Monday, October 14, 2013

Calendars 5.app for iOS - don't break my heart.

I've only been using Calendars 5 for a few hours and I'm in love.

I'm sure I'll hate it eventually, but I usually do my hating faster than this. Calendars 5 is the best calendar app I've used since DateBk 5; it gives me hope I can survive Johnny ("The Designer") Ive's kneecapping of iOS 7 Calendar.app.

This is what we've needed. No #$@$@ wasted white space. This is a Calendar app that lets us actually, you know, see the friggin' appointments.

It synchronizes with any one or more of Google Calendars, Google Tasks, and the "native" iOS Calendar apps. I think the Google Calendar sync is using Google's native APIs; I didn't have to use Google's odd web page to setup CalDAV sync for multiple Google Calendars. i had only to enter my Google credentials and all my 15 or so Google personal, family, and subscribed calendars were immediately available.

But what about my Corporate Exchange Calendar? I figured that wouldn't work - but I was wrong! I enabled 'Native'/'Local' Calendars as well as Google (when I first connected it seemed I could do only one or the other, that's wrong) and I picked up my corporate calendar that way [1]. (Calendar.app on my phone also has my Google Calendars, but native support is much nicer than CalDAV support so I disabled those.)

I don't use Google Tasks, but Emily has been reluctant to add the complexity of a separate task manager to her Calendaring. With Calendar 5 there's only one place to look.

List, Day, Week and Month view in vertical and horizontal layout are all effective on my iPhone 5. Did I mention Search in List view? Fast!

This is the Calendar app I've been waiting for. Not Cue, not Fantastical, not Agenda -- this one.

[1] I didn't try to edit that Exchange Calendar, that barely works at the best of times on Calendar.app.

Sunday, October 13, 2013

DreamHost transferring its domain reseller/registrar business to eNom

File this one under deep sigh.

I started using Dreamhost for web services and domain management in 2008. I've been reasonably satisfied with them, though these days the main thing they do for me is host my share blog and manage domains, including some I moved from eNom/Google Apps. So I didn't expect any problems when I renewed one of those domains.

Alas, Dreamhost has moved their Domain registrar services to eNom. It's not clear exactly what his means, as they may always have been a reseller of someone else's domain management. In any case I had to go through a multi-step transfer process, which was not helped when Dreamhost's outdated UI told me I was transferring to LogicBoxes - which I'd also not heard of.

I contacted support seeking an explanation. They responded (I've fixed up the english, I don't think my support person is a native speaker):

Thank you for contacting Dreamhost Support. We are a registrar (reseller), we used to use LogicBoxes (still do for some  domains), but we are transferring most of the domains we can to eNom because we have had issues with logicboxes in the past.

The email you confirmed was to have the domain move from LogicBoxes to eNom, but the domain will still be registered through Dreamhost … Nothing will change on what you see, you will still manage it renew it, and everything through us. The change will actually be on the administrator side which we will see... 

I'm a bit concerned about the sloppiness of the process -- and that it was a surprise to me. I assume times are hard for this kind of hosting service -- much of the value they once delivered has moved to other businesses. 

Update: I realize I'm not getting anything from LogicBoxes, so this email dependent process may not be working. I'll see what Dreamhost support says.

See also:

Monday, October 07, 2013

Siri needs real documentation. Here's some.

COBOL was written for "managers". Unlike FORTRAN it was supposed to be readable and useable by non-programmers. Same thing for SQL. And AppleScript.

All of which are harder to use than C or Python or any number of well documented and rational programming languages (ok, SQL isn't as bad as the other two).

Siri reminds me of AppleScript. It's supposed to be a conversational companion, but as of 2013 it's an artificial form of conversation full of "magic words" like "Cancel" and incantations and capabilities that must be memorized in one form or another.

Yeah, Siri hasn't lived up to my early brainwashed enthusiasm. She can generate passwords (via Wolfram Alpha), but you can't copy the $!$#@$ strings.

Alas, contrary to my expectations, Apple isn't giving up on Siri. If anything, Apple's doubled down. You can't search iOS settings from Spotlight, but you can search from Siri. [1] It's widely assumed Siri will be required to use Apple's iWatch.

So we need to learn it, which means studying the documentation. There's a fair bit on the web (not much on Apple's web site of course), but I wanted a book.

Turns out there is one - Talking to Siri: Learning the Language of Apple's Intelligent Assistant - Erica Sadun, Steve Sande. It's $7+ on Kindle, $9 on Play [2]. I glanced at a few pages, learned/relearned 3 new things, and bought it. (The next edition won't be available until March 2014, so for iOS 7 used the book and Sadun's TUAW update.)

Between the book and the links below I'm writing my own Siri notes (in Simplenote of course). Siri is one foreign language I need to learn.

PS. My personal (Simplenote) Siri notes are public at http://simp.ly/publish/K19h9j 

See also

- fn -

[1] A mind-boggling omission. Does Google have a patent on searching settings?

[2] Play DRM can be removed - so worth the $2 to read it via Google's web pages, iBook, and BookReader

Saturday, October 05, 2013

Integrating Google Drive Google Docs into Spotlight search: "Webpages", Kinds and Smart Folders

Mac Spotlight was behaving oddly with my Google Drive. It's not the obvious issue with indexing Google Docs files in Google Drive; was more subtle but it was fixable.

To begin with there's no problem with searching PDFs and other relatively standard files that are stored in Google Drive. They are fully indexed and searchable by title and contents. [4]

The problem is with Google documents, like those with the extension of .gsheet. Of course Spotlight can't index the contents; for most of mine there's nothing there to index anyway.[2]. What's odd is that Spotlight search on the file name didn't work from the spotlight title bar [1], but it did work from the folder search UI.

It turns out that I'd configured Spotlight preferences to exclude web pages from search results, and for Spotlight a Google Doc is a web page reference [2]. So the Google Docs were excluded from results. They showed up in the folder search because evidently Spotlight disregards file type preference there.

Next I had to address Mountain Lion's Folder Bar 'All My Files' list. Even after I revised Spotlight preferences that list didn't include my Google Folder docs.

I right clicked on 'All My Files' to see the Search Criteria -- mine showed Documents and "Kind is Other - com.microsoft.com" (Silverlight files it seems). 

So all I needed to do was add the "Kinds" for the different Google Docs. I'm embarrassed to admin I tried file extensions and Google and Terminal.app and Get Info trying to figure out what "Kind" Spotlight assigned to these files (as distinct from Type, which was "Webpages"). The answer, of course, is simply to look at the Finder's detail list (duh). The kinds in my Google Drive were:

  • "Google document" (extension .gdoc)
  • "Google spreadsheet" (extension .gsheet)
  • "Google drawing" (extension .gdraw)
I didn't have any presentations, but you can guess that one. [3]
 
Once I added those (with quotes) to the 'All My Files' criteria [7] in the Finder Sidebar they showed up in the All My Documents list. Problem is, even in Mountain Lion you can't save your edits to "All My Documents" [6]. Indeed, any editing of a saved search is weirdly obscure (no edit in context menu).
 
There was still one problem.  'All My Files' -- at best I could remove the original and save a new one with a less appealing icon. The trick, of course, is to change the icon (see comments, also [5]).
 
Alas, I couldn't put my Saved Search back into the Finder Menu! I could drag folders there, but not a File. I had to use an obscure trick - Select the file then type Cmd-T. I think this is a Mountain Lion bug, possibly for non-admin users.
 
At last all seemed well; except the Finder Sidebar persistently showed the old gear icon, even though Get Info showed the current icon. A Finder Restart didn't fix this, so I'm a bit stuck for the moment. I suspect it's a Mountain Lion bug [8].
 
(BTW, if you're a new Mac user and you do this, you probably want to set New Window Default to Home Directory or something similar. Unfortunately you can't make a smart folder a default.)
 
See also:

[1] BTW, if you use the titlebar spotlight search and mouse over a result, you get a preview. You don't see filename or path though. If you hold the command key down, you will first see filename below the preview, then, after a second or two, it will alternate with path name.

[2] Here's what a gsheet content looks like in textwrangler (GUIDs truncated for security reasons)

{"url": "https://docs.google.com/spreadsheet/ccc?key=0AtgMeRwpi&usp=docslist_api", "resource_id": "spreadsheet:0AtgMec"}

[3] I'm guessing Google Drive installation tells OS X what Spotlight Kinds to associate with these file extensions.

[4] BTW, you can use Google Drive to convert Microsoft file types to Google formats.

[5] OS X Mountain Lion: Change the icon of a file or folder. Don't try to copy the preview icon, copy the wee icon at top of get info.

[6] It is a "Canned Search" Kind, not a "Saved Search" -- and it's a System File.

[7] Get Info shows the native search language version. Here's what I got when I added kinds without quotes:

(true) && ((((kMDItemContentTypeTree = public.content) || (kMDItemKind = "com.microsoft.*"cdw) || ((kMDItemKind = "Google*"cdw) && (kMDItemKind = "Spreadsheet*"cdw)) || ((kMDItemKind = "Google*"cdw) && (kMDItemKind = "document*"cdw)) || ((kMDItemKind = "Google*"cdw) && (kMDItemKind = "drawing*"cdw)))))

Here's the better results with quotes:

(true) && ((((kMDItemContentTypeTree = public.content) || (kMDItemKind = "com.microsoft.*"cdw) || (kMDItemKind = "Google Spreadsheet"cdw) || (kMDItemKind = "Google document"cdw) || (kMDItemKind = "Google drawing"cdw))))

[8] I'm not sure if this is new with Mountain Lion, but it looks like display of custom icons in the Finder Sidebar is a known issue.

Monday, September 30, 2013

Micro-Frameworks for web app development

A developer colleague (M.A) sent me a brief list of micro-frameworks organized by language. His list is in the same vein as Microjs: Fantastic Micro-Frameworks and Micro-Libraries for Fun and Profit but quite a bit shorter.

For my own future reference, here's his list organized by server-side language
  • Java – Spark or perhaps something old fashion like Tomcat or Spring MVC in Tomcat
  • Groovy – Grails or Ratpack
  • Javascript – node.js or Meteor
  • Ruby – Sinatra
  • PHP – PHP
  • Python – Django or Bottle
For my own amusement (and perhaps my 14yo) I'd be inclined towards either Django (Python and packaged on DreamHost, my longtime hosting service) or Meteor (he likes).

PS. Clearly the world needs an AppleScript micro-framework. (ok, sick joke)

Saturday, September 28, 2013

The personal (corporate?) search tool I want

The modern publicly traded corporation is to data as water is to iron. Corrosive. There are reasons why this is getting worse - legal, regulatory, economic, political, technological. It's a long story, but trust me on the corrosion part.

Now if I kept all my data  on my personal dry dock workstation (we still have them) I could resist this, but there's power in sharing. So over time pieces of my extended (work) memory have fallen into abandoned repositories. Recently the number and complexity of these abandoned repositories ran past my cognitive limits.

In the long run part of the the solution is a corrosion resistant knowledge repository, but in the short run I need a way to track and search my archives and working repositories. I need an integrated personal search tool for pulling in data from a variety of server based search APIs. [4].

I haven't seen a tool like this and I can't be the only one who needs one; there's probably a (very) wee market here [1]. At least 10 people. Worldwide.

It's not too hard to imagine how it might work as a web app:

Search

There's a search box, a drop down with "All" or single target searches. Send (?Customized) strings to APIs of various repositories like SharePoint_1, SharePoint_2, Yammer, XWiki, Confluence, Rally, JIRA and so on. Get results back, convert to a normal form, display in a grid.

On the other hand, a web page of links to the various search engines would be better than nothing, and an embedded set of search forms would be quite good esp. with a little javascript to copy a string from one field to every search string.

So what I need is an environment that lets me start with a simple web page of links, then add embedded forms, and gradually build more capability over time. A kind of hobby project I can work on when I'm stalled on my real work and need something to that's plausibly work related.

Maybe Meteor ... 

[1] Before Google there were tools like this for the public net, but post-Google those have been relegated to (mostly) failed meta-search engine projects like dogpile, search.com, and, arguably, duck duck go. I haven't found tools that work inside corporate firewalls.

[4] My personal custom search engine fills a similar role for the Google-accessible net.

See also

Tuesday, September 24, 2013

App.net: Supporting account substreams with PourOver

[This one's for @duerig.]

The earliest mention of "channels" in my web archives dates to 1996 [1]. There's not much more than a word about them, but I remember what I was thinking. There were a lot of things I wanted to share [2], but I didn't enjoy harming unwilling bystanders. I wanted broadcast channels (now we call them streams) that could be carved from my global shares [3].

The problem, of course, is that my interests are probably not your interests. Emily is my most faithful reader, but she skips my tech shares. On app.net some like my diverse shares, but others favor dialog and social chat. Political opinions? Religion? Right. Limited scope.

So, in the interests of minimizing collateral damage, like a political post appearing in a stream of iOS comments, I'd like an easy way to do streams off my shares.

Happily Pinboard, which I use as a micro-blogging platform publishing to @johngordon  (PourOver) and kateva.org/sh (IFTTT), supports those kinds of streams. Every tag has a feed, and when posting to Pinboard I can enter single character tags corresponding to streams. It's not the most elegant UI, but it works.

At the moment though all of my shares stream into one app.net channel (mixing metaphors there, but it kind of works). If my app.net account supported sub-channels/streams (I know that work is in progress, might be done) it seems like either PourOver and/or Pinboard stream-feeds would be a good step towards reducing drive-by share damage.

Update: app.net thread. Hope to see these pieces come together over the next few months.

- fn-

[1] My web "posts" from the early 90s are now embarrassing. The web was new then, even Alta Vista was years away. There was so much I couldn't imagine. More subtly, we live in the Randall Munroe web now. I know there are minds at play far beyond my own meager insights.
[2] Sharebot I am.
[3] In those days Global Shares were static web pages. I tried to generate things that were a cross between blog posts and Simplenote entries via FileMaker web page generation.

See also

Monday, September 23, 2013

Aperture's multi-project display and why you've never heard of it.

Since at least 2010 Aperture has been able to display multiple Projects side-by-side in a tabbed UI by option-click on Project name. I was amazed to learn about this a few weeks ago. Why isn't this prominently discussed in Aperture's manual or help file? Why, even after I showed it worked, is it so hard to find documentation?

I mean - this is big. I've been looking for it for years, missing iPhoto 9's easy ability to split and merge Projects and move images between them. Aperture's single project focus is my biggest complaint. At last I can move images between Projects ...

No. You can't. 

Which is probably why Apple has never documented this feature -- it's obviously only half-built. Rather than pull tabbed albums projects from the release Apple left them in, but removed documentation. Sad that in some fine Aperture updates since 2010 this feature was never completed.

Maybe in Aperture 4.

Saturday, September 21, 2013

Apple still has an express replacement service for iPhone: $187 for iPhone 4

Years ago I think I used Apple's 'express replacement service', probably for a 3G. Apple sent me a refurb, I returned my phone and used the refurb.

Turns out, the express replacement service is still around. Request the express replacement option for an out of warrantee service and you can swap your defective old iPhone for a refurb (with a fresh battery). In our case we have an iPhone 4 with a balky home button and another with a balky power button -- both with bad batteries. Good devices, but not much resale value. An Apple Store service swap would be great if one could be arranged, but an express replacement service would be a lot more convenient.

According to Apple's web site there's a $29 service fee, a $7 shipping fee, and device specific fees:

  • iPhone 4 or earlier: $150
  • iPhone 4s: $199
  • iPhone 5, 5c, 5s: $269

I don't know if the replacement phones are carrier locked, so there's a risk of sending in an unlocked phone and getting a carrier locked phone back. 

An eBay iPhone 5 seems to cost $200-$300 and is probably much lower quality than an Apple refurb, so $187 is pretty competitive.

Analyzing mobile phone plans: Our old AT&T plan vs. H2O wireless

We're enrolled in a no longer available AT&T plan that included a secondary phone option of 

  • shared family minutes, long distance, etc.
  • $10 monthly per device
  • $15 for 200MB data (with alerts when limit nears)
  • No SMS

At the moment my daughter is on this plan, the boys are on H2O wireless. Thanks to typical carrier hidden fees and some SMS usage billed at extortionary rates** the average monthly cost is about $33.

I'd been planning to switch her to H2O wireless too, but after doing a bit of analysis I can see why AT&T discontinued the plan we have -- it's oddly cost-effective for someone with the discipline to control data use. (The latter requires a level of self control that excludes her brothers.)

Here's a rough cut at what a valuation looks like for staying on this plan over 2 years (with a new contract iPhone) vs. switching to H2O wireless:

ItemEstimated value
Phone subsidy450
AT&T sneaky phone fee-40
iPhone 5S 16GB initial fee-200
Two year payments-840
H2O plan cost120*
NET-510

So compared to H2O wireless staying on this plan would mean:

  • Pay an extra $510 over two years
  • Get an iPhone 5S (list $650)
  • Get enough data for location services, light email, iMessage, Facetime-audio

If we wanted an extra iPhone 5S her current plan would make sense. We don't, so I'm likely to switch her to H2O wireless when her contract expires - like her sibs. On the other hand, if we lose a phone it makes sense to add her back on this plan and get a new contract.

Again, I can see why AT&T discontinued this plan. It is oddly competitive with paygo options.

* As of today H2O wireless for our kids use pattern costs about $80 for two years - voice and SMS only. It used to cost $200 for two years, this $80 price is weird and seems unlikely to last. In fact I'm not sure I can even get this plan for her any more, I think it was an artifact of some pre-smartphone pricing.

** Most of her texting is via iMessage.

PS. Walmart online has an interesting list of prepaid options for AT&T compatible MVNOs.

iOS 7 has completely removed ability to play Podcasts through Music.app and Video.app

Message received when connecting my daughter's iOS 7 4S to iTunes:

Screen Shot 2013 09 21 at 2 10 03 PM

Until iOS 7 one could get reliable iTunes Podcast sync by deleting Podcast.app and viewing Podcasts in Music.app or Video.app. Those abilities are now gone. Not a surprise, too bad Apple brought a lot of bugs with the transition including iTunes 11.1 Media Kind bugs causing podcast invisibility, and claims of massive data loss when synchronizing archived podcasts with iOS 7

It's well past time for me to switch to either Downcast or Instacast. My app.net colleagues are reviewing the tradeoffs with me.

(I'm still on iOS, I like the kids to find these bugs first.)

Friday, September 20, 2013

iOS 7 fixes iOS parental controls webkit hole. Finally. (EXCEPT for Siri)

It's been exactly three years since I wrote Apple's iPhone parental controls are completely broken.

Sure, you could turn off Safari -- but there was no way to disable use of webkit embedded browsers. A lot of apps and games kids like, including encyclopedias, use links that bring up an embedded browser. From there it's often a few hops to Google and beyond.

I ranted about this in various places, but mine was a lonely voice. (One can imagine many reasons why most parents don't seem to be concerned about full web access with iOS devices, but, whatever the reason, there's clearly no clamor for a fix.)

Today, years after I gave up, Apple fixed parental controls in iOS 7. You can use Restrictions:websites:specific websites only to restrict both Safari and webkit access to urls. I believe the changes were made pretty deep in the iOS network stack, they seem to affect all browser use.

iOS comes preconfigured with a set of approved sites. The list is not simple to edit but they are all fine with me. You can add others.

There are bugs. Even preconfigured sites seem to sometimes require second authentication on attempted access. Still, it's a big, albeit very late, improvement.

IOS 7 is quite slow on the iPhone 4s two of the kids use, but this one feature is worth the sluggishness.

Update: In early testing #1 says he can't hack the current restrictions. It also seems to be far more useable than superficially similar site restrictions in OS X Mountain Lion; Mountain Lion's current mechanism has been completely broken. I wonder if some serious attention went into making this work.

Update 11/29/2013.

Siri: "Show me pictures of dogs". Shows dogs.

Siri: "Show me pictures of xxxx"....

You have to disable Siri, there are no parental controls there.

iTunes 11.1 is unable to browse some older podcast files - with a partial workaround (Fix)

The first hints of a problem with iTunes 11.1 came via an app.net referral to Kirkville: Apple Has Broken Podcasts. A large numbers of older podcasts were no longer seen in iTunes. They weren't deleted, but iTunes didn't show them.

My first thought was gratitude for my multiple onsite and offsite backups. Unsurprisingly, I'm impacted too. I have 367 episodes of In Our Time in my iTunes Podcast folder, but only 311 are browsable in iTunes -- either via Podcasts or Music. On the other hand, a Smart Playlist searching on the album "In Our Time" finds them all even if I specify Media Kind = "Podcast" in the search criteria. 

Search won't find the lost podcasts however -- only Smart Playlists.

My guess on this bug is that Apple changed the rules on what shows up in Podcasts or Music so that certain older files with a Media Type of 'podcast' don't display in either category. They're still in the iTunes database, and so discoverable via a smart playlists, but iTunes can't browse them. If you remove these files from iTunes, then add them back in, they may be reclassified so they'll be browsable again.

I wonder if there's a way to do that via AppleScript.

I'm hoping this bug gets enough attention that Apple fixes it in the next month or two.

Update 2: The bug is related to Media Kind

Media Kind has long been an Achilles Heel of iTunes. It's an attribute of media that shows up in Smart Playlists and should be changeable via the Information (Get Info) window, but there's no 'column' option for showing Media Kind in lists. It looks like this is a Media Kind option.

I created two Playlists to identify my affected IOT podcasts.

I made one Playlist by dragging all the files that showed up in the Podcast view into a static Playlist.

I made another by Smart criteria: Album = In Our Time.

Then I made a 3rd to identify what was in the Smart Playlist, but not visible elsewhere:

Screen Shot 2013 09 20 at 9 09 42 PM

That showed my hidden podcasts.

Of the 50 or so hidden podcasts, I tried changing media type to Music. That worked for two of them. They were now visible for search and browsing. The other 48 appeared to let me change Media Type, but when I checked again they still showed as Podcast. It seems iTunes 11.1 is ignoring the Media Type attribute and using a different source of metadata to decide what is a "Podcast". That's bad, but what's worse is that podcasts of mine that used to show as Music no longer show there, but they are also omitted from Podcast.

Update 3: A workaround: Media Kind Podcast -> Audiobook -> Podcast

I couldn't change the media kind for the '48' to Music (seemed to change, but didn't work), but I could change to Audiobook! Problem is Audiobook UI can't scale this way.

Once I'd changed the Media Kind to Audiobook though, I COULD change it back to Podcast. After that all my IOT files were Podcasts and once again visible to browse and search. Note to do all this I had to use Smart Playlists -- these were the only parts of ITunes 11.1 that could display my 'invisible' podcasts.

Heavens, but iTunes 11.1 is a hot mess.

See also:

Saturday, September 14, 2013

Curse of the refurb iPhone: Apple refurbished 4S has audio compiler defect, drops microphone on calls

When Emily broke the screen on her 2yo 4S I paid for a refurb replacement so I'd get a fresh battery. I'd heard good things about Apple refurbs.

Wrong.

It now sometimes happens sometimes happens that her microphone doesn't work during calls. A power cycle or simply waiting a while can resolve it. Happens about once a week. I think this is the cause:

During a call, the other person can't hear me - iPhone 4 - iFixit

I'm sorry to tell but it is 99% sure that your 'audio compiler ic' is the issue. This is the IC which performs the noise cancellation. It is only active during calls and not during memo recording... Reballing this IC is 99% gonna solve your problem. However this requires special tools and good knowledge to be performed..."

There's a possible workaround using the hearing aid option, but I'll take the phone back to the Apple Store. I wonder if they'll believe me -- I'll try to catch it on video.

It looks like this is a known manufacturing flaw:

ian's iPhone Repair: Microphone Issues with iPhone 4

If this audio compiler doesn't work, then the person on the other end will not hear you - or they will hear a very muffled voice, or a lot of static. Due to what is largely believed to be a manufacturing error in Apple's Chinese factories, a number of iPhone 4 models were assembled with this tiny chip soldered to the mainboard (motherboard) improperly. Either too much solder or glue was used, and the connection is tenuous at best.

The problem is that the phone could work perfectly for a very long time, and then after a drop (even one that doesn't break the glass), a hard jar, or even for no reason at all, this chip loses its connection to the mainboard and causes the problem you may have experienced.

There's a 178 page Apple thread on this problem: iPhone 4S - Outgoing call no audio. Given the length of the thread it's disturbing Apple missed the problem on our refurb. They should offer a recall.

Update: I found if I gently tapped the 4S on a surface I could trigger the microphone loss, so I was able to get a recording of the drop out.

Update 9/7/2013: Apple service-swapped the service-swap (so now I'm two phones removed from the phone AT&T would have unlocked in 2 months, but I'm told AT&T can manage this if I have the paper trail).

It wasn't easy though. I'd power-cycled the phone to switch SIMs, and last time I did that it took days before I could replicate the bug. So the tech couldn't replicate the problem -- and nobody at the Rosedale Minnesota Apple store had ever heard of the (alleged) audio compiler microphone cut-off defect. It took my poorly done video of the defect in action, a Google search with precise hits, and showing this blog post to get the exchange. 

I sympathize with Apple here -- a hardware exchange for a non-replicable defect is a lot of money to lose. I wonder if they're not allowed to use Google though.

Monday, September 09, 2013

Mountain Lion and the encrypted boot drive: Implications for migration assistant and what happens when you delete the only account that had FileVault 2 access (bug)

For several reasons I decided to enable encryption on my new SSD boot drive. I used the admin account on the drive. I then migrated data from my old drive, restarted, switched to my regular admin account, and deleted the admin account I'd created for drive setup.

That's the problem. Even though that account has been deleted, when I restart the Mac the startup partition (Apple_Boot Recovery HD?) I'm asked for the password for that account.

That sounds like a bug, but it could be worse. That's because when you setup a boot drive as FileVault, then use Migration Assistant, you have to enable FileVault unlocking for each of the migrated users. [1]. I'd unwittingly deleted the only account that was authorized to decrypt my boot drive.

Once I enabled my other accounts for unlocking they appeared on the startup menu -- along with my deleted admin account. So the deleted account is still used by the hidden boot partition, and it probably can't be deleted nor can the password be changed. So, yeah, it's a bug.

FileVault 2 makes me nervous.

See also:

  • [1] OS X: About FileVault 2 - Apple support. This is mandatory reading. "f you want to make the Mac available to a user that does not have unlock capabilities, log in, then when you see your own desktop, choose "Log Out (user name)" from the Apple () menu. Also, you can unlock the disk, then choose the other user's name from the Fast User Switch (appears as the currently-logged in user's name) menubar item in the upper-right part of the screen ... When FileVault 2 is enabled, Recovery HD does not appear in the Startup Manager (which is accessed by holding Option during startup).  However, you can select the Recovery HD by holding Command-R as Lion starts up."
  • OS X: How to create and deploy a recovery key for FileVault 2 - This might be the most advanced support article I've read. The recovery key for a FileVault 2 encrypted disk is shown ONCE on startup and cannot be later displayed, but using this method one can save a key that can be used when a password is forgotten. (Maybe this is what Apple does when you elect to save credentials with them.)
  • osx - Disable a user's ability to unlock a FileVault 2 volume at startup/login time - Ask Different: This is the best overview of the bug with FileVault 2 and inability to "remove, from the EFI loginwindow, a user who should no longer be able to unlock the startup volume."
  • Using fdesetup with Mountain Lion’s FileVault 2 | Der Flounder 7/2012 - Remove users from the list of FileVault enabled accounts.
  • training.apple.com/pdf/WP_FileVault2.pdf: Apple Technical White Paper. Best Practices for Deploying FileVault 2 - Deploying OS X Full Disk Encryption Technology

Update 9/11/2013

I tried sudo fdesetup list and the list did not include the unwanted user account. So I restarted and this time it didn't appear. So perhaps 1-2 restarts after enabling users took care of my orphaned EFI LoginWindow account.

I've seen some other odd behaviors, but I may get to those another time.