tag
34 posts
A defensive architecture for macOS Endpoint Security clients covering entitlements, event deadlines, cache policy, muting, message lifetime, and telemetry.
An evidence-first Rosetta 2 repair workflow for Intel Mac apps covering architecture, integrity, plug-ins, translation availability, data, and vendor support.
A non-destructive Time Machine local-snapshot workflow covering APFS accounting, inventory, backup health, supported thinning, deletion, and verification.
A correct mental model for macOS FSEvents streams, path coalescing, event IDs, per-disk persistence, dropped-event flags, exclusions, and rescanning.
A safe macOS profile workflow covering payload identifiers, scope, signing, MDM delivery, conflicts, inspection, removal, rollback, and effective-state proof.
A privacy-conscious macOS unified-log workflow using process and subsystem predicates, levels, time bounds, signposts, collection, and reproducible evidence.
A surgical macOS system-extension diagnostic flow covering architecture, signing, entitlements, bundle identity, user or MDM approval, logs, and replacement.
A map of macOS Network Extension providers, supported use cases, entitlements, configuration ownership, packet flow, privacy, and lifecycle constraints.
A security-aware explanation of Rosetta 2 translation, ahead-of-time and just-in-time paths, code identity, mixed architectures, and compatibility limits.
How Secure Enclave-backed macOS keys combine Keychain references, access-control policy, signatures, device binding, error handling, and recovery design.
Released September 13, 2000 for $29.95, the 'Kodiak' public beta gave Mac users their first hands-on look at Aqua, preemptive multitasking, and protected memory.
Catalina made zsh a mainstream interactive default; this account separates that ecosystem effect from macOS fleet migration and script compatibility.
How APFS's container/volume model, copy-on-write clones, and snapshots replaced HFS+ across every Apple platform starting in 2017.
How Apple Silicon's secure boot chain differs from Intel Macs, and the stages both go through to reach the login window.
How macOS verifies that an application hasn't been tampered with and hasn't been flagged as malware, before it's ever allowed to launch.
Your Mac restarted with a 'restarted because of a problem' message — here's how to actually read the panic report instead of just hoping.
A script that worked fine yesterday now fails with 'Operation not permitted' after a macOS update. It's almost always Full Disk Access, not a real permissions bug.
Spotlight search comes up empty for files you can see in Finder. Here's how to check indexing status and force a clean rebuild without losing any data.
How Apple's 1996 acquisition of NeXT, and Steve Jobs' return, turned NeXTSTEP into the Unix foundation underneath every Mac sold today.
What actually happens on disk when you brew install something, and why Homebrew's design differs from a traditional Linux package manager.
A complete walkthrough using the built-in createinstallmedia tool to build a bootable USB installer for a clean install or major troubleshooting.
A practical set of real, working defaults commands to unlock hidden macOS settings, plus how to find and safely revert any customization yourself.
Auditing and controlling what actually starts at login — covering both the modern Login Items UI and the launchd agents it doesn't show.
A complete Time Machine setup covering drive selection, encryption, and exclusions — plus how to actually verify your backups will restore.
How launchd unified boot-time initialization, service supervision, and scheduled tasks into a single declarative system on macOS.
A practical guide to writing, installing, and debugging your own scheduled or persistent launchd jobs, from a first plist through production-grade patterns.
At WWDC on June 22, 2020, Tim Cook announced a two-year plan to move every Mac from Intel processors to Apple's own chips.
Released March 24, 2001 at $129, Mac OS X 10.0 brought Apple's NeXT-derived, Unix-based operating system to consumers for the first time.
Released September 30, 2015, OS X 10.11 shipped with SIP enabled by default — restricting even the root user from modifying protected system files.
Released August 28, 2009, Snow Leopard was the first Mac OS X built exclusively for Intel Macs — a deliberate stability release, not a new-features showcase.
How the App Sandbox confines what an application can access by default, and how entitlements grant it specific, narrow exceptions.
What SIP protects, how it's enforced below the level of the root user, and the legitimate reasons to disable it temporarily.
How mdworker, metadata importers, and Spotlight's index let macOS answer file searches in milliseconds instead of scanning the disk on demand.
How Virtualization.framework exposes Apple Silicon's hardware virtualization support directly to Swift applications, without a third-party hypervisor.