The memorandum calls for paying employees at the Coast Guard, Federal Emergency Management Agency and Cybersecurity and Infrastructure Security Agency who have gone without pay during a record-long shutdown.
Scientists say their work on fires and climate change could be lost as the agency moves its headquarters to Utah from Washington and shuts 57 research stations.
A Connecticut high school said that it was aware of the Instagram posts and that antisemitism was “repugnant and antithetical to our values as a school.”
The Fairfield College Preparatory School hockey team, from Fairfield, Conn., huddled before a championship game against New Canaan High School last month.
A rescuer carrying Molly, the dog on the right, away from a remote waterfall on the Arahura River on the South Island of New Zealand, where she was found on Tuesday, a week after being separated from her owner.
Last week Apple released the second beta of macOS 26.4 to developers, and almost immediately I was receiving reports that SilentKnight crashed on launch in that new beta. Given how unusual that has been in previous versions, I was grateful to hear so quickly, and for so many of you to provide crash reports. As usual they don’t point to anything specific, but led me to wonder whether something might have broken in AppKit in that beta.
But there’s a strange observation reported by SilentKnight’s old predecessor LockRattler, which continues to work normally in 26.4 beta 2: that reports a bizarre iBoot firmware version number from Apple silicon Macs. Instead of a number like 13822.101.2 that I might have expected, LockRattler gives “mBoot-18000.100.10.0.1”, which is random nonsense. Yet it’s listed in a mammoth compilation of iBoot version numbers in the Apple Wiki as an occasional fault.
“mBoot-18000.100.10.0.1” is a problem for SilentKnight, as it tries to make comparisons between firmware version numbers to see whether that installed in your Mac is older or more recent that the version number it expects. If it didn’t do that, every beta-tester would be driven crazy by its persistent reports that their Mac’s firmware is out of date, when in fact it’s that for the next version.
Comparing numbers is of course simple, but I’ve been unable to find anywhere in the API that returns numbers for firmware versions. Wherever they’re available, they’re reported as strings of arbitrary characters, leaving SilentKnight the task of recovering three integers (in the case of iBoot) from what in this case turns out to be rubbish. This is further complicated by the fact that different architectures return strings with different structures: for plain Intel Macs, they should look like “2094.80.5.0.0”, those with T2 chips extend to “2094.80.5.0.0 (23.16.13120.0.0,0)”, and Apple silicon is simpler again with “13822.81.10”. What could have been a simple task is turned into lots of additional code.
It also raises the question of how any beta-release could be put in the hands of external testers when it can’t even report its firmware version correctly. Most of us draw clear distinctions between alpha and beta releases, and this strongly suggests that Apple doesn’t undertake any purposeful alpha testing before release as a beta. Either that or it’s well aware of significant bugs that it doesn’t inform beta-testers about. I fear the answer could be both, and I’m wondering whether trying to make sense of reported firmware versions is too fraught to be reliable.
My main use of SilentKnight here is to check for updates released for the security tools in macOS, primarily XProtect and XProtect Remediator. You may recall that Apple’s last update to XProtect Remediator on 17 February, bringing it to version 157, contained a strange change, which I reported as “the Bastion rules appear to correct a group of typos in the definition for bastion-common-system-binary”.
There were six typos in all, in a definition for bastion-common-system-binary introduced back in version 153 six months ago, on 5 August last year. I shouldn’t need to point out the errors in the original definition: (define bastion-common-system-binary
(require-all
(process-attribute is-platform-binary)
(require-not
(require-any
(signing-identifier "com.apple.osascript")
(signing-identifier "com.apple.zsh")
(signing-identifier "com.apple.bash")
(signing-identifier "com.apple.sh")
(signing-identifier "com.apple.ksh")
(signing-identifier "com.apple.osacompile")
(signing-identifier "com.apple.python2")
(signing-identifier "python3")
(signing-identifier "ccom.apple.pbcopy")
(signing-identifier "ccom.apple.pbpaste")
(signing-identifier "ccom.apple.cat")
(signing-identifier "ccom.apple.curl")
(signing-identifier "ccom.apple.dd")
(signing-identifier "ccom.apple.cp")
(signing-identifier "com.apple.perl")))))
Instead of “ccom.apple.pbcopy”, it should of course have read “com.apple.pbcopy”, and the same for the other five signing-identifiers below that.
I’m delighted that Arnaud Abbati has explained eloquently the consequences of those typos in a wonderful article in his blog. I won’t steal his thunder here, but agree with his conclusion: “Six months of security updates, and nobody noticed. It missed engineering. It missed testing. It missed code review. It missed QA. It missed whatever metrics pipeline is supposed to validate that the rules actually match real binaries.”
There are times when I wonder what really does go on in Apple. When it releases a beta that can’t even tell what its firmware version is, and its security intelligence tool is broken for six months because of obvious typos, it does make you wonder.
If you’ve ever watched Activity Monitor shortly after logging in to your Mac, you’ll have seen how busy it is for the first ten minutes or more. Apple silicon Macs are different here, because their sustained high % CPU is largely restricted to the Efficiency cores. This is commonly attributed to Spotlight indexing files, and may appear worrying. This article tries to describe what’s going on over that period, and why it doesn’t necessarily mean there’s a problem with Spotlight.
On-the-fly indexing
When new files are created, or existing ones changed, Spotlight indexes them very quickly. The first mdworker process is spawned within a second, and others are added to it. They’re active for about 0.2 seconds before the new posting lists they create are ready to be added to that volume’s indexes. They may later be followed by CGPDFService and mediaanalysisd running similar image analysis to that performed in Live Text. Text extracted from the files is then compressed by mds_stores before adding it to that volume’s Spotlight indexes, within seven seconds or so of file creation.
These steps are summarised in the diagram above, where those in blue update metadata indexes, and those in yellow and green update content indexes. It’s most likely that each file to be added to the indexes has its own individual mdworker process that works with a separate mdimporter.
Spotlight indexes
The indexes used in search services are conventionally referred to as inverted, because of the way they work, and those would normally be largely static. Spotlight’s have to accommodate constant change as files are altered and saved, new files are created, and others are deleted. To enable its main inverted indexes to remain well-structured and efficient, Spotlight stores appear to use separate transient posting tables to hold recently acquired metadata and content. Periodically data from those is assimilated into its more static tables. Similarly, when files are deleted their indexed metadata and contents aren’t removed immediately, but when the store next undergoes housekeeping.
Image analysis and text extraction performed by CGPDFServices and mediaanalysisd, introduced in macOS Sonoma, are computationally intensive, and normally deferred until they can be performed with minimal disruption to the user. When completed, that text also needs to be incorporated in Spotlight’s content indexes.
Startup sequence
I gathered 15 log extracts each covering all entries (excluding Signposts) for periods of 3 seconds during the 11 minutes of high Spotlight process activity after user login, on a Mac mini M4 Pro running macOS 26.2 Tahoe. Those show Spotlight processes running in phases, starting from an arbitrary time zero when their activity was first seen reaching a peak:
00:00 – mdworker processes were indexing files for periods of 1-4 seconds each; Spotlight indexes were being maintained, with a journal reset and sync;
02:40 – CGPDFService started;
04:10 – mediaanalysisd started running its Live Text extraction on files, with photoanalysisd activity; then coremanagedspotlightd maintained indexes, replaying journals;
07:20 – mediaanalysisd continued Live Text extraction;
10:40 – mdworker returned to indexing as before; index maintenance occurred again with a journal reset and sync, following which index file permissions were set;
10:45 – caches were deleted and there was general tidying up before background processes tailed off.
Times are given as MM:SS following the arbitrary start. After about 5 minutes had elapsed, Activity Monitor and the log also showed substantial activity for the initial Time Machine backup, and running the daily complete set of XProtect Remediator scans.
All Spotlight processes appeared to run in the background, at low QoS and on Efficiency cores, apart from those of mediaanalysisd. That process was run at a QoS of Utility rather than Background or Maintenance, and confirmed by the MADServiceTextProcessing being called with a QoS numeric value of 17 instead of 9 or less. That would normally be scheduled on Performance cores, although little was seen on those in Activity Monitor’s CPU History window. Text extraction run by mediaanalysisd typically took about 0.25 seconds for each file processed. mediaanalysisd ran repeatedly for about 6 minutes, between 04:10 and about 10:40.
Abnormally prolonged indexing
Several macOS upgrades in recent years appear to have caused Spotlight indexing at startup to take prolonged periods, in some cases reported as several days, and comparable to the time required to rebuild all indexes from scratch. Given the paucity of log entries recording index maintenance, this can be difficult to confirm, although text extraction by mediaanalysisd is easier to identify. In most cases, it seems preferable to allow prolonged maintenance to run to completion, by allowing that Mac to run without sleeping. In Apple silicon Macs, as those maintenance processes should run almost exclusively on E cores, this should have limited impact on the user.
Forcing a full reindex of a volume is likely to take longer than allowing maintenance to complete.
Key points
Spotlight indexes new and changed files rapidly to supplementary journals rather than main indexes.
Macs that are shut down daily perform extensive indexing and index maintenance shortly after the user logs in.
Macs that remain running should perform the same maintenance periodically during light use.
Maintenance includes the incorporation of supplementary journals into main indexes
Text extraction from images by mediaanalysisd is performed at the same time, and can take a long time.
Although image analysis may be run on P cores, almost all Spotlight indexing and maintenance is performed in the background on E cores.
Prolonged indexing and maintenance isn’t necessarily a bad sign, and may well be normal.
Disrupting Spotlight routine maintenance may affect search results.
iPhone Air 和之前的 mini 系列一样注定是小众之选，外观可以说是近年来最好看的，在手机越来越大越来越重的当下，反其道而行之，很轻薄，可惜叫好不叫座。对我来说不能插 PSIM 卡（物理 SIM 卡），电池续航低，一颗摄像头就 pass 了。曾经我也是 mini 用户呀，可是用过 Pro 机型就回不去了。
iPhone 17 Pro 两兄弟没有之前的 Pro 那么有料了（毕竟 iPhone 17 挤爆了牙膏），但是如果信号（天线重新设计），散热（今年最大卖点）够强，我还是会选择的，起步容量直接从 256 GB 开始，可谓加量也加价。
我们这方面是遥遥领先啦，遇到国庆 Apple 休息，实际等到节后再退回，服务是真的好呀，没见过无理由退货能有这么久时间的。
退货由 EMS 来揽件，没有取货码，把机子交给他还是有点慌，万一有人打了个时间差把手机取走了呢。退了两天在 Apple Store 订单页面没有动静就打了 Apple 客服 400 666 8800 电话询问，等了三分钟，各种菜单按数字键，系统才转到人工。客服说是正常的，让我耐心等待即可，他不会显示物流信息，只要把东西给他就可以了，后面出了一切问题都 Apple 兜底。今天 14 号一看果然退货已完成，只不过款项还没收到，还要等五个工作日。这里得吐槽一下，正式退款到账是这么写的：「商品已于 xxxx 年 x 月 x 日退货，你已办理退款。」，而我现在的状态是「你的退款已发放」，这不是很误导人嘛。（Apple 就喜欢晚上退钱啊，写文章的时候，22:22 退款了）。
昨晚家人在看电视的时候说 Fire TV Stick 又出问题了，我一看又更新系统了，离上一次已经快四年了，这次又折腾了好一会儿，一是 UI 不一样了，开发者选项藏起来了，二是已经没有 PC 了，需要找 Mac 端的软件来重新安装爱奇艺（银河奇异果），腾讯视频（云视听极光）。这些视频软件在 Amazon 的 App Store 里是没有的，只能「曲线救国」，安装一个叫「当贝市场」的应用。
以前一直想拥有一款 Apple Watch，但因为种种原因总是错过，或者说没想好自己到底需不需要这一块表。Apple Watch S5 的处理器只是换了马甲，和 S4 的一样。然后 S6 的时候没咋关注，当时更喜欢 Garmin 这种 Hardcore 一点的表，等到 S7 的时候有传闻说外观会有大的改变，和 iPhone 12 一样是直角平整边框，结果也没有。直到今年的 Apple Watch S8 还是没有大的改变，估计这下外观固定了，估计好多年不会变，让我遗憾的是用的处理器自从 Apple Watch S6 以来就没有更换过，可能明年就有大幅度升级了吧，也罢，不等了，入手。
选择哪一款
今年还有 Apple Watch SE2 和 Apple Watch Ultra，前者是入门款，没有 Always On Display，用的元件都是库存老款，直接 pass。后者主打极限户外，但是说实话，这售价比 Garmin 的一些户外表还便宜，续航啥的也差一截，为了穿搭好看我还是选择了 Apple Watch S8。不锈钢款性价比太低，加一点钱可以上 Apple Watch Ultra，就选择铝金属款。
Login
