Slashdot Mirror

I posted this late to the earlier discussion about this hole, but chances are not many people saw it. Looks like I'm not the only one thinking this now though, so why not post it twice...

It occurs to me that the help:// URI protocol problem could be broader than is generally being portrayed so far.

Consider: the fundamental issue here is that an OSX web browser -- Safari in the original reports, but apparently also Mozilla etc -- is acting as a broker for any URI that the user may come across, delegating the request out to external handler programs. Whether those external programs handle their URIs safely may be an open question.

The problem isn't really that Safari or Help is broken, but that the interaction between them, arising from the URI handling mechanism on OSX, is leading to Unintended Consequences.

OSX can handle many different URI namespaces, some of which seem to be used nowhere other than OSX. I'm having a hard time finding an exhaustive list of the URI protocols that OSX supports, but a partial list includes, in no particular order:

http://
https://
ftp://
mailto://
ssh://
telnet://
aim://
afp://
nfs://
smb://
sherlock://
itms://
daap://
help://

So far, I can think of published vulnerabilities in the telnet:// and now help:// protocols [and this article expands on those points], but is that the end of it, or is the whole framework vulnerable to these sorts of attacks?

I have a hunch that we're just seeing the thin edge of the wedge. If that's the case, then a real fix is going to hit a lot of the system, which in turn will mean that Apple is going to have a hell of a time doing proper bug testing on whatever fix they come up with. And if that is the case, then the patches we see for this through Software Update seem likely to be partial, possibly unreliable or ineffective, and may lead to system instability. (I'd hope that isn't the case, but if the fix has to be at some fundamental level of the UI then it can't be ruled out.)

It may be that we don't see a true correction to this situation until at least the next 10.3 point release, if not 10.4...

I recently upgraded eight Macs to 10.3, and they generally took 35-50 minutes to upgrade from OSX 10.2 to OSX 10.3. All of these computers are 1.0-1.25 ghz G4s with 0.75-1.0 GB of ram; a couple of them have dual processors. These were full upgrade installs of most system components, including BSD & X11, but not including the full package of printer drivers (only HP support was needed) and not including any of the localization packages. I took notes and would be happy to get into detail if anyone is curious, but to give an overview:

• On a dual 1.25 ghz G4 with 768mb of ram took 20 minutes to finish disc 1 of the Panther install, and the full install took about 35 minutes. A twin of this machine came in at about the same time.
• A single 1.0 ghz G4 with 768mb of ram took about 45 minutes.
• Two single 1.0 ghz G4s with 1 gb of ram each took about 30 minutes.
• Another single 1.0 ghz G4 with 1gb of ram took about 50 minutes, but for that one I forgot to deselect the localization files so it had to spend time installing half a gigabyte or so of localized interface data.
• Another single 1.0 ghz G4 with 1 gb of ram took about 70 minutes, but I'm not sure what the bottleneck was. This was the first one I upgraded and I wasn't taking as many notes of the process. Going from start to install disc 2 alone took 60 minutes, but it may be that I was away from the desk and simply gave it more time than necessary to finish.

These times are from booting the machine from the first Panther install disc through to the initial login screen. These times don't include installation of XCode, the 10.3.3 upgrade, or other system patches that Apple has released since Panther came out; if you include that stuff, then the average installation time goes over an hour for these computers.

You say you got a 400mhz G3 iMac to install Panther in 10 minutes? I say baloney. Either you're only counting the time for a partial install, you're not really paying attention to how long it's taking, or you're pulling some kind of trick to make things run faster.

If you have such a trick for speeding up the process, I'd love to know what it is. I was taking such careful notes because I was looking for ways to speed things up, or at least figure out where I could get things going in parallel. The only promising looking ways I found to speed things up seemed to be either a command line or single user console mode installs (but I wasn't able to get anywhere with that) or by setting up OSX Server and doing netboot (which I'd like to try, but that's a bigger project).

I just didn't see any way to get a normal, graphical install of OSX to take any less than half an hour or so on reasonably current (no more than a year old) hardware. Ten minutes for an old iMac? Sorry, but I don't believe you.

http://www.macosxhints.com/article.php?story=20030 320162436823

Although there is a warning that once this is done, Mail stops learning.

It occurs to me that this problem could be broader than is being portrayed.

Consider: the fundamental issue here is that an OSX web browser -- Safari in the original reports, but apparently also Mozilla etc -- is acting as a broker for any URI that the user may come across, delegating the request out to external handler programs. Whether those external programs handle their URIs safely may be an open question.

The problem isn't really that Safari or Help is broken, but that the interaction between them, arising from the URI handling mechanism on OSX, is leading to Unintended Consequences.

OSX can handle many different URI namespaces, some of which seem to be used nowhere other than OSX. I'm having a hard time finding an exhaustive list of the URI protocols that OSX supports, but a partial list includes, in no particular order:

http://
https://
ftp://
mailto://
ssh://
telnet://
aim://
afp://
nfs://
smb://
sherlock://
itms://
daap://
help://

So far, I can think of published vulnerabilities in the telnet:// and now help:// protocols, but is that the end of it, or is the whole framework vulnerable to these sorts of attacks?

I have a hunch that we're just seeing the thin edge of the wedge...

An interesting discussion about this is also taking place here.

fs

From what I understand, it was exactly what you suspected!

There's an interesting discussion going on at Mac OS X Hints regarding this.

Mods! Undo the aggregious error of that 'Troll' mod!

fs

Evily stolen from robg Link

After reading the article and the press release, I think it's pretty obvious what the program is doing -- I suspect it's nothing more than a one-line AppleScript. Although some (perhaps many) will disagree with me, I'm going to publish what I think the exploit to be, because it's not a huge secret. Basically, my guess is that the trojan horse is a one-line AppleScript that contains the following UNIX command (in the script, the command will be accessed via the AppleScript method for calling a shell command, but I'm not going to bother including that part here):

rm -rf ~

WARNING!! DO NOT USE THIS COMMAND! YOU WILL ERASE YOUR USER'S DIRECTORY!

I feel it's important that everyone understand the above command, and know what it looks like -- the more people who know what this line does and how it works, hopefully the fewer who will be fooled by it. And to claim that this is some "deep dark secret" that needs to be hidden is, in my opinion, trying to hide from the truth -- more "security by obscurity," which we all know doesn't work well at all. rm -rf is a very standard, very useful Unix command. In fact, if you search macosxhints (using the advanced search page) for the 'exact phrase' rm -rf, you'll get fully three pages of matches.

What makes it troublesome in this case is simply that it's called from a program where the typical user will not know what's happening, and will be shocked at the outcome. But listing the command is not like explaining how to write a self-replicating virus that spreads from machine to machine -- this is common knowledge to probably at least a couple of million OS X users who have some knowledge of Unix.

For those that don't know Unix, rm is "move to and empty trash," -r is "do this for all items and folders within this folder," the f means "force removal without confirmation," and the ~ means "the user's directory." Spelled out, this means that the script will, without warning or user intervention, delete everything in the user's folder. Permanently.

The Intego press release explains one way to test a program if you suspect it might be a trojan horse -- select it, do a Get Info, and try to delete the icon. Here's another safety check that I often use myself: drag and drop the program onto Script Editor (or control-click on a package and select Show Package Contents to explore the package contents if it's a package installer). If you're lucky, and the script writer was somewhat lazy (by not making the script uneditable), the script itself will open for editing.

So now that you know about this trojan horse, the question is, what should be done about them on OS X? My first thought on reading the article was "Cool, Darwin at work on the peer to peer networks!" But then, I considered some additional scenarios which may have more applicability in the real world. The current example is likely to remain on Gnutella, given that it's a program that purports to install the currently 'hot' application, the new Office suite. However, think about this version: A useful AppleScript that does something cool (change type/creator codes, backs up your directory, etc.). However, buried in the code is a timer that counts the number of times you've used the program. On the 50th run, it deletes your entire user's folder. Or worse, it pops up a dialog that says "In order to backup the Foo_bar file, we need your admin password." It may then be possible (I'm not quite sure how) for the app to delete the entire hard drive, instead of just your user's folder. If the script were useful enough, it could be very widely distributed, and then go blam! at some non-specified time in the future.

What, if anything, should Apple do about this? Note that this is not specific to OS X; it's really a 'social engineering' exploit. I think it would be just as easy to write a similar 'exploit' for Linux or even Windows, given that it's a simple script that relies

Yep

When the monitor is connected to the Mac through the KVM switch, the Mac (a G5) shuts itself down immediately. I haven't yet figured out why it does this or whether there's a workaround.

Have you tried disabling the monitor's power button, just for shits and giggles?

~Philly

http://www.macosxhints.com/article.php?story=20031 111110802488

Movie running as a desktop (one method)
Exposé blob
How to Bleed Brakes

Movie running as a desktop (one method)
Exposé blob
How to Bleed Brakes

Have you partitioned your HD to less than 8 gigs for the first partition? That was something that held me up for a while.

I highly reccomend reading the docs for XPF and checking out osxhints.com for some things.

I will admit, it is tough to get going - I had trouble with the CD drive, had to burn a new copy of the install, reset the nvram, replaced the pram battery (which seemed to do the trick) before I got going.

I then had to only install the combo updates - not software update until I was up to 10.2.8.

It's running fine now, and software update works fine as well.

1. Not allowing a person to upgrade a DVD/CD drive to a Superdrive. I bought my PowerMac two months before the superdrive was released. I get to use stupid DVD-RAM disks, but I can't burn DVD's unless I buy a whole new computer.

Or you could just buy an superiour quality DVD recorder from a third-party. Unlike Microsoft, Apple allows you to use all standards-compliant hardware with their DVD burning software.

2. Apple keeps its iSync API locked up. There are millions of really cool things I could do to make Apple able to synchronize with things like LDAP servers, competing browsers, PC's, etc. But then Apple could use it as a leverage-point to keep people subscribing to the overpriced .Mac program.

Funny that you mention LDAP; Apple supports LDAP in its acclaimed Mail application, so you don't need to write so much as a speck of code to enable it. Getting LDAP support to work is easy as pie.

I don't subscribe to .Mac, yet I can still use every iApp with ease. Perhaps Joe Sixpack needs his hand held, but I don't.

3. USB video cameras, like the ubiquitous Logitech QuickCam, just don't work (well) and Apple seems to have put blocks into place to refuse iChat AV from working with anything but their iSight hardware product. (I exaggerate a little bit here, but not much.)

Such is the price of progress. Face it: USB cameras simply don't have the throughput to push television-quality video the likes of which iChat AV with Pixlet can support. Would you take vacation photos with a so-called "camera phone"? I know I wouldn't. My wife and children enjoy seeing me using iSight: it's a high-quality multivisual experience. Sorry that your piece-of-junk QuickCam won't work with it.

this on top of the new G5 Cubed

you obviously missed this april fools joke.

For a full updated list of sites pulling april fools jokes see here

Some of the latest enteries:
livejournal.com - on userinfo pages, "Friend"/"Friend Of" -> "Stalking"/"Stalked By"
www.gpf-comics.com - Comic mirrored.
smh.com.au - Yum-cha trolleys with "L" plates
www.clutchfans.com - Patrick Ewing returning to NBA
www.freeciv.org - Freeciv ANSI client
www.rav4world.com - Closed? Should have announced that TOMORROW!
www.retrocrush.com - Nude pics of Jaclyn Smith
westcoaster.net - Roller coaster site turned into teen girl site
www.meowpawjects.com - Sock people forced webmaster to take website down.
miceage.com - Disney merges with Walmart
www.badgerbadgerbadger.com - Badgers replaces with zombies
skepdic.com - Skeptic's Dictionary closing
fool.com - Buffett buys Krispy Cream
launch.com - Britney Spears & Jason Alexander To Renew Wedding Vows
MetaFilter.com - Turned in to a Wiki for the day
www.ddrkc.com - owner sold site to a user that is unpopular
brownpau.com - March for Web Standards
www.beyondunreal.com - ut2k4 production suspended
globetechnology.com - Microsoft Solitaire
www.modernwiccan.com - Randomized Color Scheme
bbs.fuckedcompany.com - Site shutting down
www.diary-x.com - looks like diaryland!
theprp.com - Music site to "Previously Ridden Ponies"
mpx200.org - Pocket PC with 2Gb system memory/Smart Drunk Pocket PC application
www.macosxhints.com - triple G5 Powermacs
www.slyfx.com - AOL buys slyfx
palminfocenter.com - Palms for toddlers.
www.carniola.org - fake news story
eikenes.alvestrand.no - Considering porn spam to be in a separate dialect to everything else
defunctgames.com - Pimps At Sea fox xbox

For a full updated list of sites pulling april fools jokes see here

Some highlites:
livejournal.com - on userinfo pages, "Friend"/"Friend Of" -> "Stalking"/"Stalked By"
www.gpf-comics.com - Comic mirrored.
smh.com.au - Yum-cha trolleys with "L" plates
www.clutchfans.com - Patrick Ewing returning to NBA
www.freeciv.org - Freeciv ANSI client
www.rav4world.com - Closed? Should have announced that TOMORROW!
www.retrocrush.com - Nude pics of Jaclyn Smith
westcoaster.net - Roller coaster site turned into teen girl site
www.meowpawjects.com - Sock people forced webmaster to take website down.
miceage.com - Disney merges with Walmart
www.badgerbadgerbadger.com - Badgers replaces with zombies
skepdic.com - Skeptic's Dictionary closing
fool.com - Buffett buys Krispy Cream
launch.com - Britney Spears & Jason Alexander To Renew Wedding Vows
MetaFilter.com - Turned in to a Wiki for the day
www.ddrkc.com - owner sold site to a user that is unpopular
brownpau.com - March for Web Standards
www.beyondunreal.com - ut2k4 production suspended
globetechnology.com - Microsoft Solitaire
www.modernwiccan.com - Randomized Color Scheme
bbs.fuckedcompany.com - Site shutting down
www.diary-x.com - looks like diaryland!
theprp.com - Music site to "Previously Ridden Ponies"
mpx200.org - Pocket PC with 2Gb system memory/Smart Drunk Pocket PC application
www.macosxhints.com - triple G5 Powermacs
www.slyfx.com - AOL buys slyfx
palminfocenter.com - Palms for toddlers.
www.carniola.org - fake news story
eikenes.alvestrand.no - Considering porn spam to be in a separate dialect to everything else
defunctgames.com - Pimps At Sea fox xbox

I agree, Rendezvous is pretty cool technology--and it's the basis of Xgrid. However, I think they can improve scaling a bit.

I'm on a college campus that must have, oh, over 1000 Macs on it (entering students are required to purchase Macs now), and on 10.2 rendezvous used to take up 20% or more of my CPU usage (1 GHz G4). I ended up using this tip to turn it off during the worst times of day.

However, I will admit rendezvous is *much* less draining on Panther, and will hopefully keep getting more efficient.

Your girlfriends iBook is suddenly complaining about it playing the newest Justin Timberlake CD?

Find out how to do this on trusty old macosxhints.com!

Well, it kinda supports Safari - if you enable Safari's debug menu and use the Debug menu to set your user agent to, say, MSIE 6, you get the slider. I can move in in crude and fairly arbitrary steps by clicking either side of it, but when I try to drag the slider, Safari just starts dragging the slider image - either the position marker or the background bar - just like it drags all other images.

So it's not really usable, but you can see how it works and get a taste of the results.

See this article for info on changing the default search engine. It's kind of a drag to have to do it every time Safari is updated.

Safari (with the Debug menu enabled) allows me to pretend I have Mozilla 1.1, Netscape 4.79, Netscape 6.2.2, Netscape 7.0, Mac MSIE 5.22, Windows MSIE 6.0, or Konqueror 3. Very hand for getting in those silly sites. It just takes a second to enable.

considering that today's macpoll shows that 95% of them use google anyways, and that if you really wanted you could change it does this matter?

This is easy to fix. See this thread, specifically the comment by "thecloud", or, if you prefer a GUI, supposedly CertToolGUI is handy.

To enable the Debug menu see this tip.

Please, just because I list three or four does not mean that there are only three or four.

Sure, but these problems aren't exactly world-shattering. Using the File-menu for app-related stuff isn't too bad as long as it is wrong consistently. You learn it once and then you can deal with it. The level of problems in OS X that I talked about is much more serious IMHO because you can't really adapt to them.

I could list many more, but I thought I could make my point my listing a few that OS-9-ers insist are broken by OS X when in fact they were fixed.

I've never heard people claim that the application-menu is a bad idea (although they may disagree with the implementation). Using a new shortcut for creating a folder is a different case, because it basically hinges around the design of the Finder. The old Finder was spatial, which means that it attempts to give a 'real' representation of your files. Creating a new window does not really fit into that paradigm, since views do not exist. Windows equal folders and you create a new window by opening an existing folder. Creating a window an sich is appropriate for a 'browser' Finder, which just shows you a specific view of your files. There you can create a view which shows the same folder as another window, so there is no 1-on-1 relationship between folders and windows. This has certain advantages and certain disadvantages, which I won't go into at the moment. Suffice it to say that both are useful, but you cannot use them at the same time, since some features are mutually exclusive.

Anyway, the problem is that Apple did away with the spatial Finder and replaced it by a partially browser, partially spatial abomination. A good example of the problems you get is that it's nearly impossible to understand the view options of windows. John Siracusa has asked for consistent Finder which seperates the spatial and the browser elements in seperate modes, so that things actually work consistently and you have the best of both worlds instead of the worst.

At the moment, the fact that the OS X Finder is neither purely spatial or browser-based means that the new keyboard shortcut is broken. The old one was not broken in the OS 9 (since it is suitable to a spatial Finder), but it would be broken in the OS X Finder.

Ooo, hoo, hoo, who made you so smart? Just goes to show that all curmudgeons are the same. They all apparently assume that they've been using MacOS longer and that they use it harder than anyone else.

I never claimed that using more apps makes me smarter, better or whatever. The problem is that the dock cannot really cope with such a workflow. It's so overloaded that it works best if you use just a few apps (there is a reason why Apple's screenshots always show just a few apps). People like me go in the territory where the dock sucks. I don't believe that I'm unreasonable when I desire to use a lot of apps and documents and still want to use the features that the dock supposedly offers. Or do you want to claim that the dock is still as effective when you want fast access to 30 apps and 30 documents (where many docs have the same icon)?

BTW, the problem is not that I "operate differently". You can use that excuse for everything. A software developer can claim that a crash after selecting a menu item is caused by me 'operating differently', because other people don't select that menu option.

Awww... And MacOS 9's solution of having the trashcan on the desktop -- where it's either inaccessible or you have to warp your style to make sure it's always visible -- is better?

In OS 9, I only touched the trashcan when I wanted to deal with already deleted files (also use the shortcut). The easiest solution was just to hide all apps and open the can on the desk

you may want to check out this hint, it's a bug for now...

There is a small bug that is in 10.3 that tries to reference a file that doesn't exist.

is a fix. This will make OS X boot as fast as Linux and Win2000.

A lot of times, the configuration file stuff is hidden in netinfo. I forgot the name of it, but the netinfo GUI utility is somewhere in /Applications/Utilities. A lot of this is text usually tucked away in files in /etc on most other Unix style systems. For information on the command line interface to netinfo, start with a ``man niutil'' and also check the ``See Also'' section at the end of this man page. I think the correlation to the standard Unix /etc files should probably be pretty obvious.

Although Mac OS X does come with probably all you need to make it a server for things, I think there's not much documentation available because Apple would like to sell Mac OS X Server and they do make some documentation available for that, some of which may apply to the regular OS (I don't know). Here's some documentation I found on their page that should be applicable to regular Mac OS X as well, but it's targeted at development. Maybe you can also try Mac OS X Hints. In theory, you should be able to use FreeBSD documentation together with documentation on netinfo to figure out some of what you need, but I'm not sure how realistic that is.

I don't know if the L2TP config will work.. I briefly tried it, but moved on to straight IPSec since that's what most security products use (L2TP/IPSec is more of a Microsoft thing).

Check Point and Panther do work together, but there are some caveats which may require cooperation from the VPN admin to work out.

See this page for more information.

Panther does work with VPN-1.. I am using it.
But, some of the default configurations might be getting in the way.

- You must use either Certificates, or "Shared Secret" authentication. (Shared Secret is not the common way to configure users.)

- If you use Shared Secrets, gateway must be set up to support "Aggressive Mode" IKE negotiations.

See this page for more information on Check Point and Panther.

I just picked up a new 15" Powerbook (what a great machine), and went through the process of getting it connected to my VPN.. Here are some things I learned along the way:

- The VPN configurable via the network settings GUI is L2TP over IPSec.. This is the same thing that Windows 2K/XP clients support. But, most security devices (Check Point VPN-1, Netscreen) use straight IPSec. It sounds like Bluesocket wants IPSec.

- MacOS X comes with IPSec from the KAME (Kah-May, Japanese for 'turtle') project. KAME is very common in *BSD platforms, and I believe it is integrated into Linux kernel 2.6. There is a ton of config/compatibility information available for KAME.

- Several GUI tools are available to help with VPN setup/usage. VPNTracker, VaporSec, and IPSecuritas. Some VPN vendors, like Cisco and Check Point also have MacOS VPN clients (which are probably expensive)

- I ended up using a set of Perl scripts I found here. This allows me to see exactly what is going on, and tweak as necessary. (I also posted a few more tips about IPSec setup at that forum)

- I found the debugging of IPSec sessions to be rather difficult. Without help from the VPN administrator, it can be very difficult to determine what is failing..

- I was able to get the VPN working when using a "shared secret" configuration for the user. Note that this is NOT the same thing as passwords. Using passwords, SecurID tokens, or other one-way authentication systems require XAUTH or other proprietary mechanisms (like Check Point's Hybrid mode). KAME does not support this. A better option, which will be more secure, is to use certificates for authentication. I haven't gotten around to trying this yet, but I have seen other reports of success.

- The VPN device had to be configured to enable "Aggressive Mode" in the IKE negotiations.

- Some NAT gateways will not pass IPSec packets. IPSec uses a different IP protocol, not TCP/UDP. So, many gateways don't know how to NAT it. KAME does not support NAT Traversal (encapsulation of the IPSec packet in a UDP packet), so when setting this up make sure you're not behind a NAT gateway.

- KAME's configuration requires you to enter your IP address. So, as you move to a new LAN or Wireless Access Point, you must reconfigure and restart the VPN. (This is one reason I used the Perl script I linked above. It determines your current IP address automatically.)

Do the same thing! Open a terminal, type:
sleep 2; killall Dock

You now have two seconds to hit F9. When the Dock is finally killed, your windows will be stuck in expose mode! There are some strange issues with the windows that seem to stem from improper window coordinate updates.

Originally found at Mac OS X Hints.

at least give credit where credit is do! (me) :)

in case you want proof, here is my 1st publishing of the above directions (including an example)

Instructions (requires Developer Tools to be installed)

2) The latest release of JBuilder (JBuilder X) is much improved from previous versions. Lots of refactoring support. It is not yet officially available for OS X but I managed to get the trial version of JBuilder X Enterprise to install with the help of a note on the Borland community pages, and it runs fine. Details of how to get it running on OS X are here

3) Java GUI applications look so much better on OS X (Panther, Mac look & feel) compared to other platforms. This is an advantage because you will get an esthetic boost from looking at your app while developing, but it might be considered a disadvantage if (as is likely) the main target platform is Windows (where your beautiful GUI won't look nearly so nice).

In the meantime, you can use this simple AppleScript to solve your woes.

DaNi++

You want me to copy & paste today's firewall log so you can see the Nimda and Code Red attempts?

I'm confused.. could you clarify what you mean by:

"One biggie is that text windows work much better on linux"

I have actually found the opposite.... there is lots of great ways the GUI integrates directly with the CLI (ie pbpaste, pbcopy, and the infamous open command)... the keyboard shortcuts tend to be fairly uniform throughout the system, and with things like Perl Pad, you can take advantage of perl scripts operating on things selected with the mouse from global keyboard shortcuts (the services menu)... this kind of system-wide integration you just don't find with the current multitude of GUI toolkits for Linux.

You also might want to take a look at these scripts for Finder/Terminal interaction... I've found them very useful.

This is in addition to perl, awk, sed, grep, and all the other unix CLI tools we know and love.

In my opinion, the great advantage of Mac OS X over linux is the access to commercial software... I can run Macromedia Freehand right next to my gnuplot. I didn't "resist the temptation" to install OSS tools... in fact, it was precisely this synergy between great open source and commercial software which drew me to Mac OS X from Linux.

That and the USB hardware support... :)

Not that I believe in operating system religious wars, but peek around some more on that Mac OS X system... I think you'll find that with practice and maybe some third party tweaking (remember when you learned linux...) you'll be just as productive if not maybe a tad more on the mac. (Though I guess this depends on *exactly* what you're doing.. mileage may vary)

I may be completely wrong here, but from what I can gather, the built-in DHCP server in Panther offers no easy way of allocating fixed addresses to machines using MAC. I know you can install and use the ISC DHCP server and then do it (clicky) but i still think apple should put this in. I think a lot of organisations would find this useful to prevent stray laptops from popping up on the network.

I've tried to find "official" iCal serving info on Apple's website, without success.

I'd like to be able to have calendars which can be updated by several different people (secretary updating boss' calendar which he can also update).

I found (and tried) this this article on MacOSXhints. I got it to work on my local lab network, but I still cannot edit the calendar by anyone else but the original publisher.

Does Mac OS X Server have an out-of-box solution? Is it even possible to have more than one person with update rights to a calendar?

The trash stays where it is, need a haxie for getting it on the desktop.

Right on cue, today's edition of macosxhints.com comes to the rescue.

I double click sometimes to open stuff in the background. And I have accidentally dragged stuff off the dock, only because sometimes my computer (most recently a 15" TiBook) stops to think right as I'm doing something, so my mouse movements end up not doing what I wanted.

I use Amadeus II for my music editing.

I can't believe I can listen to the files in I-tunes, thanks slashdotters. I know one good thing that came out of this "news" article.

Personally, I find Photoshop is lacking the right hotkeys, and I'm unaware of any way to reconfigure them so that they're more like Gimp...

The configurability is a Mac vs. Linux philosophy thing. Don't tout it, you'll start a flamewar. Suffice to say, Apple has decided that for UI, One Consistent Way is better than a huge amount of configurability.

You need CocoaGestures to get system wide gestures. The hotkeys support is already there.

The system-wide password manager? Prithee, sir, what then would we call KeyChain?

System wide spellchecking is part and parcel of the very good Apple text widgets. You use their widgets, you get it for free. You can configure it specially, or you can let all the code in NSApp just do it for you (usually what you want).

Apple doesn't do things like auto-completion in a generic fashion (although you never see it mentioned, they do provide a completion service, and other people have cheerfully extended this functionality with supplemental abilities.) because they haven't decided on their One Consistent Way to do it. Until then, we have a plethora of software, free and commercial, that does most anything we want. The OS X software community is very happy correcting any perceived flaws or blank spots a dozen different ways.

UI is a very subjective matter, so Apple (that makes money off of their good, consistent user experience) takes the middle road in most everything. It's smarter for them that way, since it's so incredibly easy to extend their input mechanisms.

First, how much catching up Mac OS X still has to do in some respects to Linux.

Agreed. But sometimes it's about knowing where to look--naturally, the favorite haunts of the Mac community aren't well known outside of the community itself. Versiontracker is the sourceforge of the Mac community--but much of it is indeed shareware, not freeware. Mac OS X Hints serves up nice digestible bits of HOWTO for us; especially appreciated is when a Unix LongBeard chimes in with his experience.

For example, one article in the German magazine "MacWelt" talks about defragmenting the harddisk (!) with Panther.

I don't know what they were talking about specifically, but defragging isn't necessary under Panther--apps self-optimize at launch ("Hot-File-Adaptive-Clustering"?). More from Apple on the topic of defragging in 10.2-.3. I don't know how that compares to Linux.

multiple desktops

It would be nice to see good multiple desktop support in OS X; the community feeling is that Apple doesn't implement it out of fear of confusing the grannies. However, Versiontracker lists a number of Virtual Desktop managers; folks like CodeTek's (if you're paying) and I've used DesktopManager and liked it (for free). Not quite as robust as the options under Linux, but closer.

As for your other points: yeah, lots of shareware and not freeware. That's changing, some, as more and more Linux folks try OS X and re-implement what they liked in Linux on OS X; there's a fair few free projects for OS X (Fink is a good example). And yeah, the One Apple Way: that's rather the point. Jobs, right or wrong, thinks that the ability to chose breeds confusion in the consumer and is more difficult to support; look up the history of theming in OS 9 if you're interested. I don't know if I agree, personally--I think The One Way has it's points, but I think that alienated developers and tinkerers in the process, and I don't know which is better on balance.

Finally, But when you get past the cool design and ignore the far, far superior multimedia tools, Tux can hold its beak high and proud. Apple is going to have to peddle really hard if they want to continue to want money for their OS: Apple doesn't, really, want to charge for the OS. They want to sell hardware, and the OS is a loss leader for that. How many stand-alone boxes of the OS do you think that they sell? Here's a clue: besides a EULA, each install has no DRM, not a serial number, nothing. They ask you to please not install a single copy on more than one machine, but take no action to prevent it. And don't forget about the Open Source Darwin; this gives smarter minds than mine the opportunity to bring what they love about Linux to OS X.

According to Mac OS X Hints Panther supports hebrew, arabic and farsi now.

My Jaguar partition is still on 10.2.6, as I have the Gigabit Ethernet Dual 450, and was spooked after learning of the first 10.2.8 update that killed the ethernet .kext file, and left users without a net-enabled machine. I do have a few other machines online, but didn't bother doing it or the re-released update, as everything works fine with 10.2.6.

My current Panther install (I usually Carbon Copy Clone my main boot drive to an external firewire drive, then do an upgrade install on that drive to the newer system version; done for 10.1->10.2 and 10.2->10.3 once I see what's what in terms of settings, apps running or needing fresh prefs files, etc. I do a clean install on a blank partition and start building my 'new' machine, it's more fun that way) is running great, with my all my apps looking nicer, running (it seems) a bit faster, and acting more nicely with things like Expose.

I have discovered Another Launcher, a great replacement for every quickeys-type app ever made. It's a great donation-ware app. My main apps are the ones I sweat over, wondering whether they will work with the new system, and both Reason (save for a few drop-down menus going cleartext until clicked, hasn't affected anything else, I can run the same amount of tracks/effects) and RTCW MP Test2 (can finally command-tab out of it when needed) are seemingly healthy.

Today I had a kernel panic upon boot, the same thing I saw a G4 come in for in the service dept. at work (also today), so I'll be keeping an eye out for anything interesting going on.