PVIEITO

Inside Claude Cowork: How Anthropic Runs Claude Code in a Local VM on Your Mac

Mon, 26 Jan 2026 00:00:00 +0100

Claude Cowork is a feature of the Claude Desktop app that allows Claude to execute code, manipulate files, and perform complex tasks autonomously. This post documents a deep investigation into how it works under the hood, covering the architecture, security layers, and interesting implementation details.

TL;DR

Claude Cowork runs a full Linux virtual machine locally using native virtualization. Inside this VM, it executes Claude Code CLI within a multi-layered sandbox. Network access is restricted to a strict allowlist, and MCP servers from Claude Desktop are dynamically passed through to the VM. Multiple conversations share a single VM instance, but each gets its own isolated session.

TL;DR
Introduction
Architecture
Isolation
File Sharing
- Path Translation
Networking
- Allowlist
- Host-VM Communication
MCP
Pre-installed Tools
Security Implications
Conclusion

Introduction

When you start a Cowork session in Claude Desktop, Claude can suddenly run Python scripts, process videos with ffmpeg, create PowerPoint presentations, and more. But how does it actually work? Is it a Docker container? A remote server?

Cowork is currently only available on macOS, so this investigation was conducted on that platform from both sides: from within the execution environment (Claude’s perspective) and from the host system (the user’s perspective), using Claude Code 1.1.799 (2e02b6). The findings reveal a thoughtful and robust architecture.

Architecture

The core architecture consists of three main layers:

┌────────────────────────────────────────────────────────────────────────┐
│                              macOS Host                                │
│                                                                        │
│   ┌────────────────────────────────────────────────────────────────┐   │
│   │  Claude.app (Electron)                                         │   │
│   │    ├── UI Renderer                                             │   │
│   │    ├── MCP Servers (Slack, Atlassian, etc.)                    │   │
│   │    ├── Network Proxy Service                                   │   │
│   │    └── Virtualization.framework                                │   │
│   └────────────────────────────────────────────────────────────────┘   │
│                                    │                                   │
│         ┌──────────────────────────┼──────────────────────────┐        │
│         │  stdio    VirtioFS    MCP SDK    HTTP/SOCKS         │        │
│         │  pipes    mounts      protocol   proxy              │        │
│         └──────────────────────────┼──────────────────────────┘        │
│                                    ▼                                   │
│   ┌────────────────────────────────────────────────────────────────┐   │
│   │  Ubuntu 22.04 VM (ARM64)                                       │   │
│   │                                                                │   │
│   │    /sessions/<name>/mnt/ ◄── VirtioFS ──► ~/<shared-folder>/   │   │
│   │                                                                │   │
│   │    ┌────────────────────────────────────────────────────────┐  │   │
│   │    │  bubblewrap sandbox + seccomp (per session)            │  │   │
│   │    │                                                        │  │   │
│   │    │    Claude Code CLI v2.1.15                             │  │   │
│   │    │      --model claude-opus-4-5-20251101                  │  │   │
│   │    │      --mcp-config {...}                                │  │   │
│   │    │      --allowedTools Task,Bash,Grep,...                 │  │   │
│   │    │                                                        │  │   │
│   │    └────────────────────────────────────────────────────────┘  │   │
│   │                                                                │   │
│   │    Network: :3128 (HTTP) / :1080 (SOCKS) → Allowlist           │   │
│   │    Disks: rootfs.img (10GB) + sessiondata.img (36MB)           │   │
│   │                                                                │   │
│   └────────────────────────────────────────────────────────────────┘   │
│                                                                        │
└────────────────────────────────────────────────────────────────────────┘

Claude Cowork is not a separate model, it is Claude Code CLI running inside the VM, orchestrated by Claude Desktop:

Component	Value
CLI Binary	`/usr/local/bin/claude` (ELF 64-bit ARM aarch64)
CLI Version	2.1.15 (Claude Code)
Model	`claude-opus-4-5-20251101`
I/O Format	`stream-json` (bidirectional)
Session Resume	`--resume <session-uuid>`

The CLI is launched with the following arguments:

/usr/local/bin/claude \
  --output-format stream-json \
  --input-format stream-json \
  --model claude-opus-4-5-20251101 \
  --resume <session-uuid> \
  --allowedTools Task,Bash,Glob,Grep,Read,Edit,Write,... \
  --mcp-config '{"mcpServers": {...}}' \
  --permission-mode default \
  --plugin-dir /sessions/<name>/mnt/.skills

Isolation

Virtual Machine

The execution environment is a complete Ubuntu 22.04 LTS virtual machine running on ARM64 architecture:

PRETTY_NAME="Ubuntu 22.04.5 LTS"
Linux claude 6.8.0-90-generic aarch64 GNU/Linux

This is not a Docker container or a lightweight sandbox, it is a full VM with its own kernel, managed by Apple’s Virtualization Framework. The VM runs via com.apple.Virtualization.VirtualMachine, the same technology used by tools like UTM and Tart.

Resources allocated:

4 vCPUs (ARM64)
3.8 GB RAM
~10 GB virtual disk (sparse)

VM Bundle Structure

The VM files are stored locally at:

~/Library/Application Support/Claude/vm_bundles/claudevm.bundle/

File	Size	Purpose
`rootfs.img`	10 GB	Ubuntu root filesystem (sparse)
`sessiondata.img`	36 MB	Persistent session data (`/sessions`)
`efivars.fd`	128 KB	UEFI boot variables
`macAddress`	17 B	Virtual MAC address
`machineIdentifier`	70 B	Unique VM identifier
`.rootfs.img.origin`	40 B	SHA1 hash for image verification

The rootfs.img is a sparse file, meaning it does not actually consume 10 GB on disk, only the space needed for actual data.

Security Layers

The VM employs multiple security layers:

┌──────────────────────────────────────────────┐
│  macOS Host                                  │
│    └── Apple Virtualization Framework        │
│          └── Ubuntu 22.04 VM                 │
│                └── bubblewrap sandbox        │
│                      └── seccomp filter      │
│                            └── Claude Code   │
└──────────────────────────────────────────────┘

VM isolation: Full hardware-level separation
bubblewrap (bwrap): Linux sandboxing tool
seccomp: System call filtering
Network isolation: Traffic routed through local proxy (ports 3128/1080)

Multi-Session Architecture

A single VM instance serves multiple Cowork conversations simultaneously. Each conversation gets its own isolated session:

/sessions/
├── intelligent-loving-darwin/  ← Chat session 1
├── dreamy-optimistic-babbage/  ← Chat session 2
└── ...

Session names are randomly generated using a Docker-container-like pattern: adjective-adjective-scientist.

Resource	Shared?	Notes
`/tmp/`	Yes	Sessions can see each other’s temporary files
`/sessions/<name>/`	No	Permissions `drwxr-x---` block cross-session access
User (UID)	No	Each active session has its own Linux user (e.g., `uid=1002`)
Kernel/Processes	Yes	Same VM, same kernel
Network proxy	Yes	Same allowlist rules

This was verified by creating a file in /tmp/ from one session and successfully reading it from another, while attempting ls /sessions/dreamy-optimistic-babbage/ returned Permission denied.

Interestingly, inactive sessions show nobody:nogroup as owner, while the active session has its own dedicated user. This suggests sessions are “depersonalized” when closed.

User folders are shared between macOS and the VM using VirtioFS, Apple’s high-performance paravirtualized filesystem:

/mnt/.virtiofs-root/shared/Downloads → /sessions/.../mnt/Downloads

This enables bidirectional file access: Claude can read and write to the user’s selected folder, and changes appear instantly on both sides.

Path Translation

Claude Desktop performs smart path translation in the UI. When Claude executes:

cp report.pdf /sessions/intelligent-loving-darwin/mnt/Downloads/

The user sees:

cp report.pdf ~/Downloads/

This translation is context-aware: it only rewrites paths that are actual file arguments, not string literals in other commands.

Networking

Allowlist

All network traffic from the VM is routed through a local proxy with a strict allowlist. Direct DNS lookups are blocked (socket(): Operation not permitted).

Allowed domains:

Domain	Status	Purpose
`api.anthropic.com`	200	Anthropic API
`pypi.org`	200	Python packages
`registry.npmjs.org`	200	Node packages

Blocked domains:

Domain	Response
`google.com`	`403 Forbidden - blocked-by-allowlist`
`api.github.com`	`403 Forbidden - blocked-by-allowlist`
Any other domain	`403 Forbidden - blocked-by-allowlist`

This means Claude can install dependencies via pip and npm, but cannot make arbitrary HTTP requests from the VM—curl to non-allowlisted domains is blocked, and the same applies to the WebFetch tool. However, WebSearch works as it uses the Anthropic API endpoint.

Host-VM Communication

Communication between Claude Desktop (macOS) and Claude Code (VM) uses multiple channels:

┌─────────────────────────────────────────────────────────────────┐
│  macOS (Claude Desktop)                                         │
│                                                                 │
│    ┌─────────────────┐                                          │
│    │  Electron App   │                                          │
│    │                 │                                          │
│    │  stdio pipes ───┼──────────────────────┐                   │
│    │                 │                      │                   │
│    │  Unix sockets ──┼───┐                  │                   │
│    └─────────────────┘   │                  │                   │
│                          │                  │                   │
└──────────────────────────│──────────────────│───────────────────┘
                           │ virtiofs mount   │ pipes
┌──────────────────────────│──────────────────│───────────────────┐
│  VM                      │                  │                   │
│                          ▼                  ▼                   │
│    /tmp/claude-http-*.sock     pipe:[xxxxx] (stdin)             │
│    /tmp/claude-socks-*.sock    pipe:[xxxxx] (stdout)            │
│           │                         │                           │
│           ▼                         ▼                           │
│    socat → localhost:3128    Claude Code CLI                    │
│    socat → localhost:1080      --input-format stream-json       │
│    (HTTP/SOCKS proxy)          --output-format stream-json      │
│                                                                 │
└─────────────────────────────────────────────────────────────────┘

Channel	Mechanism	Purpose
Messages	Unix pipes (stdin/stdout)	JSON stream for user messages and responses
HTTP Proxy	Unix socket → socat → `:3128`	HTTP requests (pip, npm, API calls)
SOCKS Proxy	Unix socket → socat → `:1080`	Other network protocols
MCP	SDK protocol via pipes	Communication with MCP servers on host
Files	VirtioFS mount	Shared folder access

The Unix sockets (/tmp/claude-*.sock) are mounted from macOS into the VM via VirtioFS, allowing socat processes inside the VM to bridge network traffic to the host’s proxy.

MCP

One of the most interesting aspects of the architecture is how MCP (Model Context Protocol) servers are integrated. Claude Desktop’s MCP servers are passed to the VM and made available to Claude Code. The MCP configuration is injected via command-line argument:

{
  "mcpServers": {
    "ea93ae0e-73b4-4d43-9bb0-2c3720b9d627": {"type": "sdk", "name": "..."},
    "4b26c136-8d30-4046-b6ad-2e41dde789ea": {"type": "sdk", "name": "..."},
    "Claude in Chrome": {"type": "sdk", "name": "Claude in Chrome"},
    "My Custom Server": {"type": "sdk", "name": "My Custom Server"},
    "cowork": {"type": "sdk", "name": "cowork"}
  }
}

Official Anthropic integrations use UUIDs as identifiers (e.g., ea93ae0e-... for Atlassian, 4b26c136-... for Slack), while third-party and custom servers use human-readable names. The cowork server is built-in and provides tools like request_cowork_directory and allow_cowork_file_delete.

MCP servers configured in Claude Desktop are dynamically passed through to the VM. When a new MCP server is added to Claude Desktop, it becomes available to Cowork sessions. MCP servers use "type": "sdk" which means they communicate through the Claude SDK rather than stdio pipes, enabling Claude inside the VM to interact with applications running on the host.

Pre-installed Tools

The VM comes with a comprehensive toolkit:

Languages:

Language	Version
Python	3.10.12
Node.js	22.22.0
Ruby	3.0.2
TypeScript	5.9.3

CLI Tools:

ffmpeg/ffprobe 4.4.2 — Video/audio processing
git 2.34.1 — Version control
pandoc 2.9.2 — Document conversion
ImageMagick 6.9.11 — Image manipulation
ripgrep — Fast search
jq 1.6 — JSON processing
sqlite3 — Database

Node.js Packages:

docx — Word document creation
pptxgenjs — PowerPoint generation
pdf-lib — PDF manipulation
sharp — Image processing

Python Packages:

beautifulsoup4 — Web scraping
camelot-py — PDF table extraction
pandas, numpy, matplotlib — Data analysis

Security Implications

The architecture provides strong isolation:

No direct host access: Claude cannot access arbitrary files on macOS, only the explicitly shared folder
Network allowlist: Only package registries (pypi, npm) and Anthropic’s API are accessible; arbitrary web requests are blocked
Syscall restrictions: seccomp limits what system calls can be made
Per-session sandboxing: Each conversation runs in its own bubblewrap sandbox with a dedicated user
DNS blocked: Direct DNS lookups fail; all traffic must go through the proxy

Potential concerns:

Sessions sharing /tmp/ could theoretically leak information between conversations
The VM persists between sessions, so artifacts may remain in shared spaces

This is a significant improvement over running code directly on the host or in a simple container.

Conclusion

Claude Cowork represents a thoughtful approach to enabling AI code execution. By running a full Linux VM with multiple security layers, Anthropic has created an environment that is both powerful (full Ubuntu with extensive tooling) and isolated (VM + sandbox + seccomp + network allowlist).

Key architectural decisions:

Claude Code as the engine: Cowork is Claude Code CLI running inside a sandboxed VM, not a separate product
Single VM, multiple sessions: Efficient resource usage while maintaining per-session isolation
Apple Virtualization Framework: Native ARM64 performance on Apple Silicon
VirtioFS: Fast, bidirectional file sharing with the host
MCP passthrough: Desktop MCP servers are dynamically shared with the VM via SDK protocol
Network allowlist: Permits dependency installation while blocking arbitrary web access
Smart path translation: Seamless UX by rewriting VM paths to host paths in the UI

This architecture allows Claude to perform complex tasks—video processing, document generation, data analysis—while maintaining strong security boundaries. It is a practical solution to the challenge of giving AI systems the ability to execute code safely.

CVE-2024-40801: How a Sandboxed Mac App Could Steal Your Private Data Bypassing TCC Protections

Sun, 22 Sep 2024 00:00:00 +0200

This post includes the details of the first vulnerability I have ever reported to Apple. It was fixed on macOS Sonoma 14.7 and macOS Sequoia 15.0 as CVE-2024-40801.

TL;DR

A vulnerability in macOS allowed a sandboxed app to bypass TCC (Transparency, Consent and Control) protections and access sensitive user data without requiring user permission. By leveraging the container-migration.plist feature, a sandboxed app could request the migration of TCC-protected files (like Safari history, Mail database, or user documents) to its app container, effectively bypassing TCC and giving the app full access to these files. There are multiple examples included in this repository demonstrating the exploit.

Initial Report

Below is the full report as submitted to Apple. You can also check the GitHub repository that includes the example projects to reproduce the vulnerability.

Introduction

A sandboxed Mac app can exploit the container-migration.plist feature to get access to TCC-protected files without any user permission prompt.

For example, you can request the Safari history file or Mail database to be migrated by the App Sandbox to the app container, and it will happily do it. Once the files are in the app container, the app has full control to read and exfiltrate this data.

You can use the attached project to reproduce the exploit (check the demo video at Extra/Videos/ContainerMigrationExploit.mp4):

Steps to Reproduce

Run the script at Scripts/ContainerMigrationExploitReset.sh in a Terminal with Full Disk Access. This script will:
- Reset the App Sandbox container of the Exploit app (if it exists).
- Reset the TCC permissions of the Expected app that shows the proper expected behavior when accessing the protected files.
- Create a demo file in the user Documents folder named my-secret.txt.
- Restore & back up the Safari history database (History.db) and Mail recent searches plist (recentSearches.plist). Both of these files are protected by TCC, and reading them requires Full Disk Access as they contain very sensitive data like contacts and the browsing history. The first time the script runs, the restore will fail, but you can ignore it.
Open the Xcode project at Projects/ContainerMigrationExploit.xcodeproj.
Run the Expected scheme: this is an un-sandboxed app that tries to read directly the files that the exploit app will steal. As you see, it triggers the expected TCC permission prompt when reading the my-secret.txt file in the Documents folder, and it also cannot access the Safari history database nor the Mail recent searches plist as they are stored in protected directories.
Now run the Exploit scheme: this sandboxed app is able to read the three files without any issue as they have been migrated by the App Sandbox into the app container.

Expected Results

As demonstrated by the Expected scheme, the app should not be able to access any of the data in the protected directories without user permissions and/or Full Disk Access. Even worse, a sandboxed app is able to get more access to sensitive files than an un-sandboxed app using this technique.

Actual Results

The Exploit app can access sensitive files protected by TCC without any user permission. This same technique can be used to exfiltrate the following data from a fully sandboxed app:

User documents stored in the Documents folder (without any TCC prompt).
Sensitive files in the Library folder:
- Safari history & bookmarks.
- Full Mail database & contacts.
- Other apps’ containers’ data.
- …

Annex I

This new version of the project includes a new Mail-app-specific example project in Projects/MailContactsExploit.xcodeproj that demonstrates how you can use this exploit to dump all your Mail contact addresses without any TCC prompt from a fully sandboxed app (demo video at Extra/Videos/MailContactsExploit.mp4).

This same exploit can also be used for a denial-of-service / ransomware attack as the original files (in this example, the Mail database) are deleted by the App Sandbox migration from the original location and are now in full control of the attacker app.

Annex II

Some details about how the exploit seems to work under-the-hood:

The sandboxed app initializes the App Sandbox and connects to the secinitd daemon.
secinitd reads the container-migration.plist file in the app bundle.
As secinitd has the kTCCServiceSystemPolicyAllFiles value in the com.apple.private.tcc.allow entitlement, it can access any protected directory and moves the protected files into the app container.

You can check the related Endpoint Security events from eslogger in the directory Data/EndpointSecurity/.

Annex III

This final version of the project includes a demonstration that this same exploit can also be used to exfiltrate both Calendar & Contacts databases, even though their paths are symlinked inside the app container, by leveraging a custom destination in the container-migration.plist file:

<dict>
    <key>Move</key>
    <array>
        <array>
            <string>${Home}/Library/Calendars/Calendar.sqlitedb</string>
            <string>${Home}/Calendar.sqlitedb</string>
        </array>
    </array>
</dict>

You can check a Calendar-specific example project at Projects/CalendarExploit.xcodeproj and a demo video at Extra/Videos/CalendarExploit.mp4.

ChatGPT for Mac was storing all conversations in an unprotected location

Mon, 08 Jul 2024 00:00:00 +0200

This is a recap of some posts I published on Threads during the past week.

TL;DR

The OpenAI ChatGPT for Mac app stored user conversations in plain text in a non-protected location, making them accessible to any running app or malware. After public disclosure, OpenAI released an update encrypting the conversations but did not implement sandboxing.

Introduction

The OpenAI ChatGPT app on macOS is not sandboxed and stored all conversations in plain text in a non-protected location:

~/Library/Application Support/com.openai.chat/conversations-{uuid}/

This approach is somewhat typical for non-sandboxed apps on macOS, but a high-profile chat app like ChatGPT should be more careful with user data. For example, Apple started blocking access to user private data 6 years ago with the introduction of macOS 10.14 Mojave. Before that, any non-sandboxed app could access any user file. With macOS Mojave, Apple began requiring explicit user permission to access sensitive files like the Calendar, Contacts, Mail or Messages databases. Later, Apple extended this requirement to the Desktop and Documents directories, and with macOS 14 Sonoma, any file stored by a sandboxed third-party app in its sandbox container is automatically protected. This protection prevents malware or untrusted apps from exfiltrating user data without triggering a permission prompt like this:

Unfortunately, OpenAI opted out of sandboxing the ChatGPT app on macOS and stored conversations in plain text in a non-protected location, disabling all these built-in defenses. This meant that any running app, process, or malware could read all your ChatGPT conversations without any permission prompt.

Example

Here you can see how easily any other app could access any ChatGPT conversation without any permission prompt:

You can check the source code of this demo app, ChatGPTStealer, on GitHub.

Aftermath

Initially, I reported this issue to OpenAI through their security bug reporting program in BugCrowd, but they marked the report as “Not Applicable” as “in-order for an attacker to leverage this, they would need physical access to the victim’s device.”

As I disagreed with that consideration, I decided to post this issue publicly on Threads & Mastodon to raise awareness and encourage OpenAI to fix this issue and hopefully sandbox the ChatGPT app on macOS. These posts gained attention and were eventually covered by The Verge, Ars Technica, 9to5Mac, and others.

Following these publications, OpenAI finally acknowledged the issue and released ChatGPT 1.2024.171 for Mac, which now encrypts the conversations. The conversations are now stored in a new location:

~/Library/Application Support/com.openai.chat/conversations-v2-{uuid}/

These files are now encrypted with a key named com.openai.chat.conversations_v2_cache stored securely in the macOS Keychain and the old plain-text conversations are removed after upgrading to the new version. However, the app is still not sandboxed, so the conversations are still stored in a non-protected location, but now at least they are encrypted so other apps can’t read them without user-granted access to the Keychain key.

Interestingly, macOS Sequoia will introduce protections for Group Containers, so non-sandboxed apps like ChatGPT could improve their security by moving sensitive data to a Group Container directory. This way, any other process or app trying to access the data would be blocked by the system, and a permission prompt would be presented to the user.

Creating Apple Wallet Passes Instantly With ChatGPT and MakePass AI

Thu, 31 Aug 2023 00:00:00 +0200

TL;DR

You can use the MakePass AI service in the MakePass app with the Ultra subscription to create Apple Wallet passes instantly using an input photo or document of a ticket or card:

Introduction to MakePass AI

MakePass is a mighty Apple Wallet pass editor, with it you can create and customize a myriad of passes with complex layouts including images, barcodes, colors and text fields. Now it includes a new service called MakePass AI available with the MakePass Ultra subscription that allows you to create Apple Wallet passes instantly using an input photo or document of a ticket or card. It can even design the pass using a pass description.

MakePass AI uses technologies like text recognition, barcode recognition and Artificial Intelligence powered by OpenAI ChatGPT models to compose Apple Wallet passes from photos or documents of tickets and cards.

Examples

Here you can see some examples of passes generated automatically with MakePass AI from some input image or document:

Input	Pass

MakePass

MakePass is available on the App Store for iPhone, iPad and Mac.

WWDC Sessions Archive

Thu, 26 May 2022 00:00:00 +0200

Introduction

This archive of WWDC sessions is meant to extend the current collection of videos available on Apple Developer website with all the sessions prior to WWDC 2017 that are not available there but continue to be hosted by Apple servers.

Notes

The videos are hosted by Apple so you may need to login with your Apple Developer account to be able to view or download them.
Unfortunately, some of the sessions do not have a link since they are not currently published by Apple.
Recent WWDC session videos can be found directly on Apple Developer website.
You can find more links for WWDC sessions on this gist by IsaacXen. This archive would not be possible without its initial links so credits and thanks to IsaacXen.
The archive is also available in new-line delimited JSON format here.

Sessions

WWDC 2007

Session 100 – Coming to the Mac OS X Platform – Part 1 – The Mac OS X Architecture
Session 101 – Coming to the Mac OS X Platform – Part 2 – Frameworks, APIs and Tools
Session 102 – Threading for Performance Using OpenMP and Intel Threading Building Blocks
Session 103 – Getting Started with Core Data
Session 104 – Getting Started with Mac OS X Kernel Programming
Session 105 – Optimizing Your Core Data Application
Session 106 – Fundamentals of Kernel Debugging
Session 107 – Students - Getting the Most out of WWDC
Session 108 – Mac OS X File Systems – A Walkthrough For Developers and IT Professionals
Session 109 – Code Hardening Techniques
Session 110 – Cocoa Today
Session 111 – Managing Schema Versioning and Data Migration in Your Core Data Application
Session 112 – From Power On to Login – Inside the Mac OS X Leopard Boot Process
Session 114 – Developing for UNIX on Mac OS X
Session 115 – Getting Started with Cocoa Bindings
Session 116 – Students-Packets of Pure Power
Session 117 – Discovering Network Services Using Bonjour
Session 119 – Managing Processes with launchd
Session 125 – Building a Custom Control for Your Cocoa Application
Session 127 – Getting Started with Core Text
Session 128 – Cocoa Drawing Techniques
Session 130 – Cocoa Scripting Enhancements in Leopard
Session 131 – Add WYSIWYG HTML Editing to Your Web Page or Application
Session 134 – Customizing the Cocoa Text System
Session 136 – Modernizing Your Text Rendering with Core Text
Session 138 – Discover Java on Mac OS X Leopard
Session 139 – Partitioning Your Cocoa Application
Session 140 – Developing Cocoa Applications with Python and Ruby
Session 141 – Boosting Responsiveness and Performance in Your Cocoa Application
Session 145 – See What’s New in HIToolbox
Session 146 – Sign Your Application to Increase Security and Ensure Code Integrity
Session 147 – Advanced Java Development on Mac OS X
Session 154 – Leveraging SOAP Technologies on Mac OS X
Session 156 – Writing an Input Method Using the Input Method Kit
Session 157 – Extending Your Application with JavaScript
Session 158 – Adding Accessibility Support to Your Application
Session 161 – Making Your Custom Controls, Icons, and Artwork Resolution Independent
Session 164 – Professional Audio Input and Output with Leopard
Session 166 – Improving User Experience with Effective Power Management
Session 200 – Mac OS X State of the Union
Session 201 – Effective Widget Creation with Dashcode 2
Session 202 – Broadcast Your Application’s Content with iChat Theater
Session 203 – Coding Smarter with Objective-C 2.0
Session 204 – Fostering User Interaction with iChat
Session 205 – Making Your Application Scriptable
Session 206 – Building Automator Actions 2
Session 207 – Integrating iCal Events and Tasks into Your Application
Session 209 – Getting Started with Address Book
Session 210 – Building Animated Cocoa User Interfaces
Session 210 – Building Animated Cocoa User Interfaces
Session 211 – Adding Core Animation to Your Application
Session 211 – Adding Core Animation to Your Application
Session 213 – Getting Started with Spotlight and Quick Look
Session 215 – Embracing Automator Workflows with Your Application 2
Session 216 – Time Machine In-Depth
Session 217 – Unlocking the Potential of Dashcode
Session 218 – Garbage Collection Strategies for Objective-C 2.0
Session 220 – Leopard User Interface Design
Session 221 – Handling Images with the Image Kit
Session 222 – Using Advanced Objective-C 2.0 Features
Session 223 – Adopting 64-bit Programming
Session 224 – Next Generation Automation – AppleScript, Automator and Scripting Bridge
Session 300 – Developer Tools State of the Union
Session 301 – Getting Started with Mac OS X Development Tools
Session 302 – Getting Started with Xcode
Session 304 – Creating Custom Installers with Leopard’s New PackageMaker
Session 305 – Xcode 3.0 – The New Development Workflow
Session 306 – Interface Builder 3.0 – Creating an Interface from Start to Finish
Session 309 – Getting Started with Xray
Session 311 – Unleashing the Power of the Xcode Build System
Session 312 – Refactoring in Xcode – Automatic Project-wide Code Changes
Session 314 – Project-Free Xcode – Mixed Language Development
Session 315 – Tracing Software Behavior with DTrace
Session 316 – Getting Started – Performance Tuning with Shark
Session 317 – Taking Advantage of Compiler Advances
Session 318 – Using Xray and DTrace for In-depth Analysis
Session 319 – Developing Plugins for Interface Builder
Session 323 – Fortran Development and HPC on Mac OS X – 3rd Party Solutions
Session 324 – Bug Reporting Best Practices
Session 400 – Graphics and Media State of the Union
Session 401 – Creating Leading-edge 2D Graphics with Quartz
Session 402 – Understanding the Architecture of Core Audio
Session 403 – Creating Integrated Workflow Solutions with Final Cut Pro
Session 404 – Queueing, Streaming, and Extending Core Audio
Session 407 – Extending the Aperture RAW Workflow with Export Plug-Ins
Session 408 – Modernizing Your OpenGL Application for Leopard
Session 409 – Mastering QuickTime Digital Video Techniques
Session 410 – Introduction to FxPlug Development for Final Cut Studio
Session 411 – Advanced FxPlug Development for Final Cut Studio
Session 414 – Creating High-quality Content With QuickTime APIs
Session 415 – Mastering the Quartz Composer Editor
Session 416 – Integrating QuickTime Support into Your Application with QTKit
Session 417 – Switching to Mac OS X OpenGL
Session 418 – Leveraging the OpenGL Shading Language (GLSL)
Session 419 – Printing with Style in Mac OS X
Session 420 – Tune Your OpenGL Application
Session 421 – Using Quartz Composer in Your Application 2
Session 424 – Create Stunning Effects with Core Image
Session 429 – Tune Your 2D Graphics Code
Session 430 – Manipulating PDF Content in Your Application
Session 431 – Leveraging the Common Unix Printing System (CUPS)
Session 500 – IT State of the Union
Session 501 – Welcome to Leopard Server
Session 502 – Getting Started with Mac OS X Administration
Session 503 – Scripting for SysAdmins
Session 504 – Mac OS X Security Configuration
Session 505 – Discovering Wiki and Group Services in Leopard Server
Session 506 – Integrating Smart Card Solutions in Leopard
Session 508 – Building Powerful Web 2.0 Applications with WebObjects
Session 509 – Mac OS X Scientific Computing State of the Union
Session 510 – Learning to Become an Effective SysAdmin
Session 512 – Bending Directory Services To Your Will – Best Practices
Session 514 – Understanding PKI and Certificate Management on Mac OS X
Session 518 – Real-World WebObjects Solutions
Session 519 – Deploying Large-scale Storage Solutions using Xsan and Xserve RAID
Session 600 – Fundamentals of Digital Video
Session 601 – Improving Your Video With Professional Preprocessing
Session 602 – The Encoding Process In Depth
Session 603 – Delivering Your Media
Session 604 – Iterative Cocoa and Web Application Design
Session 605 – Understanding Web Accessibility for Building Better Websites
Session 606 – Motion Graphics Design Using Quartz Composer
Session 607 – Development Methods for WebKit AJAX Applications
Session 608 – Vector Graphics for WebKit
Session 609 – Dashboard Widget Design Techniques
Session 610 – Design Innovation behind Apple.com
Session 611 – AJAX Methodologies for QuickTime Development
Session 614 – Developing Web Sites for iPhone
Session 615 – Using Dojo Toolkit Power Tools to Build Rich Web Applications
Session 616 – Designing and Developing Hybrid-Web Cocoa Applications
Session 618 – Designing and Extending the Mac OS X Blog Experience
Session 619 – Designing and Developing Rich Media WebKit-based Applications
Session 621 – Advanced Concepts in Using the Prototype JavaScript Framework
Session 622 – Create Effective, Sophisticated Podcasts

WWDC 2008

Session 100 – Introduction to Mac and iPhone Development
Session 101 – Getting Started with Mac OS X Administration
Session 102 – Integrating Your Organization’s First Macs
Session 105 – Publishing on the App Store
Session 300 – Mac OS X State of the Union
Session 312 – iPhone Application Development Fundamentals
Session 313 – Getting Started with Web Development for Safari on iPhone
Session 314 – Java and WebObjects Overview
Session 324 – iPhone for Mac Developers
Session 325 – Safari and WebKit Overview: Features, Enhancements, and Open Source Development
Session 326 – Application Accessibility
Session 327 – Building Great Java Applications on Mac OS X Leopard
Session 328 – Networking with Bonjour
Session 337 – Understanding iPhone View Controllers
Session 338 – Mac OS X 64-bit Kernel: Architecture and Kernel Extension Transition
Session 339 – Getting Started with Objective-C: Migrating from Other Languages
Session 340 – Creating Secure Applications for iPhone and Mac OS X
Session 343 – Understanding iPhone Table Views
Session 344 – Adding Rich Graphics and Media to Web Content in Safari
Session 345 – Managing Certificates for iPhone and Mac OS X
Session 348 – Cocoa Fundamentals
Session 349 – Creating Rich User Interfaces for Web Content in Safari
Session 351 – iPhone Application User Interface Design
Session 352 – Web Development for iPhone: Tips, Tricks, and Advanced Techniques
Session 353 – What’s New in Objective-C
Session 362 – Controls, Views, and Animation on iPhone
Session 363 – What’s New in Cocoa
Session 364 – Font Management and Core Text
Session 374 – Internationalizing Your Software
Session 375 – Using Filesystem APIs Efficiently
Session 379 – Enhancing Your iPhone Web Application with CSS Transforms and Animations
Session 380 – iPhone Multi-Touch Events and Gestures
Session 381 – Core Data Tips and Tricks
Session 382 – Simplifying Multicore with Grand Central Dispatch
Session 387 – Text Input on iPhone
Session 391 – Building an Advanced iPhone Web Application, Hands On
Session 392 – Cocoa Tips and Tricks: Using Leopard Features Effectively
Session 393 – Managing User Privileges and Operations with Authorization Services
Session 401 – Leveraging Cocoa’s Layer-Backed Views
Session 402 – Managing Secure Data on iPhone
Session 403 – Using Advanced AJAX Technologies in Safari
Session 410 – Mastering iPhone View Controllers
Session 411 – Utilizing Offline Data in Safari
Session 412 – Cocoa Performance Techniques
Session 413 – Assigning Your Application an Identity with Code Signing
Session 417 – Optimizing Performance in iPhone Applications
Session 418 – Debugging Websites Using Safari’s Integrated Developer Tools
Session 419 – Polishing Your Cocoa Application
Session 420 – Using Garbage Collection with Objective-C
Session 421 – Introduction to Kerberos
Session 425 – Performance in Document-Centric Cocoa Applications
Session 426 – Creating Ruby on Rails Applications for Safari on iPhone and the Desktop
Session 427 – Managing X.509 Certificates and Digital Identities
Session 432 – Mastering iPhone Table Views
Session 433 – Building Native Look-and-Feel Web Applications Using SproutCore
Session 434 – Getting Started with the I/O Kit: Device Drivers on Mac OS X
Session 435 – Configuring the Apple AirPort Interface
Session 446 – How Do I Do That? Tips and Tricks for iPhone Application Development
Session 447 – Maximizing Platform Compatibility of I/O Kit Drivers
Session 453 – Using Vectorization Techniques to Maximize Performance
Session 454 – Improving Responsiveness in Websites and Web Applications
Session 455 – Kernel Extension Management
Session 456 – The KPCB iFund
Session 500 – Mac OS X Server State of the Union
Session 501 – Integrating iPhone with IT
Session 504 – Deploying Network and Portable Home Directories
Session 505 – Integrating iTunes U into Your Workflows and Infrastructure
Session 511 – Enterprise iPhone Management with Configuration Profiles
Session 512 – Deploying the Mac in a Highly Secure Environment
Session 513 – System-Wide Previews with Quick Look
Session 514 – What’s New for Podcast Producer
Session 515 – Best Practices for Tiger to Leopard Server Migration
Session 516 – Sync Services: A Complete Tour
Session 517 – Managing Clients and Preferences with Mac OS X and Leopard Server
Session 520 – Deploying and Scaling iCal Server Calendaring Services
Session 523 – Keeping Users Connected with the Instant Message Framework
Session 525 – Cocoa Development Using Scripting
Session 526 – Latent Semantic Mapping
Session 527 – Sharing Live Content Through iChat Theater
Session 529 – Address Book for iPhone
Session 533 – Customizing and Extending Leopard Server Wiki Server
Session 534 – Spotlight: Search and Be Searched
Session 535 – Podcast Producer In-Depth
Session 539 – Making Your Application Scriptable
Session 540 – Deploying Podcast Producer
Session 541 – Scripting for System Administrators
Session 543 – Deploying Final Cut Server
Session 546 – iPhone Device APIs: Location, Accelerometer and Camera
Session 547 – Building and Leveraging Automator Actions
Session 549 – Extending and Troubleshooting Directory Services
Session 550 – Integrating with Final Cut Server
Session 551 – Providing User Assistance with Apple Help
Session 552 – Unleashing Leopard Server Performance
Session 556 – Accessing Contacts and Calendars on Leopard
Session 557 – Infrastructure and Deployment Techniques for Large-Scale On-Demand Content Delivery with the Mac
Session 558 – Best Practices in Mac OS X Administration Panel
Session 700 – Graphics & Media State of the Union
Session 701 – Handling PDF Content in Your Application
Session 702 – Getting Started with OpenGL on the Mac
Session 703 – Introduction to Game Development for iPhone
Session 704 – Understanding the Core Audio Architecture
Session 706 – Audio Development for iPhone
Session 707 – Mastering the Mac Graphics Architecture
Session 708 – 3D Graphics for iPhone using OpenGL ES
Session 709 – High-Performance Image Processing with Core Image
Session 710 – Integrating Media into Your Application with QTKit
Session 711 – 2D Graphics & Animation for iPhone and Mac
Session 712 – Advanced Media Application Development
Session 716 – Core Animation Techniques for iPhone and Mac
Session 719 – Advances in Modern OpenGL
Session 722 – Preparing and Delivering Video for iPhone, Safari, and Apple TV
Session 723 – Tuning OpenGL Applications for the Mac
Session 724 – Introducing OpenCL
Session 725 – Application Printing in Mac OS X
Session 727 – Advanced OpenCL
Session 731 – Integrating and Extending Quartz Composer
Session 735 – Image Capture, Manipulation, and Display with Image Kit
Session 736 – Extending and Integrating Post-Production Applications with Final Cut Pro
Session 737 – FxPlug Development for Motion and Final Cut Pro
Session 739 – Extending Aperture with Image Editing Plug-Ins
Session 900 – Developer Tools State of the Union
Session 901 – Introduction to the iPhone Development Tools
Session 902 – Using WebObjects to Build Powerful Web Applications
Session 903 – Introducing Address Book Server
Session 906 – Xcode for Visual Studio and Eclipse Developers
Session 907 – New Compiler Technology and Future Directions
Session 908 – Managing Mac OS X with Netboot, Managed Preferences and Apple Remote Desktop
Session 910 – Designing Applications with Interface Builder
Session 911 – Advanced Performance Profiling Techniques with Shark
Session 915 – Using Xcode: Source Editor, Refactoring, Debugger, and SCM
Session 916 – Getting Started with Instruments
Session 917 – What’s New in Core Data
Session 919 – Understanding the Xcode Project Management and Build System
Session 920 – Best Practices for Large-Scale Xsan 2 Deployments
Session 921 – Using Dashcode to Create and Debug iPhone Web Applications
Session 922 – Creating Efficient Data Models with Core Data
Session 923 – Mastering Interface Builder
Session 925 – Debugging and Profiling Your iPhone Application
Session 930 – Using DTrace on Mac OS X
Session 932 – Performance Tuning Your Application with Shark
Session 933 – LLVM Compilers In Depth
Session 935 – Advanced Performance Analysis with Instruments & DTrace
Session 936 – Intel’s Multi-Core Software Visio
Session 938 – Creating Widgets with Dashcode
Session 939 – Performance Optimization Techniques using Intel Libraries
Session 940 – Mastering Advanced Objective-C Features

WWDC 2009

WWDC 2010

WWDC 2011

WWDC 2012

WWDC 2013

WWDC 2014

WWDC 2015

WWDC 2016

Automate HomeKit with HomeControl Automation URLs

Fri, 14 Jan 2022 00:00:00 +0100

Introduction

HomeControl is a powerful Mac app that allows you to control your HomeKit setup directly from the menu bar.

HomeControl also includes full automation support for all the actions available in the app (triggering scenes, switching a device or device group status, changing the primary home and also changing device properties) with “x-callback-url”-compatible Automation URLs which can be easily invoked from AppleScript, Terminal and other apps.

Automation URLs

HomeControl Automation URLs can be easily generated from the “Customize Items” section available in the HomeControl preferences window. Just right-click an actionable item like a device or scene and select “Copy Automation URL”.

A HomeControl Automation URL will be now available in your pasteboard. By default, Automation URLs run the same action that is executed when clicking on the item in the HomeControl menu:

Scenes will be triggered.
Devices will toggle their status (on to off and viceversa).
Homes will be set as the HomeKit primary home.

You can customize these default Automation URL to unleash a lot of more actions.

Device Activation Modes

Device and device group Automation URLs can be modified so they always activate or deactivate the item instead of toggling its state by changing the activation-mode parameter to activate or deactivate instead of toggle:

Toggle: homecontrol://x-callback-url/run-action?action-type=switch-device-status&item-type=device&item-name=Outlet&room-name=Principal&home-name=Home&activation-mode=toggle&authentication-token=TOKEN
Activate: homecontrol://x-callback-url/run-action?action-type=switch-device-status&item-type=device&item-name=Outlet&room-name=Principal&home-name=Home&activation-mode=activate&authentication-token=TOKEN
Deactivate: homecontrol://x-callback-url/run-action?action-type=switch-device-status&item-type=device&item-name=Outlet&room-name=Principal&home-name=Home&activation-mode=deactivate&authentication-token=TOKEN

Current Home Actions

You can also remove the home-name parameter of the URL and it will be invoked on the device or scene named as the item-name available in the current primary home. This is handy if you have the same scene available in multiple homes and want to trigger the scene in the one you are at the moment the automation is triggered.

Device Property Actions

There is a forth type of automation action that is not available directly with the “Copy Automation URL” shortcut, the change-device-property action. This action allows you to change a property of a device like light brightness, light color, thermostat mode, thermostat temperature or blinds position by setting the property-type and property-value parameters. These are some examples of what is posible with this powerful action type:

Set lightbulb named “Light” to 70% brightness: homecontrol://x-callback-url/run-action?action-type=change-device-property&item-type=device&item-name=Light&property-type=light-brightness&property-value=70&authentication-token=TOKEN
Set lightbulb named “Light” to yellow color (hue 60°): homecontrol://x-callback-url/run-action?action-type=change-device-property&item-type=device&item-name=Light&property-type=light-hue&property-value=60&authentication-token=TOKEN
Set lightbulb named “Light” to 30% color saturation: homecontrol://x-callback-url/run-action?action-type=change-device-property&item-type=device&item-name=Light&property-type=light-saturation&property-value=30&authentication-token=TOKEN
Set lightbulb named “Light” to warm color temperature (3200K): homecontrol//x-callback-url/run-action?action-type=change-device-property&item-type=device&item-name=Light&property-type=light-color-temperature&property-value=3200&authentication-token=TOKEN
Set thermostat named “Air Conditioner” to 21°C target temperature: homecontrol://x-callback-url/run-action?action-type=change-device-property&item-type=device&item-name=Air%20Conditioner&property-type=thermostat-temperature&property-value=21&authentication-token=TOKEN
Set thermostat named “Air Conditioner” to “Auto” mode: homecontrol://x-callback-url/run-action?action-type=change-device-property&item-type=device&item-name=Air%20Conditioner&property-type=thermostat-mode&property-value=auto&authentication-token=TOKEN
Set blinds named “Blinds” to 70% open: homecontrol://x-callback-url/run-action?action-type=change-device-property&item-type=device&item-name=Blinds&property-type=position&property-value=70&authentication-token=TOKEN
Set window named “Window” to 30% open: homecontrol://x-callback-url/run-action?action-type=change-device-property&item-type=device&item-name=Window&property-type=position&property-value=30&authentication-token=TOKEN
Set fan named “Fan” to 60% speed: homecontrol://x-callback-url/run-action?action-type=change-device-property&item-type=device&item-name=Fan&property-type=rotation-speed&property-value=60&authentication-token=TOKEN

Automation & Scripting

You can easily invoke HomeControl Automation URLs from AppleScript, Terminal or other apps like Shortcuts, Keyboard Maestro or Stream Deck.

AppleScript

tell application "HomeControl" to open location "homecontrol://…"

Terminal

$ open -g "homecontrol://…"

Other Apps

Simply use an “Open URL” or “Open X-Callback URL” action and set it to launch the Automation URL. Some apps also support running Terminal scripts or AppleScript.

Creating Apple Wallet Passes in Batch With MakePass and Shortcuts

Wed, 24 Nov 2021 00:00:00 +0100

TL;DR

You can download a shortcut here that parses a CSV text and generates multiple passes in batch using MakePass:

Introduction

MakePass includes multiple Shortcuts actions that allow you to create, preview and share Apple Wallet passes. The Create Pass action exposes all the power of the MakePass pass editor directly in Shortcuts so you can customize all the properties of your pass. The Create Pass action includes an Import Pass File parameter so you can import a template pass file whose properties can be overridden by the action parameters.

Process

First you should create a pass file which will be used as a template. This template file will be set in the Import Pass File parameter of the Create Pass action which uses it as the base canvas over which to override any other parameter. If you do not import a pass file, the Create Pass action will use a blank template by default. You can create your own pass template file in MakePass or use this one as an example.

Afterwards, to create multiple Apple Wallet passes in batch you should import the information which will be inserted in the pass template for each new pass. To do so, we can use the popular CSV (comma-separated values) format:

John Appleseed,CD-0000001,2021-01-01 12:00
Chandler Bing,CD-0000002,2021-01-02 12:00
Mario Gómez,CD-0000003,2021-01-03 12:00
Ursula von Köriet,CD-0000004,2021-01-04 12:00
Alejandro Couñago,CD-0000005,2021-01-05 12:00

In this example CSV document, each line represent a pass which will be generated. Each line includes 3 components which will be added to the pass template (a name in a text field like "John Appleseed", a QR barcode payload like "CD-0000001" and a relevant date like "2021-01-01 12:00"). To load this CSV in Shortcuts we can use the Text action, load the contents from a file or use the shortcut content input. In this example we will use the Text action.

Once we have the CSV text loaded in the shortcut, we can split it by line and iterate over them. In each iteration we can split the line by commas and we can extract each of the pass components needed to fill the pass template:

After extracting the components we can simply set our pass template file in the Import Pass File parameter and fill the other custom parameters in the Create Pass action to complete the template:

And voilà!, running the shortcut will generate 5 passes, each one with its own custom properties:

To complete the shortcut, we can add an action to open the passes in macOS or share them with an app in iOS and iPadOS. You can also use the Save File action to store the pass files in your device.

Shortcut

You can get the complete shortcut here.

Install Any iOS App on Apple Silicon Macs

Tue, 17 Nov 2020 00:00:00 +0100

Apple silicon Mac running multiple iOS apps, some of them not available on the Mac App Store yet.

Apple silicon Macs can run iPhone and iPad apps natively using the same Mac Catalyst technology that powers apps like Twitter or Darkroom on macOS. Although all iOS apps are by default directly available on the Mac App Store, developers can opt-out and make their apps unavailable. Unfortunately, some of the most popular apps like Instagram, Deliveroo or Netflix have been removed from the Mac App Store… but that does not mean they cannot run on macOS, they are simply hidden in the Mac App Store. If you have purchased or downloaded any app from the iOS App Store, you have the option to make a backup of it using an IPA file, and those files can be used on Apple silicon Macs to install any iOS app.

Currently there are multiple approaches to download those IPA files for any iOS app:

iMobie M1 App Checker.
Apple Configurator (requires connecting an iPhone or iPad).
iTunes 12.6 on a compatible Mac or PC.

Once you have the IPA file, you can simply double click it on any Apple silicon Mac and voilà!

Apple Silicon Macs running iOS apps natively is truly game-changing.

macOS will become the most complete app platform ever: from complex workflows with Xcode, Final Cut Pro or MATLAB to ordering with Deliveroo, browsing IMDb or watching Netflix… there will be an app for that! pic.twitter.com/CiCTOROaNR
— Pedro José Pereira Vieito (@pvieito) November 16, 2020

HomeKit Automation: Extracting HomeKit Pairing Keys from macOS

Mon, 09 Dec 2019 00:00:00 +0100

Introduction

While the Home app allows you to read and control your HomeKit-based devices on macOS, iPadOS and iOS, sometimes you want more control. You may want to bridge some sensor to other protocol, expose you home temperature on a public API, or simply export the historical data to a CSV file. Either way, currently the HomeKit framework is private API on macOS, and it is not available on other platforms like Linux or Windows.

Fortunately there are some cross-platform implementations of the HomeKit Accessory Protocol that support controller-mode functionality:

In particular HomeKit Python supports reading and writing HomeKit characteristics on paired devices as well as generating additional pairings. The main problem is that typically HomeKit devices only support one main pairing controller, thus, once it is paired with the Apple Home app it can only be controlled with the pairing keys managed by the homed system daemon which are gated by the HomeKit framework.

Fortunately, the HomeKit pairing keys are stored on the iCloud Keychain. Unfortunately (but reasonably), the system tries hard to hide these pairing keys. In particular, they do not appear on the Keychain app nor can be read with the Security framework SecItem* family of APIs without some private entitlements granting access to the keychain access group com.apple.hap.pairing.

Process

First of all, we have to subvert the AMFI security model to be able to sign arbitrary executables with private entitlements. To do it, we have to disable System Integrity Protection and AMFI. Rebooting on Recovery OS we can disable the protections using the Terminal app:

$ csrutil disable
$ nvram boot-args=amfi_get_out_of_my_way=0x1
$ reboot

After reboot, we can use KeychainTool to dump the HomeKit keychain items.

$ git clone https://github.com/pvieito/KeychainKit.git
$ cd KeychainKit
$ cat KeychainTool/KeychainTool.entitlements
# The all-powerful * `keychain-access-groups` entitlement which grants its bearer permission to read all keychain items:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>keychain-access-groups</key>
    <array>
        <string>*</string>
    </array>
</dict>
</plist>

Now we will compile and run KeychainTool to dump all the keychain entries in the com.apple.hap.pairing access group.

Bear in mind that KeychainTool uses CodeSignKit to self sign its executable with private entitlements before relaunching itself. If a codesign error is shown set the CODESIGNKIT_DEFAULT_IDENTITY environment variable to the name of your Apple Developer certificate as presented on the Keychain app.

$ swift run KeychainTool -g com.apple.hap.pairing
[*] HomeKit Pairing Identity (com.apple.hap.pairing)
[ ] Account: 7C73D188-BF12-4B8C-B7A5-5842D71C24EA
[ ] Key: “21159cfa6032438be197d668b3562e262441965789f95634d6460d4cce5cc706+d2ed8558b369b4ee1fbf4f9eb8d687ee2799aba5608efc2712d8175697bd8ad8”
[*] Paired HomeKit Accessory: CC:0D:07:E4:F7:54 (com.apple.hap.pairing)
[ ] Account: CC:0D:07:E4:F7:54
[ ] Key: “3a4473f1efe5e378fdd329826936f34b674fcb97c8aa5bd9818abde46963f864”
[*] Paired HomeKit Accessory: 58:CA:96:CE:66:5F (com.apple.hap.pairing)
[ ] Account: 58:CA:96:CE:66:5F
[ ] Key: “44d34407d583aee3b12b774a6eb15ee96c527fa83af1db66ac90f60494bbbc29”

Voilà! Here we have all we need:

The HomeKit Pairing Identity entry contains the pairing identifier stored as the item account name: 7C73D188-BF12-4B8C-B7A5-5842D71C24EA and the LTP and LTS keys required by the HomeKit protocol separated by a + sign on the entry key payload: 21159cfa6032438be197d668b3562e262441965789f95634d6460d4cce5cc706, d2ed8558b369b4ee1fbf4f9eb8d687ee2799aba5608efc2712d8175697bd8ad8
Each accessory has its own Paired HomeKit Accessory keychain entry containing its paring key. For example, the device 58:CA:96:CE:66:E9 has the LTP key 44d34407d583aee3b12b774a6eb15ee96c527fa83af1db66ac90f60494bbbc29.

Now we can use the pairing keys to set up HomeKit Python on any device and platform:

$ python3 -m pip install "homekit[IP]" --user
$ python3 -m homekit.discover
# `homekit_python` will list all HomeKit devices found on the network:
Name: Eve Extend XXXX._hap._tcp.local.
Url: http_impl://192.168.0.123:8080
Configuration number (c#): 5
Feature Flags (ff): Supports HAP Pairing (Flag: 1)
Device ID (id): 58:CA:96:CE:66:5F  # Same Device ID as in the keychain entry.
Model Name (md): Eve Extend XXXXXXXX
Protocol Version (pv): 1.1
State Number (s#): 1
Status Flags (sf): Accessory has been paired. (Flag: 0)
Category Identifier (ci): Bridge (Id: 2)
$ mkdir ~/.homekit_python
$ python3 -m homekit.init_controller_storage -f ~/.homekit_python/pairing.json
$ nano ~/.homekit_python/pairing.json
# Write the pairing credentials of each the device:
{
  "EveExtend": {
    "AccessoryPairingID": "58:CA:96:CE:66:E9",
    "AccessoryLTPK": "44d34407d583aee3b12b774a6eb15ee96c527fa83af1db66ac90f60494bbbc29",
    "iOSPairingId": "7C73D188-BF12-4B8C-B7A5-5842D71C24EA",
    "iOSDeviceLTSK": "d2ed8558b369b4ee1fbf4f9eb8d687ee2799aba5608efc2712d8175697bd8ad8",
    "iOSDeviceLTPK": "21159cfa6032438be197d668b3562e262441965789f95634d6460d4cce5cc706",
    "AccessoryIP": "192.168.0.123",
    "AccessoryPort": 8080,
    "Connection": "IP"
  }
}
$ python3 -m homekit.identify -f ~/.homekit_python/pairing.json -a EveExtend
# The HomeKit device should identify itself (for example blinking an LED).
$ python3 -m homekit.get_accessories -f ~/.homekit_python/pairing.json -a EveExtend
# Shows all the accesories exposed by the device.
$ python3 -m homekit.get_characteristic -f ~/.homekit_python/pairing.json -a EveExtend -c 3.38
# Shows the value of a given characteristic, for example the room relative humidity:
{
    "3.38": {
        "value": 54.4525146484375
    }
}

Finally, remember to re-enable System Integrity Protection and reboot your Mac:

$ csrutil clear

Jailbreaking macOS: Patching AMFI to Allow Arbitrary Entitlements

Tue, 27 Dec 2016 00:00:00 +0100

Introduction

Entitlements are an important part of Apple Security architecture. They allow Apple to limit an OS feature to be only available to Apple-approved processes. Nowadays, even with System Integrity Protection disabled, the AMFI Kernel Extension and amfid process dueto will always kill any process at execution with restricted Entitlements not signed by Apple or with a properly Apple-approved embedded provisioning profile.

Unrestricted Entitlements are available to all signed binaries, even ad-hoc (some examples of this are the Sandbox entitlements com.apple.security.* or the application identifier one com.apple.application-identifier) but they do no give any special capability to the process, on the contrary, they limit its reach.

To allow any Entitlements, even the more interesting Restricted ones, for a Developer ID signed binary we have to modificate the amfid process (to allow adhoc signatures too we would have to patch the AMFI Kernel Extension or its underlying dependencies which I didn’t try).

Process

To patch a system daemon, we have to disable macOS System Integrity Protection. After some reverse engineering, it seems one of the main decisions in the amfid flow is in the address offset 0x347D.

Decision flow of amfid.

Knowing that we can change the following two instructions from:

test %r14, %r14
je loc_100003531

To this:

mov %r14, %r15
jno loc_100003531

This way the flow will always jump to loc_100003531 and %r14 will become null (%r15 is always null in this point), so every Developer ID signed process will be validated even without a provisioning profile allowing its Entitlements.

Code

To achieve this modification we can go the hard way by modifing the binary in situ (it is located at /usr/libexec/amfid) or the soft way: patching amfid memory at runtime. I preferred the second option so I could restart the unpatched amfid code by simply killing it.

To do it I ported to Python 3 a wrapper for Mach VM APIs called pymach and added a new function to get the ASRL Slice Offset of the process: PyMach for Python 3. With that I wrote this script for macOS 10.12.2. To use it simply run:

$ sudo ./amfid_patch.py

And answer yes when asked if you want to patch the process. Voilà! Now any Developer ID signed binaries will be executed even with restricted Entitlements.

You can set any Entitlement you want, like com.apple.developer.icloud-container-identifiers or com.apple.private.appleaccount.app-hidden-from-icloud-settings with an arbitrary iCloud container. For a complete list of private Entitlements used by Apple you can go to Jonathan Levin’s Entitlements Database.

References

*OS Internals: Volume III

iCloud Locations in macOS

Tue, 15 Nov 2016 00:00:00 +0100

Sandboxed vs. Non Sandboxed

In macOS a given app can or cannot be sandboxed and since macOS Sierra non App Store apps can access iCloud APIs so could be a non-sandboxed app using this locations to sync data.

So if you want to access a sandboxed iCloud location you should go to the app container and use it as the home path.

$SANDBOXED_CONTAINER = ~/Library/Container/com.example.app/Data

iCloud Documents

Each app can have one or more document containers inside named with its Bundle ID:

~/Library/Mobile Documents/

The information and details of each container are stored here:

~/Library/Application Support/CloudDocs/session/containers

The info is stored in a plist file with the name of the container for example:

iCloud.com.pvieito.Example.plist

And the icons are stored in a folder with the name of the container:

iCloud.com.pvieito.Example/40x40_iOS.png
iCloud.com.pvieito.Example/80x80_iOS.png
iCloud.com.pvieito.Example/120x120_iOS.png

Key-Value Store

This synced data is stored as a property list file in:

~/Library/SyncedPreferences/
$(SANDBOXED_CONTAINER)/Library/SyncedPreferences/

CloudKit

CloudKit works online but macOS stores a cache of its contents in a folder appropriately called CloudKit:

~/Caches/CloudKit
$(SANDBOXED_CONTAINER)/CloudKit

Coldplay Xyloband Reverse Engineering

Thu, 29 Sep 2016 00:00:00 +0200

The Xyloband is the wristband that Coldplay gives to the audience to create a colorful light show during its concerts.

Fotografía de Carlos RM (CC) 2012.

The wristband receives data from a central transmitter. The new version of the band not only is able to light the LEDs but can receive audio and play it through a built-in speaker.

Procedure
Disassembly
PCB Inspection
- Front
- Back
PCB Reverse Engineering
Conclusion

Procedure

First, we will disassembly the device and list the different components that we find in the PCB. Then we will try to investigate them looking for datasheets and all the available information to reconstruct the behavior of the circuit. Finally that, we can recover the blueprint of the tracks in the PCB and analyze the complete system.

Disassembly

So I took the Dave Jones approach: “Don’t turn it on, take it apart!”. First I opened the wristband and extracted the PCB with the LED band.

Xyloband internals: Speaker, LED/Antenna flat-flex and PCB.

This is the internal parts of the Xyloband. We can see the speaker, the flat-flex with the LEDs and the main PCB. From this view we can intuit that the flat-flex will probably act not only to power the color LEDs but as an antenna to receive the signal.

PCB Inspection

To get a good view of the PCB layers I have done two photos from each side, one front-lighted and another back-lighted. After that we can create a composite image for each side so we can find if there are inside layers. And indeed, there are.

Both sides of the PCB with front-light, back-lighted and composite.

The PCB has 4 layers, two external or sides and two internal layers. In parenthesis is the color I have used later in the PCB track blueprint:

Front side (Orange)
Back side (Cyan)
Internal ground layer (Navy Blue)
Internal track layer (Purple)

Now we will analyze each layer in detail.

Front

So here is the first composite image of the front side with its main areas, power and data reception, demodulation and decoding (RX):

Composite image of the front of the Xyloband PCB. Horizontally flipped image to match the back layer.

In the front of the Xyloband PCB we can find these devices:

Silicon Labs Si4362 High-Performance, Low-Current Receiver
30 MHz Cristal Oscillator
IC IACMF Voltage Regulator
3 mH Inductor

The Si4362 IC is the main component of the RX area. This chip will receive the transmission from the antenna (we can see it is connected to the uppermost pin of the flat-flex), amplify it using an Low Noise Amplifier and demodulate it. Then the final digital signal will be sent to the microcontroller in the other side of the board through an I²C connection.

The Power section of the front side is mainly a voltage controller that generates the suitable voltage to drive the LEDs and the Audio Amplifier.

Back

Now back to the back were the main areas are the logic microcontroller, the audio amplifier, the LED drivers and a part of the power section that enables the connection of the battery to the voltage regulator on the other side.

Composite image of the back of the Xyloband PCB.

And in the back we can see the following ICs:

Atmel SAM D20 SMART ARM-based Microcontroller
Analog Devices SSM2211 Low Distortion, 1.5 W Audio Power Amplifier

The ARM processor is connected with the Si4362 receiver through the I²C and decodes the information, namely the audio and LEDs colors. Then it will light the LEDs through the driver and output the audio signal with its DAC.

The audio signal goes to the SSM2211 audio amplifier which is connected with the speaker.

PCB Reverse Engineering

Now we are going to analyze the board and extract to tracks printed on in to get to full circuit schematic.

Front Tracks

Back Tracks

Inside Tracks

All tracks superimposed

Conclusion

The main controller of the Xyloband is an Atmel SAM D20 which outputs the audio and sets the light of the wristband. The audio output is amplified by the Analog Devices SSM2211 low distortion power amplifier and the LEDs are managed by tree transistors. Finally all the data is received and decoded by the Silicon Labs Si4362 receiver and sent through the I²C bus to the main processor.

GIF support coming to WhatsApp

Fri, 05 Aug 2016 00:00:00 +0200

After our friends from AndroidTR found out some resources in the new update of WhatsApp for Android I wanted to go deeper and analyze the iOS version to see if it was prepared to handle GIFs as well.

New glyphs for GIF support.

In the last update of WhatsApp for iOS (version 2.16.7) there are the same three new GIF glyphs found in Android and two more for what it seems to be Live Photos support.

New methods and classes for GIF support.

Then in the proper binary executable there are a lot of new methods designed to handle GIFs. They even have created a new Class WAGIFCreator which seems to allow to create GIFs from scratch with various images or a video.

It seems this feature is complete, but the WhatsApp team has to enable it remotely as they have previously done with other capabilities like E2E Encryption.

Introducing the YAML Subject specification

Thu, 30 Jun 2016 00:00:00 +0200

The YAML Subject specification aims to define a simple file format that allows to store (and export) all the metadata of a given course subject for a student. In particular it was designed to store the assessment so a program can easily parse the file and compute the final mark and show all the available information of the subject.

Introduction

YAML Subject files are encoded in plain YAML, are identified with a double filename extension .subject.yaml and include all the metadata of a subject and its assessment. The main principles of the YAML Subject format are that it must be:

Simple
Human readable
Easy to modify
Extensible
Compatible

Structure

The following are the defined keys of a YAML Subject file. Each YAML Subject file describes a unique subject for one student, so each of these properties is about that particular subject and student:

Key	Required	Description	Type	Examples
`codename`	Required	Two or more capital letters that easily identify the subject	`String`	`CRYPTO` `MND` `SED`
`status`	Required	An integer describing the state of this subject	`Integer`	More info below
`name`	Optional	Full name of the subject	`String`	`Cryptography I` `Micro and Nano Electronic Design` `Sistemas electrónicos digitales`
`code`	Optional	Code of the subject	`String`	`G330923` `230646`
`course`	Optional	Course of the subject	`String`	`Cybersecurity Course` `Master in Electronic Engineering` `Grado en Ingeniería Electrónica`
`institution`	Optional	Institution teaching the subject	`String`	`Standford University` `Universitat Politècnica de Cat` `Universidade de Vigo`
`credits`	Optional	Number of credits of the subject	`Float`	`2.5` `6`
`type`	Optional	Type of the subject	`String`	`Online` `Core` `Obligatoria`
`year`	Optional	Academic year	`String`	`2014` `2015/16` `1999/2000`
`term`	Optional	Term of the subject	`String`	`2` `Spring`
`web`	Optional	Website of the subject	`String`	`coursera.org/learn/crypto` `atenea.upc.edu/31299`
`assessment`	Optional	Array of dictionaries containing the assessment marks	`Array`	More info below

Status

The status key of the subject is an integer that indicates the following:

Status Code	Meaning	Description	Color
`0`	Passed	The subject has been passed and now is archived	Green
`1`	Active	The subject is being taught in the actual course	Blue
`2`	Future	The subject will start in the future	Purple
`4`	Failed	The subject is failed	Red
Other	Unknown	The status of the subject is unknown	Grey

If you want to create a new proprietary status code you should use a code over 100. The colors are recommendations for any GUI.

Assessment

The assessment key is an array that includes all the marks of the subject needed to compute the final mark and a some other important information.

Each element of the array is a dictionary with the following keys:

Key	Required	Description	Default	Example
`mark`	Required	Mark of the item		`8` `68` `7.5`
`description`	Optional	Name of the item		`Mid-Term Exam` `Delivery` `Lab 3`
`weight`	Optional	Float between 0 and 1 indicating the weight of this item over the overall subject mark	`1`	`1` `0.2` `0.05`
`fullscale`	Optional	Float that indicates the maximum mark of this item	`10`	`10` `100` `2.5`

Example

Here is an example of a full YAML Subject file (AACT.subject.yaml):

course: Master in Electronic Engineering (MEE)
institution: Universitat Politècnica de Catalunya (UPC)
codename: AACT
name: Advanced Analog Circuit Techniques
code: 230642
credits: 5
type: Core
year: 2015/16
term: 2
status: 1
web: http://atenea.upc.edu/moodle/course/view.php?id=31281
assessment:
  - description: Deliveries
    mark: 7
    weight: 0.2
  - description: Mid-Term Exam
    mark: 8
    weight: 0.2
  - description: Final Exam
    mark: 76
    fullscale: 100
    weight: 0.6

Interesting courses in Coursera

Mon, 30 Mar 2015 00:00:00 +0200

Coursera is a MOOC platform with thousands of courses from different universities and institutions. These are some I have found very interesting:

Cryptography I from Standford University
Software Security from University of Maryland
Computer Networks from University of Washington
Cryptography from University of Maryland
Fundamentals of Digital Image and Video Processing from Northwestern University

Cómo recuperar acceso de administrador en un Mac

Wed, 10 Sep 2014 00:00:00 +0200

Siguiendo estas instrucciones se puede recuperar el acceso de administrador de un Mac sin eliminar otras cuentas o borrar el disco. Este método no funcionará si el disco duro está cifrado con FileVault 2.

Reiniciar el Mac.
Antes de escuchar el sonido de arranque hay que pulsar Comando+S para entrar en modo terminal.
Desde la línea de comandos borramos el archivo .AppleSetupDone para que OS X ejecute la pantalla de bienvenida la próxima vez que reiniciemos:
```
  mount -uw /
  rm /var/db/.AppleSetupDone
  shutdown -h now
```
Finalmente sólo hay que encender de nuevo el Mac y crear una cuenta.

A ICANN activa o primeiro dominio .gal

Sat, 12 Apr 2014 00:00:00 +0200

Tras 7 anos, o dominio .gal xa é unha realidade:

Nic.gal convertiuse onte pola noite no primeiro dominio de puntoGAL activado pola ICANN, o organismo internacional que xestiona os dominios da rede a nivel mundial.

Tras máis de 7 anos de traballo e coas sinaturas de apoio de doce mil cidadáns e 110 entidades, a posta en marcha desta primeira páxina, de caracter técnico e para probas, supón a delegación formal do dominio e a culminación dun longo proceso apoiado por toda a sociedade galega.

Como todos os novos dominios haberá un prazo inicial para que as administracións públicas, organizacións galegas e marcas poidan rexistrar o seu dominios antes do público xeral.

Instalación del Combo R 100

Fri, 20 Dec 2013 00:00:00 +0100

Hace unos días decidí cambiar de Movistar ADSL 10 Mbps a un Combo R 100 Mbps. Lo pedí el pasado miércoles a la mañana, a la tarde llamé para pedir la cita con el técnico y al día siguiente ya vinieron a hacer la instalación.

Instalación

Lo que lleva el PTR dentro: un repartidor coaxial y un zócalo RJ para probar el teléfono.

Básicamente suben un cable doble (coaxial para Internet y par de cobre para teléfono) desde un distribuidor externo hasta un Punto de Terminación de Red (PTR) que colocan dentro de casa. Ese PTR es una caja que simplemente tiene dos salidas coaxiales (internet y televisión) y una de teléfono.

Router

La primera salida coaxial va directamente al router, mi modelo fue el que instalan con los Combos 100 y 200, un inesperado Cisco EPC3928AD. Acostumbrado a los equipos que suele dar Movistar esto fue una bonita alegría. A parte de incluir todo los clásico (DHCP, IEEE802.11b/g/n, filtrado MAC, DDNS o DMZ) tiene también un servidor de archivos (gracias a su puerto USB), Media Server, configuración Wi-Fi avanzada (velocidad de transmisión, medición automática de ruido por canal, permite crear 2 redes inalámbricas independientes) y el VPN de Cisco.

Teléfono

Para conectar el teléfono simplemente desconectan la red del antiguo operador y enchufan el par de cobre de R a la red de teléfono interior. Desde ese momento todos los teléfonos ya funcionan con un número temporal que te dan mientras no se finaliza la portabilidad.

Velocidad

Conexión	Contratada	Bajada	Subida
Movistar	10 Mbps	4,95 Mbps	0,54 Mbps
R Combo	100 Mbps	103,63 Mbps	9,36 Mbps

En su web dicen que garantizan hasta un 80% de la velocidad contratada por cable, y la verdad es que sí que cumplen. Conectado por Ethernet todos los test de velocidad que he realizado han superado los 100 Mbps que tengo contratados. Bastante sorprendente comparado con Movistar, que de los “hasta 10 Mbps” anunciados me llegaban tan solo 5 Mbps.

Análisis de OS X 10.9 Mavericks por John Siracusa

Tue, 22 Oct 2013 00:00:00 +0200

Lo mejor de cada nueva versión de OS X es sin duda el análisis de John Siracusa. Este año es cortita, solo 23.000 palabras.

El nuevo modelo de WhatsApp para iOS

Thu, 18 Jul 2013 00:00:00 +0200

Ayer WhatsApp lanzó su última actualización para iOS, entre las novedades incluía copias de seguridad en iCloud, la posibilidad de añadir múltiples fotos a una conversación al mismo tiempo, abrir archivos en WhatsApp y una esperada API que permitirá a otras aplicaciones interactuar con WhatsApp (por ejemplo enviar fotos o música que guardemos en Dropbox).

Pero quizás la novedad más interesante es que la aplicación pasó de costar 0,89 € a ser gratis. En realidad WhatsApp a cambiado el modelo de negocio a uno similar al que tenía en Android: el primer año gratis, los siguientes 0,89 €/año. Para los usuarios que ya habíamos descargado la aplicación hay una muy buena noticia, tendremos WhatsApp gratis de por vida. Es más, la nueva versión permite transferir nuestra cuenta en caso de que cambiemos nuestro número de teléfono.

Instacast para Mac Beta

Fri, 03 May 2013 00:00:00 +0200

Instacast para iOS ha sido mi podcatcher favorito desde hace tiempo y el pasado miércoles Instacast para Mac ha llegado a la fase de beta pública. Después de probarla durante unos pocos días he de decir que está muy bien conseguida para ser una beta.

La cuidada interfaz de Instacast para Mac.

La interfaz como en Instacast para iOS está muy cuidada, el equipo Vemedio ha conseguido crear una interfaz de usuario fácil de entender a la vez que bonita y con estilo Mac. Las características son prácticamente las mismas que en iOS, los podcasts se pueden visualizar como subscripciones, listas o listas inteligentes. Incluye también pequeños detalles que se agradecen en una versión para Mac como un mini-reproductor muy parecido al de iTunes.

Las preferencias de la aplicación incluyen todo lo importante —gestión de archivos, servición para compartir— y también la opción de sincronización en la nube. Y aquí está el mayor problema de la beta. Si ya tenías subscripciones en un dispositivo iOS, una vez actives Instacast Cloud probablemente veas que todas se han pasado al Mac, sin embargo muchos episodios se marcarán como no reproducidos, algunos favoritos no aparecerán, etcétera, etcétera. Después puede que como a mi, no te sincronice en las dos direcciones, en mi caso los cambios que realizaba en el iPhone no se pasaban al Mac pero sí al revés. Finalmente encontré una solución —quizás temporal—, borrar la app de iOS, quitar la cuenta de Instacast Cloud del Mac y comenzar desde el principio la sincronización. Por ahora parece estar funcionando correctamente.

En general Instacast para Mac para ser una beta me ha sorprendido gratamente con excepción de esos problemas de sincronización. Animo a que probéis la beta pública, podéis descargarla gratis desde la web de Instacast. El precio final aún no se conoce pero Vemedio ofrece la opción “Early Bird” para comprarla más barata antes de que termine el periodo de beta.

La vida después de Google Reader: historia y alternativas

Sun, 21 Apr 2013 00:00:00 +0200

Google Reader fue presentado en el 2005 y se ha convertido en el servicio más usado para leer feeds RSS. Tan usado, que es el lector de feeds por defecto. Pero esto se acabará, Google anunció que cerrará Reader el 1 de julio de este año. En Twitter cundió el pánico, pero por suerte existen diversas alternativas:

Digg Reader: Digg ha lanzado su propio lector de feeds en beta, tiene una interfaz simple y bonita además de aplicación propia para iOS.
Feedly: el servicio web gratuito con apps nativas para iOS y Android. Han anunciado una API pública, denominada Normandy, similar a la de Google Reader y que aplicaciones como Reeder o Press serán compatibles antes del 1 de julio.
Fever: es un servicio un poco más complicado de usar, requiere disponer de un servidor propio pero tiene buena pinta y funciona con Reeder para iOS. Detalle importante, cuesta 30$. Emilcar ha escrito hace unas semanas una entrada explicando como se instala y configura.
Feedbin: este servicio tiene una interfaz muy cuidada y una API para otras aplicaciones (es compatible con Reeder). Es un servicio de subscripción, 2$ al mes.
Feed Wrangler: otra alternativa de pago, con una interfaz un poco peor que Feedbin pero con aplicación propia para iOS.
The Old Reader: está bien si solo quieres leer los feeds en un navegador. Sencillo y gratuito.

Hay algunas más pero estas son las que me han parecido mas interesantes.

El Módulo de Servicio de la Orion será diseñado y fabricado por la ESA

Thu, 17 Jan 2013 00:00:00 +0100

Módulo de Servicio de la Orion basado en los ATV de la ESA.

La futura nave tripulada Orion de la NASA que nació como parte del Programa Constellation para poner un hombre en la Luna antes de 2020 fue cancelada en 2010, sin embargo, acabó reapareciendo como MPCV (Multi-Purpose Crew Vehicle) un año después. Ahora conocemos la noticia de que será la ESA la que construya el Módulo de Servicio de la nave que se basará en los ATV cuyo diseño ya ha sido probado en varias ocasiones llevando material a la ISS.

Hoy se cumplen 40 años desde la última vez que el hombre pisó la Luna y 50 de Exploración Interplanetaria

Fri, 14 Dec 2012 00:00:00 +0100

El 14 de diciembre de 1972, el comandante Eugene Cernan, líder de la misión Apollo 17, pisó por última vez el suelo lunar, cerrando una de las eras más gloriosas de la investigación espacial. Daniel Marín en su excelente blog Eureka ha escrito un detallado post sobre la última gran misión del Programa Apollo.

¿Cómo sería vivir en la Luna? A lo largo de la historia, solamente doce seres humanos han sido capaces de contestar a esta pregunta, pero únicamente ocho siguen vivos para contarlo. Eugene Cernan y Harrison Schmitt son dos de los afortunados. Ellos fueron los últimos humanos en vivir en otro mundo. Literalmente. Durante tres días los dos astronautas recorrieron el valle de Taurus-Littrow, recogiendo rocas e instalando instrumentos científicos. ¡Tres días viviendo en la Luna! Parece un relato de ciencia ficción, pero por sorprendente que parezca ocurrió realmente. Hace cuarenta años, el Apolo 17 puso rumbo a la Luna.

Disfrutad del artículo completo en su blog.

Hoy también se conmemoran los 50 años de Exploración Interplanetaria. La sonda Mariner 2 fue la primera en entrar en órbita de otro planeta un día como hoy de 1962. El JPL de la NASA ha preparado una web especial para la ocasión.

Apple anuncia interesantes cambios en su Dirección

Mon, 29 Oct 2012 00:00:00 +0100

Apple ha anunciado unos cuantos cambios en su Dirección:

Jony Ive, que hasta ahora dirijía el diseño de los productos de Apple, también tomará control del diseño de las Interfaces de Usuario. Este será un giro importante en contra del skeuformismo que se estaba comenzado a extender desde iOS defendido por Scott Forstall —quien dejará Apple, quizás por motivo de los problemas con Siri y los Mapas de iOS 6.
Craig Federighi, seguirá dirigiendo OS X y además sustituirá a Scott Forstall como VP de iOS. Esto implica que los dos sistemas de Apple seguirán las mismas directrices y por lo tanto avanzarán de la mano.
Eddy Cue a partir de ahora dirigirá todos los servicios online de Apple. Por lo tanto al App Store, iCloud y iTunes se le unen los Mapas y Siri.
Bob Mansfield, que era VP Ejecutivo de Hardware pasará a ser VP de Tecnologías, lo que incluye la dirección del diseño de los nuevos procesadores propios de Apple —el A6 o A6X.

PVIEITO

Inside Claude Cowork: How Anthropic Runs Claude Code in a Local VM on Your Mac

TL;DR

Contents

Introduction

Architecture

Isolation

Virtual Machine

VM Bundle Structure

Security Layers

Multi-Session Architecture

File Sharing

Path Translation

Networking

Allowlist

Host-VM Communication

MCP

Pre-installed Tools

Security Implications

Conclusion

CVE-2024-40801: How a Sandboxed Mac App Could Steal Your Private Data Bypassing TCC Protections

TL;DR

Initial Report

Introduction

Steps to Reproduce

Expected Results

Actual Results

Annex I

Annex II

Annex III

ChatGPT for Mac was storing all conversations in an unprotected location

TL;DR

Introduction

Example

Aftermath

Creating Apple Wallet Passes Instantly With ChatGPT and MakePass AI

TL;DR

Introduction to MakePass AI

Examples

MakePass

WWDC Sessions Archive

Introduction

Notes

Index

Sessions

WWDC 2007

WWDC 2008

WWDC 2009

WWDC 2010

WWDC 2011

WWDC 2012

WWDC 2013

WWDC 2014

WWDC 2015

WWDC 2016

Automate HomeKit with HomeControl Automation URLs

Introduction

Automation URLs

Device Activation Modes

Current Home Actions

Device Property Actions

Automation & Scripting

AppleScript

Terminal

Other Apps

Creating Apple Wallet Passes in Batch With MakePass and Shortcuts

TL;DR

Introduction

Process

Shortcut

Install Any iOS App on Apple Silicon Macs

HomeKit Automation: Extracting HomeKit Pairing Keys from macOS

Introduction

Process

Jailbreaking macOS: Patching AMFI to Allow Arbitrary Entitlements

Introduction

Process

Code

References

iCloud Locations in macOS