mac still relies on an older kernel extension that’s Intel-only, then you can’t use that on a new Mac.
You can’t boot fully from an external drive
Unlike Intel Macs, Apple silicon models can only start their boot process from their internal SSD, as that’s required to support their Secure Boot. Although Apple silicon Macs can boot from external disks, early phases of that process still rely on the internal SSD and security policies (‘LocalPolicy’) saved there. This has several consequences:
An Apple silicon Mac can only boot from an external disk that is ‘owned’ by a user recognised by the primary system on its internal SSD. This is a valuable security measure, as without knowing login details for a suitable user of the internal SSD, it’s not possible to boot an Apple silicon Mac from an external bootable disk.
An Apple silicon Mac can only boot from an external disk if it can at least start that process from its internal SSD, normally requiring a bootable system on the internal SSD as well. If you do intend booting your Mac from an external disk, in practice you still need to install and maintain a bootable system on its internal SSD.
Total failure of the internal SSD results in failure to boot from external disks as well. A bootable external disk can’t ‘get you home’ in that emergency.
Apple silicon Macs don’t really boot fully from ‘bootable’ external installer disks, although they can still be used to install macOS when necessary, and may be required when installing older versions of macOS than currently installed.
Instructions for installing macOS on an external disk so that it can boot an Apple silicon Mac are given here.
You can’t use Boot Camp
Boot Camp allows you to start up an Intel Mac as if it’s a regular PC to run Windows. As Apple silicon Macs have completely different processors and other hardware, they can’t support that option. If you want to run Windows on your Apple silicon Mac, you’ll have to do that using a virtualiser like Parallels Desktop, and currently those can only run Arm versions of Windows, although Parallels is working on an emulator that can run some Intel versions. You can already try that out.
Avoid kernel extensions
Unlike Intel Macs, Apple silicon Macs don’t allow the use of third-party kernel extensions when running in Full Security mode. Before it can have those enabled, its startup security has to be reduced, and their use explicitly set in Startup Security Utility in Recovery mode. For most users that’s a significant deterrent. In almost all cases now, traditional kernel extensions should be replaced by new-style system extensions. You can read more about that here.
Avoid ‘cloning’ boot volume groups
Before Catalina and Big Sur divided the boot volume into a group of volumes, including System and Data, it was popular to make identical copies of, or ‘clone’, the volume containing the system. This is even more complex with Apple silicon Macs because of the multiple containers on their internal SSD. Although apps like SuperDuper and Carbon Copy Cloner can still create clones, they can’t include the whole of the internal SSD. That limits their usefulness, and they can readily fail.
The only way you can completely replace the contents of the internal SSD of an Apple silicon Mac is to restore it from an IPSW image file when the Mac is in DFU mode. That erases the SSD so that its Data volume then has to be restored from a backup or copy, not a task to be undertaken lightly or in a hurry. This is explored in detail here.
Don’t try using startup key combinations
Entering Recovery mode and accessing features that are controlled using startup key combinations on Intel Macs is completely different in Apple silicon Macs, and controlled using the Power button. Holding keys during startup does nothing for an Apple silicon Mac. I have an illustrated guide, details on Fallback Recovery, and on troubleshooting.
Neither can you reset the PMC or NVRAM using startup keys. The PMC in an Apple silicon Mac is completely different, and shouldn’t need to be reset. If it does, then restarting should suffice. NVRAM is primarily for the use of macOS not the user, and you should never have to reset it. Further information is given here.
Further reading
My page listing articles specific to Apple silicon Macs contains extensive information and guidance.
因为我的 Home Assistant 是通过 Docker 安装的 HA Core,不支持 Add On,所以这里需要通过 Docker 来进行安装,之前提到过,我的 Home Server 运行的是 NixOS,所以可以很方便的配置 Docker,具体的配置项如下,将其改为 Docker Compose 也很方便,所以这里不再提供。
The Free and Prosperous Commonwealth ——An Exposition of the Ideas of Classical Liberalism 其它英文名: Liberalism ——The Classical Tradition Liberalism, a Socio-Economic Exposition
Fermat's Last Theorem ——The Story of a Riddle That Confounded the World's Greatest Minds for 358 Years 其它英文名: Fermat's Enigma ——The Epic Quest to Solve the World's Greatest Mathematical Problem
Thinking in Complexity ——The Computational Dynamics of Matter, Mind and Mankind 其它英文名: Thinking in Complexity ——The Complex Dynamics of Matter, Mind and Mankind
UNIX Systems Programming ——Communication, Cocurrency and Threads 其它英文名: Practical UNIX Programming ——A Guide to Concurrency, Communication and Multithreading
去年11月,苹果用户在一次影响广泛的宕机事故后才知道:苹果监视了用户打开和启动的每一个应用程序(编程随想注:上一期谈过这个重大丑闻【OCSP 事件】)
苹果为什么要这么做?最为善意的猜测是:此举旨在更早发现恶意程序。在一个充斥着恶意的网络世界里,这么做是必要的。安全专家 Bruce Schneier 将这种现象形容为“封建式安全”。
生活在21世纪的我们,面临各种数字强盗的围攻。从身份窃贼,到跟踪者,到企业和政府间谍,到骚扰者。我们是没有办法自保的。即使是身经百战的专家也无法和强盗相抗衡。为了抵抗强盗,你必须做到完美,不犯任何错误。而强盗只要抓住一个错误就能逮住你。因此为了安全起见,你必须和数字军阀结盟。苹果、Google、Facebook 和微软等建立了庞大的要塞,它们投入了大量金钱招募了最强的雇佣兵来保护要塞,为客户(包括你)抵御攻击者。
但如果军阀们转向了你,你对它们而言将是赤裸裸的。这种敌我难辨的情况在与军阀打交道的过程中一直发生着。比如 Google 调整 Chrome 以阻止商业监视(但不阻止它自己的商业监视)。Google 会努力阻止其他人监视你,但如果他们付钱了,Google 就会允许他们监视你。
如果你不在乎被 Google 监视,如果你信任由 Google 判断谁是骗子谁不是,那么这没问题。但如果你们之间存在不一致的意见,那么输的肯定是你。苹果在2017年按中国要求从其应用商店下架了保护隐私的工具。原因是苹果必须遵守中国的法律,它在中国有公司,有制造基地。军阀自身的安全是远甚于客户的。
编程随想注:
俺的观点是:要善于【扬长避短】——既要利用大公司提供的某些优质服务,同时又不让大公司窥探你的隐私。
当然啦,要做到这点,需要一些经验&技巧。
就拿本人的亲身经历举例——
一方面,俺用着 Google 的博客平台 Blogspot(它的安全性足够好,而且能抵御【国家级】的 DDOS 攻击)。
另一方面,俺不用 Google 搜索(俺用的是 Startpage,其搜索质量等同 Google);另外,俺也不使用 Google 开发的 Chrome 浏览器。
编程随想注:
该漏洞编号 CVE-2021-24093,影响 Windows 10 & Windows Server 2016。这是 Google 安全研究人员在去年11月发现并报告给微软。而微软直到今年(2021)2月的例行更新才修复。
漏洞位于 DirectWrite API 进行字体渲染的代码中(缓冲区溢出)。Windows 平台上的浏览器(Chrome、Firefox、Edge、IE)都会使用系统提供的 API 进行字体渲染,因此都会受此影响。
为了利用这个漏洞,攻击者可以创建一个 Web 页面,其中包含精心构造的字体,然后诱导受害者访问该页面。当受害者的浏览器打开该页面时,就中招了。由于此漏洞针对“字体渲染”,与 JS【无关】。因此,即使浏览器禁用了 JS 脚本,还是会中招。
在上一期的《近期安全动态和点评(2020年4季度)》中,俺介绍过另一个漏洞 CVE-2020-15999,与这个很类似。CVE-2020-15999 位于“FreeType 字体渲染库”。也是利用“Web 页面的字体”来实现远程代码执行。
在上一期,俺说过如下这句,今天再次贴出来:
假如你很注重安全性,为了更彻底地消除【字体】导致的攻击面,你可以定制浏览器,禁止在 Web 页面中加载外来的字体。
对 Firefox 的深度定制,可以参考教程《扫盲 Firefox 定制——从“user.js”到“omni.ja”》;对其它浏览器的深度定制,俺暂时还没写过教程。
The two RCE(注:Remote Code Execution)vulnerabilities are complex which make it difficult to create functional exploits, so they are not likely in the short term. We believe attackers will be able to create DoS exploits much more quickly and expect all three issues might be exploited with a DoS attack shortly after release.
KrebsOnSecurity 援引消息来源报道,至少三万家美国机构——包括大量的小企业和各级政府被黑客组织利用微软电邮软件 Microsoft Exchange Server 的漏洞入侵。
微软本周披露,黑客正在利用 Exchange Server v2013 到 v2019 中的四个 0day 漏洞。在漏洞披露的三天内,安全专家称:同一黑客组织增加了对尚未修补的 Exchange 服务器的攻击,在入侵之后攻击者留下一个可以后续访问的 web shell。微软表示正与美国网络安全和基础设施安全局密切合作,为客户提供最佳的指南和缓解措施。
......
这些漏洞(CVE-2021-27363、CVE-2021-27364 和 CVE-2021-27365)存在于内核的 iSCSI 模块中。虽然在默认情况下该模块是没有被加载的,但是 Linux 内核对模块“按需加载的特性”意味着它可以很容易地被本地触发。安全专家在 Red Hat 所有已测试版本和其他发行版本中发现这些漏洞。
在 GRIMM 博客上,安全研究员 Adam Nichols 表示:“我们在 Linux mainline 内核的一个被遗忘的角落里发现了3个 BUG,这些 BUG 已经有15年的历史了。与我们发现的大多数积满灰尘的东西不同,这些 BUG 依然存在影响,其中一个可以作为本地权限升级(LPE)在多个 Linux 环境中使用”。
......
DNS-over-HTTPS(DoH)加密了 DNS 请求, 被用于规避 DNS 污染。
根据 greatfire.org 的测试结果:NextDNS、Quad9、AdGuard 在近日被屏蔽。防火墙对这些域名没有使用 DNS 污染, 而是使用检测 SNI 和 IP 黑洞的方法。Cloudflare 的 DoH 服务器还没有被屏蔽。
Google 周一宣布它可能找到了 cookies 的隐私友好替代。它测试了名为 Federated Learning of Cohorts(FLoC)的新 API,其源代码发布在 GitHub 上。
测试显示,相比基于 cookies 的广告,FLoC 广告的转化率至少达到 95%。FLoC 使用机器学习算法分析用户数据,然后根据用户访问的网站,将数千用户分成一组。数据是浏览器在本地收集的不会分享出去,但这群用户的数据会共享并被用于定向广告。也就是说 FLoC 广告是根据人们的普遍兴趣进行针对性展示。
编程随想注:
这个玩意儿到底是不是“隐私友好”?目前俺了解有限,暂时无法从技术角度发表意见。
考虑到 Google 的商业模式(主要利润来自于【在线广告收入】),俺不太相信所谓的“隐私友好”。
Google 在今年初宣布了 Cookies 的替代 Federated Learning of Cohorts (FLoC),声称它对用户隐私更为友好。但这一计划引发了美国司法部调查人员的关切,调查人员一直在问询广告行业的高管,以了解 Google 此举是否会妨碍规模较小的竞争对手。
消息人士表示,司法部调查人员的询问涉及到 Chrome 的各种政策,包括与 cookies 相关的规定,对于广告和新闻产业产生哪些影响。
Chrome 浏览器的全球市占率约 60%。消息人士并指出,调查人员正询问 Google 是否利用 Chrome 来避免对手广告公司通过 cookies 追踪用户,同时留下漏洞供自己用 cookies、分析工具、以及其他资源来收集资料,从而降低竞争。
Google Chrome Team 团队向 Linux 发行版开发者发去邮件通知,从3月15日起,在构建配置中使用 google_default_client_id 和 google_default_client_secret 的第三方 Chromium 版本,它们的终端用户将无法再登陆其 Google Accounts 账号。
Google 称,他们在最近的审计中发现部分基于 Chromium 的浏览器使用了原本只给 Google 使用的 Google API 和服务,其中最主要的是同步账号的 Chrome Sync API,它决定移除这些 API 的访问,声称这是为了改进用户数据安全。
Linux 发行版开发者表示过去十年他们一直这么做的,如果无法使用 Google 的同步功能,那么继续维护 Chromium 软件包也没有什么价值了。Chrome 的工程总监 Jochen Eisinger 在回复中表示他们的决定不会改变。Slackware Linux 和 Arch Linux 都表示考虑从仓库移除 Chromium。
When an iPhone has been off and boots up, all the data is in a state Apple calls 【Complete Protection】. The user must unlock the device before anything else can really happen, and the device's privacy protections are very high. You could still be forced to unlock your phone, of course, but existing forensic tools would have a difficult time pulling any readable data off it. Once you've unlocked your phone that first time after reboot, though, a lot of data moves into a different mode—Apple calls it "Protected Until First User Authentication", but researchers often simply call it 【After First Unlock】(注:简称 AFU).
If you think about it, your phone is almost always in the AFU state. You probably don't restart your smartphone for days or weeks at a time, and most people certainly don't power it down after each use. (For most, that would mean hundreds of times a day.) So how effective is AFU security? That's where the researchers started to have concerns.
The main difference between Complete Protection and AFU relates to how quick and easy it is for applications to access the keys to decrypt data. When data is in the Complete Protection state, the keys to decrypt it are stored deep within the operating system and encrypted themselves. But once you unlock your device the first time after reboot, lots of encryption keys start getting stored in quick access memory, even while the phone is locked. At this point an attacker could find and exploit certain types of security vulnerabilities in iOS to grab encryption keys that are accessible in memory and decrypt big chunks of data from the phone.
......
编程随想注:
关于“手机的危险性”,本博客已经唠叨过无数次了。俺反复告诫大伙儿(尤其是政治敏感人士),【不要】使用手机进行敏感的活动。
上述这篇洋文会告诉你,政府执法机构(警方 or 国安部门)破解手机其实比多数人想象的更容易,不论是 iOS 或 Android,都容易。
俺特意摘出上述三段洋文,其大意是:在【开机且解锁过一次】的状态下,即使手机屏幕已锁定,也很容易破解。关键在于,开机第一次解锁之后,全盘加密的【密钥】就会位于【内存】中。此时,“手机取证软件”只要能利用某种系统漏洞 or 软件漏洞,拿到内存中的“全盘加密密钥”,就 OK 啦。
作为对比,如果是在【关机】状态下,破解的难度就大得多(但依然有可能破解)。
假如你看不懂洋文,可以去看系列教程《TrueCrypt 使用经验》的第3篇——专门谈“加密盘的破解与防范”,其中有介绍【盗取密钥】这招的原理。
都柏林大学圣三一学院的 Douglas J. Leith 教授跟踪了(PDF)iOS 和 Android 设备向苹果和 Google 服务器发送的遥测数据,发现 Google 收集的数据二十倍于苹果。
Leith 教授称,研究考虑了操作系统本身收集的数据以及操作系统供应商提供的默认应用收集的数据,云端存储,地图/位置服务等,只计算遥测数据。
Leith 教授指出,即使用户选择退出遥测,iOS 和 Android 仍然会发送遥测数据。苹果收集了更多的信息数据类型,但 Google 收集的数据量要多得多。开机10分钟内,Pixel 手机向 Google 发送了 1MB 数据,而 iPhone 发送了 42KB;在闲置状态下,Pixel 手机每12小时向 Google 发送 1MB 数据,相比之下 iPhone 只向苹果发送 52KB 数据。
当新的 SIM 卡插入到设备中,相关信息会立即与苹果和 Google 共享。设备上预装的应用被发现在未启动或使用前就会连接苹果和 Google 服务器。Google 发言人用汽车收集数据为它收集数据辩护。
There's a Kaili Linux training suite available called Kali Linux Dojo, where users can learn how to customize their own Kali ISO and learn the basics of pentesting. All of these resources are available on Kali's website, free of charge. Kali Linux also boasts a paid-for pentesting course that can be taken online, with a 24-hour certification exam. Once you pass this exam, you're a qualified pentester!
Parrot OS
Why We Love Parrot OS:
The distro provides pentesters and digital forensics experts with the best of both worlds - a state-of-the-art "laboratory" with a full suite of tools accompanied by standard privacy and security features.
Applications that run on Parrot OS are fully sandboxed and protected.
Parrot OS is fast, lightweight and compatible with most devices.
BlackArch Linux
Why We Love BlackArch Linux:
BlackArch Linux offers a large selection of hacking tools and preconfigured Window Managers.
The distro provides an installer with the ability to build from source.
Users can install tools either individually or in groups with the modular package feature.
Whonix
Why We Love Whonix:
Whonix comes with the Tor Browser and the Tox privacy instant messenger application - ensuring fully-anonymous web browsing and instant messaging.
The OS employs an innovative Host/Guest design to conceal users' identity behind the anonymous proxy and prevent IP and DNS leaks.
The distro features pre-setup Mozilla Thunderbird PGP email.
编程随想注:
关于 Meltdown & Spectre 漏洞,去年和前年的《近期安全动态和点评》都有聊过。
在今年(2021)之前,对这俩漏洞还停留在“理论”阶段;到了今年2月份,在线查毒引擎 VirusTotal 首次发现与这两个漏洞相关的攻击代码,分别针对 Windows & Linux。这也就意味着:对这两个漏洞的研究,已经从“理论”上升到“实践”。
这两个漏洞源于 CPU 硬件的设计缺陷,很难根治;而且受影响的 CPU 很多,波及面从 x86 系列到 ARM 系列。
俺在《近期安全动态和点评(2019年1季度)》提到如下这段话:
一年前(2018年初)曝光的 Spectre 和 Meltdown 在信息安全界可以称得上是【划时代】滴!因为其利用的是 CPU 的【设计缺陷】(而且还是【根本性】缺陷)。
......
由于这两个漏洞涉及到 CPU 的【根本性】缺陷,极难搞定(就像两个幽灵,会在未来几年不断困扰 IT 行业)。
伊利诺伊香槟的三位研究人员在预印本网站 arXiv 发表论文,披露了针对英特尔 CPU 的最新侧信道攻击,该攻击被命名为 Lord of the Ring(s)。
随着芯片上的功能模块越来越多,英特尔为其 CPU 引入了片内总线,以实现各个模块之间的高速通信,它先后引入了 Ring Bus 和 Mesh Bus。最新侧信道攻击针对的就是 Ring Bus 的环形总线。研究人员首先逆向工程了 Ring Bus 的通信协议,设法构建了一个跨核心的隐蔽信道,利用环争用的细粒度时态模式去推动应用程序的秘密。从有漏洞的 EdDSA 和 RSA 实现中提取出密钥比特。对于 AMD 的 Zen 架构使用的片内总线 Infinity Fabric,研究人员表示需要进一步的研究,但相信他们的技术能应用于其它平台。
Google 资助了 Internet Security Research Group(ISRG)的一个项目:用 Rust 语言为 Apache HTTP web server 项目开发安全模块 mod_tls。
在 Apache web server 中,mod_ssl 用于支持建立 HTTPS 连接所需的加密操作,它是用 C 语言开发的。
新的 mod_tls 模块将使用 Rust 语言开发,领导该项目开发的是软件咨询公司 Greenbytes 的创始人和 Apache HTTP Server 开发者 Stefan Eissing。ISRG 希望,在完成开发之后 Apache HTTP web server 团队将采用 mod_tls 作为默认模块,取代年代悠久且不安全的 mod_ssl。