OS X Leopard 10.5: The unknown user and group bugs

I waited quite a while before upgrading to Leopard (OS 10.5). I knew the OS had had a turbulent childhood, so I waited for 10.5.3. Even so, I've run into two ugly and common bugs and one weird and exotic one:

• Upgrading to OS X 10.5.1: LaunchDaemons
• Permissions - apps cannot be updated
• Keychain First Aid 10.2 running on OS X 10.5

Now I'm on common bug #3. After upgrading from 10.4 (Tiger) to 10.5 (Leopard) an "unknown user" and/or "unknown group" appears in every user account when viewing sharing and permissions. It will also appear in the file sharing preference panel. It can be removed from the preference panel, but there's no proven safe method to remove this "user" from the OS. I've reviewed a number of web postings on this and related topics:

• discussions.apple.com/thread.jspa?messageID=8028824 - cosmetic issue?
• the "unknown group" bug
• Mac OS X Hints discussions
• here and here
• Apple kb article from Dec 2007: a very unsatisfactory terminal fix
• Apple - Support - Discussions - Leopard Permissions Unknown and ...
• macosxhints.com - 10.5: Manage users and groups using a GUI tool (this is an interesting reference, but in fact you can add users and groups in 10.5 directly in the accounts pane)

After reviewing all the references, and the wars about which unix comands might help, I have these tentative conclusions:

• this was a very bad bug prior to 10.5.2, but after 10.5.2 it's supposedly a cosmetic problem
• Apple made big changes to how permissions work in 10.5 (but "repair permissions still finds "problems" right after an OS X archive and install, so they have work yet to do somewhere), that led to this problem.
• Anyone who used Netinfo to create shares or used SharePoints in 10.4 or earlier might have extra problems.

I'm going to leave this bug alone and see if 10.5.5 does some clean up. In addition to being an annoying blemish it is the sort of defect that comes back to bit us in combination with another bug or future update. There's a rumor that after a year or so repeated train wrecks (MacBook Air, 10.5, iPhone 2.0, MobileMe) Apple may decide to focus on quality. So maybe they'll get around to cleaning up this icky one.


Update 3/11/2010: Apple never did clean up 10.5. By the time I migrated the 10.5 accounts to a 10.6 machine the permissions were a mess. I think Apple shafted us with this particular bug. In 10.6 one can delete the unknown user.

About the FLH: DejaNews, FrontPage, Google Reader, feeds, iframes and more

I admit, I'm proud of our Family news page -- the Faughnan-Lagace Herald. It was first launched around 1998 or so and is still edited in FrontPage 98 (the last good version, it will die when my XP box goes).

There have been about four major revisions, but the core table layout has been pretty stable for at least 8 years. It worked when our monitor were 640x480, and it works at 1600x1200.

The actual links haven't changed that much. The New York Times and BBC, for example, don't break their URLs very often.

In addition to the news and functional links (stamps, refuse) there are a few of interest. There's a link to my custom searches (love 'em) and my under-appreciated JFPost.ng hack (I tag usenet messages with a unique string, then find all my messages through a simple search. I did this first with DejaNews, but it works just as well with Google Groups. Good way to find responses.).

Which brings me to the latest development. Four years ago, for the third edition of the Faughnan-Lagace Herald, I integrated my Bloglines blogroll into this page by first instantiating the blogroll in a hidden page, then embedding that page in an IFRAME. It worked very well; within the fixed IFRAME window the blogroll was a good match to the page.

Now, of course, I've moved to Google Reader, shared posts, mobile reader, multiple feeds, gadgets, etc. It took me a few tries, but I've figured out all the pieces to embed both my Google Reader Feed and Google Shared Posts into the previous infrastructure (click for larger image):

There are a few moving parts here, but if you look at the page source and my 2004 post you ought to be able to figure out how it works (see also the two hidden pages: blogroll.html and google_share.html).

The links that show above the scrolling areas, and the javascript on the hidden pages, all come from Google Reader. Unfortunately it's not at all obvious how to find them all. Here are some tips, though the locations are likely to change:

• Creating the blogroll for this page: Google Reader feeds can belong to multiple categories/tags/lists/folders. In addition to the organization I use for reading my feeds, I created FLN for those I show here. GR provides various search and tagging tools to make this quick and easy.
• Blogroll JavaScript for the hidden blogroll.html page: Manage Subscriptions Folders and Tags.
• Blogroll Link to the dynamic web page expanded view: Manage Subscriptions Folders and Tags.
• Blogroll Link to a feed for the specific blogroll: View the public page for the feed in Firefox (Chrome doesn't support this.). Click the icon for the feed. You'll see a page with that includes an atom feed URL. (These two URLS are very similar btw, they differ only by a few characters.)
• Shared Post Javascript for the hidden google_share.html page: Click on your shared items folder, you'll see a link that says something like "add a clip to your web site ...".
• Shared Post link to the dynamic web page expanded view: Click on your shared items folder, you'll see a link that says something like "at this web page".
  
• Shared Post feed: View the dynamic web page (as above) in Firefox. Click on the Feed icon. You'll get a page that includes the atom feed URL.
  

Calendar unification: more than half way there

The iPhone (me) + Spanning Sync/iCal + Blackberry Pearl (emily) + Google BlackBerry Sync + Google Apps family domain + cc myself from Outlook/work is working.

By jove, it works.

Emily and I see each other's calendars, and add items from phones or browser (though for now I don't fully sync my calendar until I sync to my iMac). It's really helping us coordinate family activities,  and get more out of the time we have.

That's a win worth the pain I've gone through putting this together.

But what about the next step -- work/home calendar integration? Surprisingly, the cc myself from Outlook/work trick works much better than I'd imagined -- Gmail and gCal are very good at handling these Exchange generated transactions. I'd still like to be able to carry my work calendar around on my iPhone though -- rather than continue using my old Palm.

It turns out there's exactly one way to get work/home calendars on the iphone, but it comes at a significant price, and it's evolved with a major surprise "feature":

Gordon's Tech: iPhone work/home synchronization and dual machine sync - not impossible

I wrote a few weeks ago that the iPhone was unlikely to support work/home calendar integration. I previously wrote that you can't sync via the USB cable to two different machines.

[I was] Wrong on both counts...

...  David Pogue's iPhone Tips and Tricks tells us that Apple has a supported framework for work/home synchronization and an approved method for synchronizing at multiple machines....

... To get work/home integration you must abandon the old world of physical connections for calendar and contacts synchronization. Yes, Apple has a vision, and it doesn't involve the USB cable.

The iPhone has a concept of wireless calendar (and contact) providers. So you can have one provider that's MobileMe (personal data) and one that's Exchange server. Both can coexist....

So there's a solution, but for now it's strictly an Apple/Microsoft solution. You pay or you don't play, and you do it their way. There are a number of interesting features to this solution:

1. No cables. Apple would like to reserve the physical cable strictly for transfer of DRMd media - and probably they want to get rid of it all together. Steve Jobs doesn't run everything at Apple, but his dislike of cables is legendary. The future doesn't involve a cable.
2. It's very much sync to the Cloud, where the Cloud belongs to Apple. Apple isn't ready to cede the Cloud to Google.
3. The approach seems like it might be extensible to multiple providers, but currently there's one conduit for MobileMe transactions and one for the Exchange ActiveSync wireless transaction [1].

So if you want to go the whole way to work/home integration, you go with Apple, not Google. [2] MobileMe family account, iPhones for everyone (BB can't sync to MobileMe), and Exchange server at work.

For now it's a bit academic. I don't think I can get my employer to support my iPhone with our Exchange server, MobileMe isn't ready for prime time (no publish/subscribe), and I'm not going to buy another iPhone yet [2].

Still, it's a sign of hope, albeit one darkened by worries about Apple's trustworthiness.

Oh, what's that? What did I mean by "Surprise Feature"? 

Well, that's the entire crux of the matter.

Corporations hate the idea of employees running around with corporate contacts and calendars on an iPhone. They'd really like to keep your contact list sewn up -- one more thing to lose if you switch work. They also hate for those meetings discussion upcoming acquisitions to be lost with an iPhone (the FTC doesn't like that either).

The "Surprise Feature" is that ActiveSync supports a self-destruct signal. The Exchange server can send a "wipe all data" message to the iPhone. This is the key feature that allows corporations to live with the idea of corporate data sitting on an employees iPhone.

It's a good compromise.  It means that we might get full work/home calendar, contact, task integration sometime in the next decade, even if we have to sell our first born daughters to Apple.

[1] Which apparently has nothing to do with the Pocket PC Active Sync that so many people learned to hate. What's with Microsoft marketing? They used to be good at this stuff.

[2] So will Apple let Google put a sync solution on the phone the way they did for the Blackberry? Based on Apple's recent behavior, the answer may be no -- and so Google might not even try. I'm going to wait on moving Emily to an iPhone until we see how Apple plays this one.

Keychain First Aid crashing on startup - explained

I was deep into it, trying to solve what looked and smelled like a permission problem. Then I ran into something even stranger. That's the story of this post. The good news for anyone finding this via Google is that the problem was weird, but the fix was trivial.

I'll begin at the end -- it's really cool to be able to migrate laptops using firwire and system migration, but it ain't worth it. This isn't the first weird problem arising from migrating from an 10.3 iBook to a 10.4 MacBook -- where the iBook started out with Mac Classic and 10.1!

In this case, after my aforementioned permissions fixes were finished, I decided to run Keychain First Aid. I went to the utilities folder (hint) and ran it. Crash. Hard. On startup. Launch again. Crash. Instantly. So hard there's not even time to log a report. So I try a few things. Change accounts (clears up various preferences corruption issues, etc). Safe boot. Nothing helps. Keychain First Aid crashes every time. Odd, because Keychain Access works fine.

Somewhere along the line I do get info to check permissions. That's when I notice the date of Keychain First Aid -- the year 2002. Yep, version 1.0:

Mac OS X: About Keychain First Aid 1.0 The Keychain First Aid utility enables you to verify or repair your keychain configuration. Keychain First Aid 1.0 Download Requirements Operating System Mac OS X 10.1 through 10.2.x

That's right, 10.2. Nowadays KFA is a part of Keychain Access, but even when I tried to run it through KA it still crashed.

I had to delete the 1.0 version to get the new version, run through Keychain Access, to work. My Keychain was fine. If memory serves, Keychain First Aid 1.0 was an optional download. It would have been installed around 2002 or so. Somehow OS updates never removed it, all the way from 10.2 to 10.5 -- maybe because it was never delivered as a standalone app with the OS.

I did a few searches on this and found old references to others running into this problem. They all seemed to solve it by basically doing a clean install. Yep, that would fix it! I bet they too inherited Keychain First Aid 1.0. No-one's ever figured out what was going on -- at least that I could find. Until now.

I'm going to do a Spotlight search for other apps and utilities dated prior to 2003, but I bet I don't find much. Bottom line - today's systems are very complex. Don't make things even harder for 'em -- do at least an archive and install upgrade (if not a clean install) and don't try using system migration. Now on to the permissions war. How do non-geeks ever keep this stuff running?

New iPod nano won't charge in many accessories

Did Apple have a REALLY good reason to disable firewire charging? Electrical issues? Access to China's market? Whatever the reason, it's a big negative ...

Apple iPod nano Fourth-Generation (8GB/16GB) | iLounge

... Incompatible with past FireWire charging accessories; will not charge when placed in Bose’s SoundDock, Apple’s iPod Hi-Fi, or certain car kits...

Bet there will be a lot of surprised owners of the Apple iPod Hi-Fi and Bose SoundDock.

Update 5/5/09: The Griffin Firewire to USB converter works for me. I can use my car stereo connector again.

iPhone 2.1 - unknown application 0xE800002E - A FIX!

Update 11/24/08: With the iPhone 2.2 update I at first thought Apple had broken this in a new way, but I've also read reports that the bug has finally been fixed with iTunes 8.02 and iPhone 2.1. I'm now inclined to give Apple the benefit of the doubt, but do proceed with caution.

The bug that's been plaguing many iPhone users was not fixed with 2.1:

Gordon's Tech: iPhone application update error not resolved: don't buy your iPhone until it's fixed: "Unknown Error: 0xE800002E"

So the bad news is that Apple didn't fix the problem.

The good news is that after installing 2.1 and iTunes 8 there is indeed a fix. It works under 10.4.11 and it kept working when I upgraded to 10.5.4.

1. Upgrade to iTunes 8 and iPhone 2.1
2. Sync iPhone so you have a backup (I make a zip of my backup directory)
3. Restore iPhone to original state using the restore button on the info (a commentor says it's the summary tab) tab. This wipes the phone.
4. When the phone mounts iTunes will ask if you want to treat it as a new phone, or restore from backup.
5. Choose restore from backup. This doesn't restore everything -- but don't worry.
6. Sync (this will take a while if there's music involved) - this restores the rest.

When all is done everything should be in place. In the past the restores still left me with a lot of cleanup, but this time I only had to arrange a few icons. My passwords were largely restored, I did have to reenter my Gmail un/pw.

How do I know this solved the problem?

1. When I did this iTunes said I had no updates. The App Store on the iPhone said I had 4 updates. I actually used the App Store to apply the updates -- a process that has NEVER worked in the past and has caused many problems for most users. This time it smoothly applied the updates, and when it was done it said there were no more left.
2. Since applying the fix I have applied an app update from iTunes.
   

I assume this problem arose from one or more of:

1. DRM schemes that don't handle changes in iPhone ID when there's a restore from backup (maybe fixed in 2.1)
   
2. A permission or keychain problem arising from an OS X bug (because I've seen something similar on the desktop that breaks updates.

P.S. I need to credit a Mall of America Apple Store "genius". He thought this would work, though that was prior to 2.1. I think it really needed iPhone 2.1 and iTunes 8 to work and stay working.

Update 9/18/08: Based on the comments I can add

• It's working very well for everyone. Cookies, game scores, etc are saved.
• The icon order is not preserved -- you have to reorder your icons. I ran into this myself but only a small number were disordered. In some cases they're restored in alphabetic order. This is pretty easy to do of course.

Update 11/9/08: A commenter suggests doing a 2nd 'restore' to restore icon ordering:

...if you restore a *second* time, after the sync step, then all your icons and placements will be as they were prior to the restore.

My icon rearrangements weren't too bad, so, for myself, I'd choose to do some post-restore manual correction. If you're feeling brave and try this, please add a comment so we can see if it works for people for whom icon order restoration would be a big job.

Has Apple restricted multi-user access to iTunes 8?

Before iTunes 8 came out I wrote that the DRM issues around shared libraries would be very interesting to watch. How would Apple treat the de facto family media repository?

iTunes 8: what really matters is the household library – and its DRM

... Apple can either continue to (very, very) quietly support this arrangement [sharing of libraries], or they can make things more restrictive, or they could validate household media libraries by allowing multiple accounts to add music and supporting multiple DRM accounts in a single media library.

Today's Apple Discussions had this post along with several similar complaints ...

Apple - Support - Discussions - itunes 8 and sharing libraries between ...

... Ever since downloading itunes 8 i haven't been able use a shared library between users. Is this a known issue with itunes 8? Is there a work around? I get a file locked/permissions pop-up whenever I try to open itunes from my account. I first downloaded and ran itunes 8 on my wife's users profile...should this matter?...

Yeah, it feels ominous. I'll look for more.