• Linux Commands – A practical reference

The list is not customized for OS X systems, so not all of the commands or options necessarily work as listed. I was however able to find similar commands using the man pages. This list is really an amazing reference for commands to do practical things that you might not have known you could do.

I just discovered wget using this list. I think I might have used this a long time ago and then promptly forgot it existed. Basically it downloads files or websites for you. This was exactly what I happened to need to download all of the student websites for my Web Design class. I was able to download all of them in a matter of minutes. The only problem was that it didn’t seem to pick up CSS background images or fonts used from @font-face, so I had to manually check those. An indispensable nevertheless.

When a user logs in, they authenticate to our server using their account username (use Alice for this example). At this point they are given a Kerberos ticket. From then on, in Leopard, whenever the user attempts to connect to an AFP share on the server, Leopard assumes that they are connecting as the same user, Alice. Because the Kerberos ticket is still valid, the user is automatically authenticated as Alice. Of course, this makes perfect sense. That’s the whole point of Kerberos: single sign-on.

The problem resides in the assumption that the user wants to connect as the same user every time. What if Alice is actually an admin who needs to log on to a share using different credentials? Here’s an example: I’m testing a student account, with normal student privileges. During the course of my testing, I need to access a document from our administrative share point. Now, obviously the student account does not have access to the administrative share point. I would need to log in to the share using a user with permissions to access the administrative share point.

Unfortunately, Leopard will not even ask me what user account I want to use because I already have a valid Kerberos ticket for the student account. Fortunately, after finally getting fed up with this problem, a quick bit of googling solved it.

All that needs to be done is to destroy the Kerberos ticket. Simply open Keychain Access and select Kerberos Ticket Viewer from the Keychain Access menu. Select your Kerberos ticket from the window and click the destroy button. This doesn’t actually harm anything, it simply makes your Kerberos ticket expire. The next time you try and connect to the server, you will be asked to authenticate again; at which point you can authenticate as a different user.

Alternately, you could also create a new Kerberos ticket using a separate username to the same server. The before authenticating to a share, you would simply change the active user. Unfortunately it seems as though you can only access one at a time. For example, I could not mount two different user’s home directories at the same time. I would have to activate a user, mount their home directory, eject it, activate the second user, and then mount their home directory. Hmm, as you can probably see, there doesn’t really seem to be a reason why this would be useful. Probably simply destroying the ticket is the best bet.

For more information on this, check out the Mac OS X 10.5: About Kerberos in Mac OS X 10.5 clients knowledge base article from Apple.

Existing users is a different story though. They already have their home directories. Depending on how many users you have, adding/deleting files from you old users can be a daunting task. Ten users is easy enough, but 50 is silly and over 100 is ridiculous.

Long ago I wrote a series of scripts (well actually just one) that I use and modify for whatever files I need to change. I basically just loops through each home folder in a specified directory. It’s really a pretty basic script. Here’s an example of one that I was using:

# Copy new dock and fix permissions

echo "\ncpdock.sh"

dir=`ls $1`

cd ${1:?"No directory specified!"}

echo "PWD = `pwd`"

echo "\n$dir\n"

for folder in $dir; do
    echo "...copying dock plist to $folder"
    cp /com.apple.dock.plist $folder/Library/Preferences/com.apple.dock.plist
    chmod -R 700 $folder/Library/Preferences/com.apple.dock.plist
    chown -R $folder:staff $folder/Library/Preferences/com.apple.dock.plist
done

That’s easy enough. It’s kind of a pain though to modify the scripts all the time. Also, it’s very difficult (and scary) to try and explain how to use these scripts to my less Bash-inclined co-workers.

The other day I found this great little piece of software written by Nicole Jacque called Home Directory Helper. It does exactly what all of my scripts did, except with an easier to use GUI interface. Very nice, and highly recommended.

This updated quickstart guide is very similar to the Tiger Server Quickstart Guide posted in 2005. It’s primary purpose is to get you up and running quickly, overcoming common hurdles such as DNS and binding confusions. With the move to launchd over cron, those steps are now included as well.

You can grab the pdf at AFP548.com.

The article includes some particularly good instructions on using and setting up rsync, launchd, and Network Home Redirector.

Via Infinity’s End.

At my work we use an OS X server to host the home directories of all of our users who log in to our lab computers. We currently only support OS X clients, so we’re only doing this over AFP. Last semester we used a Tiger server and clients, but this summer we are upgrading everything to Leopard.

After setting up a test client computer in Directory Utility (used to be Directory Access in Tiger) to connect to our server I figured we were good to log in with one of migrated user accounts. We don’t do binding or Active Directory or really anything complicated so usually the process is pretty straightforward.

After setting up the client and restarting, I attempted to log on using one of our network users, and was met with this big fat error message:

Not only did not logging in not work, but the entire description of the error read “Logging in to the account failed because an error occurred”. Gee, thanks Apple. Very useful.

This error wasn’t entirely foreign to me. I remembered seeing it occasionally in Tiger, but couldn’t remember if we had ever established a cause, let alone a solution. Just for kicks I tried logging on with the same account on one of our older Tiger clients (that was known to work with the old Tiger server). The message is slightly more verbose, but generally still the same:

I knew that AFP was working because we had some share points up and running. So, AFP and at least some level of authentication were working. After inspecting the server firewall and open directory logs, as well as the client logs, it seemed clear that the user was authenticating properly. It was something that was happening after the actual successful authentication that was causing the error message.

After some research and thought, it occurred to me that it was very likely that there was some sort of configuration gone awry with the actual home directories. Then I realized that I had completely neglected to actually configure the old home directories on our server to be shared at all!

So basically the user was logging in and authenticating successfully. Then when the client asked for the home directory the server was like, what home directory? And the client was like aww shit. I’m gonna log you out right now ’cause I need your home to work. And the server was like, all right, fine. Something like that.

After some simple home directory sharing configurations, everything was running without another episode. Sigh.

After an initial false start attempting to simply upgrade the server, I ended up simply installing the Leopard server from a blank disk. This seemed to take care of most of the really strange things that were happening after the upgrade.

This particular server is of the headless XServe variety, so we primarily use Apple Remote Desktop to access it in addition to the Server Admin Tools and SSH. Since installing Leopard on the server however, I’ve been noticing that at times it is acting erratically. Usually I’ll first notice that the server will either stop showing up in ARD or it show up as black, indicating that there is no ARD agent on the computer. I’ve tried restarting the computer, which will fix it, but that’s not a very good solution for obvious reasons.

I had also noticed while using Server Admin that sometimes the server CPU is running at completely full capacity, like in this screenshot:

The other day the server stopped responding in ARD again. As usual though, I was still able to access it through both Server Admin and SSH. After a little research, I found this useful page of commands, which includes this one-liner:

sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -restart -agent -menu

Running this command restarts the ARD Agent, which is what we want if it is frozen. Once I did this things got a little better, and the server came up in ARD as active. I tried controlling the server through ARD, but no dice, still no connection.

At this point I noticed that there was a user logged on to the server and I remembered that I had also been having problems with VNCDragHelper freezing. I found this on an Apple discussion page:

When remotely managing an XServe with OS 10.5.1 from a 10.4.11 client with ARD 3.2, several times (3 up till now) the server UI becomes unresponsive, at least finder. This even gets worse when trying to start the Application Monitor, then also the Dock freezes, and the Application Monitor UI never opens. When doing an ssh> sudo top, it shows that both “Application Monitor” and “VNCDragHelper” do consume almost 100% CPU. Luckily only on a Single core, but that keeps two cores (one processor 100% busy). killall “Activity Monitor” brings the activity monitor down, when sending it with Remote Desktop Unix command.

Perfect, that must be it. In SSH, I ran the following command:

sudo killall -9 VNCDragHelper

I also killed the loginwindow because that appeared to be frozen as well (judging from the top command that I ran):

sudo killall -9 loginwindow

Suddenly after running both those commands, the server leapt back to responsiveness. I was able to access it in ARD without problem. Also, after about an hour I checked the CPU diagram in Server Admin and was able to see a noticeable improvement.

Now that’s a sight for sore eyes. For reference, I was running 10.5.3 and ARD 3.1 when this problem happened. I’m not sure that anything has been fixed in 10.5.4 though.

When I updated to Firefox 3, I immediately noticed that Bookmarks were not visible under bookmarks menu. The Search engine field had a generic icon and when I selected ‘Manage Search Engines’, the dialog box was frozen and I couldn’t get out of it without quitting Firefox. When I tried to enter a URL into the URL field and press ‘enter’, nothing happens. However, when double-click on a URL in an e-mail message, that appears to work. […] When I switched to a local admin account (i.e., Firefox profile on the local hard drive), it seems to work fine. However, when I switch back to my network home account (on our XServe), it still displays the problems described above. I tried other user accounts on our XServe with the same problems.

This is kind of unbelievable to me that Firefox 3 was released with such a show-stopping bug on the Mac side. I’m pretty sure that most companies that use Macs use them with networked home directories (at least in the Academic world). It’s good to know though before I start adding Firefox to the images for fall semester.

Apparently this is a documented bug and as a commenter suggested, will be fixed in the future. You can read the bug track in Bugzilla to see how the fix is progressing.

This paper presents an overview of the security situation of Mac OS X. The purpose of this paper is to present security in a very easy-to-understand fashion. I firmly believe that there is an absurd amount of FUD about computer security in general, mostly propagated by vendors of antivirus software and their partners. In the case of Mac OS X in specific, it is very difficult to get accurate, non-sensational information about what the real security threats are. This paper began as a genuine effort to figure out, and then convey, what the real status of Mac OS X security is.

Please be aware that I am no security expert (nor am I a hacker), but simply a normal computer nerd with a passion for most things relating to computers and design. I have made every effort to consult the writings of security experts and convey accurate information. If any security ninjas out there find any inaccuracies, please let me know.

With the exception of the section “Out Of The Box Security and Additional Hardening Measures”, the entire report refers to Mac OS X 10.4 and prior versions. Where possible, I state specific versions of the operating system that I am referring to.

I’ve broken up this report into several pages because it is quite long. You can also download the report in its entirety in PDF format.

Table of Contents

1. Preface and Disclaimer
2. Executive Summary
3. Introduction
4. OS X Background
5. Examining the OS X Security Record
6. Out Of The Box Security and Additional Hardening Measures
7. Conclusion

Executive Summary

Mac OS X has for the most part, compared to other operating systems, enjoyed a carefree history when it comes to security. There are certainly some vulnerabilities, but relatively few known exploits for them. There are also almost no examples of attacks in the wild. The few attacks that researchers have noted in the wild, although highly publicized, are mostly harmless. This however should not be taken as evidence that OS X is difficult or impossible to attack.

Two reasonable explanations for the lack of any large-scale security threats facing OS X are its small market share and superior approach to security. OS X is based in BSD UNIX and uses time tested open source software for its security foundation. It was designed to be a multiuser operating system and has strong built-in file based permission system. OS X is also very secure out of the box and includes many easily accessible additional features. By default the root user in OS X is disabled, and most normal users should never even need to use it. Network services are also disabled by default. OS X provides a unique combination of good security by default and ease of use, making it a relatively secure system for normal users.

The first virus for OS X, OSX.Leap.A was discovered in the wild in February of 2006. Although this particular virus was innocuous, it should demonstrate that OS X is certainly not immune to security threats. While the OS X market share is small, it is steadily increasing. As is becomes a more popular operating system, security threats are likely to increase and become more severe. OS X is not by any means a bulletproof operating system and Apple will have to continue to be vigilant about security in order to stay ahead of hackers.

screencapture -x FileToSaveAs

The -x option tells it not to make the shutter click sound. There is also an -i option which triggers an interactive mode, although I’m not sure why you would use the Terminal to do that.

There is also a cute little tidbit in the man page for screencapture:

Unfortunately, the options for built-to-order RAM on a Mac range from questionable to obscene. Keep in mind, there are only two slots for RAM in an iMac. Here’s how it breaks down:

Thats right, 2 sticks of 2GB RAM will cost you $850 if you get it from Apple.

The 1GB option seems silly if you’re doing anything more than web browsing. 2GB is enough RAM for now, but the configuration of 2 sticks of 1GB stinks. This means that if you want to upgrade to 4GB of RAM later, those two sticks are worthless. There is no option for the obvious choice: to chose one stick of 2GB RAM, leaving an easy upgrade path.

All of this left me pretty annoyed at Apple, and feeling like no matter what I did, I was either wasting RAM (and money) now or later. So, I really had to laugh when I came across Mike Davidson’s post on RAM Arbitrage:

…to max out my MacBook’s RAM, Apple charges me $850, while if I go through my trusty RAM comparison shopping site DealRam, I am pointed to NewEgg, which ships me the same amount of RAM for $120. As a point of comparison, Dell charges $465 for an extra 4GB… still outrageous, but not a 700% markup!

He nails it. What really sucks about this practice by Apple is that I would guess many people who buy Macs don’t know that they can get the same kind of RAM from places like New Egg. They also probably don’t know how easy it is to replace RAM. It’s a racket.

Via Daring Fireball.

The feature that really got me excited¹ though was this:

Automatically activate fonts as you need them. When an application requests an installed font that’s currently disabled, Leopard activates that font and keeps it active until the requesting application quits.

If this feature actually works and works well with lots of fonts, it’s easily got to be one of the killer features of Leopard. Seamless font auto-activation built into the os is worth the price of admission alone. How many other font management applications cost money and don’t really work (other than of course FontExplorer X, which is free)?

I’m not holding my breath though.

1. By excited I mean pessimistically hopeful.↩

When a user with a networked home folder tries to open the FontExplorer X, the file ~/Library/Application Support/Linotype/FontExplorer X/FontDatabase.db is made into an alias. Note that this is a rather important file. It appears to store the references to all of your fonts (not the fonts themselves, just the references). The alias points to a newly created FontDatabase.db file in /Users/Shared/Linotype/FontExplorer X/<username>_<uid>/, where <username> is the username of the current user and <uid> is the user id of the current user.

The end result of this behavior, is that FontExplorer behaves as if it’s the first time FontExplorer X has been opened, every time someone uses it. Of course, in a lab type environment this behavior is completely unacceptable.

Below are login/logout scripts that I wrote to circumvent this behavior. You can download the scripts and a readme.txt file here:

• FEX Login/Logout Scripts (tar format)

Update: I should point out here that this particular script has only been tested on OS X 10.4 (Tiger). It will work on 10.3, but the way that you set up the login hook is slightly different than what I describe below. I’m also using FEX 1.2.2 for this script and it should be noted that the way FEX stores it’s database changed slightly in this version. Previous versions of FEX should work with this script using only a small tweaking. As I have not gotten my hands on a Leopard yet, I have no idea if this will work with them. (added 11/8/2007)

Update #2: This script is still working like a charm using OS X 10.5.4 and FEX 1.2.3. (added 8/12/2008)

Update #3: This script still works using OS X 10.6 and FEX 1.2.3. (added 2/7/2011)

The Setup

1. Start by setting up FEX on a test computer. Set all the preferences as you want them and make sure the fonts are imported into appropriate sets.
2. Font Library: Make a copy of your entire font library and note the location it’s stored in. I use /Users/Shared/Font Explorer X/ so that everybody has access to it.
3. FEX plist: make a copy of the FEX plist file located in /Users/<username>/Library/Preferences/com.linotype.FontExploereX.plist
4. Application Support Files: Make a copy of the Linotype application support folder located in /Users/<username>/Library/Application Support/
5. A copy of each of these must reside on the client computer (the one your running the login script on).
   • Make sure that the entire font library is in the same location on the client computer as it was in the test machine (/Users/Shared/ in my case).
   • Copy the FEX plist and Linotype folder to a privileged location on the client computer. It doesn’t matter where they are, we just don’t want normal users to be able to modify them. I use an admin’s document folder.’
6. Change the $backupprefs and $backupdb variables in login.sh to the correct locations. They should be lines 11 and 14.

Installation

1. Copy login.sh and logout.sh to client computers. Make sure that you limit access to the files. They will be run as root, so these permissions will work:
   

   
   sudo chown root:admin <pathToFile>/login.sh <pathToFile>/logout.sh
   sudo chmod 750 <pathToFile>/login.sh <pathToFile>/logout.sh
   

2. Add the login and logout hooks. Run these two commands in the terminal of the client computer:
   

   
   sudo defaults write com.apple.loginwindow LoginHook <pathToFile>/login.sh
   sudo defaults write com.apple.loginwindow LogoutHook <pathToFile>/logout.sh
       

   
   Note: This works on 10.4. The syntax for 10.3 might be slightly different
3. To test to make sure the hooks got set up correctly, run this command and ensure that the directories are correct:
   

   sudo defaults read com.apple.loginwindow

Adding to Existing Login and Logout Hooks

If you already have login and logout scripts running, simply append the contents of these scripts to your existing ones. Everything should still work fine.

Login.sh

#!/bin/sh

### Modify these ###
# change to location where you put FEX plist file
backupprefs="/Users/admin/Documents/com.linotype.FontExplorerX.plist"
# change to location where you put Linotype file
backupdb="/Users/admin/Documents/Linotype"


### Start of Script ###
# Get the shortname of user who just logged in
username=$1

# create hidden file containing username for the logout script
echo $username > /Users/.username

# get the user id of user who just logged in
userid=`su - $username -c "/usr/bin/id -u"`

# set a variable for the FontExplorer folder in the format of _
userfolder=${username}_${userid}

# get the path to the networked home directory of user
userhome=`su - $username -c "/usr/bin/id -P | cut -f9 -d:"`

# Make the prefs directory in /Users/Shared/ for networked users
mkdir -p "/Users/Shared/Linotype/FontExplorer X/$userfolder/"

# On the rare occassion that the logout script fails to copy the FontDatabase.db file back to user's folder,
# this will copy in a default backup copy of the FontDatabase.db file 
if [ ! -e "$userhome/Library/Application Support/Linotype/FontExplorer X/FontDatabase.db" ]; then
 cp -R $backupdb "$userhome/Library/Application Support/"
 chown -R $username:$username "$userhome/Library/Application Support/Linotype/"
fi

# Copy the real FontDatabase.db file from user's home to the /Users/Shared location
cp "$userhome/Library/Application Support/Linotype/FontExplorer X/FontDatabase.db" "/Users/Shared/Linotype/FontExplorer X/$userfolder/"

# Set the ownership and permissions on the /Users/Shared/Linotype/ directory
chown -R $username:$username /Users/Shared/Linotype/
chmod -R 700 /Users/Shared/Linotype/

# Copy correct user preferences (users can't break them)
# Don't need to do this step, but helpful in making sure correct prefs are always set
cp $backupprefs "$userhome/Library/Preferences/com.linotype.FontExplorerX.plist"
chown $username:$username "$userhome/Library/Preferences/com.linotype.FontExplorerX.plist"
chmod 700 "$userhome/Library/Preferences/com.linotype.FontExplorerX.plist"

Logout

#!/bin/sh

# Get username of current user
username=`cat /Users/.username`


### Start of Script ###
# get the user id of current user
userid=`su - $username -c "/usr/bin/id -u"`

# set a variable for the FontExplorer folder in the format of _
userfolder=${username}_${userid}

# get the path to the networked home directory of user
userhome=`su - $username -c "/usr/bin/id -P | cut -f9 -d:"`

# Remove the sym link version of FontDatabase.db in user's home
rm "$userhome/Library/Application Support/Linotype/FontExplorer X/FontDatabase.db"

# Copy version of FontDatabase.db from /Users/Shared/ back to user's home
cp "/Users/Shared/Linotype/FontExplorer X/$userfolder/FontDatabase.db" "$userhome/Library/Application Support/Linotype/FontExplorer X/FontDatabase.db"
# Make sure ownership is correct
chown -R $username:$username "$userhome/Library/Application Support/Linotype/"

# Remove all of the user's Linotype directories from the /Users/Shared/ directory
rm -R /Users/Shared/Linotype

Cheers.

There is a new theft detection software called Undercover which actually looks very nice. Basically you install it on your system and forget about. It does it’s own thing in the background and won’t bother you. If your laptop ever gets stolen, you file a report with Undercover online to declare that it has been stolen. The next time a user goes online using your laptop, Undercover will track the network information, take screenshots and even use the built-in iSight to take pictures of the thief.

If your Mac has a built-in or external iSight, Undercover will transmit pictures of the thief and his surroundings every 6 minutes, making it even easier to identify the current user. It’s like having a private detective working for you.

Undercover will then work with law enforcement agencies and ISPs to recover the laptop.

If the first method is unsuccessful, Undercover will basically render the laptop unusable, with a full-screen message reporting that the laptop has been stolen.

One of the first things that I wondered about was how a theif would log into your account (provided you’ve actaully enabled a firmware password and turned off auto-login). Their answer to this was actually quite surprising:

What if the thief can’t login into an account? Will Undercover still phone home?
Even when no one is logged in, Undercover will still phone home because it’s a root process that’s always active. However, we do recommend to create a dummy account that will enable the thief to play around on your Mac. This account should have a blank password and no admin privileges.

I’d really like to try this software out. It sounds really cool and I’m curious to know how well it actually works. Unfortunately…I think you’d actually have to get your laptop stolen to find that out.

I am happy to announce that Office 2008 for Mac will use the Apple-recommended Apple Installer technology for Office 2008 installation. This means that the data that Office installs will ship on the disc in .pkg format, installs will work well with Apple Remote Desktop (ARD) and will be Applescript-able. Once installed, the user has the freedom to move the Office folder to a different location on the system and Office will run from there. I hope that this will make Office for Mac configuration/deployment easier for IT admins.

You can read more about installers and Apple’s recommendations for them on Apple Developer Connection . Being able to easily deploy Office through ARD is great news for IT people.

My favorite piece of news though is about fonts (emphasis added):

In addition to the change to the Apple Installer, we’ve provided IT admins greater ability to customize their deployment with optional font installations.

The current practice for Office on Macs is to automatically copy a gazillion Microsoft True Type fonts into a user’s font directory the first time they open an Office application. This behavior is truly obnoxious, especially if you already have a ton of fonts that you are trying to manage. It’s also wrong. If those fonts are actually needed for everybody for that application, they should really be put into /Library/Fonts/ at the time of the installation.

I don’t have a lot of good things to say about Microsoft these days, but I am at least happy that their Mac team is taking steps to create a better “Mac Application.”

Via Daring Fireball.

The Situation: You have a Mac OS X Server with network home directories and disk quotas enabled.

Yep, we use network home directories with OS X Server in our Mac Lab. The disk quotas in Tiger work great, except for when…

The Problem: The Mac OS Finder on client machines does not have very good support for warning users they are approaching their file quota limit. They end up all of sudden unable to save files with little or no explanation as to why.

Yeah, that. The dock reverts to the default Apple dock. iMovie keeps telling you there’s not enough space to save anything (even to an empty partition). InDesign spits out all sorts of weird error messages when you open it. And oh yeah, because of a certain login hook we run, FontExplorer X loses our entire Font Folio type library (not FontExplorer’s fault).

Meanwhile, our poor data heavy students have no idea what’s going on.

The Solution: QuotaMonitorMenu places the user’s home folder quota status right in the menu bar. It will also pop up warnings at regular intervals. All warnings and text are customizable.

• QuotaMonitorMenu 1.1 – BETA

Yes, a very handy little utility indeed.

Via AFP548.

In order to get on the same page, I want to define some standard font management terminology first. I am talking about using OS X in this post, but many of the more general concepts probably apply to font management on Windows machines as well.

System Font Folders:

OS X comes with three default font folders, each serving a different purpose:

/System/Library/Fonts/:

Contains all fonts necessary for the operating system to run. Font stored here are accessible to all users on the system.

/Library/Fonts/:

Contains most fonts necessary for standard applications to run. Font stored here are accessible to all users on the system.

/Users/<username>/Library/Fonts/:

Contains fonts only accessible to a single user.

Font Database:

This is the folder that your font management application stores your fonts in. This folder can be called any number of things, stored in any number of file formats, and in any number of locations. It all depends on the particular font management application and your setup. The important thing to remember is that this folder is distinct from all of the system font folders.

Auto-Activation of Fonts:

This happens when you open a document or application and your font management software intercepts a call for a font that is not currently activated. The font management software then activates the font for you. This can be done either through intercepting a system-wide call for a font or via a plugin.

Manual Activation of Fonts:

This is when you use your font management software to activate one or more fonts. After manually activating a font, it will be available to all applications on the system until the font is deactivated.

Auto-Activation Plug-In

A Plug-In that auto-activates fonts that are requested by an application. These plugins are written for a specific application (usually ones like Quark and InDesign).

Currently I am using FontExplorer 1.1.2 and Quark 6.5.2. I have also tested these problems using Quark 6, Quark 6.1, and Quark 6.5 and gotten the same results.

In the first versions of FontExplorer there seemed to be some sporadic problems with the auto-activation plugin for Quark 6.5. Sometimes it would work fine, but other times the font either wouldn’t activate at all, or only parts of the typeface would activate. Often times there were problems with the italic versions of typefaces. For whatever reason I also seemed to have a particularly difficult time with Univers 39. Since I’ve installed FontExplorer 1.1 (and up), which includes version 1.24 of the Quark 6.5 plugin, things seemed to be going very well with auto-activation. In fact, I haven’t noticed any problems with auto-activation in Quark 6.5 using FontExplorer X 1.1 and up.

The real problems between FontExplorer and Quark seem to happen when fonts are manually activated. A normal workflow for creating a Quark document should go something like this:

1. Open Font Management application
2. Activate desired fonts
3. Open Quark
4. Create a new document

All of the fonts that you activated should be available in Quark’s font menu at this point. In an ideal world, you should also be able to activate and use additional fonts without having to quit Quark. Clearly though, this is not an ideal world.

Unfortunately, in this case, after following the steps listed above, many¹ of the fonts simply do not show up in the Quark font menu. There is no logical reason for this that I can figure out. The problem is reproducible. I’ve isolated two fonts that always have this problem: Duc De Berry LT Std and Serlio LT Std (both OpenType). Also, no amount of quitting Quark, deactivating and then reactivating the fonts or cleaning the font caches will work. The fonts simply will not show up in Quark.

Curiously, if you take one of these problematic fonts and copy it to any of the system font folders (may require a restart), the font appears in Quark without a problem. Great, but this doesn’t help us, since we’re circumventing the whole ‘font management’ thing entirely by doing this. Remember, the whole reason why we’re using font management software is because we have lots of fonts, too many to leave activated all of the time.

I struggled with this problem for quite some time looking for possible solutions or workarounds. I even tried pulling out my hair, but that didn’t seem to work either. Searching for the problem yielded only a couple of results. Over on the FontExplorer discussion board, there were a couple of posts with similar problems (no solutions):

• QuarkXpress 6.52 Does Not See Activated Fonts
• Problems with (How I hate) Quark 6.1

On Creative Guy, there are some interesting tips for fonts in Quark. They sounded promising, but didn’t fix this particular problem:

• More Quark font issue fixes
• Missing fonts in the Quark XPress font menu

Finally I found this post on Jason Santa Maria. The post itself isn’t that interesting, the comments are where it gets good.

Jerald says: First off… I totally dig FEX. Here is my problem. Quark 6.5 will not recognize loaded fonts more than half the time unless I log out and log back in.

Tim Diacon says: Quark is the bane of my life! FEX works perfectly with everything except Quark which will not activate fonts which are active in other programs! I’ve tried the Jaws solution posted earlier but still not working – anyone worked out a solution?

Hey look, a suggested solution:

Jerald says: Follow up to my experiences with auto activation in Quark. Removing the items in the JAWS folder as described in my previous post resulted in less than stellar results.

The following seem to work:

1. Log out and log back in. This is cumbersome but works 100% of the time. Quark will pick up the newly activated fonts. Make sure you have FEX set to keep the fonts activated after restart/logout.
2. Quit FEX and Quark. Relaunch FEX first and Quark second. This is more convenient than number one but will only work 90% of the time. Still a bummer I have to do this.
3. Switch to InDesign. This option offers the benefit of not having to deal with Quark in the first place.

Okay, cool, at least we’re starting to get somewhere now. I tried Jerald’s suggestion and it did work. But logging out and then back in again just to get a font to work? There has got to be something better.

Using Jerald’s fix as a starting point, I began playing around with things (again). I eventually discovered the following process which gets those pesky fonts to show up in the Quark font menu.

1. Open FontExplorer X
2. From the Menu Bar, choose FontExplorer X > Preferences
3. Click on the Advanced icon
4. Make sure that “Deactivate all fonts which have been activated during the active session on quit” is not checked.
   
5. Activate all desired fonts
6. Quit FontExplorer (FontExplorer X > Quit FontExplorer X or Apple + Q)
7. Open FontExplorer X
8. Open Quark

After following these steps, the temperamental fonts should appear in the Quark font menu. Obviously, this is still a hack. It would be great if these things just worked. This hack however is relatively painless. I released this fix into the wild (read: design students in the labs) and have gotten positive results so far.

One last note: This whole problem appears to be fixed in Quark 7. Unfortunately I (and presumably many others) can’t just wave a magic wand and have Quark 7 installed on all of the computers. Also, we are talking about Quark. Isn’t there some adage about that: for every bug fixed, five more are born.

1. I’m working with approximately 2,500 fonts here, so I didn’t actually count how many are having this problem. It’s not all of them, but it’s definitely more than a couple of them. We will just leave it at many. ↩

Last Spring we updated all of the computers to Tiger. Extensis (the manufacturer of Font Reserve) had just released Suitcase Fusion, which was to be the consolidation of Font Reserve and Suitcase. We got the memo, Font Reserve is dead. I had high hopes for Suitcase Fusion, which had gotten some good reviews, so we ordered up a copy and I settled down to testing it.

Unfortunately, I was less than impressed with Suitcase Fusion. I didn’t like the way that it looked. I found that it was really hard to actually view the fonts. This becomes a real problem when you have over 2,000 fonts. It’s an especially big problem for graphic design students who are just starting out and don’t yet know a lot about different typefaces.

The biggest problem that I had with Suitcase Fusion was it’s lack of options in regards to actually managing the fonts. All of a user’s fonts are stored in this location:

/Users/<username>/Library/Application Support/Extensis/Suitcase/Suitcase Font Database.suitcasevault

This of course is a special format that can’t be read by any other program. Notice how the vault is stored in the user’s library? Okay, now put yourself in a computer lab environment with networked home folders. The vault is stored in the user’s home folder which resides on our server. Every single user has their own vault, stored remotely. There is no option to reconfigure this. In the past with Font Reserve, we were about to create a ‘font database’ that resided on each computer in the /Users/Shared/ folder. All of the fonts were local, and every user had access to them.

So unfortunately, this lacking feature was a complete show stopper for me. To be honest though, I really wasn’t very impressed anyway. I used the program on my own computer and it only took about a week before I started seeing web pages and HTML emails covered in funny and unreadable characters. After some research it turned out that the culprit was a double activation of Helvetica. Deactivating the extra copy solved the problems. The thing was, I had been using Suitcase Fusion the whole time. One of the major reasons to use any font management software is to prevent your computer from activating duplicate fonts!

Enter FontExplorer. She rushed in to save us all from the miserable hell of the broken promises made by the font management companies. She was our knight in shining armor…Well, okay, so not exactly. There is however a lot to be excited about in FontExplorer X.

The user interface is very sleek and easy to use. It’s modeled after iTunes, so anyone who can figure that out can use FontExplorer. That’s most people I think. FontExplorer makes it really easy to view the fonts. This helps ease the problems of deciding which ones you want to use in the first place. There is also a built in search function what works really well. Considering how smoothly the program runs and how easy it is to use, I thought it was the obvious choice for our labs. Font Management is an odd concept if you don’t know much about computers and fonts, so anything that makes it easier to see and understand is huge.

Since we started using FontExplorer in the labs, there have been good and bad things. On the good side, students seem to love it. They seem to find it much more intuitive than Font Reserve ever was. They also like how easy it makes it to browse our fonts. This is important, because we have the entire Adobe Font Folio library which comes with over 2,200 typefaces.

On the bad side, I found out the hard way that you get what you pay for. First of all, FontExplorer doesn’t work with networked user accounts. At least it doesn’t right out of the box in the way one might expect it to. I devised a way to script around this, so eventually we did get it working (More on that in the future).

There are also some really bad issues between FontExplorer and Quark 6.5. I wouldn’t say that this is exactly a FontExplorer issue per say. I think that it is somewhere between Quark and FontExplorer, and probably more Quark’s fault. Either way, it’s been really difficult dealing with these problems and trying to troubleshoot them. There just isn’t currently any real solutions, beyond moving to Quark 7. That’s not an option for us right now.

So, a year later, I guess I’m still on the fence about whether or not moving to FontExplorer was the right decision. It’s a really nice program that has some amazing features. In some ways, FontExplorer is light years ahead of all of the other font management software. This isn’t a small feat, since the other applications have been around for a long time and FontExplorer is still in its infancy. There are some reliability issues to be concerned about, mostly with Quark. I really hope that Linotype continues to aggressively develop this application. If they smooth out some of the kinks, it could be one of the best font management applications on the market. As stands now, it’s a mixed bag.

1. Actually it didn’t really work. You were supposed to be able to ‘temporarily’ activate fonts, meaning they would automatically deactivate when the user logged out. As it turned out, this feature was broken. With our huge number of fonts, and more and more being activated over time, we had all sorts of seemingly unrelated problems with the computers. For example: Microsoft Word would take several minutes to open while it scanned all of the fonts. Eventually I solved this problem by creating a really ugly hackish script that essentially replaced the entire Font Reserve font database with a default one each time a user logged out. This effectively deactivated all of the fonts. Boy was it ugly though and there were also the inexplicably long logout times… ↩

Since we got this type library, I’ve had nothing but problems in our labs. We used to run Font Reserve, but I got fed up with having to script around the fact that it was never deactivating fonts like it was supposed to. With a 1000+ font library and lots of users, that’s a problem. Try having a PR major wait two minutes for Word to open, and then bitch you out for it.

I like Font Explorer X a lot, but installing it in our labs hasn’t come without it’s fair share of problems. The biggest thing right now though is that Quark 6.5 just refuses to play nice with any of the other software. Supposedly 7 is better, but since they released it a month after our budgeting cycle ended, we’re stuck with 6.5 at least until next summer.

Latest Problem: All of those True Type fonts that come preintstalled with Tiger (and Office) I can’t get rid of. They are all always activated, except that Quark apparently doesn’t like the Italic versions. This is a real problem because the students get confused and don’t realize that the true type is not the open type. They don’t see an italic listed in Quark so most just assume it doesn’t exist until their graphic design professor yells at them. Yuck.

I need the font insanity to stop. Now.

• Apple Remote Desktop – Send Unix Commands

Via Team Apple of San Diego County.

Now, I don’t know about you, but I’ve never seen that before and it sounds pretty ominous to me. So, I opened up Terminal and started checking it out. For all intensive purposes, the file seemed blank. So, I did a quick search for it and here’s what I found:

• Mac OS X Hints

As it turns out, this is some sort of weird Macromedia file (the serial # in the resource fork follows the patterns of Macromedia serials). I deleted it. But now I’m just scratching my head wondering what the hell they were thinking by creating a file like that. Are they trying to give me a panic attack?

[Things to keep in mind] with a login hook:

• The script specified as a login hook must be executable.
• The login hook will be run as root.
• In the login hook script, the variable $1 returns the short name of the user who is logging in.
• Other login actions wait until the hook has completely executed.

How to set up a login hook:

Mac OS X 10.3, 10.4, or later

1. Open Terminal (Applications/Utilities).
2. In the Terminal window, type: sudo defaults write com.apple.loginwindow LoginHook /path/to/script (where /path/to/script is the full path to the script that you want to execute when a user logs in—it doesn’t have to be in the user’s Home directory). This modifies the /var/root/Library/Preferences/com.apple.loginwindow file.
3. Type your password at the prompt, then press Return.

First of all, it’s incredibly slow. At least once a day I find myself clicking on a PDF link and then being stopped dead in the water for what feels like an eternity. While Safari is loading an PDF file, I’m unable to browse in any other tab or window.

The worst part is that I know and understand that this will happen each time, yet I keep doing it. Apple’s documentation suggests the following:

If you still prefer Preview, simply Control-click the PDF link (or right click on a two-button mouse) and choose Download Linked File from the shortcut menu. Once the file is on your desktop, double-click it to open in Preview.

The problem is, I don’t always know that I’m clicking on a PDF link to begin with. For example, I was checking out the Quark 7 beta site today. I clicked on an unassuming link titled “ReadMe File.” Suddenly I found my browser completely stalled as I realized that a dreaded PDF was loading.

Even when I am fully aware that I’m attempting to view a PDF file, I don’t always remember that I need to Control-click or Option-click on the link. It’s usually only after Safari has stalled while the page tries to load that I think to myself, “Oh yes, I should have remembered to Control-click that link and then have selected Download Linked File from the contextual menu.”

Even beyond the slow factor, which perhaps can be attributed to my aging G4 PowerBook (seems a stretch though), the final result isn’t even satisfactory. When I open, a PDF file in a browser, I usually just want to look at it dammit. I don’t need all of those fancy Acrobat buttons. If I decide I want to do something further to the document, I’m going to save it anyways and open Adobe Acrobat to edit it.

Also, the files open up so tiny that I can’t ever read them. I’m constantly having to change the view, zoom, or resize my browser window. Resizing my browser window works, but then that messes up my workflow. I like the browser windows a certain size, just big enough to display all of most web pages.

All of this simply comes down to user preferences. I’m sure that there are many people out there who completely disagree with me and love this feature in Safari. I’ll admit, before Safari offered it, I was constantly irritated that it wasn’t even an option. I’m definitely not arguing against having this feature. Before this whole displaying PDF inline business, if you clicked on a PDF link in Safari, it would automatically download and then open in Preview. It was somewhat counterintuitive, but I have to say, once I got used to it, I liked that feature.

Preview is a great lightweight application that does a small number of things well. I like how easily the size of the document changes when you increase the size of the window, without having to mess with my browser window size. It’s fast. I can zoom in when appropriate, and for the love of god, I don’t have to stare at those ugly Acrobat icons.

All of this would be a rather trivial annoyance if Safari just included how it displays PDFs as a preference item. I’ve been searching, but I haven’t been able to find this one yet. I should be a be able to either check a box to display PDFs inline, or chose what application opens them automatically. Suggesting that I simply Control-click or Option-click just isn’t enough. In my opinion, Apple just got it plain wrong on this one.

I find this all pretty ridiculous, especially considering that around the same time Apple also introduced the feature that allows RSS feeds to be read inside Safari. It’s a cool feature that I tried out. I quickly decided that I didn’t like it nearly as much as NetNewsWire Lite, so I checked out the preferences. Sure enough, there was an option to set whatever application I wanted to use as my default RSS aggregator.

Apple got it right with the RSS feature. Why didn’t they apply the same logic to inline PDFs? I want to have the option to use all of these features within Safari, but I wan’t the option to opt out of them as well.

• Fix Quark QLA server after Java update