© Agence France-Presse — Getty Images
© Mathieu Lewis-Rolland/Getty Images
© Jae C. Hong/Associated Press
A regular file system like APFS or HFS+ gives access to local storage by providing a low-level API normally accessed by apps through higher-level functions in the operating system. Most file systems don’t extend to storage connected over a network, or to cloud storage, so there need to be network file systems like AFP and SMB that operate over TCP/IP network connections. In macOS, cloud storage is given a separate high-level FileProvider API instead.
Among the dozens of network file systems, those you are most likely to come across on Macs are Network File System (NFS), WebDAV, and the primitive File Transfer Protocol (FTP), in addition to AFP and SMB. The remainder of this article concentrates on the last two as they’re the most commonly used with Macs, although NFS still has its uses, and WebDAV is used for special purposes including calendar access using CalDAV.
In the OSI model of network layers, network file systems mostly operate in layer 7 at the top, the same as other common network protocols including HTTP. They thus depend on a great deal of infrastructure, including TCP/IP.
At their most basic, network file systems provide operations to connect to and disconnect from a share, to negotiate details of that connection, to open, read, write and close remote files, and to obtain a listing of a directory. Those can then be used by higher-level functions when accessing a server over the network, instead of calls to the API for a local file system. The sharing service on the server operates its side of the protocol, working through equivalent calls to the API of its local file system.
Modern local file systems have many more sophisticated features, though. If a network file system doesn’t support extended attributes, for example, it would effectively strip all such metadata from APFS files. Popular network file systems commonly lack provision for APFS sparse and clone files, which leads to transfer and storage inefficiency, as explained later.
Apple Filing Protocol, AFP, originated in Classic Mac OS days as part of the Apple File Service suite, and until OS X 10.8 Mountain Lion was the primary network file protocol for Macs. Recent versions rely on TCP/IP over port 548 to establish communication. Although it supports file naming, permissions, extended attributes and advanced locking much as HFS+ does locally, it remains incompatible with sharing of APFS volumes.
AFP became popular in NAS systems when an open source AFP server named Netatalk became available, and could be ported to NAS operating systems including Linux. Support has also been integrated into many network products such as Novell NetWare and Microsoft Windows Server (up to 2008), and of course Apple’s own Time Capsules.
Server Message Block, SMB, originated in IBM, for network sharing using IBM PC DOS, and was then adopted by Microsoft. For a while in the mid-1990s it was rebranded as Common Internet File System, CIFS, and it has been implemented independently in Samba, which was used by Apple to provide SMB support in Macs until Mac OS X 10.7 Lion in 2012. Apple then switched to its own implementation SMBX, which became its primary network file system in place of AFP, in OS X 10.9 Mavericks in 2013.
Early versions of SMB were a poor fit for macOS. To overcome the limitations of SMB servers it was often necessary to flatten extended attributes with file data into AppleDouble format, but later versions support what in Windows terms are alternate data streams (ADS), or named streams, which could require configuring an SMB server.
From the outset, SMB has also supported network access to printers, and SMB3 still contains that. Although this is available for connections to Windows printers from macOS, through Printers & Scanners settings, it seems considerably less reliable than using AirPrint, when it’s available.
Apple’s implementation of SMB has endured many bugs and problems over the years, but is now widely used and generally more stable and a lot less inefficient than in the past. However, it doesn’t support APFS special file types. If you copy a sparse file of 1 GB nominal size, occupying a few MB of disk space, then SMB will transfer the whole 1 GB to the share, where the file won’t be in sparse format, and will require 1 GB of shared storage. When that is copied back to local APFS, it remains 1 GB and isn’t reconstituted as an APFS sparse file.
Such are the joys of file sharing.
Apple seldom gives advanced notice of significant changes coming in the next major version of macOS, before its first beta-release at WWDC. One significant exception to this are changes to networking that could impact enterprise users. This year, with just over six weeks to go before that first beta of macOS 27, we already have two warnings of what might be coming.
Apple made SMB its primary file-sharing protocol in OS X 10.9 Mavericks, over 12 years ago, and has repeatedly told us that support for its predecessor AFP will be removed in the future. It repeated those warnings with macOS Sequoia 15.5, but still hasn’t confirmed when AFP will be lost.
Those who are most likely to be affected by this are still using Time Capsules, or elderly NAS systems that don’t support SMB3. As removal of AFP support won’t be retrospective, provided that none of your Macs will be upgraded to macOS 27, you’ll still be able to use AFP for your file shares and Time Machine backups. But if you have an Apple silicon Mac and AFP support is dropped from macOS 27, that would leave you unable to upgrade without replacing your network storage.
Most recently, Apple has warned that a future version of macOS, and its device OSes, will require connections to certain servers to be made using at least TLS 1.2, with additional requirements. I’m grateful to Rich Trouton’s Der Flounder blog for drawing attention to this.
Although Apple carefully avoids being too specific, it warns that this change could come “as early as the next major software release”, although one of the purposes behind its support article is to gauge the impact the change might have on its enterprise customers. If there would be major problems, it may decide to delay its introduction.
This change is more technical, and largely applies to servers involved in supporting MDM, DDM, Automated Device Enrolment, app distribution and installation, and Apple software updates. Fortunately, if you run a local Content Caching server, that won’t be affected.
Unlike the removal of AFP, it’s far harder to tell whether a connection to a server complies with the new rules, which require:
The most reliable way to check is to audit connections made to each server, by screening log entries from the Mac or device. That’s further complicated by the fact that the log doesn’t normally gather the information that’s required. So the first step is to install a network diagnostics logging profile available from Apple. The support article explains how to collect a logarchive using sysdiagnose, and provides a monster predicate to extract relevant entries:"p=appstoreagent|appstored|managedappdistributionagent|managedappdistributiond|ManagedClient|ManagedClientAgent|
mdmclient|mdmd|mdmuserd|MuseBuddyApp|NanoSettings|Preferences|profiled|profiles|RemoteManagementAgent|
remotemanagementd|Setup|'Setup Assistant'|'System Settings'|teslad|TVSettings|TVSetup|XPCAcmeService AND s=com.apple.network AND m:'ATS Violation'|'ATS FCPv2.1 violation'"
And yes, Apple is encouraging system administrators to copy and paste a command into Terminal, because there’s no GUI app in macOS that could be used to do that, although you can use it in Ulbow, and I suspect in LogUI with a little modification.
If you’re within the scope of this proposed change, you’ll need to read Rich Trouton’s account, and Apple’s full article. I wish you the best of luck. As with AFP, this change shouldn’t apply retrospectively.
We still haven’t got New Year right, have we? Rather than putting it in the middle of winter, it should surely coincide with the arrival of Spring and blossom on trees. If you’re in a northern temperate latitude, now’s the time that you should be watching for the full flush of cherry and other flowering trees. In Washington DC its blossom festival extends a month from mid-March, in Japan rather later, and it’s even celebrated in Perth, in Western Australia, during the austral Spring.
This weekend I celebrate the end of the winter with two days of paintings of blossom on trees, today’s from the nineteenth century, and tomorrow from the twentieth.
Early in Samuel Palmer’s career, when he was living in Shoreham in Kent, he painted this watercolour of exuberant blossom In a Shoreham Garden, in about 1830.
The Pre-Raphaelite movement emphasised painting from life; when John Everett Millais came to paint Flora and her Spring, in 1856-59, he added subtle allusions to Botticelli’s famous Primavera and classical myth. The blossom here is on apple trees, which are probably second only to May or Hawthorn in the English countryside at this time of year.
In the year that Charles-François Daubigny moved to Auvers-sur-Oise and founded the artists’ colony there, he painted this blossom-rich view of the Spring Landscape (1862). Vincent van Gogh was later to spend his final two months of painting near here.
In the closing years of Jean-François Millet’s life, he painted a commissioned series including this startling study of light, Spring (1868-73). This features a double rainbow at the upper left, with fleeting sunshine flooding the centre and dazzling on the abundant blossom. From the crops and seasonal flowers in the foreground to the inky black shower-clouds in the sky, this is a perfect summary of Spring in the countryside, and April showers.
My favourite Impressionist painting of blossom has to be Alfred Sisley’s panorama of The Terrace at Saint-Germain, Spring, painted soon after he had moved to Marly-le-Roi in 1875.
Alice Havers’ Washerwomen, which given her tragically brief life must have been painted around 1880, shows a large orchard of fruit trees in blossom on the far side of the river.
By any measure, the nineteenth century master of blossom was Vincent van Gogh. Like several of his contemporaries, he had become a collector of Japanese woodcut prints, and was fascinated by one of their dominant themes, cherry blossom.
Before he went to Arles, Vincent van Gogh had copied Utagawa Hiroshige’s woodblock print The Plum Orchard in Kameido. Shortly after his arrival there in 1888, the fruit trees came into flower, and he painted a triptych for his brother Theo’s apartment, including The Pink Orchard above, and The Pink Peach Tree below.
Van Gogh’s approach to painting blossoming fruit trees is completely different from that of the Japanese prints. His trees are built anatomically, with trunk and branches drawn in outline, often using contrasting colour. Flowers are applied using impasto; sadly some of these have faded since, and some paint that now appears white or off-white was originally pinker.
Van Gogh’s View of Arles, Flowering Orchards (1889) is a complex composition, with trunks in the foreground, fruit trees in flower in the middle distance, and the town of Arles behind, integrating his previous explorations of each element.
Among Carl Larsson’s many intimate views of life at home is this watercolour of his daughter under the Apple Blossom from 1894. He uses his favourite colour contrast between the earth red of the barns behind with the pink of the girl’s bonnet, against the rich green vegetation around her.
Some sixty-five years after Palmer’s exuberant clouds of blossom, Paul Sérusier employed a similar technique in The White Cow, from about 1895.
Laurits Andersen Ring’s finely detailed double portrait of Spring. Ebba and Sigrid Kähler from 1895 appears to show a mother and her daughter talking in their garden, but the two are actually sisters. At the right is Sigrid, the year before her wedding, at the left is her sister Ebba, who was fifteen at the time. Ring uses a light touch with the blossom and Spring flowers to avoid overwhelming the figures.
Login
