Taking My Own Medicine

I've long extolled the virtues of network-based home accounts, at least in some situations. And, of course, I've written copiously on how to implement such a thing in a lab setting. What I've never really done in any meaningful way, or for any length of time, is to use network home accounts myself. Until now. There are certainly situations in which local home accounts are preferable. Generally speaking, they tend to be the way to go if you can swing it. They're usually a bit more responsive, and of course they don't rely on a functioning network, proper network settings, authentication servers and home account servers to work. They are the de facto, the default, and they're what most people are used to. And if your users ever only use their one computer, local home accounts are likely to be all you'll ever need.

But in environments that involve numerous shared (network) resources, or in which people are moving from computer to computer on a regular basis and need some semblance of consistency among machines, a centrally-located, accessible-from-everywhere home account can be a real blessing. In order to sell this system at my new job (on the Mac side — Linux was already using network homes), I needed to prove its reliability, so I threw myself on the grenade, as it were: I started using a networked home account. And you know what? I really like it.

There are, as alluded, certain inconveniences with such a scheme. For one, login tends to be a bit slower as the system needs additional time to locate and coordinate with the necessary network resources. Also, there is no Trash folder for a network home, and deleting files is immediate on a Mac when done over the network. So every time I try to throw something away I get this alert:

And the file is deleted for good. This is probably the worst part of the networked home. No Trash. But the advantages are so great that I plan to stick with my networked home, despite the minor annoyances.

At some point not too long ago I decided that the reliability test had been a success, and that I could finally revert back to my local home account. So I synced everything back to the local drive, and changed my home account location on the server (I use server-based authentication either way), and logged in. I worked locally for a while, and then I needed to do something on a Linux machine. I logged into that machine — which uses networked home accounts — and got my old, outdated, network home. And that's when I realized: you can't have it both ways. You either need to go local-only, in which case you need to really only use one machine, or you need to go networked. Otherwise your data's all out of sync. And that's way worse than any network dependencies or minor performance hits. So I immediately switched back to my networked home. And I plan to stay there.

And speaking of having it both ways, I suppose it is possible. At my old job I had a local account on my office computer and a networked account everywhere else. This was okay, but created all sorts of problems — particularly permissions problems — any time I wanted to share data with, uh, myself. Long story short, it was a real pain in the ass. Doable, but kinda sucky. Avoid if possible.

I have to say, since committing to my network home account, I've been pretty darned happy with it. Most times I'm completely unaware that I'm even on the network. And it's great to have the same environment across every machine in the lab. It's also great to finally be able to say definitively that this approach is not only valid, but actually pretty great in instances in which it's appropriate.

Go me!

Too Many Computers

That title's not meant as a complaint. It's just that I've noticed that over the years I've tended to use fewer and fewer system add-ons and customizations than I once did. And I realize that it's because I use so many different computers. There used to be a time when I would customize the hell out of my Mac. After installing all my apps I'd get to setting up my user account, tricking out all my apps so that they behaved just like I liked, and installing and configuring any number of productivity utilities to make my life easier. It took forever, and it was a huge pain, but once it was done I could navigate my computer quickly and effortlessly.

Those days are pretty much over at this point. I no longer do much to change the default configuration of my home account in any meaningful way. I barely customize the Dock. I may change the Desktop background. On my primary computers I can't live without a pasteboard history, so on those machines I'll install the excellent(!) PTHPasteboard. And there are certain Terminal settings I really enjoy. But that's about it. I don't even install my beloved Butler anymore.

There are certain things that have contributed to this. For one, Leopard's Spotlight is a great application launcher, largely mitigating the need for Butler. (Yes, there are other things that Butler does that I miss, but I can live without most of them — but application launching is a deal-breaker.) Spaces helps a lot with window management, so I don't need the sort of hot corner stuff I used to do. And the newer Mac keyboards have iTunes control built in.

But the main reason for this change (or lack thereof) is the plain fact that I'm simply touching too many computers in the course of the day to ever really consistently customize them. And if it's not consistent, it's not going to be very efficient, because every time you go to a different computer your system breaks. I was getting to the point where I'd go to one of the many computers I have to access on a regular basis — a staff member's machine, or some workstation somewhere — and I'd start frantically hitting the keys for some custom key-command I'd set at home, getting frustrated when nothing happened. At some point I realized that this inconsistency was actually hurting my productivity. So I made the conscious decision to learn a new way.

Over the past year or so I've gotten used to working with the system in as out-of-the-box a configuration as possible. Which ain't half bad, I have to say. Apple has really done a fine job of making the initial user experience good for both new and experienced users alike. It's quite remarkable. And I love not having to set much up beyond installing my apps. It's akin to how I felt when I gave up my car to move to Manhattan. You think you'll miss it, but you end up realizing what a burden it actually was. It's kind of great to have everything I need on any newly installed Mac. And now that I don't rely on that other stuff, I don't miss it at all.

I know as "power users" we like to add to and configure our machines out the wazoo, and I've certainly been no exception. But as a SysAdmin, I have to say, the less of this I do, the better my user experience has been. Surprising, yes. But totally true.

Abandonment Issues

Because of the recent departure of Apple's Senior VP of Enterprise Sales, John C. Welch claims that "the Mac IT crowd" is wondering if Apple is abandoning the Enterprise. He then goes on to say that this depends on whether or not you thought "Apple was, or wanted to be, an 'enterprise' company." Um... No it doesn't...

Mr. Welch raises some good points in his article, the main premise of which is that Apple is, indeed, not an enterprise company, an idea I fully agree with. But the fact is that it's certainly possible to worry that Apple will abandon the enterprise without thinking of them as an enterprise company. And that's because Apple makes enterprise products that some of us have come to rely on.

I don't think many IT folk — Mac or otherwise — think of Apple as an enterprise company. In fact, I'd venture to say that we worry that Apple will abandon us because we know know full well that Apple is not such a company at heart, and that their connections to enterprise are tenuous at best. But some of us do actually appreciate the design and ease-of-use of their server products. In my case, I've come to rely fairly heavily on Mac OS X Server for cross-platform authentication, among other things. I get flack for this sometimes, but the plain fact is that no one has integrated authentication for Mac, Windows and Linux in one spot in such an easy-to-build package as Mac OS X Server. Could I do this with a Windows server? Sure. Could I do it on Linux? Yes, of course I could. But I'll spend twice as long building it, and twice as much time maintaining it, when Mac OS X Server does it out of the box with ease and grace. I suppose I could punch myself in the face over and over again as well. Do I want to? Not particularly.

I often worry that Apple will someday leave the server market altogether. I sometimes even worry that Apple will stop building high-end workstations. Hell, who knows? Maybe Apple will stop selling computers one day. But I don't worry about these things because I think Apple is one kind of company or another. I worry about them because these are products that I enjoy using on a daily basis, and I would like to keep using them for as long as they're the best tool for the job.

Just Open It

One of the new security measures in Leopard is a confirmation dialog that pops up anytime you attempt to open a file or executable bundle that was downloaded from the internet. You may have seen this dialog after downloading and launching a new application, for instance. It looks something like this:

Some have hailed this as a breakthrough in security standards, I'm sure, though I can't find any specific sources to cite. Most folks who notice such things are actually rather annoyed by the alerts, likening them to similar attempts at security in versions of Windows. Indeed, it's difficult to make the argument that such a warning would be very effective at preventing user-initiated security breaches. In reality it's just the sort of warning that most people click through because 99% of the time it's unwarranted. This has most SysAdmins and advanced users asking, "Why bother?" After which they promptly ask themselves, "How do I turn this shit off?"

The bad news is that there doesn't seem to be a GUI way. There is no simple System Preferences checkbox for the alert. The good news is that there appears to be at least a couple possibilities for getting this done.

The first approach involves watching whatever folder you use for downloads, either via a Folder Action or via a Launch Daemon. The basic gist is that anytime that folder gets modified a script runs that removes the flag that causes the warning to appear from all items in the downloads folder. Because, you see, that's all that's going on. Anytime something is downloaded to your computer, Leopard flags it. When you open it in the Finder, the flag triggers the alert. Confirmation of the alert removes the flag. That's the mechanism. Using the watch folder method simply disables the flag, which is akin to hitting that "Open" button in the alert, only it happens automatically in the background.

There are a couple problems with this method. First off, it's difficult to implement, and second, it breaks anytime you decide to start using a different folder for downloads. And then there's the obvious fact that it's just plain ugly: a script workaround to disable an OS feature? Bluglgh! Terrible!

A better solution would be some sort of preference file. Apple often enables — but hides from the GUI — certain advanced preferences, allowing more savvy users to set the preference either by the addition of a preference (.plist) file, or by using the defaults command. There are all sorts of mods for the Dock, for instance, that, while unavailable through the GUI can be set via defaults. It appears that Apple has provided such an invisible preference for the Leopard download alert as well. And if you know how to create and edit a .plist file, activating the preference and disabling the alerts is fairly straightforward.

Some Background The instructions I'm about to provide have been posted in numerous other spots on the Web. But when I went searching for this info there seemed to be no single place that explained not just how to perform the modification, but also what it did and how the mechanism we're defeating works in the first place. So I wanted to provide some background info about just exactly what's going on here.

Metadata The first piece of this puzzle is the basic concept of metadata. Metadata is often best described simply as "data about data." And in Leopard we (or, more particularly, developers) finally have the ability to add arbitrary metadata. That is, as a developer, you can add any sort of descriptive data you want to your files and the files your application creates. Mac OS X 10.5 and up can read that metadata, interpret it and behave accordingly. So, to follow our example, when we download Camino from the Internet, the Mac OS (specifically, the Finder) adds some metadata to our Camino application, and that metada says, "This application was downloaded from the internet and has not been flagged for approval." Now, when we go to open the application for the first time, the Mac OS also knows to behave a certain way based on this metadata, and so we see that alert pop up. Clicking the "Open" button writes new metadata to the file, and that metadata now says, "This application has been opened and flagged for approval." The OS now knows not to present the alert the next time the app is opened. Such is the power of metadata.

By the way, I should mention that you can actually tell which files have metadata associated with them by doing a long file listing:

DrMac:~systemsboy$ ls -l Movies
drwxr-xr-x   9 systemsboy  staff        264 Nov 14 09:35 .
drwxr-xr-x  10 systemsboy  staff        296 Nov  7 17:20 ..
-rw-r--r--@  1 systemsboy  staff  407041761 Oct 31 15:45 DownloadedMovie.mov
-rw-r--r--   1 systemsboy  staff  407041761 Oct 31 15:45 LocalMovie.mov

Notice the "@" symbol at the end of the permissions info for the DownloadedMovie.mov file? That means that this file has metadata associated with it.

You can look at any metadata your files contain by way of the xattr command. The command is simple to use:

DrMac:~systemsboy$ xattr -l Movies/DownloadedMovie.mov
Movies/DownloadedMovie.mov: com.apple.quarantine: 0000;48fa188d;Firefox.app;|org.mozilla.firefox

Here we can see that our DownloadedMovie.mov has an Apple-branded quarantine flag, and that it was downloaded with Firefox. Nice!

UTIs The next piece of the puzzle comes in the form of something called Universal Type Identifiers, or UTIs. UTIs are a specific kind of metadata that are meant to describe and define types of files. So, our Camino application has metadata not only that tells the OS that it came from the Big Bad Internet (BBI), but also what sort of file (or in this case bundle) it is, namely that it's an application. This particular piece of metadata is the UTI, and there are a bunch of them. The complete list can be found on Apple's Developer site. UTIs can be extremely useful, and they'll actually allow us some flexibility in defeating Apple's quarantine mechanism. Because with UTIs we can specify which sorts of files trigger the alert and which don't, which is pretty great if you need it. And even if you don't, it's something that might come in handy down the line.

The Defeat So, with that out of the way, let's step through our method for disabling the Mac OS alert for downloaded files.

1. The first thing we'll need is a file in our Preferences folder called "com.apple.DownloadAssessment.plist." If you have one, great, if not make one, either with Property List Editor, TextEdit or whatever text editor you have handy.
2. Next, populate the file with this data:

    <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
      "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
   <plist version="1.0">
     <dict>
       <key>LSRiskCategoryNeutral</key>
       <dict>
         <key>LSRiskCategoryContentTypes</key>
         <array>
           <string>public.item</string>
         </array>
       </dict>
     </dict>
   </plist>

3. Finally, restart the Finder.

From here on out, the OS will flag any item downloaded from the BBI (the UTI "public.item") as "Neutral." This should completely eliminate any sort of alert regarding downloads. Of course, there are exceptions — and I'll talk about them in a minute — but this should mostly do the trick.

Using UTIs and the Risk Categories outlined here, you can vary and specify the OS behavior for a wide range of file types. Want downloaded applications to raise the alert, but HTML files to be considered safe? Not a problem. Just specify as much in the plist file. It might look something like this:

 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
   "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>LSRiskCategoryUnsafeExecutable</key>
    <dict>
      <key>LSRiskCategoryContentTypes</key>
      <array>
        <string>public.executable</string>
      </array>
    </dict>
  </dict>
  <dict>
    <key>LSRiskCategory</key>
    <dict>
      <key>LSRiskCategoryContentTypes</key>
      <array>
        <string>public.html</string>
      </array>
    </dict>
  </dict>
</plist>

Now, applications we've downloaded from the Internet (UTI "public.executable") will be treated as "Unsafe Executables" and will prompt the quarantine alert. But downloaded HTML files (UTI "public.html") will be treated as "Safe" and be exempt from the alert. As you can probably gather, you could get really, really fine-grained here if you needed to. Most folks will be covered with the first example, but as a SysAdmin it's always good to know you have options.

Exceptions Now earlier I mentioned exceptions. And one of those exceptions is Camino itself. Remember earlier when I specified that developers could add metadata to files? It's important to understand that it's not always the Finder or even the Mac OS itself that's creating this metadata. Applications themselves can also write metadata to files, and that's exactly what Camino does. Anytime you download a file with Camino it adds it's own metadata to the download. And that metadata will trigger the Mac OS's quarantine alert. So the above hack fails for applications such as these, and there's not much to be done about it. The rationale for Camino's approach is at least partially detailed in bug report 464333 on Camino's developer site.

UPDATE: The folks at Camino are now re-examining the issue.

Further Reading Credit where due, I collected all my info on this topic from the following sources: The Folder Action Hack Arbitrarily Extensible Metadata Uniform Type Identifiers (UTIs) Download Security Assessments Creating and/or Modifying the Preference File

And inspiration and help for this post came from an excellent bunch of comments in another article right here on this very site.

In Conclusion I have to admit, I find what Apple is doing here fascinating. I'm not sure that popup alerts for every downloaded file is a great idea in practice, but I do think it's an interesting example of what's possible with metadata and highlights just how useful this addition to the OS could be if leveraged properly. Imagine if metadata were something in the hands of everyday users. Imagine if you could assign your own set of actions based on your own set of metadata tags. It could fundamentally change the way you interact with your computer, essentially allowing you to program it at will to your whims. And maybe someday it will, if Apple sees the potential here and continues to push forward with this Great Metadata Experiment in fresh and innovative ways.

APM Partition Boots Intel Macs

I'd thought that if you wanted to boot Intel Macs you needed to use the recently available GUID partition table, mainly because that's what it says in Disk Utility when you format the drive. In fact, as it turns out (at least as of Mac OS X 10.5.5), using the Apple Partition Map (APM) boots Intel Macs perfectly well. It's exceedingly useful to have a partition format that will boot both architectures, particularly at the museum, where Intel and PPC Macs still very much coexist.

In fact, my Mac is a G5, but all the new hardware is, of course, Intel-based. And I'm trying to create a master build image for setting up new machines. Generally the way I do this is by making a test build on a firewire partition. I can boot into this build and tweak it until it's perfect. And when it is, I image it to an ASR disk image for NetBooting. I was worried that architecture limitations would make this painful — that booting into my test build partition would be impossible on my PPC Mac because of these restrictions. Glad to know I can just use the old reliable APM for everything and it'll do what I need.

Not sure when or how they worked this out, or why the language in Disk Utility has gone unchanged. That fact does give me pause. But so far booting Intel Macs from APM partitions has worked perfectly for me on multiple machines.

UPDATE:

More info at Apple's Secrets of the GPT Tech Note, via Jeff in the comments.