The JK Buzz 10.26.2011, in this edition...

OS X 10.7 Lion: Mac OS X 10.7.2 review, Fix for double reboot after upgrading to Lion, Lion VMs now legal on Macs, Patch for mid-2010 MacBook Pro Lion Black Screen of Death

Mac OS X: Safari-only mode after activating Find My Mac, p99 mail errors after iCloud MobiileMe upgrade, Another fake Flash installer Mac Trojan, New Mac Trojan doesn't require installation

Creative Applications: InDesign/InCopy CS5.5 updated to 7.5.3, AppleWorks transition path

Office Applications: New Office updates abound, Outlook problems after 14.1.3 update

Tips from the Trenches: Strange Suitcase side effect with InDesign image modifications

OS X 10.7 Lion

Mac OS X 10.7.2 review

After almost 3 months of seeding, and numerous builds, Apple finally released the Mac OS X 10.7.2 update on October 12th.

This is the first major update to Lion (the 10.7.1 update was relatively minor). Mac OS X 10.7.2 includes the new iCloud service, Apple's replacement/upgrade to MobileMe, allowing users to store up to 5GB of data online for free and wirelessly push it to all of their devices (want more data?... pay a yearly fee).

Although the Mac OS X 10.7.2 update addresses several outstanding issues, including a major LDAP password security problem, after spending a good part of the day reading through the Apple Discussion forums I can safely say there are still plenty of Lion bugs and glitches that need Apple's attention.

Mac OS X 10.7.2 does offers a lot of interface tweaks with the Finder, LaunchPad, Mission Control, desktop spaces, and full screen apps. It also fixes Mail attachment problems, improves Active Directory integration, comes with a reportedly more stable version of Safari, and the TextEdit app no longer insists on adding .txt to the end of all documents saved. 10.7.2 also introduces the ability to boot into Lion Recovery from a Time Machine disk.

Some of the most active unresolved Mac OS X 10.7.2 discussion threads currently include: Versioning issues with files stored on servers, dual display bugs, Finder file placement and selection bugs, repeatedly dropped Airport connections, Finder sidebar bugs, poor battery performance, problems with Mail connecting to Exchange servers (unreliable connections), and HDMI video issues.

So do I believe Lion is ready for prime time yet?... No, but it's getting better. Given Apple's prior track record, and all the third-party app updates that are emerging, I'd guess Lion will be fairly stable at about the 10.7.4 mark... which would mirror when previous OS X releases had moved past the early adopter phase. I do however strongly recommend that you setup Lion on a test Mac within your environment, and begin identifying what does and doesn't work. You'll likely find that ALL of your third-party software needs to be a recent release and patched to the latest version, and it's quite likely you'll identify quirks or incompatibilities with your network/hardware/apps/printers/workflow.

Fix for double reboot after upgrading to Lion

If you have Lion's FileVault2 enabled, and are running Parallels, you may experience an issue where your Mac reboots itself every time it is turned on or rebooted. The symptom is you turn your Mac on, it boots, then reboots... or you reboot your Mac, it boots, then reboots. To fix this, first make sure your Parallels is up to date. If updating Parallels doesn't resolve the issue, turn FileVault2 off, reboot, then turn it back on.

Lion VMs now legal on Macs

Previously, to legally run Mac OS X as a Virtual Machine, you were limited to just Mac OS X 10.6 Server. Although there were methods that allowed running Mac OS X 10.5/10.6 client as a VM, they clearly broke Apple's licensing agreements and were not supported.

Apple has changed their VM licensing policy with Lion. Now if you running Lion, you are permitted to run up to two VMs of it... "to install, and run up to two (2) additional copies or instances of the Apple Software within virtual operating system environments on each Mac Computer you own or control that is already running the Apple Software". You still can't legally run Lion as a VM on non-Apple hardware, but this change is a big step in that direction.

Patch for mid-2010 MacBook Pro Lion Black Screen of Death

Apple has released a MacBook Pro Video Update 1.0, which claims to address a problem with 15" MacBook Pros manufactured in mid-2010, where they intermittently freeze or stop displaying video after upgrading to Lion (a.k.a. the Black Screen of Death). This update requires Mac OS X 10.7.2.

Unfortunately this update doesn't appear to be fixing all the Black Screen of Death problems with mid-2010 MacBook Pros, but it does help for those experiencing that problem at the OS X login window. The update also doesn't address the Black Screen of Death experienced by other Mac models after upgrading to Lion, including older MacBook Pros and 27" iMacs.

Mac OS X

Safari-only mode after activating Find My Mac

When you enable iCloud's Find My Mac feature, the OS X login window will display a Guest User account, even if the Guest User account was never enabled (it'll say Sharing-only mode if you look at the Accounts system preference pane). Clicking on the Guest User icon from the login window will display the alert "This computer will restart to a secure, Safari-only system for the Guest user".

When booted into Safari-only mode, your Mac's location will be tracked using location services, plus the user will only be able to surf the internet using a stripped down version of Safari. Apple's thought process what that if your Mac was lost or stolen, whoever wound up with it would likely be stuck at the login window (assuming you didn't turn on automatic login), and the only option they would have to use the Mac would be as a Guest using Safari-only mode.

A couple of things to know about the technology behind Safari-only mode... it actually boots from the Recovery HD partition that is created when you install Lion. If this partition isn't present on the boot drive, the Safari-only mode option won't be available. While booted into Safari-only mode, the main boot drive partition is not mounted, and cannot be accessed. When you quit Safari, you are forced to reboot back into the OS X login window. If you select the Guest User account from the login window, and other users are logged into the Mac, their sessions will be terminated without the option to save open documents. The option for Guest User will not show in the login window if it has been configured to display only username and password fields, and entering guest for the username will not work.

p99 mail errors after iCloud MobiileMe upgrade

If you were using Apple Mail with a MobileMe account, it will get upgraded to Apple's iCloud service when you opt into iCloud. After this conversion, you may run into a random error sending/receiving email stating "The iCloud IMAP server p99-imap-mail.me rejected the password".

When this happens, you can either wait it out, or try quitting and relaunching Mail. Some users experiencing this issue have reported that changing their iCloud password fixed things, and others have reported that manually creating an account in Apple Mail (instead of using the mail account configured by the iCloud system preference pane) and pointing it to imap.mail.me.com did the trick.

Another fake Flash installer Mac Trojan

Yet another Mac Trojan horse has been getting some press lately, after a new variant of Flashback (OSX/Flashback.C) was discovered that will actually remove Apple's XProtect scanner/updater, in addition to injecting malicious code in running applications.

All variants of the Flashback Trojan are disguised as an Adobe Flash Player installer, and require the user to manually run the installer and authenticate as an admin user. It can be "caught" by visiting a fraudulent website that brings up a very convincing popup window stating that your version of Flash needs to be updated, or by downloading a Flash Player installer from P2P sharing services.

If while surfing the web you get prompted that something need to be updated, ALWAYS dismiss it, then manually visit the vendor's website if you are so inclined to update. ALWAYS get your updates direct from the source, never from some random alert when visiting a website.

New Mac Trojan doesn't require installation

There's a new Mac Trojan horse making the rounds, this one called Revir (OSX/Revir-A/B). This Trojan is unique, as it doesn't require the user to authenticate as an admin user for the install to take place.

The Revir Trojan disguises itself as a Chinese language PDF containing text about political disputes. When opened, it copies files to /tmp/host, which in turn installs a backdoor named Imuler.A. This is set to launch via a LaunchAgent named checkvir.plist. Theoretically, once the backdoor is running, the Mac is vulnerable to attack from a remote server.

This Trojan is not widespread, and to date all variants have not communicated anything via the backdoor due to its poorly coded install mechanism.

To avoid getting this Trojan, don't open PDFs that you don't know where they came from. If you have recently mistakenly opened a Chinese language PDF, it would be a good idea to run a full scan on your Mac using a malware checker like ClamXav or Sophos Anti-Virus.

Apple has updated XProtect on 9/26/11 to scan downloaded files for Revir.

Macintosh Miscellaneous

R.I.P. MacBook

A friend of mine recently asked me for advice on purchasing a new Mac, and I was very surprised to find the MacBook was no longer for sale in the Apple Store. There were a few refurbished MacBooks on Apple's site, but no new MacBooks.

Upon further research, it looks like Apple quietly discontinued the MacBook in late July. I don't know how this slipped by my radar, and I have mixed feelings about the ramifications. MacBooks are the student workhorse at many of the schools Techcare supports, and although the 11" MacBook Air retail in the same price range, I just don't see them holding up to similar long-term use/abuse.

Creative Applications

InDesign/InCopy CS5.5 updated to 7.5.3

Adobe has updated InDesign CS5.5, InDesign CS5.5 Server, and InCopy CS5.5 all to version 7.5.3. The updates include a wide number of "key" and "general" fixes, including: epub/ebook functionality, error code 5, PDF exporting, font handling, file access, and file locking.

AppleWorks transition path

If you are still an AppleWorks user, and are concerned by the fact that AppleWorks is not compatible with Lion (due to the lack of Rosetta), fear not... Apple's most recent update to iWorks '09 allows Pages to read AppleWorks v6 files, and Numbers to read AppleWorks v6 spreadsheets!

Office Applications

New Office updates abound

Microsoft has released a 14.1.3 update for Office 2011, a 12.3.1 update for Office 2008, and a 11.6.5 update for Office 2004. All updates include security patches, plus the Office 2011 update fixes numerous stability issues and Outlook glitches. The Office 2008 update also addresses time zones issue with Entourage.

Numerous people have reported that after applying the 14.1.3 update for Office 2011, one or more of their Office apps would fail to launch afterwards. The confirmed fix for when this happens is to manually download the 14.1.3 updater from Microsoft's website, and reapply it.

New Office updates abound

A handful of people are also reporting that after updating to Office 2011 14.1.3, their Outlook randomly stops updating the inbox, requiring a quit/relaunch to get the inbox to update again.

When this occurs, Outlook will report that new mail is being received, it just doesn't show in the inbox. Another reported issue is mail remaining marked as unread (bold) even after read. These issues aren't affecting everyone, and manually downloading/reapplying the 14.1.3 updater from Microsoft's website had helped some. Also of note, this may be linked to not rebooting after applying the Microsoft update. Although it isn't required, some have resolved these issues simply by rebooting their Mac.

Tips from the Trenches

This tip comes from Neil McDougall, an invaluable onsite Mac tech and technology consultant who has been with Techcare since 2004.

Neil was at a client for two days installing Adobe CS 5.5 and Office 2001...

"Today they started having the weirdest InDesign problem. They would open an InDesign file that had previously been fine, and it didn't matter if it was InDesign CS4 or CS5 (they kept the old version too). It would say image were modified. You would update the images and it was fine. You would save the document and the images would go back to being modified again. Consistently. We tried resaving the document, moving the document local and resaving, moving the Photoshop documents local. It made no difference. We even saved the Photoshop docs as TIFFs and that didn't help either. It was too odd a coincidence that this problem happened the day after CS5.5 was installed, but I haven't seen this behavior anywhere else, nor have I seen it reported. It was an annoying problem because you couldn't make PDFs because it wants to save the doc first, and after you save it the images are modified so they don't appear correctly.

You know what it turned out to be? When I installed CS5.5 I also installed an updated Suitcase Fusion 3 to v14.1.0. You need this for the auto activation plugins. Well, it was the plugin that was doing it, or rather the Font Sense option. As soon as this was turned off in the InDesign Suitcase plugin prefs then the document went back to normal. I guess the plugin was activating a font inside the image but getting confused again whenever the document was saved. It also explains why I had never seen that happen before: that update to Suitcase came out 2 days ago."

JK Note: Extensis released a Suitcase Fusion 3 v14.1.1 update a couple of days after Neil discovered this problem, and the release notes include "Fixed an issue where saving an InDesign CS5.5 document that had FontSense enabled and included activated fonts also saved FontSense metadata to any placed Photoshop or TIFF files.". Neil's experience is a terrific example of how to think outside of the box when troubleshooting strange Mac issues.