LoginHow Tahoe 26.1 has enabled automatic security updates
If you have updated your Mac to Tahoe 26.1, you may be blissfully unaware that it will now automatically download and install some security updates, regardless of its Software Update settings. Open Privacy & Security settings, scroll down to the end and you’ll see a new item, Background Security Improvements, that Apple has kindly turned on for you. There are matching new settings in iOS and iPadOS 26.1 that are also enabled by default.
Apple seemingly forgot to mention these when listing the changes in 26.1, and its documentation of these Background Security Improvements (BSI) is sketchy to say the least. However, the description there as “lightweight security releases for components such as the Safari browser, WebKit framework stack and other system libraries” is so similar to that for RSRs as “improvements to the Safari web browser, the WebKit framework stack, and other critical system libraries” that we can only conclude the BSI is a rebranded RSR.
What is an RSR/BSI?
Although almost all of macOS is contained in the System volume, turned into a snapshot that’s protected by a tree of hashes with a signature, then mounted as the Signed System Volume, there are additional components that are delivered in separate cryptex files. These are also heavily protected with signatures to verify their contents, and are mounted well after the kernel has booted. APFS then grafts them into the root file system so their contents appear in the correct places. There are currently two main cryptexes common to all Macs, one containing Safari and its WebKit components, the other with dyld caches supporting frameworks. Apple silicon Macs additionally have many smaller cryptexes to support AI and related features.
Because those cryptexes are separate from the SSV, they can be unloaded, replaced with updated versions, and reloaded without necessarily having to reboot the kernel, or go through any of the complex procedures to update macOS itself. Apple first tested this new type of update, a Rapid Security Response (RSR), in beta-releases of macOS 13 Ventura, and the first was publicly released for Ventura 13.3.1 on 1 May 2023.
How do RSRs work?
RSRs have been released using the regular Software Update mechanism, controlled in its settings, and can be uninstalled manually even if you have opted for them to be installed automatically.
To remove an RSR, you open System Settings > General > About, and look down for the macOS version. At the right of that line is an ⓘ button: click on it to see the dialog above, allowing you to uninstall it.
Why don’t we get RSRs now?
Apple proudly announced RSRs at WWDC in June 2022, and they were listed among the new features in Ventura: “Get important security improvements to your devices even faster. This isn’t a standard software update. These improvements can be applied automatically between normal updates — without a restart.”
Although the first in May 2023 seemed to go well, the next on 10 July was an embarrassing disaster. RSR 13.4.1 (a) fixed one WebKit vulnerability, but unfortunately it also changed the version number of Safari to 16.5.2 (a), which was reflected in its User Agent, so broke access to many popular websites including Facebook. That had to be rectified in RSR 13.4.1 (c) released three days later. And all three of these RSRs required the kernel to be rebooted after their installation.
Since then, as far as I’m aware, Apple hasn’t released any further RSRs, although they’ve still been referred to throughout its documentation.
Their greatest limitation is that they can only fix vulnerabilities that are confined to Safari, WebKit and other components that are delivered in cryptexes. More commonly, urgent security patches also require changes to software in the SSV, for which the only solution is a full update. For example, during the year that macOS Sequoia was current, it received six patch updates in between those scheduled. Of those, only two might have been suitable as RSR/BSI updates, as all the others required changes to the SSV.
How do BSIs work?
If Apple’s current account of BSIs is complete, the only control we have over them is whether they’re downloaded and installed automatically. If you opt for that, as Apple has set as the default, then you won’t be given any warning, or even informed when the BSI has been installed on your Mac. The only way you’ll be able to learn that is by trawling through the list of software installations in System Information, although Apple will post information about the BSI in its security release notes, following its release.
If there’s a problem with a BSI, such as that in the second RSR in July 2023, then there’s no option to uninstall the BSI and revert to a previous version of that cryptex, as there was with RSRs. However, Apple might decide to remove the BSI from your Mac.
Given the short and unfortunate history of RSRs, that might appear surprising.
2025年2月1日 ｜对墨、加、中加征关税：特朗普上任后首次大规模加征关税：自2月1日开始对美国三大贸易伙伴加拿大、墨西哥和中国加征关税。特朗普宣布对邻国加拿大和墨西哥进口商品加征25%的关税，指责两国未能阻止非法移民进入美国；对来自中国商品加征10%的关税，指责中国在芬太尼生产中扮演重要角色。
2025年2月10日 ｜加征钢铝关税 无例外豁免：特朗普2月10日签署行政令，对所有进口至美国的钢铁和铝制品加征25%关税，并取消加拿大、墨西哥和巴西等钢铝主要供应国的免税额度。
2025年3月26日｜宣布对进口汽车全面征税：特朗普于3月26日宣布，自4月3日起，对所有进口汽车与轻型卡车征收25%的关税。全球汽车供应链受冲击，日韩汽车产业首当其冲。受此消息影响，丰田、本田、现代和起亚等汽车制造商股价大幅下跌，总市值蒸发约165亿美元。
2025年4月2日｜宣布“对等关税”：特朗普4月2日在白宫玫瑰花园举行“让美国再次富有”（Make America Wealthy Again）记者会，宣布“对等关税”措施。美国对大多数国家征收10％的基准关税，但针对特定国家征收更高税额。中国、欧盟和越南分别面临34%、20%和46%的关税； 日本、韩国、印度、柬埔寨和台湾，分别受到24%、25%、26%、49%和32%进口关税的打击。
2025年4月9日｜暂缓关税90日 中国除外：特朗普4月9日在大规模“对等关税”上路不到24小时后出现政策大转弯，宣布暂缓征收“对等关税”90天，在此期间，税率将统一降至10%的基准关税。但中国被排除在暂缓名单之外，不仅如此，还将对中国的关税加码至145%，其中包含了美国此前指控中国打击芬太尼不力而征收的20％关税。
2025年5月4日 | 对美国境外制作的电影征收100%关税：特朗普5月4日以“国安威胁”为由，宣布将对非美国制作的电影征收100％关税，理由是要“拯救美国电影业”。
2025年5月12日｜中美关税战90天“停火协议”：美中高层在瑞士进行谈判后于5月12日发布联合声明，就90天的“暂停期”达成协议：美国对大多数中国输美商品加征145%的关税将在5月14日前下调至30%，30%关税里包括针对芬太尼问题额外施加的20％惩罚性关税；中国对美产品加征的125%关税则将降至10%。美中双边早前不断叠加的报复性关税，在这波协商中几乎都被取消。（图为美财政部长贝森特与贸易谈判代表格里尔出席美中贸易会谈）
2025年5月13日｜美大幅下调中国“小包裹”关税：白宫5月13发布行政命令，将从5月14日起将对中国低价值货物（不超过800美元）征收的“最低限度”关税从120%下调至54%，原计划的200美元固定费用征税方案被搁置，现行的100美元固定费用将继续执行。
5月23日 对阵欧盟：特朗普威胁自6月1日起对欧盟商品加征50%的统一关税。他同时警告苹果公司，若其在美国销售的手机是在海外生产的，将面临25%的关税。两天后，特朗普收回了对欧盟加征50%关税的威胁，他表示，与欧委会主席冯德莱恩通电话后，同意将美国和欧盟的谈判期限延长至7月9日。
5月28日 美国法院裁定特朗普对等关税“越权”：美国联邦国际贸易法庭裁定，特朗普今年4月2日对多国征收的对等关税，以及早前向中国、加拿大和墨西哥加征的报复性关税都属于“非法”。判决认定，特朗普征收全球关税的行为超出了《国际经济紧急权力法》（IEEPA）赋予总统的权限。美政府表示将对该裁决提出上诉。
5月29日 美国上诉法院暂准特朗普关税恢复执行：美国联邦上诉法院一天后推翻该判决，让特朗普的关税政策得以持续实施。上诉法院指出，为了审理特朗普政府的上诉，将先暂缓此前法院的裁决，并命令原告及特朗普政府分别在6月5日和6月9日前提交回应文件。
5月30日 特朗普全面上调钢铝关税：美国总统特朗普宣布将对全球钢铁和铝产品的进口关税提高至50%。中国是美国的第三大铝供应国。他指责中国未按约降低关税，取消针对稀土等产品的贸易限制。他说：“中国完全违反了与我们达成的协议。不能再做好好先生了！”
6月10日 美中谈判双方宣布原则上达成贸易框架协议：中国和美国官员在英国伦敦举行贸易谈判，经过两天的会议，6月10日，双方宣布原则上已达成贸易框架协议，以落实5月在瑞士日内瓦的共识、还有两国领袖上周的通话内容。特朗普在社交媒体Truth Social上表示，按照美中达成的新的贸易协议，美国将从中国获得稀土磁体。他还表示，将允许中国学生在协议达成后继续留在美国大学学习。
