Hasty Briefsbeta

All tags

#macos

177 stories total

Bilingual

Programs compiled with recent D compiler are broken in macOS 15.4
a year ago
- Upcoming macOS update causes D applications to crash during runtime initialization.
- Crash appears to be a null pointer dereference in pthread_getspecific.
- Partial stack trace provided, showing frames from runtime initialization.
- Key frames include sections_darwin_64.d and sections_elf_shared.d.
Rsync replaced with openrsync on macOS Sequoia
a year ago
- rsync is a command line tool for transferring and synchronizing files on Unix-based systems.
- Apple has included rsync 2.6.9 (released in 2006) on macOS, not updating to rsync 3.x due to GPLv3 licensing issues.
- macOS Sequoia replaces rsync with openrsync, which uses the permissive ISC license instead of GPL.
- openrsync is compatible with rsync but supports only a subset of rsync's command line arguments.
- Mac admins may encounter functionality differences between rsync and openrsync in macOS Sequoia.
- The openrsync tool in macOS 15.4 is linked to /usr/bin/rsync, allowing it to be run as before.
Why is macOS syslogd listening for UDP connections?
a year ago
- Little Snitch alerted to an incoming connection attempt from a Google-controlled IP (142.250.191.99) to UDP port 56878.
- The connection attempt coincided with an outgoing Safari connection to fonts.gstatic.com using QUIC protocol.
- Port 56878 was randomly selected by syslogd, which was unexpectedly listening for UDP connections despite default configurations suggesting otherwise.
- The incident appears to be a coincidence where the same local UDP port was used by both syslogd and Safari's QUIC connection.
- syslogd's UDP listener behavior is inconsistent, appearing across macOS versions from Monterey onwards, but not always active.
- The reason for syslogd listening on UDP ports remains unclear, raising potential security concerns.
macOS Sends Locally-Served DNS Zones to iCloud Private Relay
a year ago
- Laptop (M1 Pro, macOS 15.3.2) is connected to a dual stack network via Wi-Fi with home.arpa as the search domain.
- DNS resolver forwards requests for home.arpa to a local authoritative DNS server (CoreDNS).
- CoreDNS zone file includes SOA, NS, AAAA, A, PTR, SRV, and TXT records for services like SMB.
- dig commands confirm DNS records resolve correctly (PTR, SRV, A, AAAA).
- dns-sd commands show browsing for _smb._tcp.home.arpa but no services are discovered.
- Finder->Network shows home.arpa but it's empty, indicating service discovery issues.
- DNS server logs show SOA queries for various services (_afpovertcp, _smb, _rfb, _adisk, _tcp), some returning NXDOMAIN.
- Debugging needed to identify why service discovery fails despite correct DNS resolution.
Sandbox-Exec: macOS's Command-Line Sandboxing Tool
a year ago
- sandbox-exec is a macOS command-line utility for running applications in a sandboxed environment.
- Sandboxing restricts application access to system resources, enhancing security and privacy.
- Benefits include protection from malicious code, damage limitation, privacy control, and resource restriction.
- Usage involves creating a sandbox profile with rules and executing commands within those constraints.
- Two approaches to sandboxing: Deny by Default (more secure) and Allow by Default (more permissive).
- Practical examples include sandboxed terminal sessions and using pre-built system profiles.
- Debugging sandbox issues can be done using the Console App or Terminal for real-time logs.
- Advanced techniques include creating sandbox aliases and importing existing profiles.
- Limitations include deprecation status, complexity with modern applications, and lack of GUI.
- sandbox-exec remains a powerful tool for security-conscious users and developers despite its challenges.
Apple Studio Display keeps draining power, even when blank and asleep
a year ago
- Mac mini and Apple Studio Display power management issue after macOS 15.4 update.
- Mac mini wakes up for updates but continues consuming 14–15W instead of returning to 1–2W sleep mode.
- Issue traced to Apple Studio Display not entering proper sleep mode despite Mac mini sleeping correctly.
- Studio Display remains semi-awake due to Thunderbolt activity, drawing significant power (14–15W).
- Debugging involved Terminal, smart plugs, and logs, revealing Thunderbolt interface activity as the culprit.
- Clean macOS install and 15.5 beta update did not resolve the issue.
- Workaround suggested: Use a smart plug to cut power to Studio Display when Mac sleeps, automated via Shortery.
- Issue highlights energy waste in desktop setups with Thunderbolt displays post-macOS 15.4 update.
Sapphire: Rust based package manager for macOS (homebrew replacement)
a year ago
- Sapphire is an experimental, Rust-powered package manager for macOS, currently in alpha and ARM-only.
- It manages Formulae (CLI tools, libraries) and Casks (desktop apps), with features like parallel downloads and dependency resolution.
- Key commands include `sapphire install`, `uninstall`, `update`, `search`, and `info`; future commands like `upgrade` and `cleanup` are planned.
- Supports `/opt/sapphire` as a standalone prefix and requires Rust for building from source.
- Users must manually migrate settings when switching from Homebrew due to path differences.
- Contributions are welcome for testing, bug reports, UI/UX improvements, and core/cask modules.
Projects for Old OS X
a year ago
- Author decided to leave modern macOS behind in 2019, reminiscing about the initial revelatory experience with OS X.
- Explored alternatives like Windows and Linux but sought the 'perfect computer' experience.
- Modified versions of Apple's Weather, Unit Converter, and Translation widgets are redistributed to help customers.
- QuickTime Player 10.3 in Mavericks is incompatible with third-party codecs; a modified version of QuickTime 10.2 from Mountain Lion is suggested.
- A component for QuickTime 10.2 adds compatibility with non-Apple video codecs like HEVC and VP9, requiring a powerful CPU.
- Tiny apps available to open video containers (MKV, WebM) and images (HEIC, WebP, BPG) that QuickTime X and Preview can't handle.
- Automator Service for downloading videos from YouTube and other streaming sites directly to Music and Movies folders.
- Podcast episodes and YouTube videos can be automatically delivered to specified folders without an app.
- Most downloads include source code, with omitted code available upon request.
Show HN: Infat – Declaritive application assocation manager for macOS
a year ago
- Infat is a macOS-native CLI tool for managing file-type and URL-scheme associations declaratively.
- Allows setting default applications for file extensions and URL schemes without navigating sub-menus.
- Supports loading associations from a TOML config file with `[files]` and `[schemes]` tables.
- Commands include listing default apps for extensions/schemes and setting new defaults.
- Configuration file is placed at `$XDG_CONFIG_HOME/infat/config.toml`.
- Infat is minimal, scriptable, and integrates with macOS using native frameworks.
- Installation options include building from source or using Homebrew.
- Licensed under MIT, allowing free use, modification, and distribution.
Easily setup new MacBooks
a year ago
- The Brewfile allows bulk installation of command-line utilities, apps, fonts, and VS Code extensions.
- Example Brewfile contents include utilities like Git, Node, and apps like Discord, Chrome, and Docker.
- macOS defaults utility enables terminal-based customization of system and app settings.
- Example defaults commands enable tap-to-click, disable .DS file creation, and modify Finder behavior.
- Five recommended Zsh plugins: Git, Zsh-autosuggestions, Zsh-syntax-highlighting, You-should-use, and Zsh-bat.
- Zsh aliases improve terminal productivity by reducing keystrokes for common commands.
- Future plans include creating bash scripts for easier installation and adding more commands.
macOS Sequoia wraps copied pathnames in single quotes, breaking pasted links
a year ago
- macOS Sequoia wraps copied pathnames in single quotes, breaking pasted links in Markdown editors like MacDown.
- Anthony Reimer provides a workaround involving Automator to copy unescaped paths.
- Steps include creating a Quick Action in Automator, adding a Run AppleScript action, and saving it as 'Copy Unescaped Path'.
- The saved Quick Action appears in Finder's context menu under Quick Actions.
- A keyboard shortcut can be assigned via System Settings for quick access.
Why some Mac apps launch slowly: A follow-up
a year ago
- The slow app launches are caused by the `syspolicyd` process, specifically the `DispatchQueue 'com.apple.security.syspolicy.yara'`.
- Howard Oakley denies the malware scan theory, citing reasons like file size limits in XProtect Yara rules and lack of log entries for Yara scans.
- Spindump evidence shows `syspolicyd` performing malware checks triggered by `dlopen` function calls when loading dynamic libraries.
- Oakley proposes an alternative theory involving SHA-256 hash computations for app framework files, suggesting cache misses cause delays.
- The author disputes Oakley's hash cache theory, pointing out lack of empirical evidence and questioning the utility of such a cache.
- Universal binaries complicate performance measurements, as checks might only apply to the active architecture, not the entire file size.
- The author concludes that Oakley's observations align with their earlier findings, with no new substantive evidence presented.
MacUpdater for Sale
a year ago
- CoreCode Ltd. announces discontinuation of MacUpdater after January 1, 2026.
- MacUpdater has been a trusted solution for updating over 6,700 macOS applications for 8 years.
- The project is being wound down due to lack of sustainable monetization under a non-subscription model.
- Interested parties are invited to license the technology or acquire the entire MacUpdater project.
- Concerns raised about the low one-time purchase price ($4.40) and potential security risks for malware creators.
PlainBudget – Minimalist Plain Text Budgeting
a year ago
- PlainBudget is a minimalistic plain text budgeting app.
- Currently in beta version v1.0.0-beta.2 for macOS.
- The beta version is unsigned, requiring manual authorization.
- Users can authorize it by running a specific command in Terminal.
Anylinuxfs – macOS mount any Linux filesystem read/write using NFS and a microVM
a year ago
- Mounting 3rd-party filesystems on macOS is tricky, with limited official support beyond NTFS read access.
- anylinuxfs provides a reliable solution for mounting Linux filesystems (ext*, btrfs) with write access via NFS and a microVM.
- The process is streamlined: pick a drive, mount with anylinuxfs, and it appears as an NFS share, with mount options forwarded to Linux.
- The microVM is fast, using a stripped-down Linux without UEFI, taking seconds to mount.
- Initial setup downloads an Alpine Linux image, reused for subsequent mounts; reinitialization is possible with 'anylinuxfs init'.
- Requires sudo for mount commands, but the VM runs under the user's permissions post-disk access.
- Limitations: only one drive at a time, Apple Silicon Macs only (due to libkrun).
- Built on libkrun, libkrunfw, gvproxy, and docker-nfs-server.
A brief history of fonts in Mac OS
a year ago
- Early Macs used bitmap fonts stored in FONT resources, later transitioning to NFNT bitmap fonts in 1984.
- Apple rounded the typography standard from 72.27 points per inch to 72 for the Mac.
- Adobe's PostScript Type 1 fonts led Apple to develop TrueType as a rival outline font format.
- TrueType was revolutionary, allowing font internals to be opened up, unlike Adobe's controlled PostScript fonts.
- Microsoft licensed TrueType from Apple, while Adobe opened its Type 1 font format for free use.
- Apple introduced TrueType GX in 1994, which later influenced Microsoft's TrueType Open and OpenType.
- Mac OS X in 2001 moved fonts away from resource forks to data-fork format with .dfont extension.
- Apple Advanced Typography (AAT) improved font support, especially for Latin, Arabic, and Asian scripts.
- Major foundries like Linotype developed font management software such as FontExplorer X.
- FontLab and Fontographer were key font design apps for Mac OS, with Fontographer eventually being abandoned.
Can You Really Trust That Permission Pop-Up on macOS? (CVE-2025-31250)
a year ago
- CVE-2025-31250 allowed macOS permission prompts to be spoofed, displaying as one app while applying consent to another.
- The vulnerability exploited the TCC (Transparency, Consent, and Control) system, which manages macOS permissions.
- Apple Events, an old inter-process communication protocol, was involved in the vulnerability due to its integration with TCC.
- A proof-of-concept demonstrated how to spoof TCC prompts, highlighting the ease of exploiting this flaw.
- The vulnerability could be timed to appear when a user opens a trusted app, increasing the chance of tricking them into granting permissions.
- Previous exploits like $HOMERun and powerdir were referenced, showing historical context for TCC vulnerabilities.
- Apple's patch in macOS Sequoia 15.5 addressed the issue by silently dropping malicious TCC messages.
- The article suggests that while the patch is effective, future vulnerabilities in TCC may still emerge.
Making my app worse because of macOS privacy protections
a year ago
- Apple introduced a new macOS feature that alerts users when an app programmatically reads the general pasteboard without user input.
- Developers can test this behavior using a Terminal command: `defaults write <your_app_bundle_id> EnablePasteboardPrivacyDeveloperPreview -bool yes`.
- Link Unshortener triggers an alert on launch because it checks the pasteboard for URLs to auto-fill in new windows.
- The new alert lacks options to always allow access, explain why access is needed, or avoid permission requests on first launch.
- The author decided to remove the auto-fill feature from Link Unshortener to avoid the negative user experience of the alert.
- A new System Settings section will allow users to manage pasteboard permissions, but the alert itself is minimal and unhelpful.
- Apple may introduce a new `Info.plist` key to specify reasons for pasteboard access, similar to other privacy-related keys.
- The alert's existence forces tradeoffs between security and usability, leading to reduced app functionality.
- Other apps may face worse issues if they rely heavily on pasteboard access as a core feature.
- Enabling the feature globally caused problems in apps like Google Chrome and Safari, leading to inconsistent behavior.
Show HN: Kasimba – Simple macOS app that converts Windows paths to SMB addresses
a year ago
- Converts Windows UNC paths to SMB URLs (e.g., \\server\share → smb://server/share).
- Supports Windows drive paths (e.g., C:\folder) with configurable server placeholder.
- Allows copying converted paths to clipboard or opening them directly in Finder.
- Features macOS keyboard shortcuts (⌘C to copy, ⌘O to open in Finder).
- Built with SwiftUI for a clean, modern interface.
- Downloadable as a DMG file from the Releases page.
- Open-source with MIT License; contributions via Pull Requests welcome.
- Requires macOS 13.0 or later.
Breaking the Sound Barrier Part I: Fuzzing CoreAudio with Mach Messages
a year ago
- Guest post by Dillon Franke, Senior Security Engineer, discussing MacOS security research.
- Exploration of Mach IPC messages as an attack vector for sandbox escapes.
- Use of a custom fuzzing harness, dynamic instrumentation, and debugging to identify vulnerabilities.
- Discovery of a high-risk type confusion vulnerability in the coreaudiod system daemon.
- Open-sourcing of fuzzing tools and harness on GitHub.
- Adoption of a knowledge-driven fuzzing approach combining automation and manual analysis.
- Detailed steps in the research cycle: identify attack vector, choose target, create harness, fuzz, analyze, iterate.
- Focus on Mach messages due to their historical security issues and core role in MacOS IPC.
- Selection of coreaudiod daemon as target due to complexity and accessibility from sandboxed processes.
- Creation of a fuzzing harness to directly call Mach message handlers for efficiency.
- Challenges in initializing the target and handling stateful message handlers.
- Use of API Call Chaining to manage interdependent Mach message handlers.
- Mocking out unnecessary functionality to focus fuzzing efforts.
- Improvements in sample structure to pass syntax checks and handle OOL data.
- Discovery of a type confusion vulnerability in multiple Mach message handlers.
- Proof-of-concept demonstrating the vulnerability's exploitability via mach_msg API.
- Apple's patch adding type checks to prevent the vulnerability.
- Recommendations for future prevention of similar vulnerabilities.

firstprev0next

About|Login

#macos

Programs compiled with recent D compiler are broken in macOS 15.4

Rsync replaced with openrsync on macOS Sequoia

Why is macOS syslogd listening for UDP connections?

macOS Sends Locally-Served DNS Zones to iCloud Private Relay

Sandbox-Exec: macOS's Command-Line Sandboxing Tool

Apple Studio Display keeps draining power, even when blank and asleep

Sapphire: Rust based package manager for macOS (homebrew replacement)

Projects for Old OS X

Show HN: Infat – Declaritive application assocation manager for macOS

Easily setup new MacBooks

macOS Sequoia wraps copied pathnames in single quotes, breaking pasted links

Why some Mac apps launch slowly: A follow-up

MacUpdater for Sale

PlainBudget – Minimalist Plain Text Budgeting

Anylinuxfs – macOS mount any Linux filesystem read/write using NFS and a microVM

A brief history of fonts in Mac OS

Can You Really Trust That Permission Pop-Up on macOS? (CVE-2025-31250)

Making my app worse because of macOS privacy protections

Show HN: Kasimba – Simple macOS app that converts Windows paths to SMB addresses

Breaking the Sound Barrier Part I: Fuzzing CoreAudio with Mach Messages