Little Snitch exposes network killing MobileMe behavior

My mothers modem lights were flickering madly -- but I couldn't see why. All was quiet.

It wasn't just the lights -- the network performance sucked. Sometimes things would rush down, but at other times they'd just hang. Crazy.

Naturally I blamed Videotron. Nice people, but last time we had a problem they had to replace her router twice. As usual I got an agreeable support person. Everything tested out for him, but I couldn't run the Videotron speed test - it took ages to load. He wanted to test further, but I thanked him and told him I'd check things out internally.

You see, I'd lied to him about not having a router installed. Yeah, that's bad. I felt guilty because once he'd confirmed their network was ok I had a hunch where the problem was.

I turned my suspicions to the other machines on the WLAN, including my MacBook. Sure enough, when I shut the MacBook the modem lights slowed down and the Videotron speed test showed 1mbps downlink and 128K uplink - just what Mom pays for.

So what the heck was the MacBook doing? It's not an XP machine, so I wasn't worried about malware. I don't like installing low level apps that require uninstallers, but I needed to know what was going on. So I installed the $30 Little Snitch 2 utility in demo mode

...Little Snitch has a free, built-in demo mode that provides the same protection and functionality as the full version. The demo runs for three hours, and it can be restarted as often as you like...

It's geeky, but, in short, LittleSnitch worked. The culprit? MobileMe iDisk file sync. If you have a local cached version of your iDisk share OS X Sync is very demanding about synchronizing with the remote MobileMe iDisk. I wouldn't notice this at home, but at my mother's OS X Sync was saturating the 128 kpbs uplink trying to sync a 28 MB file. The only clue to what's going on is a spinning icon seen if you view a Finder window sidebar. Turning off MobileMe sync doesn't stop this. You can only stop it by clicking on the spinning icon or by turning off local disk caching altogether.

So I was wrong, I did have malware. Apple malware.
--
My Google Reader Shared items (feed)

The Mac Mini drive clunk (knock) problem

I'm visiting my mother, so I'm reminded that every few seconds her Mac Mini makes a gentle "clunk" sound. It as though it's knocking for my attention.

Emily wouldn't care or even notice it, and I don't think my mother can hear it, but "people like me" hate noises like that.

When I first noticed a year ago, I figured her drive was failing - though Disk Utility SMART status showed all was well. After a year though, it seems like something else: "hard drive clunk mac mini.

If you turn the volume way up you can hear the sound on YouTube (my mother's mini has the same Futitsu drive). It's not just Fujitsu though, there are utilities to prevent clunking written for Seagate drives. It appears to be an OS/Firmware bug that recurs over the years with different OS drive combinations. I don't recall it in 10.4, so I suspect it was introduced in 10.5 and may be gone in 10.6 (I upgraded my mother to 10.5 about the time I noticed the noise).

Some of the better discussions include ...

• Apple - Support - Discussions - Hard drive "clunk": From 2005. The clunk behavior probably shortens drive lifespan. No fix.
• Mac Mini drive click [Archive] - The macosxhints Forums: Recommends smartreporter for diagnostics
• ClunKiller - Kill your Hard Drive *Clunk* noises! and Is your Hard Drive making *Clunk* noises?
• XdN » Clicking Hard Drives and Possibly Shortened Hard Drive Life (not clear this is a clunk problem though - PC Only)
• Set Automatic Acoustic Management level on hard drives - Mac OS X Hints (open firmware hacking -- too risky for me)
• Advanced hard drive power management via AppleScript - Mac OS X Hints - obsolete, but an interesting reference

There don't appear to be any easy fixes, and since my mother can't hear it I think I'll leave it be. Most of the complaints are a few years old, so I suspect newer drives don't clunk. I also wonder if it's fixed with 10.6, though drive clunking seems to be a cross-platform problem.

I'll update this post if I learn of a better fix.

--
My Google Reader Shared items (feed)

Subsite filtering - harder than it looks

In general the kids earn supervised computer time, but we have a "learning workstation" that's open access and less supervised. Demand is limited however; the Learning account is restricted to "educational sites". Educational as defined by Dad. The permitted sites are not terribly exciting.

One of the better sites is National Geographic Video. In fact almost all of the Nat Geo site is great -- except for the games. Of course that's also the part of the site that gets the ad revenue, so Nat Geo isn't keen to turn it off.

Naturally the kids just want to play the games. OpenDNS, OS X Parental Controls and the wee firewall built into one of our routers will let me block domains, but not specific URL patterns. So if I block Nat Geo games, I block everything.

Google's not helping me with this one. It doesn't help that the Parental Control software marketplace for OS X is moribund, probably done in by OS X Parental Controls and Steve Jobs presumed personal antipathy to parental controls. I'm also not finding any "home filtering firewall" articles, but that might be a Google problem.

I am also beginning to suspect that selective subsite filtering is technically very hard - or impossible.

I thought I'd try a proxy server with built-in filter controls, but those things are harder to find than the last time I used one about 15 years ago.

So I'm stuck for the moment. I'll update this post if I learn more. Of course eventually the kids will learn the workarounds, but by then they'll either be net solo or I'll have bigger things to deal with.

See also

• Gordon's Notes: Parental controls - not an Apple thing
• Gordon's Tech: Parental Controls - Remote Access and other tips
• Gordon's Tech: Parental Controls - The wikipedia problem solved
• Gordon's Tech: OS X parental controls still broken in 10.5.7 (this bug now fixed I think)
• Gordon's Tech: OS X 10.5: Apple engineers need more children
• Be the Best You can Be: OS X 10.5: time limited computer access
• Gordon's Tech: Can't select Jabber or Google Talk for iChat? Here's one reason.
• Gordon's Notes: The software Apple can't do
• Gordon's Tech: LEGO Digital Designer is pure evil on OS X

Update 3/4/2010: OS X includes Apache server; this post makes it sound relatively easy to use it as a proxy server and use ProxyBlock to control access. Unfortunately it's not clear whether you can control access to a subdomain; I suspect not.

Where did my Access 2007 object descriptions go? SP2 killed them.

Sometimes I have to use Access 2007. It’s always painful, but one of the worst agony comes because there are no object descriptions anymore. It’s hard enough to manage Access entities with object descriptions, but with Access 2007 all of my Access 2003 table and query descriptions are gone.

It’s weird because I swear I used to see them buried away in Access 2007 when I used it a year or two ago. Not in a useful place mind you, but at least they existed.

Turns out Office SP2 killed ‘em off:

After you apply 2007 Office system Service Pack 2, the description of an object does not appear in the Navigation Pane in Access 2007. This problem occurs when the Navigation Pane is viewed by Details.

There’s an August 2009 hotfix for this and sundry other Access 2007 bugs, unlike some hotfixes it is downloadable. I assume it will be included in Office 2007 SP3 when that comes out.

Wicked bug.

MobileMe vs. DropBox

I've been tempted by DropBox, but I signed up for MobileMe (Family!) so I could sync my OS X Address Book with my iPhone via MobileMe. (If you use Exchange Server with the current iPhone you can't do direct sync to a desktop -- I hope that will change with iPhoneOS 4.

Today I ran into a MobileMe file sync problem. The most current version of a file was "stuck" on my MacBook. I couldn't get it to sync to the server. I got a cryptic sync error message, but nothing else.

Eventually MobileMe put up the dialog I was expecting, asking me to resolve a sync conflict.

I'm not impressed. I haven't asked much of MobileMe, but it's already failed me.

I'm going to give DropBox a try -- and keep looking for some other way to manage my address book. I'm hoping I'll be able to drop MobileMe after this year is up.

See also:

• Gordon's Tech: MobileMe: Perspective of a crusty Palm veteran (2008)
• Gordon's Tech: The MobileMe Massacre begins (2010)

My 10.6 iMac is crashing - a debugging exercise

I hate when this happens. It's been a while fortunately.

My now flicker-free fairly new 27" quad core iMac is crashing.

There are two common failure modes. One is that it locks up when displaying photos in the screensaver. The clue is that the same images display repeatedly. The second mode is that iTunes becomes unresponsive, and then the Finder as well. I get the SBOD/SPOD/spinning beachball of death.

If I kill both I can restart iTunes, but not the Finder. I've tried several fixes. First I ran Safe Boot (shift restart). Then I installed the latest version of Onyx and ran the usual clean, check, maintenance, etc. Everything passed but the problems have persisted.

So I've begun uninstalling anything invasive. First I removed CrashPlan, and today I uninstalled 1Password (a quite involved uninstall, see OS X defect: The missing uninstaller).

I've been suspicious of 1Password for a while. I'm also monitoring Console.app, which is full of "missing bundle identifier" Office 2008 related messages. I've found mention of this problem in association with kernel panics last November, with a more recent responses. For example:

... 2/27/10 8:10:35 PM [0x0-0x28028].com.vmware.fusionDaemon[296] 2010-02-27 20:10:35.581 pkgutil[299:60f] PackageKit: *** Missing bundle identifier: /Library/Receipts/Office2008_en_proofing_brazilian.pkg...

Soo why the heck does vmware Fusion put this message out? (com.apple.backupd also complains, but that make sense). VMWare Fusion is doing quite a bit on startup, even though it's "not running".

 Tonight I'll run the Apple hardware test that came with my machine in loop mode. (I think you need to attach a physical kb to get this to work -- holding 'D' on my bluetooth kb didn't seem to do anything.) If the problem persists, VMWare will be the next to go (For example). I want it to run my XP VM, but if need be I can move that VM to a MacBook running 10.5 and Fusion 2. If I figure this one out, I'll update this post.

PS. Bundle Identifier via Apple Dev:

The bundle identifier string identifies your application to the system. This string must be a uniform type identifier (UTI) that contains only alphanumeric (A-Z,a-z,0-9), hyphen (-), and period (.) characters. The string should also be in reverse-DNS format. For example, if your company’s domain is Ajax.com and you create an application named Hello, you could assign the string com.Ajax.Hello as your application’s bundle identifier.

Update:

• I moved the suspicious Office 2008 .pkg files to another drive. I'll see if I can reduce the Console messages.
• I realized that when I drag things to the trash they're being deleted immediately, rather than put in the trash. I found an old article on this that's being cited by 10.6 users recently. Naturally it's a permissions problem. I wonder if it's related to the odd way my account was created when I used migration assistant (long story). I'll try some of those fixes.

Update b: Getting somewhere.

Ok, this is interesting. As described by the X Lab document I was getting the "will be deleted immediately" trash message because I had lost read/write privileges to my home directory. On inspection my User directory folders all refer to an user "_unknown". I think this was a side-effect of how I set up my account, which was:

1. I setup an account called "jfaughnan" on my new machine.
2. After a while I deleted it an migrated the "jfaughnan" account from my old machine.
3. The new account was given the home folder name "jfaughnan 1". On inspection I found that deleting the user "jfaughnan" failed to remove the original home directory.

I'll keep working this one. I also would wonder about VMware messing up my privileges and about migration assistant inheriting known permissions problems from my old machine.


Update 2/28/2010: Went through 18 loops without a problem, so hardware seems good. I'll keep hitting on the software issues - esp. VMWare.

Update 3/2/2010: I thought I was getting somewhere, but today it was unresponsive with a faint glowing blue screen. I tried putting it to sleep by pressing the power button, but nothing happened. Then, on a hunch, I turned off an attached firewire 400 drive. The system responded, then went to sleep. It woke up normally.

On resumption there was an iTunes complaint about loss of Apple Store connectivity. Meanwhile my console showed many instances of this message:

3/2/10 3:45:14 PM com.apple.launchd.peruser.502[155] (com.apple.AddressBook.abd[13839]) Exited with exit code: 1

Now I'm suspicious that 10.6.2 has a problem with sleeping firewire 400 drives. Spanning Sync and MobileMe get frownies too because of the Address Book message, and Time Machine because my last TM backup concluded just before the lockup.


Update 3/11/10: It's still locking up, sometimes with awake from sleep and sometimes with switching users. It might be less frequent - maybe once a week. I'm suspicious of VMWare 3.02 on 10.6.2. I don't see any useful Console messages. I will try restarting the machine every few days as a prophylactic measure. Maybe 10.6.3 will help, it should be out soon.

Update 3/12/10: Got the faint blue screen, and again turning off the external drive did the trick. The screensaver slideshow uses that Firewire 400 drive. I ran Disk Utility and cleaned up permissions on the drive. It's set to ignore ownership. Looks like yet another OS/firewire problem.

Update 3/13/10: Found iTunes was not responding. Time Machine backup not working. When I tried to add a share got spinning beachball (noted, however, a share reference to a user account that was deleted - bug there). Console said slide show found a corrupted jpeg. Unable to shutdown -- until I turned off external firewire drive. I think 10.6 and new iMacs have serious problems with Firewire 400 enclosures. Errors seem to cause the OS to blow up - perhaps some kind of memory overow issue.

Update 3/13/10b: Huge discussion thread on firewire issues in 10.6. I think I found my problem.

Update 3/13/10c: Apple just truncated the massive firewire complaint thread. Really, it didn't have anything to do with me. I guess they took care of that problem. I've switched to USB for now, I'll try firewire again with 10.6.3.

Update 3/29/2010: Same crash - locked up screen saver - but this time I was using a USB drive. Turning the drive off then on again cleared the problem. So this isn't a firewire problem after all! It's a screensaver and external drive bug. The console is showing "corrupt JPEG data", but that might just be from power cycling the drive.


Update 5/12/2010: I think this was fixed by 10.6.3. I haven't seen it since. I only have a USB drive attached however, so I can't rule out a Firewire bug. The "corrupt JPEG" console message was a red herring caused by loss of the drive when trying to display in the screensaver.

Update 10/27/2010: Things have been pretty stable since 10.6.3.

OS X 10.6 bug: persistent reconnection

I don't recall running into this problem with 10.5.

I want to connect to a network share using my remote machine user name and password. Snow Leopard, however, insists on connection using my MobileMe user name. If I disconnect, it simply reconnects.

I've yet to find a workaround.

--
My Google Reader Shared items (feed)