The macOS Sonoma 14.4 update introduces a bug affecting iCloud Drive's versioning system, where users with "Optimize Mac Storage" enabled can lose all previous versions of a file removed from local storage. MacRumors reports: Versions are normally created automatically when users save files using apps that work with the version system in macOS. According to The Eclectic Light Company's Howard Oakley, users running macOS 14.4 that have "Optimize Mac Storage" enabled should be aware that they are at risk of losing all previously saved versions of a file if they opt to remove it from iCloud Drive local storage: "In previous versions of macOS, when a file is evicted from local storage in iCloud Drive [using the Remove Download option in the right-click contextual menu], all its saved versions have been preserved. Download that file again from iCloud Drive, and versions saved on that Mac (but not other Macs or devices) have remained fully accessible. Do that in 14.4, and all previous versions are now removed, and lost forever."

Oakley said his own tests confirmed that this behavior does not happen in macOS Sonoma 14.3 or macOS Ventura, so it is exclusive to macOS 14.4. For users who have already updated, he suggests either not saving files to iCloud Drive at all, or turning off Optimize Mac Storage. To perform the latter in System Settings, click your Apple ID, select iCloud, and then toggle off the switch next to "Optimize Mac Storage." You may need to perform this action twice -- reports suggest it can turn back on by itself. For a more exhaustive account of the problem, see Oakley's subsequent post.

Hackers targeting individuals in the cryptocurrency sector are using a sophisticated phishing scheme that begins with a malicious link on Calendly. "The attackers impersonate established cryptocurrency investors and ask to schedule a video conference call," reports Krebs on Security. "But clicking the meeting link provided by the scammers prompts the user to run a script that quietly installs malware on macOS systems." From the report: A search in Google for a string of text from that script turns up a December 2023 blog post from cryptocurrency security firm SlowMist about phishing attacks on Telegram from North Korean state-sponsored hackers. "When the project team clicks the link, they encounter a region access restriction," SlowMist wrote. "At this point, the North Korean hackers coax the team into downloading and running a 'location-modifying' malicious script. Once the project team complies, their computer comes under the control of the hackers, leading to the theft of funds."

SlowMist says the North Korean phishing scams used the "Add Custom Link" feature of the Calendly meeting scheduling system on event pages to insert malicious links and initiate phishing attacks. "Since Calendly integrates well with the daily work routines of most project teams, these malicious links do not easily raise suspicion," the blog post explains. "Consequently, the project teams may inadvertently click on these malicious links, download, and execute malicious code."

SlowMist said the malware downloaded by the malicious link in their case comes from a North Korean hacking group dubbed BlueNoroff, which Kaspersky Labs says is a subgroup of the Lazarus hacking group. "A financially motivated threat actor closely connected with Lazarus that targets banks, casinos, fin-tech companies, POST software and cryptocurrency businesses, and ATMs," Kaspersky wrote of BlueNoroff in Dec. 2023.

An anonymous reader quotes a report from Ars Technica: Valve Software's Steam gaming marketplace and app will drop support for macOS 10.13 (High Sierra) and 10.14 (Mojave), according to a support page post. The change will go into effect on February 15, 2024. What will happen exactly? Valve writes: "After that date, existing Steam Client installations on these operating systems will no longer receive updates of any kind including security updates. Steam Support will be unable to offer users technical support for issues related to the old operating systems, and Steam will be unable to guarantee continued functionality of Steam on the unsupported operating system versions."

"The Steam store will stop considering games that offer only 32-bit macOS binaries to be Mac compatible at the end of 2023," Valve writes. The post also notes that fewer than two percent of current Mac users on Steam are running macOS 10.14 or earlier, so this only affects the small number who are holding on to those older versions that supported 32-bit apps. To be clear, lack of support for macOS 10.14 doesn't necessarily mean Steam won't run at all on machines running that OS. It just means Valve won't guarantee it'll work, and won't lift a finger to help if something breaks in the passage of time. It also means users who continue to use the older software could become vulnerable to security risks, disincentivizing continued use.

Richard Speed reports via The Register: Asahi Linux, a project to port Linux to Apple Silicon Macs, has reported a combination of bugs in Apple's macOS that could leave users with hardware in a difficult-to-recover state. The issues revolve around how recent versions of macOS handle refresh rates, and MacBook Pro models with ProMotion displays (the 14 and 16-inch versions) are affected. According to the Asahi team, the bugs lurk in the upgrade and boot process and, when combined, can create a condition where a machine always boots to a black screen, and a Device Firmware Update (DFU) recovery is needed.

Asahi Linux's techies have looked into the issue, having first suspected it had something to do with either having an Asahi Linux installation on a Mac and then upgrading to macOS Sonoma or installing Asahi Linux after a Sonoma upgrade. However, the issue appears to be unconnected to the project. The team said: "As far as we can tell, ALL users who upgraded to Sonoma the normal way have an out-of-date or even broken System RecoveryOS, and in particular MacBook Pro 14" and 16" owners are vulnerable to ending up with a completely unbootable system." While this might sound alarming, the team was at pains to assure users that data was not at risk and only certain versions of macOS were affected -- Sonoma 14.0+ and Ventura 13.6+.

The first bug is related to macOS Sonoma using the previously installed version as System Recovery, which can cause problems when an older RecoveryOS runs into newer firmware. The second occurs if a display is configured to a refresh rate other than ProMotion. According to the Asahi Linux team, the system will no longer be able to boot into old macOS installs or Asahi Linux. "This includes recovery mode when those systems are set as the default boot OS, and also System Recovery at least until the next subsequent OS upgrade." The team noted: "Even users with just 13.6 installed single-boot are affected by this issue (no Asahi Linux needed).

"We do not understand how Apple managed to release an OS update that, when upgraded to normally, leaves machines unbootable if their display refresh rate is not the default. This seems to have been a major QA oversight by Apple."

An anonymous reader quotes a report from Ars Technica: When Apple decides to end update support for your Mac, you can either try to install another OS or you can trick macOS into installing on your hardware anyway. That's the entire point of the OpenCore Legacy Patcher, a community-driven project that supports old Macs by combining some repurposed Hackintosh projects with older system files extracted from past macOS versions. Yesterday, the OCLP team announced version 1.0.0 of the software, the first to formally support the recently released macOS 14 Sonoma. Although Sonoma officially supports Macs released mostly in 2018 or later, the OCLP project will allow Sonoma to install on Macs that go back to models released in 2007 and 2008, enabling them to keep up with at least some of the new features and security patches baked into the latest release.

At WWDC today, Apple announced macOS Sonoma, the latest version of its Mac operating system that includes new features like desktop widgets, aerial screensavers, a new Game mode, and enhancements to apps like Messages and Safari. MacRumors reports: The first feature that Apple detailed was new interactive widgets, which can now be placed right on your desktop. Widgets blend into your desktop wallpaper to not be obtrusive when you're working, and with Continuity you can use the same widgets from your iPhone on your Mac. macOS Sonoma also introduces enhanced video conferencing features, including Presenter Overlay to allow a user to display themselves in front of the content they are sharing. Reactions let users share how they feel within a video session, and Screen Sharing has been improved with a simplified process.

As is usual with macOS updates, Safari is getting numerous new features within Sonoma. There's an update to Private Browsing that provides greater protection from trackers and from people who might have access to the user's device. Profiles within Safari offer a way to separate browsing between topics, like having one for work and one for personal browsing. There's also a new way to create web apps that work like normal apps and let you get to your favorite website faster.

When you're not actively using macOS Sonoma, the new screen savers feature slow-motion videos of various locations worldwide. They shuffle between landscape, Earth, underwater, or cityscape themes, similar to what you'll see on tvOS. For gamers, there's a new Game Mode in macOS Sonoma that delivers an optimized gaming experience with smoother and more consistent frame rates. It dramatically lowers audio latency with AirPods and reduces input latency with game controllers, and it works with any game on Mac. A beta version of macOS Sonoma is now available via the Apple Developer Program, with a public beta launching next month.

As Ars Technica notes, the macOS Sonoma update will only run on a couple generations of Intel Macs. "[I]f you're using anything made before 2018 or anything without an Apple T2 chip in it, you won't be able to run the new OS."

An anonymous reader quotes a report from Ars Technica: Apple has made a tiny bit of progress in the last year when it comes to getting games running on Macs -- titles like Resident Evil Village and a recent No Man's Sky port don't exactly make the Mac a gaming destination, but they're bigger releases than Mac users are normally accustomed to. For getting the vast majority of PC gaming titles running, though, the most promising solution would be a Steam Deck-esque software layer that translates Microsoft's DirectX 12 API into something compatible with Apple's proprietary Metal API. Preliminary support for that kind of translation will be coming to CodeWeavers' CrossOver software this summer, the company announced in a blog post late last week.

CrossOver is a software package that promises to run Windows apps and games under macOS and Linux without requiring a full virtualized (or emulated) Windows installation. Its developers announced that they were working on DirectX 12 support in late 2021, and now they have a sample screenshot of Diablo II Resurrected running on an Apple M2 chip. This early DirectX12 support will ship with CrossOver version 23 "later this summer." The announcement is simultaneously promising and caveat-filled; getting this single game running required fixing multiple game-specific bugs in upstream software projects. Support will need to be added on a game-by-game basis, at least at first.

"Our team's investigations concluded that there was no single magic key that unlocked DirectX 12 support on macOS," CodeWeavers project manager Meredith Johnson wrote in the blog post. "To get just Diablo II Resurrected running, we had to fix a multitude of bugs involving MoltenVK and SPIRV-Cross. We anticipate that this will be the case for other DirectX 12 games: we will need to add support on a per-title basis, and each game will likely involve multiple bugs." In other words, don't expect Steam Deck-esque levels of compatibility with Windows games just yet. There are also still gameplay bugs even in Diablo II Resurrected, though "the fact that it's running at all is a huge win."

joshuark writes: Yikes, gadzooks, and shiver my timbers! Elastic Labs has found surprisingly that 50% of malware comes from one app: MacKeeper, ironically. Ironic in that MacKeeper claims to "keep your Mac clean and safe with zero effort." MacKeeper also has a tainted reputation for being difficult to completely uninstall and as a malicious antivirus.

A new spin on the biblical phrase, "Am I my brother's keeper..." Well, when the inmate is running the asylum. The findings appear in Elastic Security Labs' recently released 2022 Global Threat Report. As Neowin reports, MacKeeper "can be abused by threat actors because it has extensive permissions and access to processes and files."

With that said, the report found that only 6.2% of malware ends up on macOS devices, compared to 54.4% and 39.4% on Windows and Linux, respectively.

Starting with macOS Ventura, released this week, the built-in Preview app on Mac no longer supports PostScript (.ps) and Encapsulated PostScript (.eps) files, according to a new Apple support document. MacRumors reports: Preview can still be used to open these files on macOS Monterey and earlier. Apple did not provide a reason for the change. Apple recommends using other third-party Mac apps that can view or convert PostScript files. It also remains possible to print .ps and .eps files by dragging them into a Mac's printer queue [...].

Developed by Adobe in the 1980s, the .ps and .eps file formats were once widely used for desktop publishing/printing purposes. PostScript was the basis of rendering on the NeXT operating system, and was mostly replaced by the PDF format in Mac OS X.

A leaker has claimed that Apple is working on a version of macOS exclusive for the M2 iPad Pro, with it expected at some point in 2023. Apple Insider reports: Leaker Majin Bu's sources have shared that Apple is working on a "smaller" version of macOS exclusively for the M2 iPad Pro. It is said to be codenamed Mendocino and will be released as macOS 14 in 2023. Testing is being done with a 25% larger macOS UI so it is suitable for touch. However, apps run on the product would still be iPad-optimized versions, not macOS ones.

It isn't clear why Apple would move the iPad to a macOS interface in a half-step like this. Those clamoring for macOS on iPad do so for the software more than the interface. [...] The other possible explanation is this wasn't macOS at all. Apple could be working to bring iPadOS even closer to macOS by adding a Menu Bar and other Mac-like interactions. It already introduced a Mac windowing feature in iPadOS 16 called Stage Manager, this could be the next iteration. Majin Bu also suggests that the exclusivity to M2 iPad Pro could be a marketing push. If the feature is only available on that iPad, more people would buy it.

An anonymous reader quotes a report from Ars Technica: Skirting the official macOS system requirements to run new versions of the software on old, unsupported Macs has a rich history. Tools like XPostFacto and LeopardAssist could help old PowerPC Macs run newer versions of Mac OS X, a tradition kept alive in the modern era by dosdude1's patchers for Sierra, High Sierra, Mojave, and Catalina. For Big Sur and Monterey, the OpenCore Legacy Patcher (OCLP for short) is the best way to get new macOS versions running on old Macs. It's an offshoot of the OpenCore Hackintosh bootloader, and it's updated fairly frequently with new features and fixes and compatibility for newer macOS versions. The OCLP developers have admitted that macOS Ventura support will be tough, but they've made progress in some crucial areas that should keep some older Macs kicking for a little bit longer.

[...] First, while macOS doesn't technically include system files for pre-AVX2 Intel CPUs, Apple's Rosetta 2 software does still include those files, since Rosetta 2 emulates the capabilities of a pre-AVX2 x86 CPU. By extracting and installing those files in Ventura, you can re-enable support on Ivy Bridge and older CPUs without AVX2 instructions. And this week, Grymalyuk showed off another breakthrough: working graphics support on old Metal-capable Macs, including machines as old as the 2014 5K iMac, the 2012 Mac mini, and even the 2008 cheese grater-style Mac Pro tower. The OCLP team still has other challenges to surmount, not least of which will involve automating all of these hacks so that users without a deep technical understanding of macOS's underpinnings can continue to set up and use the bootloader. Grymalyuk still won't speculate about a timeframe for official Ventura support in OCLP. But given the progress that has been made so far, it seems likely that people with 2012-and-newer Macs should still be able to run Ventura on their Macs without giving up graphics acceleration or other important features.

An anonymous reader quotes a report from Bleeping Computer: North Korean hackers from the Lazarus group have been using a signed malicious executable for macOS to impersonate Coinbase and lure in employees in the financial technology sector. The name of the false document was "Coinbase_online_careers_2022_07." When launched, it displays the decoy PDF above and loads a malicious DLL that ultimately allows the threat actor to send commands to the infected device. Security researchers at cybersecurity company ESET found that the hackers also had malware ready for macOS systems. They said that the malicious file is compiled for Macs with both Intel and Apple silicon, meaning that users of both older and newer models were targeted. In a thread on Twitter, they note that the malware drops three files [...].

ESET linked the recent macOS malware to Operation In(ter)ception, a Lazarus campaign that targeted high-profile aerospace and military organizations in a similar way. Looking at the macOS malware, the researchers noticed that it was signed on July 21 (as per the timestamp value) with a certificate issued in February to a developer using the name Shankey Nohria and team identifier 264HFWQH63. On August 12, the certificate had not been revoked by Apple. However, the malicious application was not notarized -- an automatic process that Apple uses to check software for malicious components. Compared to the previous macOS malware attributed to the Lazarus group of hackers, ESET researchers observed that the downloader component connects to a different command and control (C2) server, which was no longer responding at the time of the analysis.

An anonymous reader quotes a report from TechCrunch: A new security feature in Apple's upcoming macOS 13 Ventura will automatically block new USB-C devices from communicating with the operating system until the accessory can be approved by the user. Apple dropped details of the new security feature in its release notes, which appears to be aimed at protecting newer Apple laptops that run its bespoke M1 or M2 chips from potentially malicious accessories.

According to Apple's description, the feature will be enabled by default and will require the user to approve a USB-C accessory before it can talk to the operating system -- essentially an on-screen pop-up asking the user for permission. Apple says this doesn't apply to power adapters, standalone displays, and connections to an approved hub -- and devices can still charge even if you don't approve the accessory. Apple says that accessories that are already connected will automatically work when updating to the new macOS software.

An anonymous reader quotes a report from Ars Technica: One of the few things that Intel Macs can do that Apple Silicon Macs can't is run operating systems written for Intel or AMD processors inside of virtual machines. Most notably, this has meant that there is currently no legal way to run Windows on an Apple Silicon Mac. Apple Silicon Macs can, however, run operating systems written for Arm processors inside of virtual machines, including other versions of macOS and Arm-compatible versions of Linux. And those Linux VMs are getting a new feature in macOS Ventura: the ability to run apps written for x86 processors using Rosetta, the same binary translation technology that allows Apple Silicon Macs to run apps written for Intel Macs.

Apple's documentation will walk you through the requirements for using Rosetta within a Linux guest operating system -- it requires creating a shared directory that both macOS and Linux can access and running some terminal commands in Linux to get it set up. But once you do those steps, you'll be able to enjoy the wider app compatibility that comes with being able to run x86 code as well as Arm code. Some developers, including Hector Martin of the Asahi Linux project and Twitter user @never_released, have already found that these steps can also enable Rosetta on non-Apple ARM CPUs as long as they're modern enough to support at least version 8.2 of the Arm instruction set. As Martin points out, this isn't strictly legal because of macOS's licensing restrictions, and there are some relatively minor Apple-specific hardware features needed to unlock Rosetta's full capabilities.

Apple has released iOS 15.5, macOS 12.4, and more today with updates like new features for Apple Cash, the Podcasts app, and the Studio Display webcam fix. However, a bigger reason to update your devices is the security patches with today's releases. iOS 15.5 includes almost 30 security fixes while macOS 12.4 features over 50. 9to5Mac reports: Apple shared all the details for the security fixes in its latest software for iPhone, iPad, Mac, and more on its support page. For both iOS and Mac, many of the flaws could allow malicious apps to execute arbitrary code with kernel privileges. Another for iOS says "A remote attacker may be able to cause unexpected application termination or arbitrary code execution." Specifically on Mac, one of the 50+ flaws fixed was that "Photo location information may persist after it is removed with Preview Inspector." Important security updates are also available for macOS Big Sur with 11.6.6, macOS Catalina, Xcode 13.4, and watchOS 8.6.

An anonymous reader quotes a report from Ars Technica: What makes the ["Infinite Mac"] project unique isn't necessarily the fact that it's browser-based; it has been possible to run old DOS, Windows, and Mac OS versions in browser windows for quite a while now. Instead, it's the creative solutions that developer Mihai Parparita has come up with to enable persistent storage, fast download speeds, reduced processor usage, and file transfers between the classic Mac and whatever host system you're running it on. Parparita details some of his work in this blog post.

Beginning with a late 2017 browser-based port of the Basilisk II emulator, Parparita wanted to install old apps to more faithfully re-create the experience of using an old Mac, but he wanted to do it without requiring huge downloads or running as a separate program as the Macintosh.js project does. To solve the download problem, Parparita compressed the disk image and broke it up into 256K chunks that are downloaded on demand rather than up front. "Along with some old fashioned web optimizations, this makes the emulator show the Mac's boot screen in a second and be fully booted in 3 seconds, even with a cold HTTP cache," Parparita wrote.

CPU usage was another issue. Old operating systems and processors didn't really distinguish between active and idle processor states -- your computer was either on or off. So when you emulate these old systems, they'll ramp one of your CPU cores to 100% whether you're actually using the emulator or not. Parparita used existing Basilisk II features to reduce CPU usage, only requiring full performance when "there was user input or a screen refresh was required." Infinite Mac won't run later releases of classic Mac OS (including 8.5, 8.6, and 9) because those releases ran exclusively on PowerPC Macs, dropping support for the old Motorola 68000-based processors. Emulators like QEMU are capable of emulating PowerPC Macs, but (at least as far as I am aware) there are no easy browser-based implementations that exist. Not yet, anyway.

Apple will no longer bundle Python 2.7 with macOS 12.3, according to developer release notes for the upcoming software update. MacRumors reports: Python 2 has not been supported since January 1, 2020 and no longer receives any bug fixes, security patches, or other changes. Apple says that developers should use an alternative programming language instead, such as Python 3, but it's worth noting that Python 3 also does not come preinstalled on macOS. Developers can run the stub /usr/bin/python3 in Terminal, but it prompts users to install Xcode developer tools, which includes Python 3.

If you're using either Dropbox or Microsoft OneDrive to sync files on a Mac, you'll want to pay attention to the release notes for today's macOS 12.3 beta: the update is deprecating a kernel extension used by both apps to download files on demand. Ars Technica reports: The extension means that files are available when you need them but don't take up space on your disk when you don't. Apple says that "both service providers have replacements for this functionality currently in beta." Both Microsoft and Dropbox started alerting users to this change before the macOS beta even dropped. Dropbox's page is relatively sparse. The page notifies users that Dropbox's online-only file functionality will break in macOS 12.3 and that a beta version of the Dropbox client with a fix will be released in March.

Microsoft's documentation for OneDrive's Files On-Demand feature is more detailed. It explains that Microsoft will be using Apple's File Provider extensions for future OneDrive versions, that the new Files On-Demand feature will be on by default, and that Files On-Demand will be supported in macOS 12.1 and later.

In addition to integrating better with the Finder (also explained by Microsoft here), using modern Apple extensions should reduce the number of obnoxious permission requests each app generates. The extensions should also reduce the likelihood that a buggy or compromised kernel extension can expose your data or damage your system. But the move will also make those apps a bit less flexible -- Microsoft says that the new version of Files On-Demand can't be disabled. That might be confusing if you expect to have a full copy of your data saved to your disk even when you're offline.

Apple is rebuilding Apple Music as a full native app with the first beta of macOS Monterey 12.2. 9to5Mac reports: Back in 2019, when Apple introduced macOS Catalina, the well-known iTunes was replaced by the Music app to better reflect the company's strategy on iOS and tvOS. However, although under a new name, the Music app on macOS retained the iTunes backend, which was basically a bunch of web content loaded into an app. While this works for most users, having web content within apps makes the experience less fluid. Luckily Apple is finally changing this with macOS Monterey 12.2 beta, which includes some big changes to the Music app backend.

As first noted by Luming Yin on Twitter, Apple Music in macOS 12.2 beta now uses AppKit -- which is macOS' native interface framework. 9to5Mac was able to confirm based on macOS code that the Music app is now using JET, which is a technology created by Apple to turn web content into native apps. Some parts of the Music app were already native, such as the music library. But now Mac users will notice that searching for new songs in Apple Music is much faster as the results pages are displayed with a native interface instead of as a webpage. Scrolling between elements has also become smoother with the beta app, and trackpad gestures are now more responsive.

Along with new MacBook Pro models, Apple announced during its Mac event today that macOS Monterey will be available on Monday, Oct. 25. Gizmodo reports: As with macOS Big Sur before it, Monterey represents a renewed effort by Apple to streamline its operating systems, with new Focus profiles for limiting notifications and helping you be more productive just like in iOS 15 and iPadOS 15. Shortcuts, Apple's automation app, is now available on desktop for the first time. Monterey also represents the first time users will be able to AirPlay content from a Mac, a function that iPhone users have long enjoyed. If you've already downloaded iOS 15, updating to Monterey just makes sense -- these devices are so much more functional when they work seamlessly with each other.

But perhaps the most anticipated feature Monterey is supposed to bring us is Universal Control, which allows you to use a single mouse/trackpad and keyboard to control multiple Macs and iPads simultaneously. While the new feature wasn't initially included in the public beta rollout of Monterey, that omission has only allowed the hype to grow. It's unclear when Universal Control will come to macOS, only that it won't be available to use at launch. FaceTime's new SharePlay feature, which is also expected to arrive in iOS 15, will also not be ready to try at launch. That feature will allow you to share music or watch shows with folks over FaceTime. The devices that support macOS Monterey include: iMac (late 2015 and newer), iMac Pro (2017 and newer), Mac Pro (late 2013 and newer), Mac Mini (late 2014 and newer), MacBook Pro (early 2015 and newer), MacBook Air (early 2015 and newer), and MacBook (early 2016 and newer).

Further reading: macOS Monterey Release Candidate Undoes Safari Changes, Reintroduces Old Tab Design