Eclectic Light Company

That would be a cinch with a Mac one decade ago, or 20 years or 30 years ago, or probably even back in 1985. But these days, when it comes to external bootable drives, Apple vacillates between neglect and hostility. I've lost track of the current status of bootable backups on the Mac. Based on the following blog, it seems there's some new insult to the process once or twice a year: https://eclecticlight.co

https://eclecticlight.co/ - Howard Oakley is always worth a read, on art or Macs.

interesting. id love an eclecticlight breakdown of this. they're one of the few if only that write anything worth reading on apple hardware, i once found a QOS/scheduler insight through those guys when I couldn't get my c/cpp project pinned to the cores I wanted on m-series. https://eclecticlight.co/m1-macs/

Adding a folder to the Time Machine exclusion unfortunately does not exclude it from the local snapshots, it only removes it from the copy it does to the TimeMachine destination volume. From https://eclecticlight.co/2025/10/02/why-did-that-macos-upgrade-take-so… > Backup utilities including Time Machine normally make a snapshot with each backup, and retain them for 24 hours, following which they’re automatically deleted. As snapshots can’t exclude folders in the way that Time Machine can in its backups, if you’ve been working with a couple of 100 GB VMs then they will be retained in snapshots even though you probably exclude them from being backed up.

> Apple-maintained antivirus system called XProtect which works great Earlier this year it began detecting Apple-distributed iOS simulator bundles as malware and deleted those [0]. This was a major headache for several days as different headless CI systems developed the problem; we could not figure out how to get a 'good' version of XProtect installed in-place and ended up removing and rebuilding machines. [0]: https://eclecticlight.co/2024/05/03/did-xprotect-remediator-132-damage… > and most people don’t even know exists. This part is for sure correct.

https://eclecticlight.co/2023/07/24/how-to-fix-problems-with-icloud-an… https://eclecticlight.co/?s=icloud

Regarding the lack of detail, this has to be taken in a bit of context. Howard Oakley -- the author of the site -- has many articles that go into great technical depth and ones that are more high level advice. While I would agree the article should link to more details, they are easy to find on the site. In fact, the author has written many benchmarking tools. Here are their tools related to disk and file system performance: https://eclecticlight.co/dintch/ It is a fair bet, they used their own benchmark tools. You can read other articles on the site that describe their work.

I really appreciate your comment, I'm hoping I am wrong about my experiences! But, this is the issue I believe: https://mjtsai.com/blog/2023/09/15/limitations-on-macos-virtual-machin… (or, the original is here: https://eclecticlight.co/2023/12/26/when-macos-wont-work-with-the-app-… You cannot login using AppleID. If you can't do that, aren't you prevented from basically doing any kind of stapling and/or retrieving certificates for signing? I would LOVE to be wrong about this. You've done that?

I feel like Howard Oakley (https://eclecticlight.co/) has written about issues with iCloud products but I’m sleepy and don’t feel like digging through search results.

The $99 buys a certificate that Apple can revoke if (for example) you were using it to sign malware. The revocation of your certificate would prevent your malware from running on any Mac connected to the internet [0]. To me at least, that feels materially less dangerous to run than an unsigned app. Whether or not the system is effective, or if that's worth the $99 is obviously up for debate. [0] https://eclecticlight.co/2020/10/28/code-signatures-1-how-they-work-an… (Search for CSSMERR_TP_CERT_REVOKED)

https://eclecticlight.co/ Has multiple articles characterising the M1 (and M2) and how the MacOS scheduler uses it. I’m sure Android’s scheduled does things differently but it’s at least an idea of the sort of things which can happen. For macs (and I assume iOS) the basics are that background processes get scheduled on E cores exclusively, and higher priority processes get scheduled on P cores preferentially but may be scheduled on E cores if the P cores are at full occupancy.

Time Machine over NAS has always been unstable for me. As you experienced, my backup would be regularly corrupted and would need to restart. Alternatively, a normal <10G backup could take in excess of 24h. I eventually gave up on the NAS and now backup to external drives at home. This site has excellent articles on Time Machine - scroll down to Time Machine Problems: https://eclecticlight.co/mac-troubleshooting-summary/

I think Eclectic Light had something pretty comprehensive on Mac booting. https://eclecticlight.co

There's also a follow up to that with more findings here: https://eclecticlight.co/2023/01/20/demonstrating-causal-connections-u…

>If you’ve been following any of my articles about the performance of the cores in M1 series chips, you’ll have come across the term Quality of Service (QoS), which can have major impact on how fast code runs on processors under macOS. In addition to each process being given a priority, a number that can be changed using the command tool renice, some years ago Apple introduced another setting, the QoS. This is set for each process, and can be one of four discrete values from 9 (the lowest, for background tasks) to 33 (the highest, for tasks involving user interaction). https://eclecticlight.co/2022/01/07/how-macos-controls-performance-qos…

No, still no user-facing method for that. There have also been no apparent improvements to the Catalina permission dialogues (for Documents, Desktop, Downloads), but keep watching https://eclecticlight.co/ over the next few weeks, if there have been any improvements he'll probably talk about it.

This is a great write-up. Are Apple getting more secretive as I had heard they were trying to become more open regarding their security. This and not providing release notes [1]for 11.5.2 make me think otherwise https://eclecticlight.co/2021/08/15/last-week-on-my-mac-trus

Very hidden. The 11.5.2 patch from last week had no release notes (https://eclecticlight.co/2021/08/15/last-week-on-my-mac-trust-apple/), and Apple replied to inquiries with "No further details on the Big Sur 11.5.2 update will be released" (https://twitter.com/ClassicII_MrMac/status/1425632779262431232).

Perhaps related: "How come someone notarized my app?"[0] It mentions that anyone with an apple developer ID can notarize a qualifying app and submit this notary to the Apple Notary Service. However, the proof of notarization—the notarization ticket—might not be stapled to the application. In the case of no stapled ticket, Catalina contacts the notary service to see whether a ticket exists. If so, the app is good to go. [0]: https://eclecticlight.co/2020/05/22/how-come-someone-notarized-my-app/ EDIT. More informative link here[1]. It specifically outlines what happens on first run of an app. (and there's a great diagram if you scroll down) [1]: https://eclecticlight.co/2020/01/27/what-could-possibly-go-wrong-on-an…

That's what I use. Arq is great, but my quibble with it is that, like all third-party backup solutions, it relies on scanning the file system. Any such program, Arq included, will take a very long time to run on a hard drive where absolutely nothing has changed. What Time Machine does is use macOS's local database of pending changes, FSEvents. On the next backup cycle, it knows what's changed and doesn't need to scan unless the FSEvents database is missing or corrupt. I'm looking forward to a time when Time Machine can take advantage of file system snapshotting, which apparently was a design goal for APFS. Snapshotting is used for Apple's Software Restore function now, but the Time Machine parts weren't ready for Catalina [1]. [1] https://eclecticlight.co/2019/08/16/are-we-ready-for-time-machine-2-0-…

Be careful with using Little Snitch etc.: 'Predictably, online discussions about problems with app translocation and Little Snitch usually recommend stripping quarantine flags, and from what I can see, this has become quite widespread practice. Yet – just as in the blog article – no one seems to be concerned that what they are doing is bypassing macOS’s primary security defences.' https://eclecticlight.co/2020/01/26/last-week-on-my-mac-when-more-secu…

The blog post below contains a useful flowchart showing how to open a non-Mac App Store app on Catalina. https://eclecticlight.co/2019/10/04/will-gatekeeper-let-me-run-that-ap… A follow-up post mentions that standard users will not see an Open button at all. https://eclecticlight.co/2019/10/05/what-to-do-when-a-newly-installed-…

The original source for the article is a bit clearer on what's actually happening, and the blog post for the HN link omits some details: https://eclecticlight.co/2018/01/06/icloud-drive-can-strip-metadata-fr… I recommend read the original (and that the submission be changed to the original source instead), but a more accurate description here is that two Macs running two different versions of macOS will see the file differently once it's copied to iCloud. If a High Sierra Mac sends a file with a custom icon, for example, to iCloud, the High Sierra Mac will see the file as expected in iCloud. If a Mac on Sierra looks at the same file on the same iCloud share, it will see the base file without the custom icon. Other xattr items are removed as well, as documented in the original source.

You can boot regular macOS directly to a root terminal in “Single User Mode”. This was easier on Intel macs of yore but is also possible on M1+ Below content from https://eclecticlight.co/2020/11/28/startup-modes-for-m1-macs/#comment… Launch 1 True Recovery, open Terminal, then run “bputil -a” (without the quotes) to downgrade system security and allow for more boot arguments. You might need to restart after this step. Then, run [nvram boot-args=”-s”] (without the square brackets). Restart to launch Single User Mode. Once in Single User Mode, run these commands (in the following order) to mount the root volume group: 1. mount -P 1 2. /usr/libexec/init_data_protection 3. mount -P 2 Future restarts will always launch Single User Mode first. To stop launching Single User Mode, run [nvram boot-args=“”] (without the square brackets). To restore your system to full security, run “bputil -f” (without the quotes). If you choose to run that command in macOS, prefix “sudo” to the beginning.

Oh man. I used PostScript a ton when I worked at hp 20 years ago. It's actually a pretty great language, like lisp/scheme but I found it to be more approachable somehow. Maybe because it's postfix instead of prefix? https://liucs.net/cs101s13/fixity.html Anyway, it had several fatal flaws. I don't think it could handle images natively, so instead it encoded them as vectors and those files took up MB. It probably just needed a metaphor like iframe. I remember when Apple switched to the PDF engine in Quartz in preparation for OS X in the late 90s, I thought it was a mistake then. The QuickDraw it was replacing was actually quite good, in some ways the epitome of C-style rendering. And Cocoa was refreshing at first (it handled stuff like palettes and gamma in a data-driven way instead of through leaky abstractions) but without a way to transition off QuickDraw, it felt like more busywork that had to be done just to keep up. https://eclecticlight.co/2024/06/01/pdf-on-macs-the-rise-and-fall-of-p… Apple seems to have lost its academic roots, and suffers for it now. Or I should say, its customers suffer while it grosses almost half a trillion dollars per year. At least with vibe coding we can just whip up a Preview app in an afternoon, so maybe none of this matters anymore.

In the past, I've heard recommendations not to use remote Time Machine over SMB directly, but rather to create an APFS disk image on a remote server and then backup to that as if its an external hard drive. Supposedly, doing that eliminates a lot of the flakiness specific to SMB Time Machine, and while I haven't tested it personally, I have used disk images over SMB on macOS Tahoe recently, and they actually work great (other than the normal underlying annoyances of SMB that everyone with a NAS is mostly used to at this point). The new ASIF format for disk images added in Tahoe actually works very well for this sort of thing, and gives you the benefits of sparse bundle disk images without requiring specific support for them on the underlying file system.[1][2] As long as you're on a file system that supports sparse files (I think pretty much every currently used file system except FAT32, exFAT, and very old implementations of HFS+), you get almost native performance out of the disk image now. (Although, again, that's just fixing the disk image overhead, you still have to work around the usual SMB weirdness unless you can get another remote file system protocol working.) [1]: https://eclecticlight.co/2025/06/12/macos-tahoe-brings-a-new-disk-imag… [2]: https://eclecticlight.co/2025/09/17/should-you-use-tahoes-new-asif-dis…

This is a very interesting conversation, thank you! A couple of minor quibbles: FAT32 is not a compatible extension of the older FAT; ext2fs is not a compatible implementation of any old Unix filesystem; having less features does not always make software worse; the BSD LFS research report is from 01993 rather than 01988 https://www.usenix.org/legacy/publications/library/proceedings/sd93/se… (it credits Ousterhout with introducing the idea of LFSs in 01989); several of the other filesystems I listed that I don't think are significantly influenced by HPFS have not in fact disappeared; and Windows 95 does not, to my knowledge, support extended attributes on existing filesystems. It's probably worth mentioning that, as you imply, ext2fs did eventually add both extended attributes and B-tree directories, just after being quasi-renamed ext4fs. And I do agree that ext2fs was initially intended to be as boring as possible (without suffering the annoyances of the Minix filesystem) rather than innovative. It just failed to be compatible with BSD FFS. It's a good point that renaming and hardlinking doesn't automatically take into account such extended attributes implemented as a library; that's a plausible reason to implement them in the filesystem. But implementing them in the filesystem doesn't actually help you with respect to copying, unless copying files is an operation the filesystem supports intrinsically, like "reflinks" on some Linux filesystems such as XFS. You…

No :) but that's a close approximation. The editor is a native macOS window that's kind of like list view in a file manager, or a spreadsheet, or a little folder...depending on your point of view. Plus some menu commands and keyboard equivalents. The items in each list are macOS "bookmarks" which are a type of authorised/verified/secure alias (in fact, they're still called aliases in the code) that have been around for about 10–15 years. They contain the path plus a bunch more info. As macOS becomes more locked-down the recommended way of accessing files is to retrieve these bookmarks through the normal layers of system permissions and security. Without the bookmarks, for example just using plain text paths, I would not be able to show the full images in Quick Look or easily launch the list items. A key benefit is that the bookmark will still resolve if the file is moved somewhere else on the same disk, or even to a different volume! Here's more info on file bookmarks: https://eclecticlight.co/2020/05/21/bookmarks-a-type-of-alias-their-ac… I store the items as JSON in the saved file, simply because I prefer it to XML (which is the main/default option). I wanted the files to still be human readable and editable to a degree. The files are launched using the default app specified by that file, so it can be changed on a per-file basis. Individual images might open in an image editor, image viewer, app to run OCR, script to run OCR on it, etc.

Have you run into Viable https://eclecticlight.co/virtualisation-on-apple-silicon/ or VirtualBuddy https://github.com/insidegui/VirtualBuddy ? I think at least Viable has some limitations though Edit: "some" limitations is putting it lightly. From https://eclecticlight.co/2022/11/17/lightweight-virtualisation-in-vent… which is apparently still current: > Apple’s current implementation of lightweight virtualisation still has no support for Apple ID, iCloud, or any service dependent on them, including Handoff and AirDrop. Perhaps the most severe limitation resulting from this is that you can’t run the great majority of App Store apps, although Apple’s free apps including Pages, Numbers and Keynote can still be copied over from the host and run in a guest macOS. Same deal with VirtualBuddy, apparently the root of the problem is that some sort of hardware validations fail in VMs https://github.com/insidegui/VirtualBuddy/discussions/27

> Is netatalk the key thing here that makes it Time Machine compatible? The rest seems like standard DIY home server stuff. The last update to AFP shipped with Mac OS X Mountain Lion in 2012 [1]. Nobody should be using AFP in 2023, unless you have no other choice. While you can use Time Machine to backup to an SMB share, ideally you want to use an APFS volume to get all of the benefits, especially if you're concerned about data integrity. You can read about using APFS network shares for Time Machine at The Eclectic Light Company [2], a Mac-focused blog/website by Howard Oakley. If you're interested in the details of how Time Machine works, nobody I'm aware of has written more about its details than he has [3]. He's written a slew of useful macOS utilities, including T2M2 for Time Machine [4]. [1]: https://en.wikipedia.org/wiki/Apple_Filing_Protocol [2]: https://eclecticlight.co/2021/04/16/time-machine-to-apfs-using-a-netwo… [3]: https://eclecticlight.co/?s=time+machine [4]: https://eclecticlight.co/2021/09/29/going-beyond-t2m2-with-mints-grokk…