So why on 4 January 2018 was Apple pushing out a silent update to those settings files which it had apparently created over 15 months earlier?īy an odd coicidence, I happen to have a copy of earlier versions of those files: while the paths file in Compatibility.bundle hasn’t changed, ist has, adding /usr/lib/libgutenprint.2.0.3.dylib to its blacklist for migration, and changing its internal version number from 10.12.155 to 10.12.156. Oddly they, and all the other items installed on 4 January 2018, are listed with modification dates of 24 September 2016. The ‘action’ files in those are ist (in amework), and paths (in Compatibility.bundle). These aren’t of any use in day-to-day security, but determine which files are treated as compatible when migrating systems. These included a complete new Resources folder for /System/Library/PrivateFrameworks/amework, and new Contents for /System/Library/Sandbox/Compatibility.bundle. It was quite a substantial update too: according to Suspicious Package (looking at that BoM), there was a total of 89 items weighing in at 1.3 MB. There were no other updates installed from Apple even near that date: the last before it was on 14 December 2017, and the next after it was Safari 11.0.2 update on 8 January 2018. I’ve combed my logs, and there’s no evidence that my Mac was restarted until a couple of days later. Now, ten days later, I can’t remember what might have happened at the time. What’s more, that update replaced some files which are protected by SIP. There, on 4 January 2018, was the BoM for an update to the OSX1012IncompatibleAppList, which doesn’t appear in the system install history. It was, again, an accidental discovery when I was rummaging through Bill of Materials (BoM) files in /System/Library/Receipts, on my iMac17,1 running 10.12.6. Now it has brought a mystery: how Apple can push such a silent update that it doesn’t even appear in the list of installations?

There hasn’t been a repetition since, but watching what gets installed behind my back enabled me to detect Apple’s nudgeware that is still irritating many users who haven’t yet upgraded to High Sierra. It broke the trust that I had placed in those silent updates.

That fiasco – in which Apple had pushed an update to its list of blocked kernel extensions which disabled one of its own Ethernet drivers – taught me that I needed to keep tabs on them. I hadn’t really taken a great deal of interest in Apple’s ‘silent’ security updates until the morning one kindly disabled my wired Ethernet port.

There Is No Light for mac instal