iPhone Video Recorder: Jailbreak-Only

When Apple announced the iPhone app store, video capture was one of the first apps I expected to see. Instead, here we are, a half-a-year later, and no such luck. Too bad, too. This is the one application I’d actually pay for.

Well, this and Bowling, of course.

Local-to-Local Copy: Just What You'd Expect

This makes plenty of sense. The Finder (actually, the filesystem on which the Finder resides, in this case HFS+) is not case-sensitive by default, so it sees the file “intro.mpg” as being identical to “Intro.mpg” and therefore simply alerts the user of the presence of a like-named file and asks him how to proceed.

But the other day I got the strangest alert I’ve seen in a while when trying to copy a file named “Intro.mpg” from my networked home account to a local folder with a file called “intro.mpg”:

From Network Drive to Local Drive: Case Issues!

Seems that, all of a sudden, we have some case issues. Now why would that be?

It appears that if the originating file comes from my network home, and if that network home lives on an NFS mount, and if the filesystem that hosts that network home is case-sensitive — all of which in this case is true — the Finder kinda freaks out. Or at least alerts the user in a very strange way. I mean, what’s with that wording? I don’t think I’ve ever read a more convoluted sentence in my life. And the options spelled out in that sentence — “skip” or “continue” — are not reflected in the language used by the buttons — “Stop” or “Skip.” Tsk, tsk! And “some of these items?” Dude, it was only one item. I swear.

Actually, this last one I think I understand: Though I was only copying one Finder item, as users of non-HFS filesystems might be aware, copying between HFS and non-HFS filesystems will cause the creation of dot-underscore files, which are there to preserve HFS-specific data about the file in question. These files automatically get created and follow the file around invisibly, transparently to the user. I believe the Finder was taking these additional files into consideration in the alert. This may or may not be true. I can really only guess. But that’s my hunch.

Nevertheless, this alert is abominable, if somewhat amusing. Apple still has some work to do when it comes to the wording in their alerts.

And they clearly have some work to do when it comes to dealing with conflicts on non-HFS volumes as well.

UPDATE:
I’ve changed this post slightly for clarity.

“For me, the best part of buying my original iPhone was the activation process.”

And you know what? I totally frickin’ — yes, I said frickin’ — agree. One of the most ingenious achievements of the iPhone was pain-free activation. Apple removed that feature in a trade-off that enabled them to lower the base price of the iPhone 3G, and frankly it’s the one thing that’s prevented — yes, I said prevented — me from buying an iPhone for my girlfriend.

AT&T: Online iPhone Purchase

Well, it now appears that at least some semblance of easy activation is again being offered, though this time it’s by AT&T and it happens online. Not as cool as the original deal, but at least I won’t have to get up off my ass, get down to an Apple Store, and possibly stand in line in the hopes that they have what I want in stock. Nope, this can all be done from the comfortable comfort of my comfiest chair.

I’ll take it!

UPDATE:
The other crap thing about the new 3G iPhones? The price — yes, I said the price. Sure, the phones are cheaper, but in the end the monthly is $20 bucks more, and my lady’s on a budget. So I ended up getting her the Google Phone. So far, I think she likes it, though she’s actually having to look at the manual: and I quote, “Totally useless.” Hmmm…

There are some things I really like about the gPhone, though. The Google integration is pretty cool, for one — all your Gmail, Google Contacts and the like are instantly synced. Nice! It looks like it will make an excellent alternative to the iPhone.

Calaboration Utility to Configure iCal-Google Sync

Along with offical support, Google is now supplying a configuration utility, which simplifies the setup of iCal, thus addressing my major beef with the service.

Great news.

In my old job, there were basically two and-a-half SysAdmins running the whole show. And since I was the front man, most requests got funneled through me. So I was pretty much dealing with everything.

In my new job, on the other hand, I am one member of a much larger team that deals with a whole wide range of technologies — from SANs to fibre connections to video playback devices. In some respects my job description is fairly generalized. All the SysAdmins on the team essentially share the same set of responsibilities, but as usually happens, each of us has our unique talents and proclivities, and since our team is comprised of a bunch of people, we each have a chance to specialize to some extent as well. We each get to focus more on stuff we’re good at — which is to say, stuff we like — and worry less about stuff we don’t like.

Case in point: last week we got a new printer. Not only did I have nothing to do with spec-ing, purchasing or installing the printer, I wasn’t even aware of the fact that we’d gotten one until the part of the crew that installs printers had installed the damn thing.

Printer Prefs

People in my old job all knew how much I hate printers. I truly despise them. I despise the hardware — it’s large, cumbersome, ugly and resource intensive. I despise the software — the drivers are always a pain to find and install (especially Epson’s) and the bundled software is ugly and unintuitive. I even despise the act of printing itself, which is often problematic, wasteful and eco-unfriendly, particularly when dealing with inkjet technology. Prints themselves I find generally useless as they’re not searchable. And, of course, troubleshooting printer problems is a nightmare that’s usually best dealt with by simply getting a new printer.

In the past it was my job to deal with every aspect of any printer purchase and installation. Needless to say, It was one of my least favorite duties. So to never have to deal with any aspect of the printer pipeline is a dream come true. When I saw the guys setting up a printer I almost laughed out loud when I realized that I’d had nothing to do with it.

Well, I did have to add the printer to the lab systems. But that’s the best part. And that was it.

Back to building servers. Fantastic.

There are certainly situations in which local home accounts are preferable. Generally speaking, they tend to be the way to go if you can swing it. They’re usually a bit more responsive, and of course they don’t rely on a functioning network, proper network settings, authentication servers and home account servers to work. They are the de facto, the default, and they’re what most people are used to. And if your users ever only use their one computer, local home accounts are likely to be all you’ll ever need.

But in environments that involve numerous shared (network) resources, or in which people are moving from computer to computer on a regular basis and need some semblance of consistency among machines, a centrally-located, accessible-from-everywhere home account can be a real blessing. In order to sell this system at my new job (on the Mac side — Linux was already using network homes), I needed to prove its reliability, so I threw myself on the grenade, as it were: I started using a networked home account. And you know what? I really like it.

There are, as alluded, certain inconveniences with such a scheme. For one, login tends to be a bit slower as the system needs additional time to locate and coordinate with the necessary network resources. Also, there is no Trash folder for a network home, and deleting files is immediate on a Mac when done over the network. So every time I try to throw something away I get this alert:

No Trash!

And the file is deleted for good. This is probably the worst part of the networked home. No Trash. But the advantages are so great that I plan to stick with my networked home, despite the minor annoyances.

At some point not too long ago I decided that the reliability test had been a success, and that I could finally revert back to my local home account. So I synced everything back to the local drive, and changed my home account location on the server (I use server-based authentication either way), and logged in. I worked locally for a while, and then I needed to do something on a Linux machine. I logged into that machine — which uses networked home accounts — and got my old, outdated, network home. And that’s when I realized: you can’t have it both ways. You either need to go local-only, in which case you need to really only use one machine, or you need to go networked. Otherwise your data’s all out of sync. And that’s way worse than any network dependencies or minor performance hits. So I immediately switched back to my networked home. And I plan to stay there.

And speaking of having it both ways, I suppose it is possible. At my old job I had a local account on my office computer and a networked account everywhere else. This was okay, but created all sorts of problems — particularly permissions problems — any time I wanted to share data with, uh, myself. Long story short, it was a real pain in the ass. Doable, but kinda sucky. Avoid if possible.

I have to say, since committing to my network home account, I’ve been pretty darned happy with it. Most times I’m completely unaware that I’m even on the network. And it’s great to have the same environment across every machine in the lab. It’s also great to finally be able to say definitively that this approach is not only valid, but actually pretty great in instances in which it’s appropriate.

Go me!

FCS Release Notes: Cool

TUAW’s mistake is understandable; Apple often fails to detail updates to their software. But not in this case. And I, for one, am glad for the change. Not sure how long this page has been around. But here’s hoping they keep this sort of thing up.

(I won’t hold my breath.)

There used to be a time when I would customize the hell out of my Mac. After installing all my apps I’d get to setting up my user account, tricking out all my apps so that they behaved just like I liked, and installing and configuring any number of productivity utilities to make my life easier. It took forever, and it was a huge pain, but once it was done I could navigate my computer quickly and effortlessly.

Those days are pretty much over at this point. I no longer do much to change the default configuration of my home account in any meaningful way. I barely customize the Dock. I may change the Desktop background. On my primary computers I can’t live without a pasteboard history, so on those machines I’ll install the excellent(!) PTHPasteboard. And there are certain Terminal settings I really enjoy. But that’s about it. I don’t even install my beloved Butler anymore.

Too Many Computers!

There are certain things that have contributed to this. For one, Leopard’s Spotlight is a great application launcher, largely mitigating the need for Butler. (Yes, there are other things that Butler does that I miss, but I can live without most of them — but application launching is a deal-breaker.) Spaces helps a lot with window management, so I don’t need the sort of hot corner stuff I used to do. And the newer Mac keyboards have iTunes control built in.

But the main reason for this change (or lack thereof) is the plain fact that I’m simply touching too many computers in the course of the day to ever really consistently customize them. And if it’s not consistent, it’s not going to be very efficient, because every time you go to a different computer your system breaks. I was getting to the point where I’d go to one of the many computers I have to access on a regular basis — a staff member’s machine, or some workstation somewhere — and I’d start frantically hitting the keys for some custom key-command I’d set at home, getting frustrated when nothing happened. At some point I realized that this inconsistency was actually hurting my productivity. So I made the conscious decision to learn a new way.

Lockdown!

Over the past year or so I’ve gotten used to working with the system in as out-of-the-box a configuration as possible. Which ain’t half bad, I have to say. Apple has really done a fine job of making the initial user experience good for both new and experienced users alike. It’s quite remarkable. And I love not having to set much up beyond installing my apps. It’s akin to how I felt when I gave up my car to move to Manhattan. You think you’ll miss it, but you end up realizing what a burden it actually was. It’s kind of great to have everything I need on any newly installed Mac. And now that I don’t rely on that other stuff, I don’t miss it at all.

I know as “power users” we like to add to and configure our machines out the wazoo, and I’ve certainly been no exception. But as a SysAdmin, I have to say, the less of this I do, the better my user experience has been. Surprising, yes. But totally true.

Um… No it doesn’t…

Mr. Welch raises some good points in his article, the main premise of which is that Apple is, indeed, not an enterprise company, an idea I fully agree with. But the fact is that it’s certainly possible to worry that Apple will abandon the enterprise without thinking of them as an enterprise company. And that’s because Apple makes enterprise products that some of us have come to rely on.

Mac Server: I'll Miss You When You're Gone

I don’t think many IT folk — Mac or otherwise — think of Apple as an enterprise company. In fact, I’d venture to say that we worry that Apple will abandon us because we know know full well that Apple is not such a company at heart, and that their connections to enterprise are tenuous at best. But some of us do actually appreciate the design and ease-of-use of their server products. In my case, I’ve come to rely fairly heavily on Mac OS X Server for cross-platform authentication, among other things. I get flack for this sometimes, but the plain fact is that no one has integrated authentication for Mac, Windows and Linux in one spot in such an easy-to-build package as Mac OS X Server. Could I do this with a Windows server? Sure. Could I do it on Linux? Yes, of course I could. But I’ll spend twice as long building it, and twice as much time maintaining it, when Mac OS X Server does it out of the box with ease and grace. I suppose I could punch myself in the face over and over again as well. Do I want to? Not particularly.

I often worry that Apple will someday leave the server market altogether. I sometimes even worry that Apple will stop building high-end workstations. Hell, who knows? Maybe Apple will stop selling computers one day. But I don’t worry about these things because I think Apple is one kind of company or another. I worry about them because these are products that I enjoy using on a daily basis, and I would like to keep using them for as long as they’re the best tool for the job.

Leopard Quarantine: Yes, I Am Sure, Thank You Very Much

Some have hailed this as a breakthrough in security standards, I’m sure, though I can’t find any specific sources to cite. Most folks who notice such things are actually rather annoyed by the alerts, likening them to similar attempts at security in versions of Windows. Indeed, it’s difficult to make the argument that such a warning would be very effective at preventing user-initiated security breaches. In reality it’s just the sort of warning that most people click through because 99% of the time it’s unwarranted. This has most SysAdmins and advanced users asking, “Why bother?” After which they promptly ask themselves, “How do I turn this shit off?”

The bad news is that there doesn’t seem to be a GUI way. There is no simple System Preferences checkbox for the alert. The good news is that there appears to be at least a couple possibilities for getting this done.

The first approach involves watching whatever folder you use for downloads, either via a Folder Action or via a Launch Daemon. The basic gist is that anytime that folder gets modified a script runs that removes the flag that causes the warning to appear from all items in the downloads folder. Because, you see, that’s all that’s going on. Anytime something is downloaded to your computer, Leopard flags it. When you open it in the Finder, the flag triggers the alert. Confirmation of the alert removes the flag. That’s the mechanism. Using the watch folder method simply disables the flag, which is akin to hitting that “Open” button in the alert, only it happens automatically in the background.

There are a couple problems with this method. First off, it’s difficult to implement, and second, it breaks anytime you decide to start using a different folder for downloads. And then there’s the obvious fact that it’s just plain ugly: a script workaround to disable an OS feature? Bluglgh! Terrible!

A better solution would be some sort of preference file. Apple often enables — but hides from the GUI — certain advanced preferences, allowing more savvy users to set the preference either by the addition of a preference (.plist) file, or by using the defaults command. There are all sorts of mods for the Dock, for instance, that, while unavailable through the GUI can be set via defaults. It appears that Apple has provided such an invisible preference for the Leopard download alert as well. And if you know how to create and edit a .plist file, activating the preference and disabling the alerts is fairly straightforward.

Some Background
The instructions I’m about to provide have been posted in numerous other spots on the Web. But when I went searching for this info there seemed to be no single place that explained not just how to perform the modification, but also what it did and how the mechanism we’re defeating works in the first place. So I wanted to provide some background info about just exactly what’s going on here.

Metadata
The first piece of this puzzle is the basic concept of metadata. Metadata is often best described simply as “data about data.” And in Leopard we (or, more particularly, developers) finally have the ability to add arbitrary metadata. That is, as a developer, you can add any sort of descriptive data you want to your files and the files your application creates. Mac OS X 10.5 and up can read that metadata, interpret it and behave accordingly. So, to follow our example, when we download Camino from the Internet, the Mac OS (specifically, the Finder) adds some metadata to our Camino application, and that metada says, “This application was downloaded from the internet and has not been flagged for approval.” Now, when we go to open the application for the first time, the Mac OS also knows to behave a certain way based on this metadata, and so we see that alert pop up. Clicking the “Open” button writes new metadata to the file, and that metadata now says, “This application has been opened and flagged for approval.” The OS now knows not to present the alert the next time the app is opened. Such is the power of metadata.

By the way, I should mention that you can actually tell which files have metadata associated with them by doing a long file listing:

DrMac:~systemsboy$ ls -l Movies
drwxr-xr-x   9 systemsboy  staff        264 Nov 14 09:35 .
drwxr-xr-x  10 systemsboy  staff        296 Nov  7 17:20 ..
-rw-r--r--@  1 systemsboy  staff  407041761 Oct 31 15:45 DownloadedMovie.mov
-rw-r--r--   1 systemsboy  staff  407041761 Oct 31 15:45 LocalMovie.mov

Notice the “@” symbol at the end of the permissions info for the DownloadedMovie.mov file? That means that this file has metadata associated with it.

You can look at any metadata your files contain by way of the xattr command. The command is simple to use:

DrMac:~systemsboy$ xattr -l Movies/DownloadedMovie.mov
Movies/DownloadedMovie.mov: com.apple.quarantine: 0000;48fa188d;Firefox.app;|org.mozilla.firefox

Here we can see that our DownloadedMovie.mov has an Apple-branded quarantine flag, and that it was downloaded with Firefox. Nice!

UTIs
The next piece of the puzzle comes in the form of something called Universal Type Identifiers, or UTIs. UTIs are a specific kind of metadata that are meant to describe and define types of files. So, our Camino application has metadata not only that tells the OS that it came from the Big Bad Internet (BBI), but also what sort of file (or in this case bundle) it is, namely that it’s an application. This particular piece of metadata is the UTI, and there are a bunch of them. The complete list can be found on Apple’s Developer site. UTIs can be extremely useful, and they’ll actually allow us some flexibility in defeating Apple’s quarantine mechanism. Because with UTIs we can specify which sorts of files trigger the alert and which don’t, which is pretty great if you need it. And even if you don’t, it’s something that might come in handy down the line.

The Defeat
So, with that out of the way, let’s step through our method for disabling the Mac OS alert for downloaded files.

1. The first thing we’ll need is a file in our Preferences folder called “com.apple.DownloadAssessment.plist.” If you have one, great, if not make one, either with Property List Editor, TextEdit or whatever text editor you have handy.
2. Next, populate the file with this data:

    <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
      "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
   <plist version="1.0">
     <dict>
       <key>LSRiskCategoryNeutral</key>
       <dict>
         <key>LSRiskCategoryContentTypes</key>
         <array>
           <string>public.item</string>
         </array>
       </dict>
     </dict>
   </plist>

3. Finally, restart the Finder.

From here on out, the OS will flag any item downloaded from the BBI (the UTI “public.item”) as “Neutral.” This should completely eliminate any sort of alert regarding downloads. Of course, there are exceptions — and I’ll talk about them in a minute — but this should mostly do the trick.

Using UTIs and the Risk Categories outlined here, you can vary and specify the OS behavior for a wide range of file types. Want downloaded applications to raise the alert, but HTML files to be considered safe? Not a problem. Just specify as much in the plist file. It might look something like this:

 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
   "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>LSRiskCategoryUnsafeExecutable</key>
    <dict>
      <key>LSRiskCategoryContentTypes</key>
      <array>
        <string>public.executable</string>
      </array>
    </dict>
  </dict>
  <dict>
    <key>LSRiskCategory</key>
    <dict>
      <key>LSRiskCategoryContentTypes</key>
      <array>
        <string>public.html</string>
      </array>
    </dict>
  </dict>
</plist>

Now, applications we’ve downloaded from the Internet (UTI “public.executable”) will be treated as “Unsafe Executables” and will prompt the quarantine alert. But downloaded HTML files (UTI “public.html”) will be treated as “Safe” and be exempt from the alert. As you can probably gather, you could get really, really fine-grained here if you needed to. Most folks will be covered with the first example, but as a SysAdmin it’s always good to know you have options.

Exceptions
Now earlier I mentioned exceptions. And one of those exceptions is Camino itself. Remember earlier when I specified that developers could add metadata to files? It’s important to understand that it’s not always the Finder or even the Mac OS itself that’s creating this metadata. Applications themselves can also write metadata to files, and that’s exactly what Camino does. Anytime you download a file with Camino it adds it’s own metadata to the download. And that metadata will trigger the Mac OS’s quarantine alert. So the above hack fails for applications such as these, and there’s not much to be done about it. The rationale for Camino’s approach is at least partially detailed in bug report 464333 on Camino’s developer site.

UPDATE: The folks at Camino are now re-examining the issue.

Further Reading
Credit where due, I collected all my info on this topic from the following sources:
The Folder Action Hack
Arbitrarily Extensible Metadata
Uniform Type Identifiers (UTIs)
Download Security Assessments
Creating and/or Modifying the Preference File

And inspiration and help for this post came from an excellent bunch of comments in another article right here on this very site.

In Conclusion
I have to admit, I find what Apple is doing here fascinating. I’m not sure that popup alerts for every downloaded file is a great idea in practice, but I do think it’s an interesting example of what’s possible with metadata and highlights just how useful this addition to the OS could be if leveraged properly. Imagine if metadata were something in the hands of everyday users. Imagine if you could assign your own set of actions based on your own set of metadata tags. It could fundamentally change the way you interact with your computer, essentially allowing you to program it at will to your whims. And maybe someday it will, if Apple sees the potential here and continues to push forward with this Great Metadata Experiment in fresh and innovative ways.