I hope that you enjoyed Saturday’s Mac Riddles, episode 328. Here are my solutions to them.

1:

2:

3: James Bond, Jason Bourne, George Smiley, Modesty Blaise

The common factor

I look forward to your putting alternative cases.

Here are this weekend’s Mac riddles to entertain you through family time, shopping and recreation.

1:

2:

3: James Bond, Jason Bourne, George Smiley, Modesty Blaise.

To help you cross-check your solutions, or confuse you further, there’s a common factor between them.

I’ll post my solutions first thing on Monday morning.

Please don’t post your solutions as comments here: it spoils it for others.

I hope that you enjoyed Saturday’s Mac Riddles, episode 327. Here are my solutions to them.

1: Lost rocket platform as an app for your apps.

2: Burning telegraph and lynx now disconnected.

3: Happy Christmas 2017 is sad September 2025 for the most powerful Mac.

The common factor

I look forward to your putting alternative cases.

Here are this weekend’s Mac riddles to entertain you through family time, shopping and recreation.

1: Lost rocket platform as an app for your apps.

2: Burning telegraph and lynx now disconnected.

3: Happy Christmas 2017 is sad September 2025 for the most powerful Mac.

To help you cross-check your solutions, or confuse you further, there’s a common factor between them.

I’ll post my solutions first thing on Monday morning.

Please don’t post your solutions as comments here: it spoils it for others.

One of the many fine details in macOS is its built-in support for a content caching service, both as server and client. This can be used for local distribution of macOS and other system updates, App Store updates, Apple media content such as Music and movie purchases, and iCloud content.

This appears to have originated as one of the new services added to Mac OS X Server 10.4 Tiger in April 2005, initially confined to a Software Update server. Apple’s online services were growing rapidly at the time, with the iTunes Store opening in 2003, and the first of its App Stores for iOS launching in 2008. Those were followed by the iCloud service in 2011. To cater for those, Apple added a separate Content Caching server by OS X Server 2 in 2012.

This shows the Software Update service in OS X Server 2 in 2012, with a list of some of the updates it had in its cache at the time.

At that time, a client Mac’s Software Update pane in System Preferences had to be pointed at the local server for that to be used instead of Apple’s. However, that didn’t work with App Store caching, for which the /Library/Preferences/com.apple.SoftwareUpdate.plist file had to be edited manually on each client to add a new property specifying the IP address of the local server.

macOS Server 5 in 2015 extended this further.

Features of the Software Update server then included the ability to limit the server’s bandwidth in its link back to Apple’s servers, and to control local network bandwidth used to transfer updates from the server to clients.

Amazingly, its original documentation is still available online here, and instructions for setting up clients remain here.

The Caching service worked with all content and apps provided by the Mac App and iTunes Stores, which of course included OS X updates, and is explained here. By this time, Macs and iOS devices connected to the local network would automatically find a server when it was running; there was minimal configuration for the server, and none for the clients.

When macOS 10.13 High Sierra was released in 2017, that brought update and content caching services to client Macs, and no longer required macOS Server, which was already in its terminal decline. These were configured in a new Content Caching feature added to the Sharing pane in System Preferences.

In essence, you designated one or more Macs as ‘parents’, to serve their cached content to ‘children’, which can themselves host caching services, to allow tiered setups. Initially, parents also needed to share their internet connection, required a minimum of iOS 10.3 for iOS devices, required a wired Ethernet connection to your router, and couldn’t sleep, so had to be run on mains power.

Although the content caching service has become quite widely used since, it’s never been as popular as it deserves. It remains remarkably simple to set up, as seen in these screenshots from 2020.

Clicking on the Options button let you set the cache location and its size.

Tabs were made available if you held the Option key before clicking the Options button, which then became Advanced Options. That let you set up clients, as well as other servers functioning as peers or parents, on more extensive networks.

These remain essentially the same today in Tahoe.

When Apple changed macOS updates in Big Sur, life became more complicated. When updating Apple silicon Macs, the first GB of macOS updates had to be downloaded direct from Apple’s servers, and it was only after that the remainder of the update could be obtained from a local caching server.

Apple has further extended the types of content that can be cached locally, to include

• macOS updates normally obtained through Software Update or the command tool softwareupdate;
• internet Recovery images from macOS 10.13.5 onwards when obtained in Recovery mode;
• apps and their updates supplied through the Mac and iOS App Stores;
• GarageBand downloadable content;
• iCloud documents and data, including Photos libraries;
• Apple Books;
• downloadable components for Xcode.

Most recently Rosetta 2, screen savers, wallpaper and AI models have been added to the list. Apple’s reference document is here.

Advanced server configurations are catered for by the command tool AssetCacheManagerUtil which can also provide performance information, and there are two additional tools available, AssetCacheLocatorUtil and AssetCacheTetheratorUtil. On the server, performance information is most readily accessed in Activity Monitor’s Cache view, which provides summary statistics for the local cache.

This includes the total size of data served for the last hour, 24 hours, 7 days, and 30 days. To view those graphically, the time period for the charts at the foot can be changed by using it as a popup menu.

These show what happened on my content caching server during the macOS 11.4 update in 2021, for which almost 30 GB still had to be downloaded from Apple’s servers, while just over 20 GB was served from its cache.

Over the last 20 years or so, Software Update and Content Caching services have been remarkably reliable, but in June 2022 there was a period during which updates to XProtect and XProtect Remediator failed to install correctly when attempted through a content caching server. Apple never explained what the cause of that was, but it was eventually fixed and hasn’t recurred since.

Then, out of the blue, iOS and iPadOS 26 introduced a new feature to identify and test a connected caching server.

To access this, in Settings > Wi-Fi tap the ⓘ button on your current active network, scroll to the bottom and tap Content Caches. Tap the active cache to see full details, together with a download test. Don’t bother looking for an equivalent feature in macOS 26 Tahoe, though, as it isn’t available yet. How odd.

I hope that you enjoyed Saturday’s Mac Riddles, episode 326. Here are my solutions to them.

1: Melody containing cocoa plugs the ears.

2: Confident bearing of attached label to track your stuff.

3: Breeze reduction moves files wirelessly.

The common factor

I look forward to your putting alternative cases.

Here are this weekend’s Mac riddles to entertain you through family time, shopping and recreation.

1: Melody containing cocoa plugs the ears.

2: Confident bearing of attached label to track your stuff.

3: Breeze reduction moves files wirelessly.

To help you cross-check your solutions, or confuse you further, there’s a common factor between them.

I’ll post my solutions first thing on Monday morning.

Please don’t post your solutions as comments here: it spoils it for others.

The original 128K Mac from 1984 came with a single Motorola 68000 processor running at 8 MHz that could only run one app at a time. Yet today’s Macs come with multiple CPU cores that can comfortably run several substantial apps simultaneously, while running a Time Machine backup and other tasks in the background. This brief history outlines the journey between them.

A processor with a single core and no support for multi-tasking runs one sequence of instructions at a time. When those call for an operating system function to be performed, the running app is interrupted to hand control over to the system, and once that has completed, control is passed back to the app. That’s what the first Macs did until Andy Hertzfeld wrote Switcher, released by Apple in April 1985. This allowed the user to switch between running more than one app, but was still limited to running just one of them at a time.

Multitasking

Over the next couple of years, some third-party utilities were produced to go further than Switcher, but it wasn’t until 1987 that MultiFinder replaced Switcher, and was integrated into System 7 in 1991. Developed by Erich Ringewald and Phil Goldman, this brought cooperative multitasking, which was to become the mainstay of classic Mac OS.

In computers with a single processor core, multitasking is a way of cheating to give the impression that the processor is doing several things at once, when in fact all it’s doing is switching rapidly between two or more different programs. There are two fundamental models for doing that:

• cooperative multitasking, in which individual tasks yield to give others processing time;
• preemptive multitasking, in which a scheduler switches between tasks at regular intervals.

When a processor switches from one task to the next, the current task state must be saved so it can be resumed later. Once that’s complete, the next task is loaded to complete the context switch. That incurs overhead, both in terms of processing and in memory storage, which are less when switching between lightweight tasks. Different strategies have been adopted to determine the optimum size of tasks and overhead imposed by context switching, and terminology differs between them, variously using words such as processes, threads and even fibres, which can prove thoroughly confusing.

Classic Mac OS thus has a Process Manager that launches apps in cooperative multitasking. This works well much of the time, but lets badly behaved tasks hog the processor and block other tasks from getting their fair share. It’s greatly aided by the main event loop at the heart of Mac apps that waits for control input to direct the app to perform work for the user. But when an app charges off to spend many seconds tackling a demanding task without polling its main event loop, that app could lock the user out for what seems like an age.

In February 1988 Apple released the first Unix for Macintosh, A/UX, which came with preemptive multitasking. That was added to Mac OS in 1996 in System 7.5.3, in Multiprocessing Services, and further enhanced in Mac OS 8.6 three years later. Cooperative multitasking was also supported by the Thread Manager.

Threads

In 2000 Apple’s hardware and software changed radically. Its first Macs with dual processors (apart from the Power Mac 9600/200MP that was available briefly in 1997) came in PowerPC 7400 (G4) chips in Power Mac G4 desktop systems, and Mac OS X brought several types of thread that could be used to manage processing on multiple processors or CPU cores, together with preemptive multitasking. Thread types include low-level Mach threads, higher-level POSIX threads or Pthreads that replaced Multiprocessing Services, Java Threads, Cocoa’s NSThreads, and cooperatively scheduled threads using the Carbon Thread Manager. The following diagram summarises Apple’s current terminology.

In most cases, we’re considering applications with a GUI, normally run from a bundle structure. These can in turn run their own code, such as privileged helper apps used to perform work that requires elevated privileges. In recent years, there has been a proliferation of additional executable code associated with many apps.

When that app is run, there’s a single runtime instance created from its single executable code, and given its own virtual memory and access to system resources that it needs. This is a process, and listed as such in Activity Monitor, for example.

Each process has a main thread, a single flow of code execution, and may create additional threads, perhaps to run in the background. Threads don’t get their own virtual memory, but share that allocated to the process, although they have their own stack. On Apple silicon Macs they’re easy to tell apart as they can only run on a single core, although they may be moved between cores, sometimes rapidly.

Within each thread are individual tasks, each a quantity of work to be performed. These can be brief sections of code and are more interdependent than threads. They’re often divided into synchronous and asynchronous tasks, depending on whether they need to be run as part of a strict sequence.

In 2005 the Power Mac G5 was the first Mac to use dual-core PowerPC G5 processors, then the iMac 17-inch of the following year used Apple’s first Intel Core Duo processor with two cores.

Grand Central Dispatch

In 2009 Mac OS X 10.6 Snow Leopard introduced a new dispatcher, named Grand Central Dispatch (GCD) after Grand Central Terminal in New York City, and that was enhanced in macOS Sierra a decade later. More recently it has been referred to simply as Dispatch.

At its heart, GCD is a dispatcher managing queues of tasks, activating those that need most to be run, and leaving the less pressing to wait a bit longer. It has its own queues, as well as those assembled by apps. Some are run as simple queues with a first in first out rule, others using sophisticated heuristics to determine relative priorities. There’s a detailed account of GCD internals in Jonathan Levin’s book *OS Internals volume 1, and Apple’s current developer documentation is here.

GCD was introduced for Macs with multiple identical cores, to support their symmetric multiprocessing (SMP), and with the release of the first Apple silicon Macs in November 2020 it has managed queues of threads to be dispatched for execution on two CPU core types, Performance and Efficiency. Core allocation is now managed according to the Quality of Service (QoS) assigned to each thread. When used on SMP processors with no contention for core availability, QoS has limited effects on thread performance, but performance on P and E cores may differ by a factor of 10.

Over the last 41 years, macOS has gained thorough support for getting the best performance from multiple tasks, threads, and processes in chips that contain up to 32 CPU cores of two types – a far cry from that single 68000 processor.

I hope that you enjoyed Saturday’s Mac Riddles, episode 325. Here are my solutions to them.

1: Not quite a dogcow functions in six modules from 1991.

2: Suite in three movements replacing 1 from 2004.

3: Yoga position with syncopated music, but it wasn’t the sequel to 1-2-3.

The common factor

I look forward to your putting alternative cases.

Here are this weekend’s Mac riddles to entertain you through family time, shopping and recreation.

1: Not quite a dogcow functions in six modules from 1991.

2: Suite in three movements replacing 1 from 2004.

3: Yoga position with syncopated music, but it wasn’t the sequel to 1-2-3.

To help you cross-check your solutions, or confuse you further, there’s a common factor between them.

I’ll post my solutions first thing on Monday morning.

Please don’t post your solutions as comments here: it spoils it for others.

I hope that you enjoyed Saturday’s Mac Riddles, episode 324. Here are my solutions to them.

1: Last edit from KeyGrip but not for the amateur.

2: Movement to accompany 1 for its titles and effects.

3: Opening that closed for your photos a decade ago.

The common factor

I look forward to your putting alternative cases.

Here are this weekend’s Mac riddles to entertain you through family time, shopping and recreation.

1: Last edit from KeyGrip but not for the amateur.

2: Movement to accompany 1 for its titles and effects.

3: Opening that closed for your photos a decade ago.

To help you cross-check your solutions, or confuse you further, there’s a common factor between them.

I’ll post my solutions first thing on Monday morning.

Please don’t post your solutions as comments here: it spoils it for others.

Few other companies have had as much influence on the Mac and its success as Adobe. Founded just over a year before Apple launched the Mac, its original mission was to develop and market its new PostScript page description language, originally designed and written by Adobe’s co-founders, John Warnock (1940-2023) and Charles Geschke (1939-2021). Steve Jobs (1955-2011) was an early enthusiast who shared their vision. After an unsuccessful bid to buy Adobe, Apple bought a 19% stake in it and paid in advance for a five-year licence for PostScript. When Apple introduced its first PostScript laser printer, the LaserWriter, in March 1985 the partnership launched the Desktop Publishing (DTP) revolution.

Adobe Illustrator (1987)

The same year the LaserWriter brought PostScript and its fonts to the first DTP designers, Adobe started development of its first retail software product, Illustrator, released two years later in 1987. This is a vector graphics editor aimed initially at creating in Encapsulated PostScript Format (EPSF), so had to render the bézier curves of PostScript into the Mac’s QuickDraw graphics.

Illustrator wasn’t offered for Windows for another two years, and even then was widely criticised for lagging behind its Mac version. It wasn’t until 1997 that the Windows version achieved parity. Adobe’s major competitor, Aldus FreeHand, was preferred by many professionals until Adobe bought Macromedia in 2005, following which it was quietly suffocated.

This is Adobe Illustrator running in Mac OS X 10.2 Jaguar in early 2003.

Adobe Photoshop (1990)

In 1988, Adobe bought the distribution licence to a raster graphics editor already named Photoshop by its original developers, brothers Thomas and John Knoll. The first Adobe version was released for Macs only in February 1990. It has the distinction of being the major app developed using Apple’s MacApp class library, and wasn’t released for Windows until late 1992, by which time it was establishing itself as the standard, particularly for pro photographers. In 2007 it was joined by Adobe Photoshop Lightroom, an image management app that became the standard when Apple discontinued Aperture in 2015.

This is Adobe Photoshop in Mac OS 9.2, in late 2002.

And this is its matching Mac OS X version in 10.2 Jaguar.

Adobe Premiere (1991)

Digital non-linear video editing was in its infancy in 1991, when SuperMac Technology developed a QuickTime-based app to support its Video Spigot capture card. Adobe purchased the whole project, and four months later at the end of 1991 released the first version of Adobe Premiere. Although severely constrained by hardware of the time, it proved another successful Mac-only product until its Windows version was released almost two years later, and the product was renamed Adobe Premiere Pro in 2003.

In 1995, Premiere was joined by After Effects following Adobe’s acquisition of Aldus the previous year. After Effects provides digital effects including motion graphics and compositing. In 1999, Apple released Final Cut Pro, whose early development had been by the first Premiere development team working for Macromedia, and has since added Motion and other apps to form its Pro suite. They successfully competed against Adobe’s video products on the Mac.

PDF and Adobe Acrobat (1993)

I have already given a fuller account of the history of PDF and Adobe Acrobat on Macs.

This is Acrobat Distiller 4.0 running on Mac OS 9.1 in early 2001, showing some of its bewildering array of options for turning PostScript files into PDF.

Adobe provided its free Acrobat Reader for Mac OS X, here seen in 10.0 Cheetah.

Adobe FrameMaker (1995)

FrameMaker, originally developed by Frame Technology, is a high-end technical publishing system bought by Adobe in 1995. It was then offered in a premium version with extensive support for SGML, seen here in 2002, two years before Adobe dropped this Mac version.

Adobe PageMaker (1995-2001)

From its launch in 1985, the leading page layout app for Macs had been Aldus PageMaker, which Adobe acquired when it purchased Aldus in 1994. By this time, PageMaker was under increasing pressure from QuarkXPress, which had become preferred by many professionals. As a result, Aldus had already started to develop what it claimed would be its “Quark killer”, and Adobe continued that. It then discontinued support for PageMaker in a final version released in 2001, which notoriously didn’t support Mac OS X and was never ported to Intel Macs either.

Adobe InDesign (1999)

Early development on what was to become Adobe InDesign had started in Aldus before it was swallowed up by Adobe, and its first version was released in 1999, for both Windows and Mac OS. When Mac OS 10.0 Cheetah was released in March 2001, InDesign was its first native page layout app, as well as the first to support Unicode and advanced features of OpenType fonts. As QuarkXPress entered a decline, InDesign became the DTP product of choice.

This is Adobe InDesign in its early days, seen here editing Christmas cards in Mac OS X 10.2 Jaguar in December 2002.

Adobe Dreamweaver (2005)

Dreamweaver is a website development app that originated in Macromedia in 1997, and was acquired by Adobe with its purchase of that company in 2005.

Adobe Dreamweaver is seen here running in Mac OS X 10.6 Snow Leopard in August 2009.

Flash (2005-2020)

Another of Macromedia’s products that Adobe acquired in 2005 was Flash, a rich multimedia software platform that became enormously popular in websites including YouTube and many corporate sites. Flash came with its own scripting language ActionScript, but proved a security nightmare because of its long series of exploited vulnerabilities. Although Flash Player was almost universal on Macs, Apple refused to allow Flash support on its devices, leading to a bitter standoff between Steve Jobs and Adobe. About a year later, much to the relief of security staff around the world, Adobe announced it would cease Flash development; it was deprecated in 2017, and all support stopped at the end of 2020.

‘Shockwave Flash’ and the Flash Player plagued Mac OS X Tiger in 2006.

Others

There have been and still are many other apps from Adobe. One of my favourites was LaserTalk, first released by Emerald City Software in 1988. This was a PostScript debugger acquired by Adobe and bundled in its PostScript SDK. Finally, there was Adobe Streamline, a tool for converting bitmap graphics into Adobe Illustrator vector graphics, first released in 1989, and absorbed into Illustrator in about 2001. No doubt you will also have your own favourites.

Apple sold its 19% stake in Adobe in 1989, and in 2011 Adobe introduced its Creative Cloud subscription service, that two years later replaced its popular Creative Studio DVD distributions with perpetual licences.

I hope that you enjoyed Saturday’s Mac Riddles, episode 323. Here are my solutions to them.

1: Well-guarded like West Berlin was, it holds your greatest secrets.

2: Motor nerve processes your images.

3: Cloth or worsted to connect it all together.

The common factor

I look forward to your putting alternative cases.

Here are this weekend’s Mac riddles to entertain you through family time, shopping and recreation.

1: Well-guarded like West Berlin was, it holds your greatest secrets.

2: Motor nerve processes your images.

3: Cloth or worsted to connect it all together.

To help you cross-check your solutions, or confuse you further, there’s a common factor between them.

I’ll post my solutions first thing on Monday morning.

Please don’t post your solutions as comments here: it spoils it for others.

Inside every Intel Mac with a T2 chip, and every Apple silicon Mac, is a secure enclave, originally referred to as its security enclave. The subject of a flurry of Apple’s patents from 2012 onwards, this was introduced in the A7 chip inside the iPhone 5s and iPad mini 3, 12 years ago in September 2013, where it brought biometric authentication in Touch ID.

iPhone 5s

Protecting the most important secrets in a computer is a great challenge. No matter how secure you try to make the main processor and memory, as they’re exposed to direct attack, isolation can only be relative and temporary. An alternative approach is to move the most secure data and its processing into a secure enclave and its processor, and that’s the architectural solution chosen by Apple in what it patented as a security enclave, filed in September 2012, a year before its release in the iPhone 5s. Engineers credited for that patent are Manu Gulati, Michael J Smith and Shu-Yi Yu.

Successive iPhone chips steadily improved their secure enclaves, and by the time the iPhone 7 was introduced in September 2016, with its A10 Fusion chip, its secure enclave was handling encryption and authentication but not replay prevention. It also had EEPROM secure storage, and an AES engine with DPA protection and lockable seed bits. When the first Intel Mac with a T1 chip was released a couple of months later, that was based not on the A10 but the S2 used in the Apple Watch Series 2. The T1 thus doesn’t really have a secure enclave as such, although it supports Touch ID.

An early and thorough account of these secure enclaves was presented by Tarjei Mandt, Mathew Soling and David Wang at Black Hat USA in 2016. This appears to be the only such account apart from the section in Apple’s Platform Security Guide, most recently updated in December 2024. Apple’s engineers continued to gain new patents, covering trust zone support (filed in 2012), key management (filed in 2014), and most relevant to Macs, Pierre Olivier Martel, Arthur Mesh and Wade Benson’s patent for multi-user storage volume encryption, filed in 2020.

T2 chip

The first Macs with a true secure enclave are those with a T2 chip, starting with the iMac Pro in December 2017. Those are based on the same A10 Fusion chip from the previous year, and were already lagging the iPhone 8 in this respect.

The T2 secure enclave is another co-processor system, run by a Secure Enclave Processor (SEP), a 32-bit ARM CPU running its own operating system, sepOS, based on a specialised L4 microkernel completely different from those used by Macs and Apple’s devices. It has its own secure storage (EEPROM), and a Public Key Accelerator for signing and encryption/decryption using RSA and ECC methods. Outside the enclave is a dedicated AES256 encryption/decryption engine built into the data transfer path between the internal SSD and main system memory.

M-series chips

The big leap forward for Macs was the release of the first models featuring M1 chips, which caught up with the features of late versions (after autumn 2020) of the A12 and A13, with Apple’s second generation Secure Storage Component.

Perhaps the most significant of its improvements are measures to prevent replay attacks. Those are best illustrated with FileVault. Let’s say that you didn’t enable FileVault at first, but left your Apple silicon Mac to handle the encryption of its internal Data volume without the added protection of your password. That would mean that its volume encryption key (VEK) was generated internally by the Secure Enclave, and stored there. If you then turned FileVault on, the VEK would be encrypted using your password and the hardware key. In the T2 chip, it might be possible to use the old VEK to decrypt the volume. In the secure enclave of an M-series chip, that type of replay attack is prevented by the revocation of all previous events and records.

Other improvements include the use of second generation secure storage incorporating counter lockboxes to enforce limits on the number of passcode attempts allowed, instead of an EEPROM, and a better Public Key Accelerator.

Currently, the secure enclave is known to protect the following:

• encryption keys for Touch ID, FileVault, and the Data Protection (iCloud) keychain (but not file-based keychains);
• that Mac’s Unique ID (UID) and Group ID (GID);
• Touch ID control, and (on older devices not Macs) Face ID using a secure neural engine; in recent devices and M-series chips, that’s implemented as a secure mode in the main neural engine (ANE);
• Apple Pay handling;
• Activation Lock, through the Owner and User Identity Keys;
• signing and verification of LocalPolicy for boot environments (Apple silicon).

Communication between the CPU and SEP is performed using a dedicated mailbox whose function is detailed in Apple’s patents. Further information is also provided in the Platform Security Guide.

FileVault encryption

It has been stated widely (even here) that the secure enclave in T2 and Apple silicon chips contains a hardware encryption/decryption unit and acts as the internal SSD’s storage controller. In fact, as shown in the original patent of Martel and others, and now in the Platform Security Guide, the AES engine responsible is located outside the secure enclave, together with the Flash controller, and has a secure link to the enclave.

During SEP boot, it generates an ephemeral key to wrap keys to be used by the AES engine for encryption and decryption. That key is sent from the secure enclave to the AES engine over the dedicated connection between them, then used to protect keys transferred from the enclave to the AES engine. That ensures an unprotected key is never exposed outside the enclave and AES engine.

The Apple silicon secure enclave is by no means unique. ARM TrustZone, other Trusted Execution Environments, and Trusted Platform Modules offer similar features and facilities. However, the secure enclave is unusual because it has been integrated into all Macs with T2 or Apple silicon chips, and all Apple’s recent devices, and can’t be disabled or bypassed.

References

Manu Gulati, Michael J Smith and Shu-Yi Yu, US Patent 8,832,465 B2, Security enclave processor for a system on a chip, filed 25 September 2012, granted 9 September 2014.
R Stephen Polzin, James B Keller, Gerard R Williams, US Patent 8,775,757 B2, Trust zone support in system on a chip having security enclave processor, filed 25 September 2012, granted 8 July 2014.
R Stephen Polzin, Fabrice L Gautier, Mitchell D Adler, Conrad Sauerwald and Michael LH Brouwer, US Patent 9,419,794 B2, Key management using security enclave processor, filed 23 September 2014, granted 16 August 2016.
Pierre Olivier Martel, Arthur Mesh and Wade Benson, US Patent 11,455,432 B1, Multi-user storage volume encryption via secure processor, filed 8 June 2020, granted 27 September 2022.
Tarjei Mandt, Mathew Soling and David Wang (2016), Demystifying the Secure Enclave Processor, Black Hat USA 16 (PDF)
Apple, Platform Security Guide
Wikipedia’s overview of Apple silicon chips.

I hope that you enjoyed Saturday’s Mac Riddles, episode 322. Here are my solutions to them.

1: It’s about evolution, and open source for 25 years.

2: If the kernel isn’t Unix, this is it.

3: Mud puddles in Pittsburgh misheard as the basis for 2.

The common factor

I look forward to your putting alternative cases.

Here are this weekend’s Mac riddles to entertain you through family time, shopping and recreation.

1: It’s about evolution, and open source for 25 years.

2: If the kernel isn’t Unix, this is it.

3: Mud puddles in Pittsburgh misheard as the basis for 2.

To help you cross-check your solutions, or confuse you further, there’s a common factor between them.

I’ll post my solutions first thing on Monday morning.

Please don’t post your solutions as comments here: it spoils it for others.

When Mac OS X 10.0 was released in March 2001, privileges, permissions and security adopted a conventional model based on BSD and Unix. Those sufficed for 15 years until the release of OS X 10.11 El Capitan in September 2015, when System Integrity Protection, SIP, was introduced. This article outlines its history over the last decade.

2015 Introduction

The first public account of SIP was presented by Pierre-Olivier Martel at WWDC 2015 in June, and documented in Apple’s System Integrity Protection Guide that September, which hasn’t been revised since. These changes were justified as adding a further layer of security protection to prevent attackers from gaining full control by escalating privileges to root.

Three types of protection were promised:

• file system protections, so that system files could only be modified by processes signed by Apple;
• prevention of runtime attachment, code injection, or modification of system binaries, with modifications only permitted by Apple’s installers and updaters;
• kernel extensions (kexts) had to be signed using special certificates granted by Apple.

Each Mac’s SIP configuration was stored in NVRAM, and controlled by the csrutil command used in Recovery mode.

When released, the csrutil command provided some degree of separate control over six groups of features: file system protections, debugging protection, DTrace protection, kext signing requirement, NVRAM and ‘Apple internal’ protection. One immediate beneficial side-effect was that SIP prevented permissions being changed for system files, and that made the practice of repairing permissions on them unnecessary, allowing removal of support for that procedure from Disk Utility.

2015 Conflicts

Press reviews of the SIP feature were divided, with some claiming it was a sign that OS X was being closed down and moved to the iOS security model, while others considered that few users would notice much difference.

Problems resulting from SIP were reported soon after El Capitan’s release. For example, some older Mac models intentionally prevented their use with Apple USB SuperDrives. One workaround to address that had been to modify one of the files now protected by SIP, which consequently required the user to disable SIP to make that change.

As kernel extensions hadn’t previously been required to be signed at all, other early casualties were all older unsigned kexts, making some apps unusable unless a new version was provided with a correctly signed kext.

2016 Error

Late in 2016, it became clear that Apple had shipped a substantial batch of new MacBook Pro systems with SIP disabled. At that time, System Information was unable to report SIP status, and the only way to enable protection was to start that Mac up in Recovery mode and use the csrutil command in the Terminal app there. That applied to macOS Sierra 10.12 to 10.12.1.

To make this easier, Apple changed csrutil so that it could enable SIP when invoked in normal running mode, provided it was run with elevated privileges obtained using sudo. Despite that, some of those affected MacBook Pro models didn’t have SIP enabled correctly for several months.

2017-18 Problems

Over the following years, SIP continued to cause irritations that infuriated some users.

Bundled apps in the main Applications folder were protected by SIP, and that prevented the user from modifying them. As the handling of kexts changed, it was discovered that SIP made it awkward to remove old kexts the user had installed. That was because the folder /Library/StagedExtensions was put under the protection of SIP by attaching a com.apple.rootless extended attribute to it.

One reading of that extended attribute is that only Apple’s KernelExtensionManagement service can give permission for changes to be made within that folder, and the folders within it.

2020 Extended attributes

Apple later used SIP to lock down individual extended attributes (xattrs) attached to regular unprotected files. The first example of this was the undocumented com.apple.macl xattr that macOS started to attach widely to all user documents. Presence of that xattr was implicated in some problems in which those documents became locked down and unable to save changes, despite permissions and other visible attributes showing that the user had full ownership of the file. The only workaround for this has been to copy the file to another volume, where the xattr no longer has the protection of SIP, and can be stripped.

When Apple later introduced another undocumented xattr com.apple.provenance, that too was sometimes but not always protected by SIP, although that hasn’t been implicated in problems visible to the user.

2022 Launch constraints

Launch constraints were introduced in macOS 13 Ventura and iOS 16 in 2022. Every executable binary in the system now has a set of rules determining the requirements for that binary to be launched. These include self constraints that the binary itself must meet, parent constraints that must be met by its parent process, and responsible constraints that must be met by the process requesting the launch. Together these form that code’s launch constraints. To make those constraints simpler, they come in different categories, ranging from 0, in which there are no constraints at all, to combinations that prevent launch by processes that aren’t themselves part of the system and require the code itself to be on the System volume.

Although Apple has documented these for developers, they can cause unexpected behaviour for users, who haven’t been given any explanation. Testing has demonstrated that launch constraints are dependent on SIP, so must be assumed to have been added to its list of protections.

2024 Malware scans

Many users have reported slowing app launch times in recent versions of macOS. In February 2024, Jeff Johnson investigated these, and concluded that the cause was the macOS security system repeatedly performed malware scans against a growing set of Yara rules. These stopped when SIP was disabled, implying that this is yet another protection that has been added to those controlled by SIP.

2024 Current protections

Current user documentation for SIP explains only its file system protection, csrutil‘s man page refers to its usage information, but from that and XNU it’s possible to separate out its controls to include the following, at least:

• Filesystem Protections, disabled by CSR_ALLOW_UNRESTRICTED_FS, abbreviated to fs
• Debugging Restrictions, disabled by CSR_ALLOW_KERNEL_DEBUGGER and CSR_ALLOW_TASK_FOR_PID, abbreviated to debug
• DTrace Restrictions, disabled by CSR_ALLOW_UNRESTRICTED_DTRACE, abbreviated to dtrace
• Kext Signing, disabled by CSR_ALLOW_UNAPPROVED_KEXTS, abbreviated in csrutil to kext
• NVRAM Protections, disabled by CSR_ALLOW_UNRESTRICTED_NVRAM, abbreviated to nvram
• Apple Internal, disabled in XNU by CSR_ALLOW_APPLE_INTERNAL, and only disabled when SIP is fully disabled
• BaseSystem Verification, abbreviated to basesystem
• Boot-arg Restrictions, disabled with nvram
• Kernel Integrity Protections, disabled with kext
• Authenticated Root Requirement, disabled by CSR_ALLOW_UNAUTHENTICATED_ROOT, managed separately using csrutil authenticated-root disable and enable
• Additional configuration flags available in XNU that don’t appear to be directly supported by csrutil include: CSR_ALLOW_TASK_FOR_PID, CSR_ALLOW_DEVICE_CONFIGURATION, CSR_ALLOW_ANY_RECOVERY_OS and CSR_ALLOW_EXECUTABLE_POLICY_OVERRIDE. Those should be disabled when SIP is fully disabled.

2015-2025 Vulnerabilities

Over the last decade, many vulnerabilities have been discovered in SIP that have allowed parts of its protections to be bypassed. Among the most recent is CVE-2024-44243 discovered by Jonathan Bar Or (@yo_yo_yo_jbo) of Microsoft Threat Intelligence and Mickey Jin (@patch1t), and fixed in the update to macOS 15.2 Sequoia. However, this wasn’t fixed in Sonoma until the following round of updates (14.7.3), and appears to remain unpatched in Ventura 13.7.8.

Microsoft’s report explains how bypassing just one of SIP’s many protections can give access to bypasses of more or all of SIP’s other protections. Note also how Apple’s description of the vulnerability in its security release notes refers to StorageKit but doesn’t reveal that this affected SIP.

Over the last decade, SIP has grown like Topsy from three protections that seemed worthwhile and simple, into a protean collection of many parts that remain largely undocumented and pervade much of modern macOS security.

References

Wikipedia’s account, still largely based on SIP in 2015
This blog on csrutil controls

I hope that you enjoyed Saturday’s Mac Riddles, episode 321. Here are my solutions to them.

1: Where to sell an image of the Knolls in a two-year exclusive.

2: Rembrandt, Claude Monet, JMW Turner and Corel.

3: One of the first two, it could be beige acrylic and written by Bill.

The common factor

I look forward to your putting alternative cases.

Here are this weekend’s Mac riddles to entertain you through family time, shopping and recreation.

1: Where to sell an image of the Knolls in a two-year exclusive.

2: Rembrandt, Claude Monet, JMW Turner and Corel.

3: One of the first two, it could be beige acrylic and written by Bill.

To help you cross-check your solutions, or confuse you further, there’s a common factor between them.

I’ll post my solutions first thing on Monday morning.

Please don’t post your solutions as comments here: it spoils it for others.

Before the arrival of Mac OS X, our Macs had remained almost free from the property lists and other XML files that now seem to fill them. Those owe their origin to the grandfather of markup languages, SGML, originally known as Generalised Markup Language. That was invented by Charles Goldfarb, Ed Mosher and Ray Lorie in 1969, when they were working at IBM, as a means of structuring text semantically, and first used a different form of markup, as in
:h1.Chapter 1: Introduction
to set that text as a top-level headline. Ordered lists should look familiar to anyone who writes HTML:
:ol
:li.Item one.
:li.Item two.
:eol.
SGML was flexible as to markup formatting, but has become most widely seen using the angle brackets <> common to HTML, XML, and other markup languages.

Although it has never been popular in its own right, SGML still features in some products where markup is required to impart structure and meaning.

FrameMaker, originally developed by Frame Technology, is a high-end technical publishing system bought by Adobe in 1995. It was then offered in a premium version with extensive support for SGML, seen here in 2002, two years before Adobe dropped this Mac version.

XML

In 1996, a working group of W3C (the World Wide Web Consortium) started developing a profile of SGML that became known as Extended Markup Language, or XML. Work continued through 1997, and in February 1998 XML 1.0 was adopted as a W3C Recommendation. While there’s also a slightly different version 1.1, published in 2004, and various editions of 1.0, in its fundamentals the XML we use today is still version 1.0, with 1.1 only recommended for special purposes.

Property lists

Unlike traditional implementations of Unix, NeXTSTEP used its own property lists to contain serialised objects including settings. When Mac OS X was introduced, those were replaced by a new XML format using a public Document Type Declaration (DTD) still used today.

Although intended to be expressed in plain text, binary representations of XML developed during the early years of the new millennium, and Apple decided to adopt its own, bplist, in the early days of Mac OS X. This brought improved parsing speed, as well as being more compact, and has acted as a deterrent to those who might make casual changes to critical property lists. These were introduced in Mac OS X 10.2 Jaguar in 2002, and have been used as standard for property lists since Mac OS X 10.4. They are described well in this Wikipedia article.

A typical modern property list coded in XML might read
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<array>
<date>2017-10-10T13:13:43Z</date>
</array>
</plist>
That specifies a datestamp in an extended attribute.

Tools

Bundled tools to create and edit property lists have remained disappointingly primitive, but there has been no shortage of contenders from third parties.

This is the ElfData XML Editor, one of the first to be released in 2001, seen two years later in Mac OS X 10.2 Jaguar editing DocBook XML format.

In 2004, David Reitter created a version of GNU Emacs with an Aqua interface and named it Aquamacs. It’s seen here in 2006, in Mac OS X 10.4 Tiger, with its XML tools for editing a property list.

Another early entrant, from 2002, that has blossomed into one of the most extensive and sophisticated XML development environments is cross-platform Oxygen, from SyncRO Soft. Although written in Java its Mac versions have been sensitively implemented. It’s seen here in Mac OS X 10.4 Tiger in 2006, viewing an XML rendition of Shakespeare’s Hamlet.

This is Syntext Serna in 2007, again in Mac OS X 10.4 Tiger, seen editing an XML version of my PhD thesis that had originally been written in Adobe FrameMaker+SGML.

Other editors came and went, such as XML Editor, here in the last few days of Mac OS X 10.4 Tiger in 2007. This is a table from my thesis.

Major text editors also gained XML powers. These are Safari’s preferences in Mac OS X 10.5 Leopard, seen rendered by Rich Siegel’s BBEdit. He first distributed this text editor for System 6 back in 1992, and over 30 years later it remains one of the few high-end text editors for macOS.

My final example returns to the specialist features in Oxygen, seen here in Mac OS X 10.7 Lion in 2012, where it’s being used with a botanical flora.

Today XML and property lists remain at the heart of macOS, something I doubt that Charles Goldfarb ever dreamed of back in 1969.

References

Charles F Goldfarb (1996) The Roots of SGML – A Personal Recollection, Wayback Machine
SGML on Wikipedia
XML on Wikipedia
Property lists on Wikipedia

I hope that you enjoyed Saturday’s Mac Riddles, episode 320. Here are my solutions to them.

1: What ET wants is a call coming to the Mac.

2: A glass to enlarge among the liquid.

3: Daybook you might already have started elsewhere.

The common factor

I look forward to your putting alternative cases.

Here are this weekend’s Mac riddles to entertain you through family time, shopping and recreation.

1: What ET wants is a call coming to the Mac.

2: A glass to enlarge among the liquid.

3: Daybook you might already have started elsewhere.

To help you cross-check your solutions, or confuse you further, there’s a common factor between them.

I’ll post my solutions first thing on Monday morning.

Please don’t post your solutions as comments here: it spoils it for others.

To make its graphical interface work, the Mac needed a high-performance graphics system, for which the late Bill Atkinson (1951-2025) and Andy Hertzfeld designed and implemented QuickDraw. When it came to driving printers, though, Steve Jobs licensed the new page description language PostScript from Adobe, where it had just been developed by John Warnock (1940-2023), Charles Geschke (1939-2021) and others. PostScript is a stack-based interpreted language that could take many seconds or even minutes to image a page for printing, so wasn’t practical for doing much else at that time.

In the early 1990s, as desktop publishing became dominant among Mac users and we were all sending one another faxes, several companies recognised the need for a universal document format that could display laid-out text and graphics. Among them was Adobe, where Warnock formulated the aims of what he then referred to as Interchange PostScript or IPS, and so led the development of Portable Document Format. It’s telling that the final sentence of his proposal reads: “In any event corporations should be interested in site-licensing arrangements.”

When the first version of PDF was released in 1993, with its Carousel reader app, it faced competition from other similar ideas, and Adobe found itself competing against products including Farallon’s Replica, and Tumbleweed’s Envoy that gained the support of WordPerfect, then a popular cross-platform word processor. PDF didn’t become dominant until Adobe distributed its reader app free, rather than charging $50 for it as it had initially.

For many years, the only way to create really good PDFs was using Adobe’s Acrobat Distiller app, costing $695 for a single-user licence. That ingested PostScript files, created on the Mac by printing to a file, and transformed them into PDFs that could in turn only be read using Adobe’s software. Although PostScript was by then a prerequisite for all publishing work on Macs, it wasn’t until 1996, when PDF reached version 1.2 in Acrobat 3.0, that it captured the prepress market, which it consolidated in 1998 with the PDF/X-1 standard.

This is Acrobat Distiller 4.0 running on Mac OS 9.1 in early 2001, showing a few of its bewildering array of options for turning PostScript files into PDF.

At the same time, John Warnock’s aspirations for success in enterprise markets were being realised, and PDF steadily became the standard for fixed-format electronic documents, with the support of the US Internal Revenue Service and Adobe’s free cross-platform Acrobat Reader.

When Steve Jobs established NeXT in 1985 he must have become the only person to have licensed PostScript from Adobe twice, as NeXTSTEP adopted Display PostScript as the centrepiece of its graphics, developed collaboratively between NeXT and Adobe. At the time many thought this to be a mistake, as PostScript isn’t as efficient a graphics language as QuickDraw, despite Adobe’s efforts to accelerate it.

When NeXT and Mac merged to form the beginnings of Mac OS X in 1997, Display PostScript was replaced with PDF as the central graphics standard for both display and printing, in what was dubbed Quartz 2D. This was first demonstrated at WWDC in 1999 and lives on today in macOS. At the time, Apple’s in-house PDF engine in Quartz was one of few, alongside Adobe’s.

Prior to Mac OS X, Adobe Acrobat, both in its free viewer form and a paid-for Pro version, had been the de facto standard for reading, printing and working with PDF documents on the Mac. The Preview app had originated in NeXTSTEP in 1989 as its image and PDF viewer, and was brought across to early versions of Mac OS X, where it has remained ever since.

This PDF shows Apple’s original iPod promotional literature from late 2001.

Adobe continued providing its free Acrobat Reader for Mac OS X, here seen in 10.0 Cheetah.

The full paid-for version of Adobe Acrobat provided an extensive suite of editing tools, here in Mac OS X 10.1 Puma in early 2002.

By Mac OS X 10.3 Panther in 2003, Apple was claiming that Preview was “the fastest PDF viewer on the planet”, capable of navigating and searching text within PDF documents “at lightning speed”. This worked with the Mac’s new built-in support for faxing, which rendered received faxes in PDF to make them easier and clearer to access.

This is an early Keynote Quick Reference guide from 2003, viewed in Preview.

At that time, Preview was also able to convert Encapsulated PostScript (EPS) files and raw PostScript to PDF, so they could be saved in the more accessible format, and printed easily.

This page from the 9/11 Commission Report of 22 July 2004 is being viewed in Preview.

Acrobat Distiller remained an important component in Adobe’s paid-for product, even though Mac OS X was capable of generating its own PDFs. It’s seen here in Mac OS X 10.4 Tiger in 2005.

This is Acrobat Pro in 10.4 Tiger in early 2006, showing its long list of supported export formats.

Since those heady days, Preview has been relatively neglected. Revision of both the Quartz PDF engine and its API brought a spate of bugs that only abated with macOS Sierra. Preview has adopted an uncommon model for PDF annotations that often doesn’t work well with other PDF products, but it has remained very popular for completing electronic forms. Then, in macOS Ventura, Apple removed all support for converting EPS and PostScript to PDF, most probably as a result of security concerns, and their progressive disuse.

Although rumours of the death of Preview continue to prove unfounded, it’s unlikely to feature again as one of the strengths of macOS.

References

John Warnock (1991) The Camelot Project, on the Internet Archive’s Wayback machine.
Laurens Leurs’ The history of PDF.

I hope that you enjoyed Saturday’s Mac Riddles, episode 319. Here are my solutions to them.

1: Successor to 3 inside a scheme was part of a popular atelier.

2: High speed subatomic particle took the lead in the 1990s.

3: Creator of a squire’s assistant was the first, but died before Mac OS X.

The common factor

I look forward to your putting alternative cases.

Here are this weekend’s Mac riddles to entertain you through family time, shopping and recreation.

1: Successor to 3 inside a scheme was part of a popular atelier.

2: High speed subatomic particle took the lead in the 1990s.

3: Creator of a squire’s assistant was the first, but died before Mac OS X.

To help you cross-check your solutions, or confuse you further, there’s a common factor between them.

I’ll post my solutions first thing on Monday morning.

Please don’t post your solutions as comments here: it spoils it for others.

Since writing A brief history of local search, I have come across numerous patents awarded to Apple and its engineers for the innovations that have led to Spotlight. This more detailed account of the origins and history of Spotlight uses those primary sources to reconstruct as much as I can at present.

1990

ON Technology, Inc. released On Location, the first local search utility for Macs, a Desk Accessory anticipating many of the features to come in Spotlight 15 years later. This indexed text found in the data fork of files, using format-specific importer modules to access those written by Microsoft Word, WordPerfect, MacWrite and other apps of the day. Those files and their indexed contents were then fully searchable. This required System Software 6.0 or later, and a Mac with a hard disk and at least 1 MB of RAM. It was developed by Roy Groth, Rob Tsuk, Nancy Benovich, Paul Moody and Bill Woods.

1991

Version 2 of On Location was released. ON Technology was later acquired by Network Corporation, then by Symantec in 2003.

1994

AppleSearch was released, and bundled in Workgroup Servers. This was based on a client-server system running over AppleShare networks. September’s release of System Software 7.5 introduced a local app Find File, written by Bill Monk.

1998

Sherlock was released in Mac OS 8.5. This adopted a similar architecture to AppleSearch, using a local service that maintained indexes of file metadata and content, and a client app that passed queries to it. This included remote search of the web through plug-ins working with web search engines, as they became available.

Early patent applications were filed by Apple’s leading engineers who were working on Sherlock, including US Patent 6,466,901 B1 filed 30 November 1998 by Wayne Loofbourrow and David Cásseres, for a Multi-language document search and retrieval system.

1999

Sherlock 2 was released in Mac OS 9.0. This apparently inspired developers at Karelia Software to produce Watson, ‘envisioned as Sherlock’s “companion” application, focusing on Web “services” rather than being a “search” tool like Sherlock.’

2000

On 5 January, Yan Arrouye and Keith Mortensen filed what became Apple’s US Patent 6,847,959 B1 for a Universal Interface for Retrieval of Information in a Computer System. This describes the use of multiple plug-in modules for different kinds of search, in the way that was already being used in Sherlock. Drawings show that it was intended to be opened using an item on the right of the menu bar, there titled [GO-TO] rather than using the magnifying glass icon of Sherlock or Spotlight. This opened a search dialog resembling a prototype for Spotlight, and appears to have included ‘live’ search conducted as letters were typed in.

2001

Karelia Software released Watson.

2002

Mac OS X Jaguar brought Sherlock 3, which many considered had an uncanny resemblance to Watson. That resulted in acrimonious debate.

2005

In preparation for the first Intel Macs, Mac OS X 10.4 Tiger, released in April 2005, introduced Spotlight as a replacement for Sherlock, which never ran on Intel Macs.

Initially, the Spotlight menu command dropped down a search panel as shown here, rather than opening a window as it does now.

2006

On 4 August, John M Hörnkvist and others filed what became US Patent 7,783,589 B2 for Inverted Index Processing, for Apple. This was one of a series of related patents concerning Spotlight indexing. Just a week later, on 11 August, Matthew G Sachs and Jonathan A Sagotsky filed what became US Patent 7,698,328 B2 for User-Directed search refinement.

A Finder search window, precursor to the modern Find window, is shown in the lower left of this screenshot taken from Tiger in 2006.

2007

Spotlight was improved in Mac OS 10.5 Leopard, in October. This extended its query language, and brought support for networked Macs that were using file sharing.

This shows a rather grander Finder search window from Mac OS X 10.5 Leopard in 2009.

2014

Search attributes available for use in the search window are shown here in OS X 10.9 Mavericks, in 2014.

In OS X 10.10 Yosemite, released in October, web and local search were merged into ‘global’ Spotlight, the search window that opens using the Spotlight icon at the right end of the menu bar, accompanied by Spotlight Suggestions.

2015

John M Hörnkvist and Gaurav Kapoor filed what was to become US Patent 10,885,039 B2 for Machine learning based search improvement, which appears to have been the foundation for Spotlight Suggestions, in turn becoming Siri Suggestions in macOS Sierra. Those were accompanied by remote data collection designed to preserve the relative anonymity of the user.

This shows a search in Global Spotlight in macOS 10.12 Sierra, in 2017.

c 2019

Apple acquired Laserlike, Inc, whose technology (and further patents) has most probably been used to enhance Siri Suggestions. Laserlike had already filed for patents on query pattern matching in 2018.

I’m sure there’s a great deal more detail to add to this outline, and welcome any additional information, please.

4 August 2025: I’m very grateful to Joel for providing me with info and links for On Location, which I have incorporated above.

Here are this weekend’s Mac riddles to entertain you through family time, shopping and recreation.

1: Total banker’s order quickly verifies integrity.

2: 1 broke by 2005, 2 is still cryptographic, 3 is even better, but not in Iran.

3: Missing from …MNOPQTUVW… but present in CD.

To help you cross-check your solutions, or confuse you further, there’s a common factor between them.

I’ll post my solutions first thing on Monday morning.

Please don’t post your solutions as comments here: it spoils it for others.