Apple Releases Mac OS X 10.3.4 Update — Apple has released Mac OS X 10.3.4, a free update for owners of Mac OS X 10.3 Panther. (A similar update was also released for Mac OS X Server 10.3.) Apple says the update addresses issues in Mail, Safari, Address Book, Stickies, QuickTime Player, and DVD Player; and improves behavior with iPods connected via USB 2.0, mass storage devices, and video cameras connected to PowerBooks via FireWire. The installer also reportedly incorporates recent security updates (although Adam was prompted to install the latest security update on one Mac even after installing 10.3.4), improves file sharing and directory services, and fixes some disc burning oddities. The update is available via Software Update, which requires a 41 MB download. A standalone installer is available as a 39.5 MB download to update from Mac OS X 10.3.3, or as a 79 MB combined update for any earlier version of 10.3. [MHA]

<http://docs.info.apple.com/article.html? artnum=25764>

<http://www.apple.com/support/downloads/ macosxupdate_10_3_4.html>

<http://www.apple.com/downloads/macosx/apple/ macosxcombinedupdate.html>

Creo Six Degrees 2.0 Supports More Email Programs — Creo has released a major update to Six Degrees, their utility for connecting related email messages, files, and people for coherent project management. The most important change is that Six Degrees 2.0 now works with email programs beyond Microsoft Entourage, including Apple Mail and Eudora. It achieves this functionality by communicating directly with your POP or IMAP server to retrieve a copy of every message. Once Six Degrees 2.0 has imported mail into its own database or retrieved and indexed messages, it provides a Web browser-based interface for tracking a project’s related email messages, attached files, and more. Other features include full-text searching of messages, to-do lists, and integration with Creo Tokens (see "Creo Eases File Sharing with Tokens" in TidBITS-707). A somewhat-limited Six Degrees 2.0 Lite Edition is a free 13.4 MB download; the $100 Personal Edition (a free update for Six Degrees 1.x customers) adds additional features such as support for an unlimited number of projects, importing from Microsoft Entourage (the free version imports only from Eudora and Mail), links that initiate reply/forward actions in your default email client, and the capability to delete items. [ACE]

<http://www.creo.com/global/products/software_ solutions/creative/six_degrees/>

<https://tidbits.com/getbits.acgi?tbart=07449>

Ergonis’s KeyCue Offers Keyboard Shortcut Cheat Sheet — KeyCue is a simple but ingenious Mac OS X application from Ergonis Software, makers of the invaluable PopChar X (see "Panther-Prepared PopChar Published" in TidBITS-699). Taking advantage of Panther’s Accessibility API (which I described in "Scripting the Unscriptable in Mac OS X" in TidBITS-670), KeyCue reads through the menu items of the frontmost application, finds those that have keyboard shortcuts, and displays a window listing them when you hold down the Command key for a few seconds. A serious shortcoming of the menu paradigm, after all, is that it requires you to open each menu one at a time to hunt for a shortcut or menu item, with the result that you never get a conspectus of an application’s shortcuts, and you probably never bother to memorize most of them because, having found the menu item you want, you then just choose it with the mouse. Using KeyCue for a little while, I find, quickly helps me remember the shortcuts for the menu items I use most often; and of course it also gives me a fast way, without hunting in the menus, to access the shortcuts I don’t memorize and use less often. KeyCue isn’t yet quite the utility I was hoping for; what I really want is a cheat sheet that lets me see and choose from all of an application’s menu items, whether or not they have shortcuts, and I’d also like a cheat sheet showing all the global "hot keys" that various applications have installed. But it’s certainly a big help, and the $15 pricing is reasonable. You can download a demo version (659K) to try for yourself; it shows all available shortcuts only for the first 10 invocations, after which it hides some of the shortcuts. [MAN]

<http://www.ergonis.com/products/keycue/>

<http://www.ergonis.com/products/popcharx/>

<https://tidbits.com/getbits.acgi?tbart=07372>

<https://tidbits.com/getbits.acgi?tbart=07102>

Eudora 6.1.1 Released — Qualcomm has released Eudora 6.1.1, a minor update to the company’s popular email program. Bug fixes include a fix to importing from Apple Mail, tweaks to Eudora’s Bayesian-based spam filter, and other minor fixes. Although the update is minor (and free), it’s worth getting because one of the spam filter fixes eliminates a bug that could cause corruption of Eudora’s junk mail database. Eudora 6.1.1 is available for Mac OS 9 and Mac OS X and is a 6.1 MB download. [ACE]

<http://www.eudora.com/download/>

PowerMail 5 Released — In other email news, CTM Development has shipped PowerMail 5, a major revision of their email client. PowerMail 5 features tight integration with Michael Tsai’s excellent SpamSieve for spam filtering, significant performance improvements throughout, additional filter actions, automatic deletion of trashed mail after a user-specified number of days, support for long file names and aliases for attachments, fully customizable toolbars, multiple Undos for various message management actions, and more. Upgrades from PowerMail 3 and 4 cost $30 (or $45 with SpamSieve, a significant discount); upgrades are free for those who purchased PowerMail 4.2.1 in the last three months. New licenses cost $50, or $65 with SpamSieve. PowerMail 5 requires Mac OS X 10.2 or later; a demo is available as a 4.8 MB download. [ACE]

<http://www.ctmdev.com/powermail5.html>

<http://www.c-command.com/spamsieve/>

<http://www.ctmdev.com/documentation/Read_ me.html>

<http://www.ctmdev.com/download.html>

Just as we were about to wrap this issue, including a brief bit about an update to Paranoid Android – Unsanity’s hack for warning the user about the launching of unknown URL schemes – Apple released Security Update 2004-06-07, which claims to fix all of the recently identified security vulnerabilities in Mac OS X (see our articles on the topic in TidBITS-731 for full details on what was broken).

<https://tidbits.com/getbits.acgi?tbart=07679>

<https://tidbits.com/getbits.acgi?tbart=07680>

<http://www.unsanity.com/haxies/pa/>

In short, the security update revises Launch Services so it alerts the user to applications that have not been explicitly launched before (with a dialog along the lines of the one Paranoid Android puts up). It also removes the registration of the disk URL scheme so disk images accessed via disk URLs no longer mount automatically. A change to Safari eliminates a feature that could open certain downloaded files when the Show in Finder button was clicked. And lastly, an unrelated fix enables telnet URLs to have port numbers specified with them again; that functionality had been removed by a previous security update. See Apple’s articles on the topic for more details and a look at the new alert.

<http://docs.info.apple.com/article.html? artnum=61798>

<http://docs.info.apple.com/article.html? artnum=25785>

Security Update 2004-06-07 is available via Software Update; it’s also available as a 900K standalone download for both Mac OS X 10.3.4 and Mac OS X 10.2.8.

<http://www.apple.com/support/downloads/ securityupdate_2004-06-07_(10_3_4).html>

<http://www.apple.com/support/downloads/ securityupdate_2004-06-07(_10_2_8).html>

Needless to say, we haven’t had time to evaluate how well Apple’s fixes work or if they cause any other problems, but we’ll be tracking user reports on TidBITS Talk and other forums in the upcoming week.

Apple fixed two security gaps in the recent Mac OS X 10.3.4 release, and although they aren’t at the level of the URL scheme failure documented in our last issue and now addressed by Security Update 2004-06-07 (covered earlier in this issue), it’s worth mentioning a few details.

The first problem involved encrypted connections for AppleShare servers using the SSH (Secure Shell) protocol. These connections didn’t work in Mac OS X 10.3 through 10.3.2, and were implemented in 10.3.3 in a manner that could allow a man-in-the-middle attack to compromise a network and extract passwords (see "AppleShare Encryption Security Flaw Discovered" in TidBITS-719).

<https://tidbits.com/getbits.acgi?tbart=07563>

The fix warns users when they have set their AppleShare options to use SSH when an SSH connection is unavailable. While users still can’t manage SSH fingerprints and other methods of handling these kinds of secure connections, the small percentage of people relying on AppleShare over SSH are now in a better position to be alert to possible compromises.

In testing, I was unable to create an AppleShare-over-SSH session between two Mac OS X 10.3.4 systems over the Internet or on the same local network with SSH correctly enabled and with no firewalls in place. However, I could mount an AppleShare volume from a Mac OS X Server running 10.3.4 using SSH with no problem.

The other, unrelated, problem is a potential threat that could disrupt the Internet’s various backbone and high-level routers (see "Serious TCP Weakness Identified" in TidBITS-727). While it looks like that threat has not materialized yet due to diligence by the operators of that equipment, the same flaw is present in personal computers where it has much less risk of being exploited.

<https://tidbits.com/getbits.acgi?tbart=07648>

Apple notes in the security improvements description attached to 10.3.4 that the release "provides better handling of out-of-sequence TCP packets." This may or may not signify that they’ve mitigated this problem in Apple products – it’s unclear at this point.

<http://docs.info.apple.com/article.html? artnum=61798>

What’s slightly larger than a PowerBook power brick, has three ports, and talks Wi-Fi? Apple’s latest wireless entry, the AirPort Express, a 6.7-ounce (189 gram) 802.11g base station. Announced today, the AirPort Express will ship in mid-July for $130, replacing the low-end AirPort Extreme base station, which cost $200.

<http://www.apple.com/airportexpress/>

The AirPort Express plugs directly into any electrical outlet and supports alternate power standards with no external adapters. It has three jacks: Ethernet, to link in a single computer or an Ethernet hub or switch; USB, to add a printer; and audio, to support either analog two-channel or digital 5.1 with surround. If you need cables to connect the AirPort Express to your stereo, Apple sells the $40 AirPort Express Stereo Connection Kit with Monster cables: it includes a Monster mini-to-RCA left/right audio cable, a Monster mini-to-optical digital Toslink audio cable, and an AirPort Express power extension cord for greater flexibility in placement.

The audio feature is the most intriguing. The system, called AirTunes, works with an iTunes 4.6 update, due out later this week, and software built into the AirPort Express. Anyone on the wireless network with iTunes, whether for Mac OS X or Windows, can choose to direct music to the speakers connected to an AirPort Express base station. In one sense, AirTunes turns a Mac with iTunes into the ultimate remote control for your stereo.

<http://www.apple.com/airportexpress/ airtunes.html>

<http://www.apple.com/airportexpress/ unwireyourlivingroom.html>

If multiple AirPort Express base stations are on a network, each one can have a separate set of speakers controlled uniquely by a separate copy of iTunes. iTunes recognizes available speakers through Rendezvous. iTunes and the base station negotiate control so that only one copy of iTunes may play through a given set of speakers at once. The stream of music is sent losslessly but in encrypted form between iTunes and an AirPort Express unit to protect the music "from being stolen," Apple said.

The new AirPort Express base station can connect directly to a broadband DSL or cable modem via its single Ethernet jack, or it can use Wireless Distribution System (WDS) to join an existing AirPort Extreme or AirPort Express network. Apple said that while the AirPort Express’s version of WDS might work with base stations from other companies (we’ve found compatibility with gear from Buffalo Technologies, for instance; see "AirPorts Where the Buffalo Roam" in TidBITS-696), the lack of a standard for WDS meant they could only guarantee it would work with Apple equipment. If your existing network doesn’t support WDS, you must tie in the AirPort Express via its Ethernet jack.

<https://tidbits.com/getbits.acgi?tbart=07341>

The AirPort Express doesn’t have all the features of an Extreme unit – exactly which ones are missing won’t be clear until I see its configuration software – but the specs say it can only support 10 users versus 50 on the $250 models. That’s a guideline based on processing power and other parameters, of course, but one worth keeping in mind. The $250 models also have antenna jacks; one offers Power over Ethernet and a fire-safety rating, while the other includes a modem. Apple said the AirPort Express, like the AirPort Extreme, could share an Internet connection using DHCP and NAT, among other similar features.

The portability of the AirPort Express shouldn’t be understated. In a survey a few months ago, I tried and failed to find an effective portable base station. Similar devices cost substantially more than the AirPort Express and still require a tangle of cords. The AirPort Express’s small form factor and weight mean it will become a standard item for business travelers to pack for maximum flexibility in working on the road.

<http://www.apple.com/airportexpress/ onthego.html>

What’s the real difference between AirPort Express and just turning on Software Base Station/Internet Sharing in Mac OS 8.6/9 or Mac OS X? At home, you’re not dedicating a Mac to a problem that a standalone box with great features can solve. On the road, you’re not stuck connecting your laptop to an Ethernet cable on a carpal-tunnel inducing desk with a cruddy chair. Additionally, Software Base Station/Internet Sharing doesn’t offer WPA (Wi-Fi Protected Access) encryption, which some users find important, especially when traveling.

From our perspective at TidBITS, the AirPort Express is an important step. Apple has once again followed its traditional strategy of charging somewhat more than the bare-bones competition, while including far more capabilities. With the AirPort Express, Apple has dropped the price of a wireless base station to a far more competitive level while combining features rarely found in a single device such as print sharing, wireless bridging, and audio streaming. If you were to try to assemble the same set of features using the best, cheapest products from other makers, you’d easily spend $300 to $500. The AirPort Express also offers a compelling form factor that enables true portability and adds an elegant method of integrating wireless into your home entertainment system. Barring any nagging technical problems that might arise, AirPort Express could be another hit product for Apple. Wall Street may already be anticipating sales: Apple’s stock closed today at its highest price in four years.

A few months ago in TidBITS I compared the various disk repair programs then available for Mac OS X: Norton Utilities 8.0 ($100), DiskWarrior 3.0 ($80), Drive 10 1.1.4 ($70), Disk Guardian 2.2 ($70), and Apple’s Disk Utility (free). See "Shootout at the Disk Repair Corral" in TidBITS-707 for the full details.

<https://tidbits.com/getbits.acgi?tbart=07451>

<http://www.symantec.com/nu/nu_mac/>

<http://www.alsoft.com/DiskWarrior/>

<http://www.micromat.com/drive_10/drive_10_ introduction.html>

<http://www.subrosasoft.com/>

But I missed Tech Tool Pro. Micromat had announced TechTool 4 at Macworld Expo San Francisco in January 2003 for $100, but had not yet shipped it nine months later when I wrote the comparison. I didn’t want to review TechTool 3, knowing it would soon be out of date. As luck would have it, version 4 finally shipped just as TidBITS published the article.

<http://www.micromat.com/tt_pro_4/tt_pro_4.html>

In my previous comparison of disk repair utilities, I created 13 different HFS+ disk images, and damaged a different part of the disk on each one. I then duplicated each damaged disk image for each disk utility. I repaired one set of damaged disk images with each disk utility, and recorded how many images were repaired correctly, and how many still had errors, or had lost data. I did not test any of the other features of the disk repair programs. The descriptions of each error are abbreviated here; for more detail see the original article.

I used the same methodology here as in the original comparison. Using Tech Tool Pro 4.0.2, I attempted to repair the exact same disk errors that were used in the original review. Do note that I’m not reviewing any of the other features of Tech Tool Pro beyond its capability to repair damaged disks.

Free Advice — A disk repair program can fix many things, but when you drop your Mac in a swimming pool, leave it in the back of a taxi, or lose it to a light-fingered burglar, the only thing that helps is having a current backup copy of your data. If you don’t have a current backup, make one today.

Also, if you are using Mac OS X 10.3 Panther, use Disk Utility to turn on journaling. Journaling enables Mac OS X to fix certain kinds of damage automatically, before you even notice a problem exists.

Bad Sector! Bad sectors are a common problem and can occur when a sector on the disk becomes unreadable, either due to damage to the disk surface, or because the data on the sector becomes scrambled. Although the data will be toast either way, it’s relatively easy to repair the disk. In the first case, the bad sector is replaced from a set of spare sectors the disk maintains. In the latter case, new data is written to the sector, replacing the scrambled data. In either case, the original contents of the sector are lost.

Using a special tool, I created bad sectors with scrambled data. (I had to perform this test on a real disk.) Tech Tool Pro detected the bad sectors, but couldn’t fix them. It also didn’t say which unlucky files contained the bad sectors, so it doesn’t give you any hints as to which files are damaged. This result puts it on par with Drive 10 and Disk Guardian. Disk Utility, Norton Disk Doctor and DiskWarrior didn’t even detect the bad sectors.

It’s fairly easy to fix bad sectors on modern disks, and its not that hard to find out which file contains a bad sector. I’m surprised no disk utility has mastered this trick yet, since it would give them a distinct advantage.

Directory Destruction — All the remaining tests involve damage to the various data structures that Mac OS X uses to track where your files are located on the disk.

The allocation file tracks which blocks on the disk contain files, and which are empty. Errors in the allocation file are not uncommon. Tech Tool Pro repaired a damaged allocation file easily on my test disk image, as did all the other disk utilities.

The volume header is a guide to all the other important structures on the disk. Without it, you can’t find the allocation file, the catalog file, or any of your files. Erasing the signature in the volume header makes Mac OS X declare the disk corrupt, and refuse to mount it. Tech Tool Pro fixed this problem quickly, as did the other disk utilities.

The catalog is the single most important data structure on an HFS+ disk. It tracks all your files and folders. I erased the first node of the catalog, a devastating error. Tech Tool Pro repaired it properly, joining Norton Disk Doctor, Drive 10, and DiskWarrior and leaving Disk Guardian and Disk Utility behind.

The catalog file (and the extents file as well – more on the extents file later) contains a map that records which nodes are in use, and which are free. After I damaged this map, Tech Tool Pro repaired it, just as all the other utilities did.

The catalog file is set up in a tree structure: branches link together the various file and folder records in a strict order. If the links are damaged, you won’t be able to find certain files or folders. Damaged links are one of the more common forms of catalog corruption. Tech Tool Pro repaired this damage perfectly. DiskWarrior, Norton Disk Doctor and Drive 10 also fixed this, although Disk Utility and Disk Guardian couldn’t.

The file and folder records in the catalog are maintained in a specific order. Just as with a library card catalog, if the records lose their order, finding the file or folder you want becomes impossible. Tech Tool Pro fixed this problem, and although it mangled one file name, the data inside the file was fine. All the other disk utilities also handled this error.

Certain characters are illegal in file names, including colons and composed Unicode characters (don’t ask). Although Tech Tool Pro found the illegal colon in a file name, it didn’t manage to fix it. Only DiskWarrior and Norton Disk Doctor fixed this error.

The catalog file is divided into nodes, and the nodes are divided into records. A record stores information about a particular file or folder. At the end of the node is a map which points to each record. If the map becomes corrupt, you can’t find the files and folders in that node. Tech Tool Pro managed to fix the mangled map, but in the process it lost five files. Drive 10 and Disk Guardian also lost five and six files respectively fixing this error. Norton Disk Doctor and Disk Utility didn’t manage to fix it. Only DiskWarrior fixed the damaged node map properly.

Threads are special records in the catalog, used to look up folders and resolve aliases quickly. By damaging a thread, I created two problems: the damaged thread record itself, and a broken alias that no longer had a corresponding thread. Tech Tool Pro fixed both problems. Norton Disk Doctor, DiskWarrior, and Drive 10 also succeeded, while Disk Guardian and Disk Utility failed.

A dangerous situation – called either "overlapping extents" or "cross-linked files" – occurs when the file system thinks two files occupy the same space on the disk. One file (at least) will be overwritten. I extended the length of one file to overlap the beginning of the next file. Tech Tool Pro managed to separate the files without losing any additional data. DiskWarrior, Norton Disk Doctor and Drive 10 fixed my cross-linked files as well, although Disk Utility and Disk Guardian didn’t.

No One Expects the Spanish Inquisition — So far, Tech Tool Pro had done well. The time had come to bring out the comfy chair.

When a file is badly fragmented, it breaks into too many pieces (called extents) for the catalog to keep track of them all. The additional pieces are tracked in a special file called the extents file. Using a custom tool, I fragmented all the files on the test disk. Then I damaged two of the extent records. Tech Tool Pro detected the problem, but couldn’t fix it. Disk Utility, Drive 10 and Disk Guardian couldn’t fix them either. DiskWarrior and Norton Disk Doctor put everything right.

HFS+ volumes are enclosed in a wrapper, which is a relic from the old days when HFS+ was new. For Macs that didn’t know about HFS+ in their ROMs, the wrapper provided a bootstrap that let them boot from an HFS+ disk anyway. The wrapper has its own small but complete HFS (not HFS+) file system. So, I damaged the wrapper’s catalog file. Tech Tool Pro didn’t notice that anything was wrong. It’s not alone; only Norton Disk Doctor fixed this obscure problem.

Some people put several partitions on a hard disk. The partition map tracks the various partitions. I damaged the partition map. As with the bad sectors, I performed this test on a real hard disk, since disk images don’t have partition maps. Tech Tool Pro didn’t detect the problem. Of the other utilities, only Norton Disk Doctor even noticed this problem, although it couldn’t fix it.

Finally, instead of testing errors individually, I created a disk image with a slew of problems. I messed with the headers in some nodes, the records in various nodes, and the maps in some nodes. Some nodes got hit with all three bits of nasty corruption. I did this in both the catalog and extent files. It took Tech Tool Pro three tries, and on the third try it hung, but it finally did put the disk back together. However, about 50 files were missing. Considering the level of damage, Tech Tool Pro acquitted itself well enough. Only DiskWarrior handled this serious situation better, fixing the disk and losing fewer files. The other utilities tried hard, but as with the king’s horses and the king’s men, they simply couldn’t put Humpty Dumpty together again.

Of the 15 damaged disk images, Tech Tool Pro repaired 9 of them perfectly or well enough, and did pretty well on the last disk. That stacks up against DiskWarrior with 12 fixes, Norton Utilities with 11, Drive 10 with 9, Disk Guardian with 5 and Disk Utility with 4.

Micromat says that Tech Tool Pro and Drive 10 (also from Micromat) share the same repair engine, so it’s not surprising that the two programs scored nearly identically.

Although TechTool Pro acquitted itself fairly well, joining Drive 10 in the middle of the pack, I stick with my earlier recommendation for dealing with damaged disks. Try Apple’s Disk Utility first (since it’s free and isn’t likely to create any additional problems), and if Disk Utility fails, hand the damage over to DiskWarrior, which has the best chance of fixing whatever ails your hard disk. And please, keep good backups!

[David Shayer was a senior engineer on Norton Utilities for Macintosh 3.0, 4.0, and 5.0. Before that he worked on Public Utilities, a disk repair program that won the MacUser Magazine Editor’s Choice Award, and on Sedit, a low-level disk editor.]

PayBITS: If David’s detailed and expert testing told you which

disk utility you should rely on, reward his efforts via PayBITS!

<http://www.amazon.com/paypage/P12NE4WQ7K8ODD>

Read more about PayBITS: <http://www.tidbits.com/paybits/>

The second URL below each thread description points to the discussion on our Web Crossing server, which will be much faster, though it doesn’t yet use our preferred design.

<http://emperor.tidbits.com/TidBITS/Talk/>

Mac Browser Security Hole — Readers continue to discuss the Mac OS X security vulnerabilities discovered over the past few weeks (23 messages)

<https://tidbits.com/getbits.acgi?tlkthrd=2233>

<http://emperor.tidbits.com/TidBITS/Talk/99>

Tactile Pro Keyboard feedback — TidBITS sponsor Matias asks for reader opinion on offering a keyboard with modified Option and Control keys. (7 messages)

<https://tidbits.com/getbits.acgi?tlkthrd=2244>

<http://emperor.tidbits.com/TidBITS/Talk/109>

Ideal auto-save behavior — Several programs offer the capability to save your data automatically while you work, but how well do they accomplish this task? (4 messages)

<https://tidbits.com/getbits.acgi?tlkthrd=2243>

<http://emperor.tidbits.com/TidBITS/Talk/108>

FrameMaker replacements — Adobe announced that it will no longer develop its long-document layout program. What other tools are available, and how do they compete with FrameMaker – if at all? (16 messages)

<https://tidbits.com/getbits.acgi?tlkthrd=2241>

<http://emperor.tidbits.com/TidBITS/Talk/106>

How Envision should work — The beta release of Open Door Software’s Envision prompts comparisons to digital picture frames, as well as suggestions for the upcoming 1.0 version of the Web image viewing application. (2 messages)

<https://tidbits.com/getbits.acgi?tlkthrd=2240>

<http://emperor.tidbits.com/TidBITS/Talk/105>