In the past month or two I noticed that my phone was becoming increasingly slow. Eventually I managed to pinpoint the problem down to the location services. The issue cropped up whenever I used an app that wanted to check my location. Because of this issue, I had actually turned off location services for any apps where it wasn’t absolutely necessary. But, the two primary apps I used that needed location services were Maps and Pocket MBTA.

My phone was so slow using these two apps that it was unbearable. I could not even get directions to a location because as soon as I started typing in a destination the phone would freeze completely. Eventually the app would just quit. When I tried to use Pocket MBTA to get buses near my location, the buses would actually arrive before I ever even got the app to tell me which buses were in the area. Even worse, after closing the app, my phone would still be a useless brick for several minutes after the fact. I’ve actually missed several calls because my phone was frozen and no attempt at clicking the accept button would work. Even worse, the Phone and Chat apps would just freeze and then quit when I tried to open them. Eventually after a few minutes the phone would start working again. There’s nothing that makes you feel more silly than holding a $300 phone that works about as well as a brick.

The release notes to a recent update of The Weather Channel app gave me an idea however. The issue for this app was a crash on startup. They suggested reseting your location services database. My weather channel app was fine, but I figured it was worth a shot to try and fix my other problems.

On my phone I went to Settings > General > Reset. Then I chose to “Reset Location Warnings”. A warning pops up and says that this will reset all the location warnings. I clicked Reset Warning. Amazingly, since doing this, my phone has been much more snappy. I can finally use the Maps app again!

Exporting Your Messages

First off, you need a way to export your text messages from either your phone or your backup. All the messages are backed up on your computer with the normal iPhone sync process, but they aren’t in a format that is readable for humans. There are several different software applications that will do this for you. I’ve tried a few different ones with varying success. Most of them seemed downright kludgy. After trying out several apps, I finally discovered Decipher TextMessage from Decipher Media. It is very modestly priced at $6.99.

Decipher TextMessage is an OS X only app (sorry Windows users) that simply pulls your text messages out of your iPhone data backup file. I like the idea of this because it’s only messing with the backup file, not your actual phone. The great part about Decipher Text Message is that it uses your address book to match up phone numbers with contact names. All texts are sorted into conversations with each contact. You can then easily select a conversation and save it as either a text file or a CSV file. For this method, I just exported the conversation I wanted as a text file.

Make Your Texts Into a Self Contained HTML File

The text file is great, but if it’s a long conversation, it’s going to be hard to read and not terribly useful. This is where a little regular expression kung fu and some HTML and CSS love come in handy.

Once you export your text conversation, you’ll get a text document that looks something like this:

Conversation with: Johnny Appleseed (5555558555)


Wednesday Mar 31 14:56

Me: Do you still have that spare ticket?

Johnny Appleseed: I dont BUT if you want to go I can probably grab another.

Me: What time is it at?

Johnny Appleseed: Doors @ 8 but we'll most likely grab food down there first and get there shortly after 8

Me: Hmm. I think I'll pass. I got into work late today so should prolly stay until at least 8. Have a good time though!

Johnny Appleseed: Mmmkay.   Perhaps next time.


Sunday Apr 04 15:49

Me: I just got home.

Johnny Appleseed: Hey, im @ the field. You should come here

Me: Oh yeah? Who you out with?

Johnny Appleseed: Work peeps. Theyre cool. Come out  

As you can tell, although there is a lot of text, it’s all in a very predictable pattern. One part at the top, dates, texts from your contact, and texts from you.

Make the document into an HTML file

The first thing we need to do to our text file is convert it to HTML. Setting our text into an HTML template is easy. Just surround the whole conversation with a very basic HTML head tag and a body tag. For the purpose of this document, I’m not even worried about getting all the right tags in there, just enough to make it work. Here’s what it looks like now:

<!DOCTYPE html>
<html>
<head>
    <title>Me and Johnny Appleseed Converstaion</title>
</head>

<body>
    Wednesday Mar 31 14:56

    Me: Do you still have that spare ticket?

    Johnny Appleseed: I dont BUT if you want to go I can probably grab another.

    Me: What time is it at?

    Johnny Appleseed: Doors @ 8 but we'll most likely grab food down there first and get there shortly after 8

    Me: Hmm. I think I'll pass. I got into work late today so should prolly stay until at least 8. Have a good time though!

    Johnny Appleseed: Mmmkay.   Perhaps next time.


    Sunday Apr 04 15:49

    Me: I just got home.

    Johnny Appleseed: Hey, im @ the field. You should come here

    Me: Oh yeah? Who you out with?

    Johnny Appleseed: Work peeps. Theyre cool. Come out  
</body>
</html>

As you can see, I deleted the first line from the text file that said “Conversation with: Johnny Appleseed (5555558555)”. I don’t need that for this case. If I had wanted, I could have used that as the title of the document. I’ve also changed the extension of my document from .txt to .html.

TextWrangler is a beast

Next up is putting all of our text into HTML tags. Now, for any conversation that is more than a few texts, doing this by hand is just out of the question. That’s where some regular expression kung fu and my favorite find and replace tool come in handy.

For this job, I use TextWrangler from Bare Bones Software. It’s a great free text editor that includes the best search and find and replace tools I’ve found. In my opinion, it’s much better than the search tool for TextMate, which is the editor I use for pretty much everything else.

Get rid of the pesky extra line breaks

The first thing we’ll do is reduce the length of the file by getting rid of the extra line breaks. The line break pattern will match our line breaks. We just use \r for this. We want to end up with just one line break after each line with text and no empty lines. We do this by searching for two line breaks in a row and replacing them with one.

Doing “Replace All” once on this search will give us a much more manageable file length.

Mark up the dates

Next we want to put all of the date lines in a paragraph tag with a class of “date”. We can use the TextWrangler find and replace and, making sure that the Grep option is checked, search for a regular expression that matches all of the date lines. The following regex does just the trick:

^[a-zA-Z]* [a-zA-Z]{3} \d{2} \d{2}:\d{2}$

The above regex will match the entire line and then we use the ampersand (which just represents the entire match) in our replace string. We just surround the ampersand with our HTML:

<p class="date">&</p>

Here’s what it looks like in TextWrangler:

Mark up each of the conversation bits

Next I’ll search for all of my parts of the conversation. These each start with the label “Me:”. I want to code the classes so that the CSS will be easily to reuse later for different conversations. So in this case, I’ll just use generic ‘me’ and ‘you’ classes. For my parts of the conversation, I want to do the following things:

• Mark up each of my texts in a paragraph
• Give each of the paragraphs two clases: ‘message’ and ‘me’.
• Change the starting label from “Me:” to be my full name instead.
• Enclose my name in a strong tag.

In order to accomplish each of these things in one fell swoop, we can basically just match the text “Me:” at the start of a line and save the match that is everything after it in that line. There parenthesis save the pattern that is matched inside them. Since we’re getting rid of the “Me:” part, we don’t save it. Here’s what the regular expression looks like:

^Me:( .*)$

In the replace string we just surround the entire match that we saved (indicated by \1) with our appropriate HTML and label. Here’s the replace string (Obviously you wouldn’t want to use my name):

<p class="message me"><strong>Alissa Miller:</strong>\1</p>

The step is to match the other person’s texts. Here we’re trying to accomplish a very similar thing:

• Mark up each of the other person’s texts in a paragraph
• Give each of the paragraphs two clases: ‘message’ and ‘you’.
• Enclose the other person’s name in a strong tag.

We’ll use almost exactly the same search pattern as the last time, except this time I’m using Johnny’s name instead of mine. Just substitute the Johnny part for whoever the conversation is with.

Here are screenshots of each of the last two searches in TextWrangler.

And there we have it. Just a small bit of regex kung fu has given us a fully marked up HTML document. This is a great start, but in order to make it actually usable, we have to add some CSS styling to it. Here’s what are document looks like so far.

<!DOCTYPE html>
<html>
<head>
    <title>Me and Johnny Appleseed Converstaion</title>
</head>

<body>

    <p class="date">Wednesday Mar 31 14:56</p>
    <p class="message me"><strong>Alissa Miller:</strong> Do you still have that spare ticket?</p>
    <p class="message you"><strong>Johnny Appleseed:</strong> . I dont BUT if you want to go I can probably grab another.</p>
    <p class="message me"><strong>Alissa Miller:</strong> What time is it at?</p>
    <p class="message you"><strong>Johnny Appleseed:</strong> Doors @ 8 but we'll most likely grab food down there first and get there shortly after 8</p>
    <p class="message me"><strong>Alissa Miller:</strong> Hmm. I think I'll pass. I got into work late today so should prolly stay until at least 8. Have a good time though!</p>
    <p class="message you"><strong>Johnny Appleseed:</strong> Mmmkay.   Perhaps next time.</p>

    <p class="date">Sunday Apr 04 15:49</p>
    <p class="message me"><strong>Alissa Miller:</strong> I just got home.</p>
    <p class="message you"><strong>Johnny Appleseed:</strong> Hey, im @ the field. You should come here</p>
    <p class="message me"><strong>Alissa Miller:</strong> Oh yeah? Who you out with?</p>
    <p class="message you"><strong>Johnny Appleseed:</strong> Work peeps. Theyre cool. Come out  </p>

</body>
</html>

Styling Our Conversation

For the purpose of this conversation, my goal was to make the HTML page mimic the look of the iPhone text messages. I also want to make the HTML page self-contained, so I’m going to use internal CSS styles for everything.

Basic body styles

The first thing is to add some very basic styles to the body element. Here we are setting the background color and fonts. We also use the margin: 40px auto; to center the page and the width property to give us a nice narrow page width for our conversation.

body {
    background-color: #dbe1ed;
    color: #000;
    font: 14px/1.4 helvetica, arial, verdana, sans-serif;
    margin: 40px auto;
    width: 450px;
}

Styling the strong tags

Next we should style the strong tags. In this case, I want the strong elements to have a normal font-weight, but to be a different color. I styled all the strong elements as a medium gray color and then used the me class to override the the gray color with a bright green for my texts.

strong {
    color: #555;
    font-weight: normal;
}
.me strong {color: rgb(78,145,3);}

Basic paragraph and date styles

Now we style the paragraphs and the date class. We’re going to be floating elements in a bit, so we want to make sure to add a clear to all of the paragraphs on both sides. Also, the date class should have bold text that is centered and slightly larger than usual. Here are the styles:

p {clear: both;}
p.date {
    color: #777;
    font: bold 14px/1.4 helvetica, arial, verdana, sans-serif;
    text-align: center;
}

Creating rounded speech bubbles

Now that we’ve done some basic styling, we can start mimicking the speech bubbles. First we’ll style the message class to give some padding and rounded corners. We’ll also set the max-width of the each message to 70% so that it will stretch only slightly less than three quarters across the page.

p.message {
    position:relative;
    padding:5px 10px;
    border:2px solid rgb(74,77,82);
    border:2px solid rgba(74,77,82,.5);
    -moz-border-radius:10px;
    -webkit-border-radius:10px;
    border-radius:10px;
    max-width: 70%;
}

Add the fancy CSS gradients

After that, we’ll set the background colors and use CSS3 gradients to create the green and gray speech bubbles. The gradients are a bit complex, so I used the online Ultimate CSS Gradient Generator tool. This was a fabulous way to visually match the iPhone styles as closely as possible while getting the cross-browser compatible code automatically generated. After generating the two sets of gradients, this is the CSS I ended up with:

/* Gradients and styles for each bubble */
p.you {
    background: #EBEBEB; /* old browsers */
    background: -moz-linear-gradient(top, #EBEBEB 5%, #D6D6D6 15%, #D2D2D2 71%, #E7E7E7 99%); /* firefox */
    background: -webkit-gradient(linear, left top, left bottom, color-stop(5%,#EBEBEB), color-stop(15%,#D6D6D6), color-stop(71%,#D2D2D2), color-stop(99%,#E7E7E7)); /* webkit */
    filter: progid:DXImageTransform.Microsoft.gradient( startColorstr='#EBEBEB', endColorstr='#E7E7E7',GradientType=0 ); /* ie */
}
p.me {
    background: #D0ECCC; /* old browsers */
    background: -moz-linear-gradient(top, #D0ECCC 5%, #87CD65 15%, #92D664 70%, #ADE763 99%); /* firefox */
    background: -webkit-gradient(linear, left top, left bottom, color-stop(5%,#D0ECCC), color-stop(15%,#87CD65), color-stop(70%,#92D664), color-stop(99%,#ADE763)); /* webkit */
    filter: progid:DXImageTransform.Microsoft.gradient( startColorstr='#D0ECCC', endColorstr='#ADE763',GradientType=0 ); /* ie */

    float: right;
}

Notice that I also tucked in a float:right to the ‘me’ class. This will set my speech bubbles off to the right of the page.

Using just these few styles, we’ve created a nice looking self contained HTML page displaying our exported SMS conversation. Take a look at the HTML page so far.

Make more better speech bubbles

We could stop here and the page would be fine. However, we’ll use some really fancy CSS border trickery to make the text bubbles looks just a little bit better. Using images would make the text bubbles perfect, but remember, we want the file to be self contained.

In order to make the speech bubbles, I used a technique of arranging multiple CSS borders and using positioning to create a small triangle off to the side. The code is modified from Nicolas Gallagher’s excellent post on Pure CSS Speech Bubbles. In this case, I chose to use a modified version of the “Triangle Border” shown in Gallagher’s demo page (the one’ with the thick green border). The CSS had to be changed a bit because I didn’t actually want borders. Here is the final CSS I used:

/* The basic speech triangle */
p.message:before {
    content:"";
    display:block; /* reduce the damage in FF3.0 */
    position:absolute;
    border-style:solid;
    border-color:transparent rgb(74,77,82);
    border-color:transparent rgba(74,77,82,.5);
}
p.message:after {/* creates the smaller  triangle */
    content:"";
    display:block; /* reduce the damage in FF3.0 */
    position:absolute;
    border-style:solid;
}
/* Me points to the right */
p.message.me:before {
    right:-14px;
    bottom:7px;
    border-width:8px 0 8px 14px;
}
p.message.me:after {/* creates the smaller  triangle */
    right:-10px;
    bottom:8px;
    border-width:7px 0 7px 14px;
    border-color:transparent #94d749; /* green */
}
/* Other person points to the left */
p.message.you:before {  /* creates the larger triangle */
    left:-16px;
    bottom:7px;
    border-width:8px 16px 8px 0;
}
p.message.you:after {   /* creates the smaller  triangle */
    left:-10px;
    bottom:8px;
    border-width:7px 14px 7px 0;
    border-color:transparent #d3d3d3; /* grey */
}

You can see the finished effect on this page.

So with just a little bit of work we’ve marked up our conversation into HTML and created some advanced CSS styles to put our entire text conversation into a nice self contained HTML page that should be easily viewed in browsers for years to come.

Even better, we’ve made the CSS generic enough that we can just copy and paste it into another conversation we’ve marked up using HTML.

Obviously, there are a few caveats here. The Decipher Text Message program only on works on Macs. I haven’t tested any Windows-based software for the same purpose, but I stumbled across quite a few of them when I was looking for the software, so there are definitely options out there. Also, we’ve used some pretty complex CSS and several CSS3 properties that aren’t fully supported by all browsers. I have tested this in Firefox, Chrome and Safari. Hopefully things shouldn’t look too terrible in other browsers. I confess though, I did not even check it in IE.

Check out the video comparing the performance differences. And finally, here’s the link to the SSD express card on New Egg.

Existing users is a different story though. They already have their home directories. Depending on how many users you have, adding/deleting files from you old users can be a daunting task. Ten users is easy enough, but 50 is silly and over 100 is ridiculous.

Long ago I wrote a series of scripts (well actually just one) that I use and modify for whatever files I need to change. I basically just loops through each home folder in a specified directory. It’s really a pretty basic script. Here’s an example of one that I was using:

# Copy new dock and fix permissions

echo "\ncpdock.sh"

dir=`ls $1`

cd ${1:?"No directory specified!"}

echo "PWD = `pwd`"

echo "\n$dir\n"

for folder in $dir; do
    echo "...copying dock plist to $folder"
    cp /com.apple.dock.plist $folder/Library/Preferences/com.apple.dock.plist
    chmod -R 700 $folder/Library/Preferences/com.apple.dock.plist
    chown -R $folder:staff $folder/Library/Preferences/com.apple.dock.plist
done

That’s easy enough. It’s kind of a pain though to modify the scripts all the time. Also, it’s very difficult (and scary) to try and explain how to use these scripts to my less Bash-inclined co-workers.

The other day I found this great little piece of software written by Nicole Jacque called Home Directory Helper. It does exactly what all of my scripts did, except with an easier to use GUI interface. Very nice, and highly recommended.

lsof | grep DISKNAME

Read the full tip from Mac OS X Hints.

This updated quickstart guide is very similar to the Tiger Server Quickstart Guide posted in 2005. It’s primary purpose is to get you up and running quickly, overcoming common hurdles such as DNS and binding confusions. With the move to launchd over cron, those steps are now included as well.

You can grab the pdf at AFP548.com.

The article includes some particularly good instructions on using and setting up rsync, launchd, and Network Home Redirector.

Via Infinity’s End.

At my work we use an OS X server to host the home directories of all of our users who log in to our lab computers. We currently only support OS X clients, so we’re only doing this over AFP. Last semester we used a Tiger server and clients, but this summer we are upgrading everything to Leopard.

After setting up a test client computer in Directory Utility (used to be Directory Access in Tiger) to connect to our server I figured we were good to log in with one of migrated user accounts. We don’t do binding or Active Directory or really anything complicated so usually the process is pretty straightforward.

After setting up the client and restarting, I attempted to log on using one of our network users, and was met with this big fat error message:

Not only did not logging in not work, but the entire description of the error read “Logging in to the account failed because an error occurred”. Gee, thanks Apple. Very useful.

This error wasn’t entirely foreign to me. I remembered seeing it occasionally in Tiger, but couldn’t remember if we had ever established a cause, let alone a solution. Just for kicks I tried logging on with the same account on one of our older Tiger clients (that was known to work with the old Tiger server). The message is slightly more verbose, but generally still the same:

I knew that AFP was working because we had some share points up and running. So, AFP and at least some level of authentication were working. After inspecting the server firewall and open directory logs, as well as the client logs, it seemed clear that the user was authenticating properly. It was something that was happening after the actual successful authentication that was causing the error message.

After some research and thought, it occurred to me that it was very likely that there was some sort of configuration gone awry with the actual home directories. Then I realized that I had completely neglected to actually configure the old home directories on our server to be shared at all!

So basically the user was logging in and authenticating successfully. Then when the client asked for the home directory the server was like, what home directory? And the client was like aww shit. I’m gonna log you out right now ’cause I need your home to work. And the server was like, all right, fine. Something like that.

After some simple home directory sharing configurations, everything was running without another episode. Sigh.

After an initial false start attempting to simply upgrade the server, I ended up simply installing the Leopard server from a blank disk. This seemed to take care of most of the really strange things that were happening after the upgrade.

This particular server is of the headless XServe variety, so we primarily use Apple Remote Desktop to access it in addition to the Server Admin Tools and SSH. Since installing Leopard on the server however, I’ve been noticing that at times it is acting erratically. Usually I’ll first notice that the server will either stop showing up in ARD or it show up as black, indicating that there is no ARD agent on the computer. I’ve tried restarting the computer, which will fix it, but that’s not a very good solution for obvious reasons.

I had also noticed while using Server Admin that sometimes the server CPU is running at completely full capacity, like in this screenshot:

The other day the server stopped responding in ARD again. As usual though, I was still able to access it through both Server Admin and SSH. After a little research, I found this useful page of commands, which includes this one-liner:

sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -restart -agent -menu

Running this command restarts the ARD Agent, which is what we want if it is frozen. Once I did this things got a little better, and the server came up in ARD as active. I tried controlling the server through ARD, but no dice, still no connection.

At this point I noticed that there was a user logged on to the server and I remembered that I had also been having problems with VNCDragHelper freezing. I found this on an Apple discussion page:

When remotely managing an XServe with OS 10.5.1 from a 10.4.11 client with ARD 3.2, several times (3 up till now) the server UI becomes unresponsive, at least finder. This even gets worse when trying to start the Application Monitor, then also the Dock freezes, and the Application Monitor UI never opens. When doing an ssh> sudo top, it shows that both “Application Monitor” and “VNCDragHelper” do consume almost 100% CPU. Luckily only on a Single core, but that keeps two cores (one processor 100% busy). killall “Activity Monitor” brings the activity monitor down, when sending it with Remote Desktop Unix command.

Perfect, that must be it. In SSH, I ran the following command:

sudo killall -9 VNCDragHelper

I also killed the loginwindow because that appeared to be frozen as well (judging from the top command that I ran):

sudo killall -9 loginwindow

Suddenly after running both those commands, the server leapt back to responsiveness. I was able to access it in ARD without problem. Also, after about an hour I checked the CPU diagram in Server Admin and was able to see a noticeable improvement.

Now that’s a sight for sore eyes. For reference, I was running 10.5.3 and ARD 3.1 when this problem happened. I’m not sure that anything has been fixed in 10.5.4 though.

I fired up Mail and clicked on the note icon and…nothing happened. Hmmm, check the Menu bar. Go to File → New Note…nothing again. Well okay, I thought to myself, somethings wrong here. Maybe I should do a Google search. Hmmm, what to search. Mail Notes Error. Umm, okay too generic, I’ll try being more specific. Apple Mail error opening new note. Grrr. Try several other search strings. #@$%*! ¹

Okay, so it’s become clear to me at this point that Googling the problem is just not going to work. I decide to fire up Console to see if there are any enlightening error codes. Console does at least offer me something, in the form of “Mail[471] font-family cannot be nil”.

Hmm, that looks like gibberish to me. I do some more unsuccessful Google searches. Finally, I decide to attempt to decode that error again. That error means that somewhere a font family is not selected or unavailable. We know it’s happening when a new note is being created. I opened up Mail again and started pursuing the preferences. Low and behold, under the tab for Fonts & Colors, I found this:

The field for the Note font is completely blank. I selected a font and attempted to open a new note. Success!

As it turned out, this happened to be a very simple solution for a very silly problem. That solution took me over an hour to figure out. Unfortunately, I’ve never been able to figure out why that field was blank in the first place. I wonder how many other people have had this exact same problem and just given up on trying to figure it out.

1. Side Rant: What exactly was Apple thinking when they named their email client “Mail.” Could they have thought of a worse name? It is impossible to search for information about a problem with the program because “mail” could refer to so many things. It’s kind of like buying a computer, that has the model name of “computer.” Then say said computer one day won’t start up. You find another computer and start doing a search for the problem. Your query string is going to look something like this: [brand name] computer won’t start. Completely useless.↩

When I updated to Firefox 3, I immediately noticed that Bookmarks were not visible under bookmarks menu. The Search engine field had a generic icon and when I selected ‘Manage Search Engines’, the dialog box was frozen and I couldn’t get out of it without quitting Firefox. When I tried to enter a URL into the URL field and press ‘enter’, nothing happens. However, when double-click on a URL in an e-mail message, that appears to work. […] When I switched to a local admin account (i.e., Firefox profile on the local hard drive), it seems to work fine. However, when I switch back to my network home account (on our XServe), it still displays the problems described above. I tried other user accounts on our XServe with the same problems.

This is kind of unbelievable to me that Firefox 3 was released with such a show-stopping bug on the Mac side. I’m pretty sure that most companies that use Macs use them with networked home directories (at least in the Academic world). It’s good to know though before I start adding Firefox to the images for fall semester.

Apparently this is a documented bug and as a commenter suggested, will be fixed in the future. You can read the bug track in Bugzilla to see how the fix is progressing.

Here is the script (or download it here):

-- To change the tags, edit text inside quotes below
-- Use spaces to seperate multiple tags (ex: "tagOne tagTwo")
set tags to "toPost"

-- build delicious URL for current tab in frontmost window of Safari
tell application "Safari"
    set u to (name of current tab of front window) & ¬
        "&url=" & (URL of current tab of front window) & ¬
        "&tags=" & tags
end tell

-- Add URL to Delicious
tell application "Safari"
    do JavaScript "javascript:void(open('https://api.del.icio.us/v1/posts/add?description=" & u & "','delicious','toolbar=no,width=150,height=100'));" in document 1
    delay 0.5
    close current tab of front window

end tell

This is basically a simple modification of the script written by Andrew Faden which does pretty much the same except from NetNewsWire instead of Safari. Be sure to check out his original script and also the much improved version submitted by Larry from http://scriptingforlawyers.com/.

This paper presents an overview of the security situation of Mac OS X. The purpose of this paper is to present security in a very easy-to-understand fashion. I firmly believe that there is an absurd amount of FUD about computer security in general, mostly propagated by vendors of antivirus software and their partners. In the case of Mac OS X in specific, it is very difficult to get accurate, non-sensational information about what the real security threats are. This paper began as a genuine effort to figure out, and then convey, what the real status of Mac OS X security is.

Please be aware that I am no security expert (nor am I a hacker), but simply a normal computer nerd with a passion for most things relating to computers and design. I have made every effort to consult the writings of security experts and convey accurate information. If any security ninjas out there find any inaccuracies, please let me know.

With the exception of the section “Out Of The Box Security and Additional Hardening Measures”, the entire report refers to Mac OS X 10.4 and prior versions. Where possible, I state specific versions of the operating system that I am referring to.

I’ve broken up this report into several pages because it is quite long. You can also download the report in its entirety in PDF format.

Table of Contents

1. Preface and Disclaimer
2. Executive Summary
3. Introduction
4. OS X Background
5. Examining the OS X Security Record
6. Out Of The Box Security and Additional Hardening Measures
7. Conclusion

Executive Summary

Mac OS X has for the most part, compared to other operating systems, enjoyed a carefree history when it comes to security. There are certainly some vulnerabilities, but relatively few known exploits for them. There are also almost no examples of attacks in the wild. The few attacks that researchers have noted in the wild, although highly publicized, are mostly harmless. This however should not be taken as evidence that OS X is difficult or impossible to attack.

Two reasonable explanations for the lack of any large-scale security threats facing OS X are its small market share and superior approach to security. OS X is based in BSD UNIX and uses time tested open source software for its security foundation. It was designed to be a multiuser operating system and has strong built-in file based permission system. OS X is also very secure out of the box and includes many easily accessible additional features. By default the root user in OS X is disabled, and most normal users should never even need to use it. Network services are also disabled by default. OS X provides a unique combination of good security by default and ease of use, making it a relatively secure system for normal users.

The first virus for OS X, OSX.Leap.A was discovered in the wild in February of 2006. Although this particular virus was innocuous, it should demonstrate that OS X is certainly not immune to security threats. While the OS X market share is small, it is steadily increasing. As is becomes a more popular operating system, security threats are likely to increase and become more severe. OS X is not by any means a bulletproof operating system and Apple will have to continue to be vigilant about security in order to stay ahead of hackers.

I’ve been looking for a good application like this ever since I found my self writing a diff-based app in Automator to check for differences between my iTunes libraries. This one looks like it will do that and a lot more. It also integrates with my favorite text editor, TextMate. For the old school folks, it works with BBEdit as well.

screencapture -x FileToSaveAs

The -x option tells it not to make the shutter click sound. There is also an -i option which triggers an interactive mode, although I’m not sure why you would use the Terminal to do that.

There is also a cute little tidbit in the man page for screencapture:

Get the new and improved free download of NetNewsWire here.

The second item pertains to Safari 3. Starting with this update, Safari 3 will be the default browser. Now, this is really great, but it introduces some problems with my workflow. If I install this update, how am I going to be able to continue to test my designs in Safari 2.x?

As it turns out, Michel Fortin has gone through the trouble of creating standalone versions of every Safari installment. So go ahead, jump on that update from Apple, then grab a standalone copy of Safari 2.

Unfortunately, the options for built-to-order RAM on a Mac range from questionable to obscene. Keep in mind, there are only two slots for RAM in an iMac. Here’s how it breaks down:

Thats right, 2 sticks of 2GB RAM will cost you $850 if you get it from Apple.

The 1GB option seems silly if you’re doing anything more than web browsing. 2GB is enough RAM for now, but the configuration of 2 sticks of 1GB stinks. This means that if you want to upgrade to 4GB of RAM later, those two sticks are worthless. There is no option for the obvious choice: to chose one stick of 2GB RAM, leaving an easy upgrade path.

All of this left me pretty annoyed at Apple, and feeling like no matter what I did, I was either wasting RAM (and money) now or later. So, I really had to laugh when I came across Mike Davidson’s post on RAM Arbitrage:

…to max out my MacBook’s RAM, Apple charges me $850, while if I go through my trusty RAM comparison shopping site DealRam, I am pointed to NewEgg, which ships me the same amount of RAM for $120. As a point of comparison, Dell charges $465 for an extra 4GB… still outrageous, but not a 700% markup!

He nails it. What really sucks about this practice by Apple is that I would guess many people who buy Macs don’t know that they can get the same kind of RAM from places like New Egg. They also probably don’t know how easy it is to replace RAM. It’s a racket.

Via Daring Fireball.

In More Goodies in Apple’s New Operating System, David Pouge mentions two new features in Spotlight (other than fixing the molasses problem) I wasn’t aware of.

Menu bar calculator:

[Spotlight] is also a tiny pocket calculator now. Hit Command-Space, type or paste 38*48.2-7+55, and marvel at the first result in the Spotlight menu: 1879.6. You don’t even have to fire up the Calculator.

This is a neat idea, and if I could train myself to actually use it, it would be useful.

Dictionary lookups

The Spotlight menu also searches the Leopard dictionary now. If you type, for example, “schadenfreude” into the Spotlight box, the beginning of the actual definition appears right there in the menu. Click it to open Dictionary and read the full-blown entry.

Um, interesting example word. Anyway, one of my favorite features in OS X is the ability to move your mouse cursor over any word (in a Cocoa app) and press Ctrl + Cmd + D and get a little pop up that defines the word.

I’ve been steadily beefing up my vocabulary by using this feature. Sometimes this little trick isn’t enough though and I have to go to the real dictionary. I usually use Dashboard for this, but in general I’m really not a fan of it. This new Spotlight trick is great.

Visual integration with Windows and OS X is our primary objective for the Firefox 3 refresh.

This is great news for Firefox, because as I have mentioned before, its user interface has really been the achilles’ heel of the browser, especially on the Mac.

Mozilla’s user experience team literally wants to do a better job of visually integrating with Windows than IE, and a better job of visually integrating with OS X than Safari. I don’t know if we will be able to pull that off, but that’s the goal.

I’m glad that they’ve recognized this as an issue and I can’t wait to see what they come up with. If Firefox actually did look as good or better than Safari on a Mac, I might use it as my primary browser.

Via Beauty And The Geek: Firefox 3′s Visual Makeover.

The feature that really got me excited¹ though was this:

Automatically activate fonts as you need them. When an application requests an installed font that’s currently disabled, Leopard activates that font and keeps it active until the requesting application quits.

If this feature actually works and works well with lots of fonts, it’s easily got to be one of the killer features of Leopard. Seamless font auto-activation built into the os is worth the price of admission alone. How many other font management applications cost money and don’t really work (other than of course FontExplorer X, which is free)?

I’m not holding my breath though.

1. By excited I mean pessimistically hopeful.↩

When a user with a networked home folder tries to open the FontExplorer X, the file ~/Library/Application Support/Linotype/FontExplorer X/FontDatabase.db is made into an alias. Note that this is a rather important file. It appears to store the references to all of your fonts (not the fonts themselves, just the references). The alias points to a newly created FontDatabase.db file in /Users/Shared/Linotype/FontExplorer X/<username>_<uid>/, where <username> is the username of the current user and <uid> is the user id of the current user.

The end result of this behavior, is that FontExplorer behaves as if it’s the first time FontExplorer X has been opened, every time someone uses it. Of course, in a lab type environment this behavior is completely unacceptable.

Below are login/logout scripts that I wrote to circumvent this behavior. You can download the scripts and a readme.txt file here:

• FEX Login/Logout Scripts (tar format)

Update: I should point out here that this particular script has only been tested on OS X 10.4 (Tiger). It will work on 10.3, but the way that you set up the login hook is slightly different than what I describe below. I’m also using FEX 1.2.2 for this script and it should be noted that the way FEX stores it’s database changed slightly in this version. Previous versions of FEX should work with this script using only a small tweaking. As I have not gotten my hands on a Leopard yet, I have no idea if this will work with them. (added 11/8/2007)

Update #2: This script is still working like a charm using OS X 10.5.4 and FEX 1.2.3. (added 8/12/2008)

Update #3: This script still works using OS X 10.6 and FEX 1.2.3. (added 2/7/2011)

The Setup

1. Start by setting up FEX on a test computer. Set all the preferences as you want them and make sure the fonts are imported into appropriate sets.
2. Font Library: Make a copy of your entire font library and note the location it’s stored in. I use /Users/Shared/Font Explorer X/ so that everybody has access to it.
3. FEX plist: make a copy of the FEX plist file located in /Users/<username>/Library/Preferences/com.linotype.FontExploereX.plist
4. Application Support Files: Make a copy of the Linotype application support folder located in /Users/<username>/Library/Application Support/
5. A copy of each of these must reside on the client computer (the one your running the login script on).
   • Make sure that the entire font library is in the same location on the client computer as it was in the test machine (/Users/Shared/ in my case).
   • Copy the FEX plist and Linotype folder to a privileged location on the client computer. It doesn’t matter where they are, we just don’t want normal users to be able to modify them. I use an admin’s document folder.’
6. Change the $backupprefs and $backupdb variables in login.sh to the correct locations. They should be lines 11 and 14.

Installation

1. Copy login.sh and logout.sh to client computers. Make sure that you limit access to the files. They will be run as root, so these permissions will work:
   

   
   sudo chown root:admin <pathToFile>/login.sh <pathToFile>/logout.sh
   sudo chmod 750 <pathToFile>/login.sh <pathToFile>/logout.sh
   

2. Add the login and logout hooks. Run these two commands in the terminal of the client computer:
   

   
   sudo defaults write com.apple.loginwindow LoginHook <pathToFile>/login.sh
   sudo defaults write com.apple.loginwindow LogoutHook <pathToFile>/logout.sh
       

   
   Note: This works on 10.4. The syntax for 10.3 might be slightly different
3. To test to make sure the hooks got set up correctly, run this command and ensure that the directories are correct:
   

   sudo defaults read com.apple.loginwindow

Adding to Existing Login and Logout Hooks

If you already have login and logout scripts running, simply append the contents of these scripts to your existing ones. Everything should still work fine.

Login.sh

#!/bin/sh

### Modify these ###
# change to location where you put FEX plist file
backupprefs="/Users/admin/Documents/com.linotype.FontExplorerX.plist"
# change to location where you put Linotype file
backupdb="/Users/admin/Documents/Linotype"


### Start of Script ###
# Get the shortname of user who just logged in
username=$1

# create hidden file containing username for the logout script
echo $username > /Users/.username

# get the user id of user who just logged in
userid=`su - $username -c "/usr/bin/id -u"`

# set a variable for the FontExplorer folder in the format of _
userfolder=${username}_${userid}

# get the path to the networked home directory of user
userhome=`su - $username -c "/usr/bin/id -P | cut -f9 -d:"`

# Make the prefs directory in /Users/Shared/ for networked users
mkdir -p "/Users/Shared/Linotype/FontExplorer X/$userfolder/"

# On the rare occassion that the logout script fails to copy the FontDatabase.db file back to user's folder,
# this will copy in a default backup copy of the FontDatabase.db file 
if [ ! -e "$userhome/Library/Application Support/Linotype/FontExplorer X/FontDatabase.db" ]; then
 cp -R $backupdb "$userhome/Library/Application Support/"
 chown -R $username:$username "$userhome/Library/Application Support/Linotype/"
fi

# Copy the real FontDatabase.db file from user's home to the /Users/Shared location
cp "$userhome/Library/Application Support/Linotype/FontExplorer X/FontDatabase.db" "/Users/Shared/Linotype/FontExplorer X/$userfolder/"

# Set the ownership and permissions on the /Users/Shared/Linotype/ directory
chown -R $username:$username /Users/Shared/Linotype/
chmod -R 700 /Users/Shared/Linotype/

# Copy correct user preferences (users can't break them)
# Don't need to do this step, but helpful in making sure correct prefs are always set
cp $backupprefs "$userhome/Library/Preferences/com.linotype.FontExplorerX.plist"
chown $username:$username "$userhome/Library/Preferences/com.linotype.FontExplorerX.plist"
chmod 700 "$userhome/Library/Preferences/com.linotype.FontExplorerX.plist"

Logout

#!/bin/sh

# Get username of current user
username=`cat /Users/.username`


### Start of Script ###
# get the user id of current user
userid=`su - $username -c "/usr/bin/id -u"`

# set a variable for the FontExplorer folder in the format of _
userfolder=${username}_${userid}

# get the path to the networked home directory of user
userhome=`su - $username -c "/usr/bin/id -P | cut -f9 -d:"`

# Remove the sym link version of FontDatabase.db in user's home
rm "$userhome/Library/Application Support/Linotype/FontExplorer X/FontDatabase.db"

# Copy version of FontDatabase.db from /Users/Shared/ back to user's home
cp "/Users/Shared/Linotype/FontExplorer X/$userfolder/FontDatabase.db" "$userhome/Library/Application Support/Linotype/FontExplorer X/FontDatabase.db"
# Make sure ownership is correct
chown -R $username:$username "$userhome/Library/Application Support/Linotype/"

# Remove all of the user's Linotype directories from the /Users/Shared/ directory
rm -R /Users/Shared/Linotype

Cheers.

I actually started this project about a year ago. We had a whole bunch of documentation for the labs written, but mostly in pdf and Quark documents. My goal was to get everything online for students to have easy access. So, without much of a plan, I created a very barebones site and started adding stuff to it.

Another member of our department also creates a monthly newsletter which she then emails out to all faculty and students. It usually comes in the form of an attached pdf. I figures that I should add that to the site as well.

So, at the beginning of last summer I basically had an overgrown list of links with a very bare bones design. My goal was to create a more cohesive site, with a much more appealing design. We do offer a major in graphic design after all.

My thoughts design-wise were that I’ve really been digging the plain old black and white designs that I’ve been seeing around. I also like the grid. Given the nature of the page, I thought it was a good place to also finally figure out how to use sIFR.

I had a hard time figuring out what my secondary color would be. I’m always drawn to green and blue, but it somehow didn’t quite feel right. I wanted to use red, but that can seems a little too harsh or sterile sometimes. Then it came to me: magenta. It’s perfect for the site.

So here is what I ended up with:

Home Page

Archives page for The Comunicator

How to make clipping path (example documentation page)

You can see the whole site here.

There is a new theft detection software called Undercover which actually looks very nice. Basically you install it on your system and forget about. It does it’s own thing in the background and won’t bother you. If your laptop ever gets stolen, you file a report with Undercover online to declare that it has been stolen. The next time a user goes online using your laptop, Undercover will track the network information, take screenshots and even use the built-in iSight to take pictures of the thief.

If your Mac has a built-in or external iSight, Undercover will transmit pictures of the thief and his surroundings every 6 minutes, making it even easier to identify the current user. It’s like having a private detective working for you.

Undercover will then work with law enforcement agencies and ISPs to recover the laptop.

If the first method is unsuccessful, Undercover will basically render the laptop unusable, with a full-screen message reporting that the laptop has been stolen.

One of the first things that I wondered about was how a theif would log into your account (provided you’ve actaully enabled a firmware password and turned off auto-login). Their answer to this was actually quite surprising:

What if the thief can’t login into an account? Will Undercover still phone home?
Even when no one is logged in, Undercover will still phone home because it’s a root process that’s always active. However, we do recommend to create a dummy account that will enable the thief to play around on your Mac. This account should have a blank password and no admin privileges.

I’d really like to try this software out. It sounds really cool and I’m curious to know how well it actually works. Unfortunately…I think you’d actually have to get your laptop stolen to find that out.

• Photoshop for iPhone

I particularly like the URL in the video: adobe.com/itsnotreal

Via Daring Fireball.

I am happy to announce that Office 2008 for Mac will use the Apple-recommended Apple Installer technology for Office 2008 installation. This means that the data that Office installs will ship on the disc in .pkg format, installs will work well with Apple Remote Desktop (ARD) and will be Applescript-able. Once installed, the user has the freedom to move the Office folder to a different location on the system and Office will run from there. I hope that this will make Office for Mac configuration/deployment easier for IT admins.

You can read more about installers and Apple’s recommendations for them on Apple Developer Connection . Being able to easily deploy Office through ARD is great news for IT people.

My favorite piece of news though is about fonts (emphasis added):

In addition to the change to the Apple Installer, we’ve provided IT admins greater ability to customize their deployment with optional font installations.

The current practice for Office on Macs is to automatically copy a gazillion Microsoft True Type fonts into a user’s font directory the first time they open an Office application. This behavior is truly obnoxious, especially if you already have a ton of fonts that you are trying to manage. It’s also wrong. If those fonts are actually needed for everybody for that application, they should really be put into /Library/Fonts/ at the time of the installation.

I don’t have a lot of good things to say about Microsoft these days, but I am at least happy that their Mac team is taking steps to create a better “Mac Application.”

Via Daring Fireball.

• Apple doesn’t get the Web

Agreed. 408K of JavaScript? Come on people. How am I supposed to load that into my iPhone¹ on the EDGE network?

1. This would be nearly impossible anyway since I don’t actually have an iPhone.↩

• Another Quicksilver Tutorial: Gold Trigger

By using Proxy Objects in Quicksilver, you can gain access to the Current Web Page object. After making sure that you have activated the Open URL With... action in the Quicksilver preferences you are free to specify Firefox (or another browser).

Current Web Page → Open URL With... → Firefox

Once you have this working, you can set it up as a custom trigger. I set mine to the F1 key. Even better, this trigger is much more extendable than the script. You might not necessarily always want to open a URL in Firefox. Say you want to open a page in Opera. Just create another trigger, but leave out the item in the third pane.

Current Web Page → Open URL With... → "Leave this blank"

Now when you use that trigger, activate it with a hotkey (I used F2) and type in the first few letters of the browser (or program) you want the URL to open in.

1. Open Firefox (one step with Quicksilver)
2. Activate Safari
3. Copy URL from desired website
4. Activate Firefox
5. Paste URL into Firefox.

I could probably consolidate these steps a little bit (by dragging and dropping the URL perhaps), but the point remains, this is an annoying process to go through every time I want to quickly check something out in Firefox.

Last week I put together a nifty little script in Automator to streamline this process. Basically, the script copies the URL from the active tab in Safari, opens Firefox and loads the page. I saved the script as an application and with Quicksilver it’s now just one step to activate the script.

• Open in Firefox Script (ZIP)

For the most part, the script was pretty easy to set up. There is a built-in action to Get Current Webpage from Safari. There aren’t any scriptable actions for Firefox from Automator, but opening it is simple enough using a terminal command:

open -a Firefox.app

The only slightly tricky part about the script was getting the copied URL to automatically load when Firefox opens. After a little research I found that this could be simply passed as a parameter to the open command:

open -a Firefox.app $@

Perhaps some other Safari-lovers will find this useful. Enjoy.