Around a week ago the following at the Internet Storm Center popped up in my feeds...
Multiple vulnerabilities have been reported in Apple Mac OS X and applications. Proof of Concept code has already been posted along with the information regarding the vulnerabilities. At this time no patches or workarounds appear to be available for the majority of the vulnerabilities. The impact is Denial of Service or arbitrary code executed remotely, and severity is highly critical.
I set a reminder to write some notes about it if it hadn't really permeated the "Mac Web" after a week -- or whatever the hell pandering placebo passes for the majority of it at this point (it's probably food for thought that the majority people reading will be seeing them first the first time on some site named DrunkenBlog sporadically updated by some guy named drunkenbatman... and no offense to myself, but that's probably as big a canary as the following issues) -- so it's worth running through these while the coffee brews as, ya know, they're kinda important...
posted on May 01, 2006 at 09:05 AMI was really surprised to see the following bit of Javascript show up in the comments of a previous post, and waited awhile to see if it'd get picked up by anyone, but it didn't, so here we are. While I knew Apple knew about it internally for quite awhile, I hadn't yet seen it floating about in the wild -- and I wasn't at liberty to say anything as sometimes part of getting to know something is not being able to talk about it without making the life of the person who passed it on very difficult.
Chances are if you're loading this page in Safari (tested on multiple variants of 10.4 up to 10.4.5, on PPC and Intel boxen) you aren't reading this unless it's been fixed in a security update, as the image below crashes anything webkit-based in a very hardcore way. Actually, it crashes anything using ImageIO in a hardcore way, which includes the Finder and Preview.app and apps based on Webkit and WebCore...
You might be surprised how many random instant messages I get that lead with "You bastard," such as...
Note to Self: The global spellcheck built into Mac OS X can be contrarian, but with my propensity for typos there's enough irony in my not being able to trust it that the pain is eased to a dull ache.
Note to Readers: The first person to say theirs works fine, and to then suggest that perhaps ShapeShifter is affecting the spellchecker gets their IP address thrown in the firewall as -drop, as it's that kinda morning.
On December 9th I saw a document which intimated that Apple and the last defendant in the original "Tiger Torrent" lawsuit were close to reaching a settlement, which would be filed on December 13th. I sat on this so as not to cause any problems while it went through, however everything went through yesterday. With a little knowledge of the system and some cash you could view the court papers, but since they're public documents I'm posting them here:
There can be an out-of-sight-out-of-mind quality to a story like this, and if you're wondering what the deal is, an earlier entry lays most of it out, and links to the rest of the earlier posts and my earlier contact with David. With this settlement, it's my understanding that the Tiger Torrent lawsuits are now over, as there have been no other filings against any John Does...
Ten minutes after backing up and installing 10.4.3, I accidently hit the corner for Exposé, and when I dropped out of it there was a nice obvious graphical error. I was able to repeat the error several times. It stopped once I brought a different app to the foreground. Fun...
Earlier today I was dealing with the crucible that is my inbox, and Exposé and I came to ahead again, which we often do, especially when it involves terminal windows. The thing is, I like Exposé, but ergh...
While I think they could have done better than F9, F10 and F11, and I've actually seen users hit a corner and have no clue what just happened to their windows, I also think it's a worthy innovation -- especially for a single-document-interface paradigm like OS X uses. It often helps me get things done faster, but there is one horrifyingly critical usability flaw: It uses a scrubbing interface.
Years ago I watched an old rerun of a television show, where the teenage son runs into the Dad's home office saying, "OMG Dad! If I turn off the TV, and turn it back on, the show has kept going!", to which the father responded "Gilligan's Island is being broadcast to millions, whether you're watching or not. Are you just not realizing the world doesn't revolve around you..?" Ayep, this is going to be rudimentary, but I need something to link to help keep the inbox below 100...
I took an email break a few hours ago, and in order to have a usable Dock.app and to free up some screen real estate, did an Apple+H to hide my email client. If you check out the image from the last post and compare it to the one above, you'll see what happened. Nothing would get rid of it short of un-hiding and re-hiding the original app...
Canaries have been on my mind over the last day or so. Well, that and why Steve Job's Gulf Stream spent an afternoon in Lake Tahoe on Sept. 19th, but it's Apple Bug Friday, and we're back to the Finder...
So, I missed the last Apple Bug Friday, or maybe I missed the last two, as it's all kind of blurring together at the moment, but I'm reasonably sure I missed the last one. This was kind of disappointing, as earlier in the week I'd done some thinking about the lamest bugs in Mac OS 10.4 Tiger.
For something to be considered The Lamest Tiger Bug™, it isn't enough for it to just be an obvious bug. It has to be a bug that so downright sickly sad that, like a dead canary in a coal mine, its state of being tells us something, somewhere, has gone horribly awry. This won't be exhaustive, but rather just what comes to mind...
There are days when it doesn't pay to check my inbox before I fall asleep, as while I was nestling into the pillow I kept randomly laughing at the ramifications of the below. My brain wasn't going to drop it until I'd dragged myself to the computer and forwarded it onto a few like souls who'd also appreciate it, and leave myself a note to write a post...
Anyway, I recently filed a bug [radar - #4273090] with Apple about how Preview breaks its bookmarks to files when their file path changes because it doesn't refer to the file via its file system node, and they replied. Quelle surprise! Unfortunately, the reply was less than encouraging.To quote:
"NAME REMOVED: Engineering has determined this issue behaves as intended based on the following information:
"If you move the file, how would Preview know where you’d moved it? This kind of thing only works with applications because of the launch services mechanism and the Finder. Since Preview isn’t running all the time, it can’t receive notifications of when every file on your disk is moved, and you probably wouldn’t want Preview being launched every time you move or rename a file."
Oh my fucking god.
Will R.
That rhythmic thumping you're hearing is the sound of a thousand developers across the world beating their heads on their keyboards. Since everyone hates being excluded from a joke, and you may not be a developer, we'll quickly go through why the title of this post is OMFG...
Somehow, it technically got to be Friday a little bit ago, which means it's Apple Bug Friday again. My brain is trying to reject this, because yesterday seemed like Monday night, but here we are and there they are. Once again, we'll be revisiting our old friend: The Mac OS X Finder.
More specifically, how it integrates Spotlight. It's rare that someone is able to introduce a technology meant to be better than what came before, but due to f'ing up the implementation it ends up being worse in just about every way. It happens, but generally not if the right people are paying attention and there's a competent testing and feedback loop involved, yet here we are with Spotlight.
The ∞ symbol is in the title because aside from some of the core tech and exposing it to developers (Well, developers already had SearchKit), there's just so little they've gotten right, and today we'll note a few of those...
A few minutes ago, I ran Software Update just to check and be sure that it was wanting me to restart. I was flying close to the Sun again yesterday, which means yesterday is hazy -- I have iTunes sitting on my Desktop, but can't recall if I'd tried Software Update which people said wasn't asking you to restart.
I got the above, where it's just sorta sitting there. It says it ran, yet the progress bar is still spinning... and actually it's saying "Last Check" which could mean it ran successfully, or it ran successfully last time. Checking top, the process is just sitting there doing nothing...
I could run a sample and try to see if that gives any clue, but this comes on the tail of seeing Software Update actually lock up the entire System in 10.4., and at some point it sucks to pay for something -- only to have to allocate time as a beta tester -- so I'm disinclined.
Somehow it got to be Friday again, which means it's Report an Apple Bug Friday again. Since last week's was a bit of a doozy, we'll downshift and pull out something generic and arbitrary (Because it's not lacking for material) from an app we all use, the Finder.
One of the things that's fascinated me when it comes to Mac OS X has been the Finder's ability to screw up the most mundane of things, over and over, almost as though it's in its nature. I'm not talking about say, completely locking up your Mac when a server disconnects, but rather something as simple as remembering what size a window should be, or what you see in the following screenshot...
As you're probably aware, earlier today Apple released Safari Update 2.0.1. A few notes...
It's Friday, which means it's report Report-an-Apple-Bug Friday. Dan Wood started this a few weeks ago, and it seems to be catching some traction around the web. This is a very cool idea, and it'll let me throw out something I'll be referring back to over some upcoming posts.
Now, before you click and view the following image, if you happen to be using Apple's Safari or possibly OmniWeb, you may want to commit www.drunkenblog.com to memory, as there's a very high likelihood your browser is about to crash...
Apple posted Security Update 2005-007 v1.1 early this morning...
Security Update 2005-007 v1.1 replaces Security Update 2005-007 v1.0 for Tiger systems Mac OS X v10.4.2. Users who have already installed v1.0 on Tiger systems should install v1.1.Security Update 2005-007 v1.1 provides a combined 32- and 64-bit version of LibSystem to replace the 32-bit version that was delivered in v1.0. No other changes have been made in version 1.1.
Well, that explains it. They just forgot the 64-bit version in the last one... Yeah, I'm sticking to everything I said yesterday, and then some.
A few hours ago, AppleInsider posted that Apple's newly released Security Update 2005-007 had major problems when it came to 64-bit apps, namely that it completely broke them:
Wolfram Research, makers of the popular Mathematica software, began informing its customers of the issue in an email on Tuesday. The company said the security update disables its flagship Mathematica software: "Due to an error on the part of Apple, this update prevents any 64-bit-native application from running. In particular, this means that Mathematica 5.2 will not run on any G5 system if it has installed this Security Update
MacInTouch apparently contacted Apple and confirmed the issue. The same email AppleInsider was working from ended up on the Mac Enterprise list in its entirety yesterday evening...
The last time I looked at any language-used stats, English was used on ~68% of all blogs, which I remember because I was freaked out at how much content people from Iceland and Sweden were throwing up.
So the whole American part probably isn't kosher, considering there are other countries that speak English also, but I'm willing to concede the joke on the rest of it, and asumme its their small way of telling people they are listening. [Via Laughing Squid, via Sandy.]
[Update:] Gruber pointed out he mentioned this before, and that I'd seen it before, which means I just shouldn't be let near anything today. FYI, it's straight from the New Oxford Americal Dictionary, which means they have an Easter Egg. *trundles back to his cave*
Rory has some reasoned thoughts on Spotlight's user interface...
In today's post I'm going to show you some UI from Tiger and I'm going to point out all the obvious flaws in its design. These are flaws that if I can spot, any one with some serious training in HCI should be able to see in the first few seconds of looking at it, and one does hope that Apple still employs such people (and that someone actually listens to them!).
It's not an exhaustive list, and I agree with all of them. Like most bad UI, it all seems immediately obvious once it's been pointed out to you. Rory is one of those Mac devs I'm trying to keep an eye on, because his approach to software reminds me so much of the others I like. I.E., quality is the cake, features are the icing, not the other way around. It doesn't hurt that he sent me a movie not long ago showing his efforts to shave pixels off his app, and the website looks pretty sweet in it... (QT 7 required)
In a previous post, I mentioned I had to finish the last chat on another platform, because of a bunch of wonky bugs I was having to deal with in Mac OS 10.4, many of them involving text. Some of you screamed for details, so we'll go through the evening which led me to sit down and write A Community of Quality.
At this point, it's not just that interview, or the ones I'm working on right now. If I didn't have access to a Linux or Windows machine right now, it would be difficult for me to do much for the site, let alone my other stuff.Today we'll follow the downward spiral that made me give up and finish it on another computer -- the whole deal -- warts and caveats and all. Now, I'm well aware my experience isn't everyone's experience, but I'm also well aware that what led to my issue is real, as the movies and such will show.
Hey Drunken Bat Dude,Is something going on with you? I was reading through your last post, and I recognize some of the behaviors you pointed out in myself, but the drunk I know would not have made me feel stupid while making his point. Just my opinion, take it for what it's worth.
Mark F.
I actually got two emails like this, and after a little sleep and some coffee, and now looking over that last post, there is probably some truth to them and I should take my lumps. I was certainly a little more acerbic in what I'm banging out than I often am. I meant everything I said, but given a second shot I'd probably word some of it quite differently, as if I'm making people feel stupid I'm letting people down, including myself. In deference, I proffer these excuses:
- I'm stretched more than a little thin lately.
- A few of the things I'm working on have me frustrated to a level I rarely reach, yet I have to sit on quite a bit of it, and it wouldn't surprise me if stuff eeks out around the edges.
Let's just say I've become somewhat obsessed with the current quality of Mac OS X, and Apple hardware in general, but for right now am keeping it to the quality of what is going out on discs. I've been devoting a lot of resources into digging into what's going on, enough that I'm already backed up on the chats again. Not full-on Deconstructing Maui X-Stream obsessed, but it's getting close.
I think most real users know, in our heart of hearts, that Mac OS X has been misfiring quite a bit lately, and that 10.4 was almost a total misfire in terms of actually using it. It doesn't mean we're going to switch, it doesn't mean we've given up, it just means we know something is wrong.
You can like the idea of XHTML/JavaScript/CSS apps and still know Dashboard was a complete misfire, even if your only clue is that they're bolting on major functionality in a .2 release. You can like the idea of building webkit into your apps while knowing the quality of what you are building your app around isn't at the level it should be.
Severe, extreme wonkiness like this doesn't happen by accident, whether it is going on at Apple or Microsoft or anywhere between.
You know, it's a little f'ing embarrassing to just post about how a very specific issue has been fixed involving the display of an OpenGL app, and then a few hours later open up iTunes and there it is again. Jinx.
It's the stupidest bug, and I am sure it is indicative of the major changes Apple made to aspects of the display layer in 10.4, and I know there probably aren't a lot of others throwing down with Chess.app on a regular basis.
I can always just play a game of Lux, but aside from the audio balance issue, it was the only problem that was finally fixed in 10.4.2 out of the numerous issues I'm having (Text editing in cocoa fields, Spotlight, banking in Safari, memory leaks in Dashboard, Mail.app, etc. -- all of which I'll go into), and being able to say so kept the bile down a little before I lay into the others, the text editing being the most egregious to me personally.
This stupid Chess.app thing is becoming a symbol of all the bugginess I'm having to deal with in 10.4; it's driving me batty. With the 10.3.9 massive webcore/webkit changes that were jammed on developers, and now Tiger, the Mac OS is developing a singular ability to just piss me off. I expect to have to fiddle with Linux, and I expect to have to watch Windows like a hawk, but I expect the Mac to just work sanely.
I have no clue as to why or when this bug presents itself; I'll admit I'd stopped playing Chess.app for a few weeks because I was so annoyed, but had been playing it for hours before posting that it was gone and knew Apple had been fiddling with the video drivers for 10.4.2.
No clue why launching iTunes, or switching to and from iTunes, would trigger some redraw errors, nor why after I switched to Gyazmail and back it went completely screwy (Picture 04), nor why after changing the Desktop picture and switching between apps I couldn't get it to show up again. No clue as to whether or not Apple has my bug reports, or if they think they've fixed the problem, because Apple doesn't work that way.
And no, not everyone is seeing the same bugs I am, because bugs don't work that way. I'm sure many had a lot of things fixed in 10.4.1 and 10.4.2, and I know others are seeing things I can't reproduce -- I'm sure some people can bank online now that couldn't in Mac OS 10.3 -- but I know they're there just the same. Something has got to give here, or Mac OS 10.5 is going to be a complete nightmare.
Awhile ago, there were rumors going around that the 10.4.2 was supposed to fix "all known bugs" in 10.4, which, depending on who you asked was:
- An 'intentional leak' by Apple marketing to hopefully stave off the reputation for bugginess that Mac OS X is starting to get, with the idea being that if people have the impression it'll all be fixed soon they may hold onto some bitching. We'll call this The Great Bug Fix Hope™ theory.
- Something that was really going around Apple; That yes, there were some problems with 10.4 and 10.4.1, but 10.4.2 was going to be their big push towards something really working, in the vein that Microsoft's Service Pack 2 was their big push towards security.
You may have noticed that I haven't really talked about 10.4 a lot on the site, or as an email put it, I've been "noticeably quiet." The truth is, I was just having a terrible amount of problems with it, but wanted to have my ducks in a row, and I kept thinking they'd be ironed out in a point release...
Things have come to a bit of a head, and we're going to be talking about bugs here shortly. Frequently, because quality control -- or at the level Apple considers acceptable -- is becoming unacceptable. It probably became unacceptable awhile ago, but allowances are made because, well, it's Apple (I do this too) and stuff will happen... And one isolated incident does not a pervasive pattern make. However, incident after incident in release after release does a pervasive pattern make.
However, before I go lifting up the plate in the sink to expose the roaches to sunlight, in the interest of fairness, today we'll mention two things 10.4.2 did fix for me. Obviously there are more things, and I'm being somewhat arbitrary, but luckily there are 365 days in a year and I'm saving a good week for Spotlight.
For the record, I've been running 10.4 with a stock install, and without my beloved ShapeShifter to remove the pinstripes, because with an OS this buggy I just didn't want it in as a factor.
The below is from a post on secondfoundation.org, which kinda wigged me out.
I’ve just spent about an hour and a half going through the archives on DrunkenBlog and making PDFs of the posts that interest me. Even though it’s just going to dilute my iTunes library, I’m filling it up with various articles and lengthy pages from the web that would otherwise just sit forgotten on my “Bookmarks” menu.
I was going through Rory's blog the other day, where he has 'Apple's UI department going insane?' up for reading. He has some good points to make on where and how brushed metal is used, some great points on the Finder, and wraps up his points on the upcoming 10.4 with:
Come on Apple, at this rate Windows users might actually be pointing and laughing at us for how bad our UI looks by the time Longhorn ships sometime this decade.
The thing to keep in mind about Rory is that he's the maker of the excellent NewsMac software for OS X, and not long ago quit his day job to write code his heart out for the platform full time. He's not just a user with a couple of quibbles, he's a developer with an investment in Mac OS X.
I've written blurbs about this here and there throughout my posts, but the bottom line is that there's a huge elephant in the room when it comes to Mac OS X: The UI is going to hell in a hand basket and everyone is just averting their eyes.
I mentioned some of the growing pains the other 'nixes are going through in terms of SMP support, and it's worth noting that Linux, the BSDs and Windows aren't alone in this. OS X is still just hitting its adolescence in terms of SMP and will hopefully be taking its own little step further into adulthood with 10.4. This might seem a little weird, as everyone has heard that OS X on a dually kicks much more ass over a single CPU.
I was reading through an Oreilly interview on the improved multiprocessing in FreeBSD, and and it sparked the memory of a conversation I had several days ago where I said: "I'm interested in Linux, but I love the BSDs".
The person was curious as to why I'd say that, and I actually had to think about it for a few seconds. I dig Linux in general, and use it. There are a whole bunch of places where I'd pick using Linux over a BSD. There just isn't quite that same... affectionate warm spot in my head.
Back in "The-High PPI Problem" I went into what resolution independance was, why it was important, and what was needed to get it that we don't have.
The biggest thing I went on about was accelerated drawing, namely that it didn't look we'd get it for 10.4, and so it didn't look like we'd be anywhere close to resolution independence for quite awhile. I've been meaning to revisit that...
Awhile ago I found some cocktail napkins left behind by a girl who just wasn't careful enough about her cleanup when she left for the restroom. For the most part, those napkins had all sorts of tidbits on them about iChat. I passed on a few of them to a very small group of people, and right now there's an Adium developer reading this link about iChat getting iTunes integration and probably pissing themselves wondering if the rest will be true.
I dunno, but a very telling sign will be if you'll be able to click on the song in someone's status and it'll take you directly to that track in the iTunes store. And no, no one is going to get that subject except the girl who was careless, and only because it was on the napkin next to hers. So many napkins, so little time.
Back in 'Deconstructing H.264/AVC' I spent a bunch of time going through MPEG-4 and leading into the upcoming H.264/AVC codec. I got a lot of feedback, questions mostly, as people seem to be under the impression that I may or may not read the comments. :)
I've also been greasing the wheels of whispers with alcoholic beverages, trying to garner more info about what we'll be seeing with Tiger; keep in mind this is pretty much taken from bits I've been able to gather from here and there and then tried to form a coherent picture from. It's amazing what you can infer from scribbling on napkins while someone is using the loo.
So take the following answers to your questions with a salt mine, but it should be reasonable.
So earlier today I ended up around a group of people, one of which I won't mention by name, but I will say I deserve a damn medal for not leaving an impression of the Apple logo on their forehead by using my Powerbook as a clue stick, nor just tearing into them verbally.
This person seemed to feel the need to educate those around him on how bad their Dell and other laptop screens were, and why his Powerbook screen was so much better and so much thinner while being so much better! A person rightly, since they had their x86 laptop right there, seemed to be kind of confused by this supposed quality disparity and kept pointing out how he either couldn't tell the difference or areas where his x86 laptop seemed to actually have a sharper, or higher contrast picture.
Ah, but then he laid down his trump card: that web pages on the x86 laptop was so small and thank the $Deity that Apple hadn't bought into the resolution game and knew it was better to ship screens with a low PPI, and that if he had been given the same x86 laptop he would have returned it because the web experience was so poor.
So, rather than test the resolution of his damnable forehead with my laptop, I bottled up my anger into that secret place inside which all men have and chased it with some drinks and the following post.
So my bday started out as a bit of a bummer. I'd cleared off a section of the day for grunt so I could jump back and forth between the WWDC keynote when something interesting popped up...
As it turns out, this was the only WWDC keynote in recent memory that wasn't streamed. At all. Bummer. I couldn't really understand the reasoning for this, as it's not as though they don't have the bandwidth and its not as though people needed another reason to think Apple might be changing their name to 'Apple Entertainment' in the near future.
