Monday, July 24, 2023

macOS 13.5

Juli Clover (release notes, security, enterprise, developer, full installer, IPSW):

According to Apple’s release notes, macOS Ventura 13.5 introduces important bug fixes and security updates. Apple recommends that all users install the software.

There are no notable feature changes or standout bug fixes in macOS Ventura 13.5, and work on the operating system is wrapping up.

After several updates that worked automatically, I’m back to having to apply the update manually using sudo softwareupdate -irR because it kept failing from System Settings.

See also: Mr. Macintosh and Howard Oakley.

Previously:

Update (2023-07-28): Howard Oakley (tweet):

Thanks to Maurizio for pointing out a serious bug in 13.5: in System Settings > Privacy & Security > Location Services, all third-party apps have been omitted from the list of services you can control.

Update (2023-07-31): Howard Oakley:

Ever since its introduction in the first betas of Ventura, System Settings has been dogged by inattention to detail. Its most significant omission from the first release of 13.0 was support for network locations, which was belatedly added back in 13.1, camouflaged in a popup menu under an ellipsis so obscure that most don’t even notice its existence, and assume it’s still missing.

Loss of control over Location Services in apps is the more serious because there’s no command tool to act as substitute.

[…]

If experience is anything to go by, Apple now seems to delegate most pre-release testing and checks on macOS to third-party beta-testers, and depends on their reporting of issues using Feedback. When we fly, we expect the pilots and engineers to perform thorough checks on the aircraft and its essential functions before declaring that flight ready for takeoff. If they instead walked through the main cabin asking some of their passengers whether they thought everything seemed OK, would you fly with that airline?

Since updating to macOS 13.5, I get at least one crash of transparencyd per day.

Update (2023-08-11): Juli Clover:

Since July, there have been complaints from macOS Ventura users who updated to the new software and then were unable to access and control location permissions for first and third-party apps.

Update (2023-08-23): Howard Oakley:

This was just the wrong time for the bug introduced in macOS Ventura 13.5 that effectively paralysed access to Location Services until it was fixed in last week’s update to 13.5.1. Although not a crashing bug, memory leak or kernel panic, its effect was disastrous. For over three weeks, every Mac that was kept up to date with Ventura lost all user control over access given by macOS to location and related data.

Those who installed some software like Little Snitch were unable to authorise its access to Location Services, while other apps, notably those already installed, were automatically given access without the user having any say in the matter. For a corporation that places privacy and its protection at the heart of its products, this was surely catastrophic: in the latest release of its current computer operating system, the user had absolutely no control over which apps were given access to their location data.

[…]

No, the root cause was an intentional design choice that makes all privacy protection vulnerable to a single point of failure. […] Yet the only tool that works with those privacy settings controlled by TCC, tccutil, is deliberately stunted so that all it can do is reset them, and there isn’t any tool to work with Location Services.

Previously:

6 Comments RSS · Twitter · Mastodon

> After several updates that worked automatically, I’m back to having to apply the update manually using sudo softwareupdate -irR because it kept failing from System Settings.

That's very Windows XP. Seems like there's still more work to do!

To those running Ventura, how do you find its bugginess and overall UX compares to, say, macOS 10.13 or 10.14?

@Bri Ventura is better than Catalina, but High Sierra was by far the least buggy of the recent releases.

Yep, I would say 10.15 Catalina was a low point. 11.0 Big Sur was better, which may be counterintuitive given its visual overhaul (I guess Catalina was the one that overhauled the underpinnings).

12.0 Monterey and 13.0 Ventura have been mostly fine for me. Its screensaver glitch wrt multiple displays doesn’t make for a good show among colleagues, though.

Apple is aware of the broken Location Services bug, a potential fix is currently in preparation and will be available soon. The Cupertino-based company is also working on two other fixes after users reported an inability to put their Macs into sleep and missing notifications from Software Update and App Store.

An upcoming macOS 13.5.1 update containing the 3 aforementioned fixes is expected for release next week.

The question for me is _why_ this broke in 13.5. Was this to fix a different privacy issue? Some security hole?

Was it an attempted backport of something from the 14.0 betas?

In both cases, shouldn't there have been _something_ location services- or tcc-related in their diff to tell QA to take a quick look at whether configuring location services still works?

>Yet the only tool that works with those privacy settings controlled by TCC, `tccutil`, is deliberately stunted so that all it can do is reset them, and there isn’t any tool to work with Location Services.

I suppose they could add a mechanism where `tccutil` _can_ be used to configure location services, but only while you're in Recovery.

There's a 13.6 RC (there were no betas of it before that), and oddly enough, they haven't yet cherry-picked the fix — so, thus far, the 13.6 pre-release _brings back_ the Location Services bug.

Leave a Comment