Java on the Mac is malware - and how to turn ALL of Java on or off as needed.

US-CERT recommend disabling Java in all web browser on all platforms

... This and previous Java vulnerabilities have been widely targeted by attackers, and new Java vulnerabilities are likely to be discovered. To defend against this and future Java vulnerabilities, consider disabling Java in web browsers until adequate updates are available. As with any software, unnecessary features should be disabled or removed as appropriate for your environment...

They don't mention removing Oracle Java [3] entirely, and they don't specifically address the Mac. By nature, they must be sober and governmental.

I am not so constrained. I can just say ...

DO NOT PUT ORACLE JAVA ON YOUR MAC ANYWHERE, ANYTIME. IT IS MALWARE.

Let me name the ways:

1. It always installs for all users. You can't install for a single user.
2. It installs with root privileges in System/Library, not /Library as it should.
3. There's no uninstaller for Oracle Java and Oracle's online instructions for manually uninstalling Java 7 only uninstall the browser plugin. Full Oracle Java uninstall requires sudo/root privileges.
4. The Preference Panel is merely a pointer to Oracle's ugly control panel, and that control panel disregards OS X Admin/User/Managed User controls. Any user can enable Java plug-in. You can't turn off all Java, just the plug-in.
5. You can disable the Java plug-in in Safari or Chrome, and in Chrome you can use Fretty's brilliant Click to Run Extensions in Chrome tip, but you have to do this for every user on a Mac, and they can all turn it back on regardless of privileges.

Even if we didn't know about Java's global record of frequent security failures, the implementation of Java on Mac reeks of hacks, bad design, and high risk.

This thing is bad, and most recommendations for managing the risks on a Mac are inadequate. There's really no way to make this thing safe even if:

• In Java control panel: uncheck run Java in browser
• In Safari: Security - uncheck Java
• In Chrome: Disable Java in PlugIn and also Click to Activate (Flash PDF)

I have to put Java on my MacBook Air for work reasons, but based on what I've learned I'm hunting it down to remove it from every machine at my home. Java-dependent Mac apps are unacceptable (Sorry Crashplan, Fugu, XMind and more).

 

Meanwhile, on my Air, I'm going to see if I can sudo into /System/Library/Java/JavaVirtualMachines/1.6.0.jdk/Contents/Home/bin/java and rename the Java Folder to Java_DIE to prevent it from running except when I absolutely need it. [1] [2] See Update below.

See also:

• Gordon's Tech: The post-Flashback era: removing Java and Flash from OS X 4/2012
• How to disable Java on your Mac | Macworld:
• JDK 7 Mac Install (Oracle)
• Mac Java FAQ (Oracle)

[1] su [admin_user_name], sudo mv Java java_die does the rename, but I think I need a permission fix.

[2] via GigaOM: Mac Apps that need java: Minecraft, Runescape, CrashPlan, Illustrator, OpenOffice, NeoOffice, FreeMind, Xmind, Gantt, Vuze, Screenr, Cisco and Juniper VPN Clients.

[3] - added 2/24/2013: I added the word Oracle here, because there's a big difference between Oracle/Sun's Java on the Mac, the Java JRE on the Mac, and the Java language. From a security perspective the language is no worse than most alternatives and better than many. The JRE is problematic because it bypasses the App Store/SignedCode framework that is our current best hope for the future of personal computing, but that's similar to distribution of any software outside of the App Store. The real crime is the installation of the JRE into System with root privileges.

Update 2/23/2013 (rewritten):

I asked on app.net about a way to turn ALL of Java on the Mac on or off as needed. alextrott replied and recommended these terminal commends to enable and disable (Since sudo -u doesn't seem to work on Mountain Lion, if you run from a non-admin account you have to enter "su YourAdminAccountName" first.):

disable

• sudo chmod 000 /System/Library/Java/JavaVirtualMachines/
• sudo chmod 000 /Library/Java/JavaVirtualMachines [on my machine this is unnecessary, there's nothing there]

enable:

• sudo chmod 755 System/Library/Java/JavaVirtualMachines/  
• sudo chmod 755 /Library/Java/JavaVirtualMachines [on my machine this is unnecessary, there's nothing there]

Alex tells me he's working on a small Mac app to toggle Java on or off as needed.

When I tried this on my Mac chmod 000 did disable Java. XMind wouldn't run. However my attempt to reenable failed; probably due to user error.

Which was when I realized I could easily do this in the Finder:

I can set JavaVirtualMachines to allow No Access or Read & Write. With No Access XMind won't run, with Access it will. I put a shortcut to the Java folder on my desktop for easy access to this JVM Folder.

Update 8/29/2013: With Mountain Lion as of 8/2013, if type 'java' at the command line OS X will download Apple's version of Java 6 and will remove the old preference panel. (It's not supposed to install a browser plugin). If you go to Oracle's site and install Java 7 you get their preference panel.

Oracle's Java 7 can be uninstalled -- albeit with difficulty. (Plugin is easy to uninstall, Java 7 is not easy.)

Apple's Java 6 cannot be uninstalled. It has permissions like this:

- system: read & write

- wheel: read only

- everyone: read only.

Curiously when I unwittingly installed Apple's Java 6 there was no option from a non-admin account to set Privileges to 'No access'. From an admin account I could set to "no access" or "write only" but command line java still ran. So clearly there's much of this I don't understand.

Flickr has a Snapfish problem

I've been hearing reassuring sounds on app.net about Flickr's resurrection. Since I've been unhappy with Picasa Web's disinterest in Aperture/iPhoto the app.net support meant I gave Flickr a try. Not least because Aperture has built in Flickr sharing features.

I signed up for the 3 month pro service. It auto-renews, but if you "cancel" you effectively turn off the auto-renewal and continue the term of your subscription.

I liked the Aperture integration, but Flickr felt old and clumsy. Worse, the sharing settings are difficult to revise for Sets, and there's no true equivalent of Google's share-by-unguessably-large-unique-URL.

I could live with that, more or less, but Snapfish did me in. 

Twice I sent "Sets" to print via Snapfish, and twice a few photos were "unavailable" (all seemed well in Flickr). Worse, when I tried to delete my new Snapfish account, I learned terminating a Snapfish Account isn't easy. That's a flagrant violation of clause 1 of Gordon's Laws for services.

Since I couldn't delete, I set a very long password, removed all my photos, and tried to change my email to my spam account. Alas, now I was forced to enter a (fake) postal address. 

Sorry Flickr, that's too many problems; I'll suffer with Picasa a bit longer. Call me back when you have a different print partner.

Pre-Lion Macs: Go iCloud or Google?

It's been a while since I reviewed the PIM world [1], but a post on CardDav sync between MacOS Mountain Lion (10.8) and Google Contacts brought me up to speed. In particular, I thought about the special case of a pre-Lion Mac user (Snow Leopard and Leopard especially - 10.6 and 10.5). I'll assume for the purposes of this post that every Mac users also has an iOS device.[2]

Every Mac/iOS user has to choose between Google and Apple for Calendar and Contacts (and thus Email). On Mountain Lion (or Lion) the choice is more difficult; those operating systems can work directly with Apple's iCloud. So it's not a slam dunk decision [3].

On pre-Lion Macs however, the choice is fairly easy. Older Macs can't use iCloud sync or data services at all; they can only access the web interface to iCloud Contacts and Calendars. On the other hand, even old Mail.app can use Google's (troublesome) IMAP services, and old versions of iCal can more or less interoperate with Google Calendar. Google's web interface to Contacts is crude, but their Calendar web services are much more robust than iCloud calendar. If there were any doubt, Gmail and Google Docs would seal the deal [7].

So, if you're an iOS/Snow Leopard user you can (mercifully) forget about iCloud. You need to use Google; for maximal Google compatibility SL users can even install Chrome [5].

You still have one choice though. You can:

• pay for Google Apps ($50/year) and use ActiveSync [4] on your iPhone and web UI on your Mac with optional user of iCal (CalDAV) and Mail (IMAP) on the desktop [6]
• use ad-supported Google Services and use web UI on Mac and the standard sync services for iPhone or Mac: CalDAV (calendar), IMAP (Mail), CardDAV (iPhone, not Desktop alas).

I don't think ActiveSync is necessarily superior to CalDAV/IMAP/CardDAV any longer -- but it is simpler to setup on the iPhone. Still, that's not enough to choose between paid and ad-supported. The main thing you get for your $50/year is freedom from ads and phone support. The last isn't a small thing.

Snow Leopard users used to feel abandoned and left out. No longer! Sometimes lack of choice is a feature. Apple has spurned you, Google awaits with open arms. What are you waiting for?

--

[1] PIM: Personal Information Management. Always includes Calendar and Contacts; since PalmOS usually tasks and notes (or equivalents). In the 90s it was mostly PalmOS and Palm Desktop for me, in 2013 it's a bit more complex:

• Contacts: iOS/iCloud/MacOS/Win7OutlookExchange via ActiveSync + Google/MacOS via CardDAV
• Tasks: Todo.app/Toodledo via proprietary + iOS/Win7OutlookExchange via ActiveSync
• Notes; Simplenote/Notational Velocity
• Calendar: iOS/Google via ActiveSync + iOS/Win7OutlookExchange via ActiveSync

I've simplified a few of those connections. I think we're starting to hit the boundaries of human cognition.

[2] If you're Mac/Android you have to Go Google. Mac/RIM or Mac/Microsoft -- you're on your own and you're used to being hard core.

[3] I've largely gone Google myself.

[4] I don't think Google offers free versions of Google Apps any longer. I'm from the early generation when it wasn't hard to end up with a half-dozen App/Domain combinations all of which were grandfathered in to ActiveSync support.

[5] Real old Mac users may want to try Camino.

[6] It's not clear to me that Google Apps users can use CardDAV services.

[7] iCloud can still be used for iDevice backup and media services, but trusted friends tell me the backup is unreliable.

Google Contact Sync on Mountain Lion and iOS - CardDAV (Project Contacts 2013)

I'm rather late to this party [6], but around the time Google ended ActiveSync support for unpaid accounts [1] they added vCard 3 (1998) based CardDAV support [3]. Up until then one could sync iOS and OS X mail and Calendars via IMAP and CalDAV, but Contact sync was only via Active Sync. [2]

TUAW has some details and Google's iOS CardDAV instructions are here.

As we all know, synchronization is hell. Even if Apple and Google actually used the same vCard spec (probably vCard 3, 1998), and even if they agreed on newline characters, they still have to deal with distinctions between their internal data models and vCard. Some of those data model gaps are non-computable. [5]. Even thought Google and Apple have similar 'Group' models that relationship metadata is ignored [8].

That said, at least CardDAV is relatively Apple friendly. Most importantly, this standard means, for the very first time I know of [7], there's a somewhat supported way to synchronize Contacts between Google and OS X Contacts and iOS contacts.

I've begun using it on Mountain Lion. Since I use Google two factor authentication I had to use one of their totally-defeats-the-purpose-giant-security-hole-not-single-use-god-i-hate-passwords-humans-are-losing-the-battle alternative passwords. There was some kind of transient authentication glitch but on a second try it worked. After a few minutes I had all 634 of my Google "My Contacts" on my Mac. Because of the long history of my Google/Apple Contact sync efforts (See Also, below) these largely duplicate my Address Book/iCloud contacts -- but Mountain Lion Contacts.app seems to merge the duplicates when I search [9].

This looks promising in a terrifying sort of way. You can drag and drop contacts between the iCloud and Google Contact lists; they'll be copied.

So what about Snow Leopard? Many fine machines run Snowie (and should not upgrade to Lion even if they theoretically can). They're (more or less) cut off from iCloud. Does CardDAV sync work with Google now? I wonder about adopting Hsiaio's technique, but so far the answer is no (same with Yahoo CardDAV). I didn't find much research on this question, but I suspect it's a combination of 10.6 bugs and SSL requirements. [9]. There is some limited Google Contacts sync on Snow Leopard that some still use.

- fn - lots

[1] Google grandfathered my half-dozen Google Apps accounts and recently extended the termination date for non-Apps users.

[2] Google says Google Apps accounts should use "Google Sync", which is their implementation of Microsoft's Exchange Server derived ActiveSync (with different bugs one assumes).

[3] vCard over HTTP/WebDAV. vCard has been Apple's Contact/Address Book export option for as long as I can recall, so it may be a good match to their Contact data model. CardDAV is also used by Apple's ancient Address Book Server. vCard 4 2011 has old-style and XML representations, but I suspect Apple, like Google, is more or less on 1998's vCard 3.

Google's vCard implementation has limits; worse the only partly implement the 1998 vCard 3 spec: "why did Google move the ADR extended address "Oak and Pine" into the street address component? And worse still, why did it separate the two using an '\r\n' (CRLF) sequence? The VCard 3.0 specification clearly states that CRLF must be escaped by the single escape sequence '\n', not by '\r\n'".[4]

[4] Reading the last line of [3], by the way, a penny dropped. Apple changed the way they handled CRLF and vCard between MobileMe and iCloud, with near-disastrous consequences for my OS X Contacts. By Darwin, I hate the ancient DOS/unix/mac line newline debacle.

[5] Meaning data loss is inevitable, transferring a Contact between systems won't return the original. Incidentally, under my TrueName, I've spent 15 years dealing with interoperability issues in healthcare - from HL7 to TermInfo to SNOMED/RxNORM and back again via cCCD and the like. If you understand why CardDAV is hard, then you have a glimmer of a smidgen of a hint of an idea why we don't have true interoperability between EpicCare and Cerner -- and why we won't for decades.

I think the people who trudge away on vCardX are heroic figures who should be carried upon our shoulders. Forget Ive, these people do the work I rely on.

[6] The marketing/interest problem is unsolved -- largely because of the spam/advertising counter-current. I'm very interested in productivity software and I follow a number of related feeds; but I still miss news like this.

[7] Check out "See also" - lots of history here.

[8] Looking at Apple's braindead implementation of iOS Contacts and Groups I'd pin this failure on Cupertino and Apple's corporate silos.

[9] A friend of mine has a 10.6 MacBook and needs to use Google's world (as do we all). I think the easiest way to manager her Contract migration will be to get them to iOS/Google and then use Gmail web on Mac. I may put them on an account on my ML machine to help with cleanup.

[9] So which gets edited when one clicks "Edit" in Mac Contacts.app? Don't ask those questions. OS X doesn't say.

See also - via Gordon's Tech

Yeah, I've been fighting this war a long time. February 2009, almost exactly 4 years ago, was a big series of battles, but the 2008 PalmOS to iOS migration was probably the worst (later there were tools). I've read recently that Apple is an intensely siloed company -- that explains why iOS and OS X contract integration is so very bad.

• OS X 10.6: Synchronizing Address Book to Google Contacts 9/2010 - Snow Leopard sort of synchronized to Google Contacts, but Apple never finished the job.
• Migrating Contacts from Outlook/Exchange server to OS X Address Book via MobileMe: 8/2011. MobileMe was working well when Apple killed it.
• How I synchronize OS X Contacts with Google Contacts and my iPhone 1/2011: I was using Spanning Sync to connect Google Contacts to a set defined in an Address Book Group. I did that for about a year but I think it foundered on OS X and iOS updates. Eventually Spanning Sync gave up -- understandably. I still use and recommend their Contact Cleaner.
• Googaby: Novel approach to Google Contacts and OS X Address Book integration 2/2009: It's still sort-of-living, but I think Lion killed it (Lion was an impressive killer). I haven't tried it.
• OS X Address Book to Google Apps Contacs using Google ActiveSync 2/2009: It didn't quite work.
• iPhone sync to Google contacts - 3 methods and work/home implications 11/2008: Five years later we are still struggling with the same issues.
• Project Contacts: Integration across iPhone, Google and whatever 2/2009: Slow progress indeed. Contacts have been hard.
• Project Contacts: Now mixing Outlook/Exchange, PST file, Outlook/Home, MobileMe Sync, OS X Address Book and the iPhone. 5/2009. Shudder. More struggle.
• MobileMe: Integrating Work and Personal Contacts 5/2009: MobileMe was pretty good around mid-2009 and then continued to improve. iCloud still isn't up to that mark.
• iPhone Google Sync - Mail and Google Apps and Google saves my iPhone 2/2009: Did a lot that month! Google's original ActiveSync implementation saved the iPhone for me. I was ready to toss it out a window.
• Work home contact integration: Outlook to Google to OS X Address Book
• I try NuevaSync on my secondary iPhone 2/2009: They are still around. Alas, no OS X support.
• MobileMe to iCloud - Is Apple getting nervous? 5/2012: I keep reading how much better iCloud is than MobileMe. That's not my experience.
• iCloud transition went as expected - disastrously 6/2012: My Battle of the Bulge. Ugh.
• Consolidating Contacts: From Outlook to Address Book via MobileMe and the 5th Circle 9/2011: Migration from Outlook. Has to be a better way.
• Sync heck: CalDAV vs Exchange Server - a Google Apple review 2/2010: These days CalDAV might be ahead, but each has merits. I'm still on ActiveSync, but in 11/2009 I tried it the other way: Big switch on my iPhone sync: CalDAV and Exchange server.
• Plaxo - just not a good feeling 5/2009: Now we surrender everything at the drop of a hat. They are still around.
• MobileMe, Microsoft Outlook, Exchange, iTunes and yes, sync Hell 10/2008. I'm having flashbacks now.
• Palm to iPhone migration - address book and notes: 8/2008. Moving from Palm to iOS was exquisitely hard.

Facebook albums: How to choose which photo will appear on the timeline view of the album (primary photo, key photo)

I don't put that many albums on Facebook, but whenever I do I spend at least five minutes trying to remember how to change the album picture that appears on the timeline when the album is published.

The problem is there are many edit menus associated with Facebook photos. There are menus that appear on the photo, menus for photo descriptions, menus for editing albums and so on. The one you want is the edit menu associated with the timeline item, not with the album or the photo:

19+ Facebook Timeline Features and Resources You Should Know!

... To switch it with another photo, click at the pencil icon and select ‘Change Primary Photo’. You can then use ‘Reposition Photo’ if your selected picture doesn’t fit in properly."...

Now I might remember.

Brother HL-2270DW out of toner workarounds and admin screens

I just bought an HL-2270DW to replace a 2140 at drum end-of-life. This review is excellent (here is my short one), Wirecutter recommended it as best cheap laser printer and Brother drivers seem better behaved than most. User manuals are here.

I've have preferred the lower print costs of a higher grade printer, but the Brother model I considered draws too much current for many overloaded home circuit breakers.

Like most Brother printers (all printers?) it will stop printing when toner is "low" -- typically a few hundred pages short of an empty cartridge. With the 2140 I could cover an optical sensor and order a new ($$) cartridge. That doesn't work on the 2270; this page provided 3 options which I've revised here:

1. The unscrew and rotate method
2. Press the GO Button 7 times (quickly). " All of the LEDs should flash twice, and the Ready LED should turn on." Repeat to revert.
3. Use the web GUI to change the Replace Toner printer setting to "continue" instead of "stop"

I like the last one. I used Bonjour Browser to find my printer's IP address, but I don't recommend this [2]. Instead read the Network guide/manual. In OS X  I used Open Print Queue I clicked a button called "Show Printer Webpage ...". That did the trick; OS X resolves the Rendezvous URL to the correct network address.

Click printer settings (un/pw is user/access) then change the Replace Toner settings. There are other settings  and reports of interest as well [1].

I left the settings on Stop -- when the printer stops I know to order a new cartridge; I can change the settings then.

PS. The printer is supposed to come with an optional sticker that explains various flashing lights. I found mine floating about the floor. Watch for this when unpacking.

[1]

• Drum Unit is rated for 12,000 pages, memory size is 32MB.
• The Administrator pw is admin/access. You can use this to change both the Admin (admin/access) and User (user/access) credentials if you wish.
• You can give the printer a static IPv6 address (good luck)
• It has NetBIOS support (brings back nightmares)
• BRAdmin uses the printers SNMP services
• It has an FTP and TFTP server with mDNS and LLMNR (who needs all this in a home printer?!)
• It has an SMTP service and a POP3 Server?!! - presumably for notifications (but why POP3?). You just know that this would feature in some evil network hack.

From the Network Guide supported protocol list:

(IPv4) (IPv6) 1 10/100BASE-TX IEEE802.11b/g (Infrastructure Mode / Ad-hoc Mode) ARP, RARP, BOOTP, DHCP, APIPA (Auto IP), WINS / NetBIOS name resolution, DNS Resolver, mDNS, LLMNR responder, LPR / LPD, Custom Raw Port / Port 9100, IPP, FTP Server, SNMPv1 / v2c, HTTP Server, TFTP Client and Server, SMTP Client, ICMP, LLTD responder, Web Services (Print) NDP, RA, DNS Resolver, mDNS, LLMNR responder, LPR / LPD, Custom Raw Port / Port 9100, IPP, FTP server, SNMPv1 / v2c, HTTP Server, TFTP Client and Server, SMTP Client, ICMPv6, LLTD responder, Web Services (Print) APOP, POP before SMTP, SMTP-AUTH WEP 64/128 bit, WPA-PSK (TKIP/AES), WPA2-PSK (AES), APOP, POP before SMTP, SMTP-AUTH Wi-Fi Certification Mark License, Wi-Fi Protected Setup (WPS) Identifier Mark License, AOSS Logo

I wonder if it's running Linux.

[2] After I ran Bonjour Browser ML persisted in showing the Rendezvous identifier for the printer as a "SHARED" item in the Finder left bar. I had to run BB again, and twiddle with reload services, to make it go away. I think BB might need an update -- in one config screen it refers to "Jaguar".

Update 2/21/2013: I had to do this when the "starter" toner ran out and the real cartridge didn't arrive. First times I tried setting the web config to 'continuous' instead of 'stop' it failed with a 'printer busy' message. I paused the queue and restarted the printer and I was able to change the setting.

Update 4/4/2013: I bought a TN-450 2,600 page extended cartridge, and after 200 pages I have a toner light. I wonder if it was a counterfeit -- though I did buy it through Amazon direct. Alternatively it or the printer may be defective. Alas, it's 4 days past the return period so I'm stuck.  Looking at the 1 star reviews I'm not the only user to run into this. 

Update 5/21/2013: These aren't counterfeit cartridges, we really are only getting 600 or so pages per $55 cartridge. See: Gordon's Tech: Is Brother running a scam with its HL-2270DW printer and TN-450 toner cartridge?

Sharing a credential store for a family (or small business) - and the end of the personal database

I have managed family credentials and web site data in a FileMaker database since 1996 [1]. That database now holds over 1600 records, of which at least 1200 are historical (dead accounts, obsolete urls). The historical items don't get in the way as much as one might think, and I kind of like this mini-history of the net.

This repository has survived many technology transitions. Over the past 10 years it has more-or-less synchronized with credential stores running on PalmOS and iOS. At some times I've used FileMaker sharing (web publishing and the IP based fmnet: protocol) to allow my wife to access and edit both of our credentials too. (I am too boring to have any secrets, and it's critically important that she have credential access if I'm unavailable -- as in dead.)

Alas, all things must come to an end. FileMaker and its half-baked replacement "Bento" are both dying. Filemaker Go, which I'd like to use on my iPhone, doesn't support true synchronization. Bento is supposed to have some synchronization capabilities with iOS clients, and there's some form of encryption on the desktop version, but I don't know of anyone using this product. Bento feels stillborn.

So while I could probably cobble together a solution using some combination of FileMaker licenses ($180+ each) and or FM 12 web sharing (Mountain Lion broke FM 11 web sharing [2]) -- but then I'm investing in a dead technology niche.

There are other issues with the way I use this credential store. I've been maintaining it in FileMaker and exporting to 1Password for iPhone access, but that means my iPhone repository is read-only. The update loop is slow; sometimes I don't have credentials on hand.

It's time to move.

After consultation with appnetizens there appear to be 3 solutions:

1. Use 1Password with Dropbox. (I'm still on iPassword 2, but it works similarly. I don't mind upgrading anyway.)
2. Use some other Cloud solution, such as shared Google Doc or Spreadsheet, Simplenote, etc.
3. Use 1Password on her iPhone only (see below). [1Password 2 only - see update.]

The first two require the Cloud. I don't like that - for several reasons [3].

That leaves option 3, and that only works because 1Password runs constantly on my always-active account and 1Password on the desktop can support multiple iOS clients. It's not perfect as it gives her credential access only via her iPhone; but since we do use Google Sync that's less of a problem than it might be [4].

I think we'll try option 3, which implies I'm going to treat 1Passwords as the "source of truth" and slowly archive my last FileMaker database -- and then FileMaker itself.

RIP old friend.

Update:

• I'm using 1Password 2.x - WiFi sync is complex and error prone but I was able to get it working. AgileBits really recommends DropBox. It wasn't clear from the limited documentation that it actually supported multiple devices, but it appears it does.
• I discovered 1Password 3 has local synchronization at all!  There is unidirectional iTunes based file transfer only. So option 3 only works for people with 1Password 2.

Well, that's interesting. Technology transitions are rarely smooth. It's not clear that there is a non-Dropbox solution any more. I think I'll keep Filemaker on life-support a bit longer.

 

Incidentally, There's something disturbing about how 1Password syncs. Watching the behavior it's almost as though it replays every transaction that's every occurred on 1Password desktop; implying it still keeps fully deleted credentials. When I updated the cache 10,000 records were processed for 1,500 credentials. Looking at my backup history the agilebits keychain file is growing at a rate consistent with retention of deleted credentials. I think the only way really clean it out is to delete the keychain and start anew.

--

[1] FileMaker is a survivor from the pre-net era of software, when geeks used personal databases for address books, recipes, PDF based document management, record and CD collections,  archives of thousands of stapled paper medical journal article archive indexing with pre-web "Grateful Med" MEDLINE metadata (Grateful Med), club memberships, and much more. With a relatively large user base FileMaker was then quite affordable.

I will now interrupt this post to admit that review of those web 1.0 pages, and particularly the data store transformations of the past 8 years, has given me a dose of old-guy future shock. When I started researching this topic I didn't realize I was also writing an obituary for the personal database!

It has been one hell of a ride from my 1990s FileMaker article file to Google and the Strata conference I'll be attending in Santa Clara this month.

[2] I tried reenabling Apache on ML using a freeware pref pane. Apache ran, but FM web sharing still didn't work. Looking at the FM 12 writeup I think it barely works even there.

[3] Example: An encrypted database store is forgotten in the cloud. Six years from now, when Dropbox's assets have been acquired by the Russian mafia, 2012 encryption is trivially broken. I don't want this store public even in 2019. Not to mention the LastPass breach.

[4] So why do I allow that form of Cloud use? Good question.