We maintain a macOS product whose installer uses custom InstallerSection plugin bundles to show configuration panes during install. Starting with macOS 27 beta 6, all of our plugins stopped loading in Installer.app — the panes never appear and the install fails because our preinstall step depends on data the panes collect.
A third-party PKG installer that ships a custom Installer Plugin no longer displays one of its selection panes. The plugin bundle appears not to be loaded, so the pane that it provides is silently skipped and the user cannot choose the intended installation option.
This is regression for all latest updates eg. 15.8, 27.7, 28.0. This bug refuse open installer plugin for security reason in spite of the plugin and installer are correctly signed, notarized and works seamlessly in previous macOS versions. Workaround is copy installer (*.pkg) to local file system (home, desktop folder).
I discovered that macOS 15.3 had enabled a feature that was phoning home every 15 minutes with personal data. And that I said “no” and turned it off.
[…]
And today I discovered that Apple had [in macOS 27] removed the “no” switch.
[…]
Digging through macOS 27 settings I turned off Siri (again). Of course, multiple unkillable Siri processes remain, stealing memory and writing data. For what purpose? Who knows. Note that they removed “Apple Intelligence” from this control.
[…]
All of this garbage was enabled after upgrading to macOS 27 despite me having “Apple Intelligence & Siri” turned off already. That was a rather explicit “no”, no?
Author claims the system setting “Privacy & Security > Apple Intelligence Report > Report Duration” with its 3 options [Off | 15 minutes | 7 days] sends that data to Apple with that frequency. This is wrong - this is a transparency report so that you as a user can see everything that is getting sent to Apple as a part of Apple Intelligence. Nothing additionally is getting sent to apple if you switch this away from “Off”.
To me, the main point of the post was about the missing off switch for Apple Intelligence itself. Bushell was forced into enabling a feature (and storage use) he had specifically turned off, and there is no option to block his data from being sent to Private Cloud Compute. But, yes, the first sentence I quoted from Bushell is wrong. The report feature isn’t periodically sending data to Apple; it’s reporting what was already sent. Turning it off does not add any additional privacy, except from someone snooping the report file directly on your Mac. Apple’s wording explaining the report was confusing but has improved somewhat in recent versions.
Apple is continuing its weekly update cycle by sending out fresh testing builds for older Mac operating systems. The company has officially started rolling out the third release candidates for macOS Sequoia 15.8.2 and macOS Tahoe 26.7.2 to registered developers this week. These new updates arrive alongside testing builds for newer platforms, keeping older machines […]
Yesterday I tried doing the 15.8 update (from 15.7.9) inside one of those VMs. It hanged, midway through the post-reboot install process. I had to ‘power-cycle’ the VM. Which booted it back into 15.7.9, except… shockingly slow. Like, I can watch the individual elements of the GUI render like it’s the 1980s again.
I eventually figured out that my 16 GiB VM could only “see” 1.75 GiB of RAM, and was therefore swapping all to hell.
[…]
In hindsight, the simplest solution might be – I have not tested it – to just run:
sudo nvram -d boot-args
That should clear the boot args, eliminating whatever insane stupidity Apple’s updater enacted there.
I can corroborate there being a problem with RAW files on macOS 15.8. I’ve had two customers run into problems trying to copy RAW images with PowerPhotos, it appears that photolibraryd ends up deadlocked somewhere in the RawCamera library, and you have to kill it to get things moving again.
Apple was able to completely break the essential RawCamera system framework, and macOS 15.8 is now unable to use Nikon, Canon, and other RAW files anymore.
[…]
Spotlight will hang for CR2, NEF, or DNG and other files, Preview.app can no longer open RAW files and will hang forever. The Finder can no longer display thumbnails of RAW files and will hang trying to do so. As will all other applications that can open these RAW files directly, like Apples own Pages.
Mac users are faced with the annual classic computing question again; should I upgrade to the latest major new system software that is available? In this case, MacOS 27 Golden Gate is available to download and widely considered to be a solid system software version, so if your Mac is currently running MacOS Tahoe 26, ... Read More
Apple has released MacOS Tahoe 26.7 along with MacOS Sequoia 15.8 as security updates for older Mac users and for those who are not yet interested in running the just released MacOS Golden Gate 27 update. MacOS Tahoe 26.7 and MacOS Sequoia 15.8 have over a hundred security fixes but do not include any new ... Read More
One of our Macs kept filling up its SSD even though there isn’t supposed to be anything more stored on it. Photos is set to optimize its storage, and Messages is set to only keep messages for a year. It should be pretty much in a steady state, but we kept getting alerts from Mail that it couldn’t launch because there wasn’t enough free space. It’s an M4 MacBook Air used mostly for Web stuff, but somehow it felt as slow as the Intel one it had replaced.
I deleted unused apps and offloaded photos. Restarting sometimes helped, so I thought maybe it was an issue with Time Machine snapshots not being reclaimed promptly, which has been an issue before. But what data would even be changing so much to create large snapshots?
The problem kept getting worse, so I broke out OmniDiskSweeper. It didn’t find anything unusual, except it showed that the totals for the main folders added up to about 90 GB less than was reportedly used on SSD. Disk Utility showed that there were no snapshots taking up space. There must be real files but not ones that the app could see.
I relaunched OmniDiskSweeper using sudo, and it found a huge amount of stuff hidden in the root account: /private/var/root.
I had thought that wasn’t really used except when running Terminal from macOS Recovery. But apparently various daemons store all kinds of stuff there now. The /private/var/root/Library/Logs folder alone was using 74 GB, and there were also several multi-GB cache folders.
I deleted the files using OmniDiskSweeper, but that didn’t help. It turns out that by default it moves files to the trash, and I guess since it was running under sudo this meant the invisible trash folder for the root account. It’s better to hold down the Option key to Delete Immediately.
After deleting the files and restarting the Mac, the free space looked right at first but then steadily dropped. Pretty soon there were again 5 GB of RTCReporting logs with the Mac just sitting there. I started using sudo du -h -d 2 /private/var/root/ to track how the sizes were changing. Within a day it was back up to 27 GB.
Activity Monitor showed that rtcreportingd and fileproviderd were each using almost 100% CPU constantly. I immediately suspected Dropbox because it had been working poorly on this Mac for a year or so. It wouldn’t keep files offline and constantly seemed to be syncing even when files weren’t changing. Sure enough, turning off Dropbox stopped the CPU use and the ballooning log files.
This was our last Mac still using Dropbox, so it seemed time to migrate it to iCloud Drive. The syncing problems ended up not being limited to keeping files offline. It couldn’t even reliably download most of them from the cloud to move them out of the Dropbox folder, instead reporting I/O errors for most files. And the files that I did move to the Documents folder never synced that deletion up to the cloud. I ended up just downloading the whole folder from the Web interface. iCloud Drive uploaded everything quickly and then settled into a state of no CPU use.
Apple has released updates to macOS 26.6.1, 15.7.9, and 14.8.9 to fix a Screen Sharing vulnerability that could let an attacker “on the network” connect without valid credentials. Update soon.
Apple has released security updates for MacOS Tahoe 26.6.1, MacOS Sequoia 15.7.9, and MacOS Sonoma 14.8.9, each addressing the same security flaw relating to the Screen Sharing service where an attacker could authenticate without valid credentials. Download links for IPSW and full installers for these new versions of MacOS are available further below. Due to ... Read More
Apple Intelligence files can occupy several gigabytes of Mac storage because locally downloaded models power text generation, summaries, image creation, Siri requests, and other on-device features. Removing these files can recover valuable space when Apple Intelligence is no longer needed.
Apple lists 7GB of available device storage among the requirements for Apple Intelligence, but the amount displayed on a Mac can be higher. Additional languages, image-generation resources, updated models, and temporary assets can increase the total over time.
The files are managed by macOS and do not appear as ordinary documents that can be moved to the Trash. Apple provides a supported removal method through System Settings: turning off Apple Intelligence causes macOS to remove the downloaded on-device models.
This also disables features that depend on Apple Intelligence. Writing Tools, summaries, Image Playground, Genmoji, intelligent Shortcuts actions, and Apple Intelligence functions inside Siri may become unavailable. Regular Mac applications and the rest of macOS continue working normally.
Check Apple Intelligence Files on Your Mac
Recording the available storage before removing the files makes it easier to confirm how much space macOS recovered afterward.
To see the current storage allocation:
Apple menu > System Settings > General > Storage
Allow the Storage page to finish calculating its categories. The process may take a moment when the Mac contains many applications, local files, connected volumes, or several user accounts.
Apple Intelligence may appear as a separate item within the macOS storage category. Depending on the installed macOS version, some related assets may instead be counted under macOS or System Data.
Note the amount of available storage displayed near the storage graph. Comparing the total free space before and after the procedure is usually more reliable than watching one category because macOS can reclassify system-managed files while deleting them.
To inspect the complete internal storage container:
Apple menu > System Settings > General > Storage > All Volumes
This view is useful when the internal drive contains several APFS volumes sharing the same physical storage. The available capacity belongs to the shared container rather than remaining permanently assigned to one volume.
The storage used by Apple Intelligence is different from the memory, or RAM, used while features are running. Closing applications may reduce RAM consumption, but it does not delete the models stored on the internal SSD.
Image Credit: AppleMagazine
Remove Local Apple Intelligence Files
Apple Intelligence is available on compatible Macs with Apple silicon. Intel-based Macs do not support the complete Apple Intelligence system and should not contain the same downloadable model collection.
To turn off Apple Intelligence and request the removal of its on-device models:
Apple menu > System Settings > Apple Intelligence & Siri > Turn off Apple Intelligence > Turn Off Apple Intelligence
The second Turn Off Apple Intelligence command confirms the change. The exact appearance may vary between macOS versions, with the first control presented as either a switch or a button.
Apple says that turning off Apple Intelligence removes the on-device models. There is no separate model manager, Delete Models button, or supported Finder location from which users must remove the files manually.
Keep the Mac connected to power while macOS completes its background storage work. The Apple Intelligence setting changes immediately, but the Storage page may not display the recovered capacity at once.
macOS manages these models through its system asset service. The operating system must identify the associated packages, release them, and recalculate the storage categories. The process can therefore continue after the Apple Intelligence switch has already moved to the off position.
Turning off only individual features does not remove the complete model collection. Disabling notification summaries, Writing Tools, ChatGPT access, or Siri suggestions leaves Apple Intelligence itself active.
A Screen Time restriction also serves a different purpose. It can prevent access to image generation, Writing Tools, and other functions without turning off the underlying intelligence system. Use the Apple Intelligence control inside Apple Intelligence & Siri when the objective is recovering storage.
Confirm That the Space Was Recovered
After macOS has had time to process the removal, return to the Storage page.
To check the available capacity again:
Apple menu > System Settings > General > Storage
Wait for the storage graph and categories to finish updating. Compare the new amount of available space with the figure recorded before Apple Intelligence was turned off.
The Apple Intelligence entry may disappear completely, display a smaller amount, or become part of an adjusted macOS or System Data category. The increase in total available storage provides the better indication that the local models were removed.
If the figures have not changed, restart the Mac to refresh its system services and storage calculation.
To restart macOS:
Apple menu > Restart > Restart
Sign back in, allow the Mac to remain idle for a while, and open the Storage page again.
Apple menu > System Settings > General > Storage
Restarting does not delete the models by itself. Apple Intelligence must remain disabled while macOS completes the removal.
Emptying the Trash is not part of this procedure because macOS does not place Apple Intelligence models there. The Trash affects only files that a user or application has already marked for deletion.
Image Credit: Apple Inc.
What to Do When the Files Remain
First, verify that the complete Apple Intelligence system is off rather than one related feature.
To confirm its status:
Apple menu > System Settings > Apple Intelligence & Siri > Apple Intelligence
The control should display Apple Intelligence as disabled. If macOS presents another confirmation request, complete it and leave the feature off.
Storage information can take time to settle because macOS also manages caches, local snapshots, temporary update packages, and purgeable files. These categories can change while the Mac is idle, making an immediate before-and-after comparison misleading.
Installing the latest stable macOS update can correct storage reporting or asset-management problems.
To check for an available update:
Apple menu > System Settings > General > Software Update
Save current work before installing an update. The Mac may need to restart, and the installation temporarily requires additional free storage.
Beta versions of macOS require extra caution. Development releases may download experimental models, retain previous model revisions, or temporarily change the Apple Intelligence controls. A procedure confirmed for the public version of macOS may not produce the same storage behavior in a beta.
Avoid following online instructions that require starting in macOS Recovery, disabling System Integrity Protection, mounting protected volumes, and deleting folders with names referring to MobileAsset or generative models.
System Integrity Protection prevents applications and administrator accounts from modifying protected parts of macOS. Disabling it weakens that protection and creates the possibility of deleting the wrong asset, leaving macOS with an incomplete model installation, or causing the system database to disagree with the files present on the drive.
A storage utility can help identify how much space system files occupy, but it should not require disabling macOS security to remove Apple Intelligence. If the documented switch leaves a large allocation after a restart and sufficient processing time, Apple Support can investigate the asset database without exposing the Mac to an unsupported system modification.
Turning Apple Intelligence on again reverses the storage saving.
To restore its features:
Apple menu > System Settings > Apple Intelligence & Siri > Turn On Apple Intelligence
The Mac will download the required local models again. Apple recommends leaving the device connected to Wi-Fi and power while the model download completes.
Nonetheless, when I send an email in Mail app, from a non-iCloud account to an non-iCloud account, Mail immediately triggers an iCloud connection, as revealed by Little Snitch.
[…]
What could Mail be querying and saving in CloudKit when I’ve disabled Mail in iCloud?
[…]
As you can see in my screenshot at the beginning of this blog post, I have Contacts turned off in iCloud settings, so my Previous Recipients list should not be synced to iCloud. Nonetheless, I followed the commenter’s suggestion of logging in Terminal. I saw log messages that referred to com.apple.mail.recents, which might indicate Previous Recipients and would certainly explain why this happens when I send an email.
[…]
I do object to notifying Apple that I’ve just sent an email. That in itself seems like a violation of my privacy.
The settings are confusing, even more so than with System Preferences. If you go to System Settings ‣ Apple Account, it shows a round rect that says Mail and shows the Mail icon. If you click this, it lets you uncheck Sync this Mac for iCloud Mail. This mirrors the iCloud Mail checkbox that you get when you click See All to see the full list of apps. I don’t like how the top-level name and icon suggest that you’re going to a settings sheet for the Mail app, but then it actually gives you iCloud settings.
Importantly, there’s also anotherMail checkbox in that list. It’s easy to miss because, first, why would you expect to see twoMail checkboxes?
And, second, it’s not obvious that there are actually three lists: a bunch of “favorite” system apps, in non-alphabetical order, for some reason including lesser ones like Freeform and Image Playground; followed by a second list of system apps in alphabetical order; and then a third list of alphabetical third-party apps.
Mail is in the second list, along with (to me) other top-tier apps like Books and Maps. Anyway, this second Mail checkbox controls the syncing of non-mail Mail data such as rules and smart mailboxes. But not, apparently, according to Apple, the previous recipients.
When you are shell scripting or working in Terminal, sometimes you want a quicker way to enter the path to a file or folder, particularly if you have already navigated to it in the Finder. One way that works in Terminal is to drag the file or folder from the Finder onto the Terminal window, which then types the path into the current command. However, another method was introduced in El Capitan (OS X 10.11) that allows you to copy the full path onto the clipboard.
In Finder, you can hold down Option and choose Edit ‣ Copy Pathname.
Starting in macOS Sequoia, copying the path to the clipboard using the method described generates a path that can be directly pasted into the Terminal or a script and be interpreted as that path without further manipulation.
It adds single quotes and or escapes characters, but only if necessary.
Graham Pugh pointed out that if you have text on the clipboard, you have the option of pasting that text “escaped” in Terminal. Simply copy the text from whatever source you choose (e.g., the output of an AutoPkg run, where paths are not escaped), then in Terminal choose Edit > Pasted Escaped Text or use the shortcut Command-Control-V.
[…]
As a bonus, this concept can be applied to a tip I learned from Armin Briegel a few years ago, namely that if you select something in Terminal that you want to then paste into the current shell command, you can skip the copy-paste dance and instead just press Command-Shift-V to do it in one step (or if you prefer menus, Edit > Paste Selection). If you add the Control key to that sequence, the text pasted is escaped (Edit > Paste Escaped Selection or Command-Control-Shift-V).
MacOS Sequoia 15.7.8 and MacOS Sonoma 14.8.7 are available for Mac users who are not running the Tahoe operating system. Both MacOS Sequoia 15.7.8 and MacOS Sonoma 14.8.7 include a myriad of security patches, making them recommended updates for all Mac users who are running those operating systems. No new features are included. Separately, Apple ... Read More
Following the rollout of no less than seven Release Candidates, Apple has now finally released macOS Sonoma 14.8.8 and macOS Sequoia 15.7.8 officially.
Spotlight doesn’t currently appear able to search Time Machine backups reliably, at least not in Sequoia or Tahoe, although this may not be universal.
[…]
If I now step back through my backups to reach one that I know contains that file, I can restore it. But if I type anything into the search field, nothing is found. If I change the scope of the search to that backup, the window title changes but its contents remain blank, and there isn’t even a busy spinner to indicate a search is in progress.
[…]
As I can’t disable Spotlight indexing on that volume without macOS telling me that it’s required to be indexed by Spotlight, neither can I force that volume to be reindexed.
[…]
My conclusion is that using Spotlight to search Time Machine backups no longer works, and the instructions given by Apple are also broken.
That has been my experience, too. As I see it, there are four separate problems:
I want to be able to search all my backup snapshots, because I don’t know which one might contain the file I want to restore. Time Machine only lets you search one at a time.
Searching an individual snapshot doesn’t actually work.
Spotlight indexing is invasive, using lots of CPU time, and with spinning hard drives causes wear and tear and creates lots of noise. If search doesn’t work anyway, I’d like to turn it off, but macOS won’t let me.
If the problem is with the index, there’s no way to reset it without deleting your backup.
Unfortunately, all those saved versions in the version database fall outside the scope of Spotlight indexing, and Spotlight search can’t look inside any of the old versions saved in a volume’s version database. Surprisingly, the version browser doesn’t offer any search facilities either, as that’s presumably another feature intended for a future that never came.
[…]
One way around this is to save each document version as a separate file, allow Spotlight to extract their contents and add those to its indexes for that volume, then to search those files. This is quick and simple using my free utility Versatility.
A vulnerability in Apple’s “Hide My Email” tool lets almost anyone discover a person’s real email address that is supposed to be hidden by the feature, and Apple has failed to fix it for more than a year, according to a security researcher and 404 Media’s own tests.
[…]
“Apple Hide My Email is leaking email addresses that are supposed to be hidden. We reported the issue and replication instructions to Apple over a year ago. We don’t know why it hasn’t been fixed, but we don’t feel comfortable waiting any longer. Hide My Email users deserve to know that it may be possible for attackers to discover their hidden email addresses,” Tyler Murphy, the co-founder of EasyOptOuts, which discovered and reported the issue to Apple, told 404 Media.
“Free, publicly accessible people-search sites make it easy to link an email address to other personal details, so people relying on Hide My Email for safety may be at risk,” Murphy added.
[…]
To test the issue I generated a new Hide My Email address and provided it to Murphy. Around five minutes later, he replied with my real email address linked to my Apple account which was supposed to be hidden.
Murphy said that he reported the issue to Apple in June of last year, and the company told him it was looking into it. Apple said it had been fixed in March of this year, but Murphy found that wasn’t the case. He again contacted Apple, with the company saying that it would appreciate him not revealing the existence of the flaw until it had been resolved.
Apple then said it planned to address the issue in June, but since it still hasn’t been fixed[…]
March 19, 2026: Using the reproduction instructions from our initial report, we determined that the vulnerabilities hadn’t been fixed.
May 22, 2026: We realized that the vulnerabilities may have greater severity and scope than we thought initially and reported this to Apple. Apple never acknowledged the report of increased severity.
June 30, 2026: Apple again reported that the vulnerabilities were fixed and asked us to verify. We determined that the vulnerabilities hadn’t been fixed.
Very few details are available right now. I have seen speculation that the original email address is revealed when someone replies using their hidden email address, but the impression I get from Cox’s reporting is that no user interaction is necessary[…]
[…]
I am also unclear about how, as of May, the EasyOptOuts guys found the “vulnerability may have greater severity and scope” than initially reported. Ominous, though.
I don’t know whether I’ve accidentally stumbled upon that vulnerability, or perhaps in this case the Hide My Email user just messed up in some way, but I’ve definitely discovered a bizarre and troubling Hide My Email bug in Mail app (on macOS Sequoia 15.7.7).
[…]
Bizarrely, however, Mail app displayed an alert that I’ve never seen before, “This message was forwarded to you by Hide My Email,” despite the fact that I have previously received many emails from people using Hide My Email.
[…]
Why I am seeing two different @icloud.com email addresses, one of which appears to be the sender’s unhidden address?
Why are the To: and From: fields in my reply disabled?
Why is my reply not from my @underpassapp.com email address but rather displayed falsely as from the sender’s @icloud.com address and really from my unrelated Apple Account address?
Apple this week was sued over a reported “Hide My Email” flaw that could expose a user’s real email address. The proposed class action lawsuit alleges that Apple violated California’s false advertising law and other consumer protection statutes by knowingly offering a feature that does not work as advertised.
This is interesting in that the June 2025 bug report is the evidence that Apple “knew” the feature didn’t work, while “Apple continued to represent to consumers that Hide My Email
would actually hide users’ email.” How long are they supposed to get to fix a bug?
The misleading user interface elements in Mail app are a bug, but by themselves they’re not a vulnerability. The vulnerability is that when I send a reply to my maliciously crafted email, my Apple account email address is disclosed in the “From” field of the sent reply! In other words, the Mail app interface lies, fails to show the true sent value of the “From” field.
There are a couple of crazy aspects to this information disclosure vulnerability:
It does not require that the victim actually use Hide My Email! I never use it. As I mentioned in my previous blog post, I don’t even have an icloud.com email account.
It does not matter which of the victim’s email accounts receives the email from the attacker. If your Apple account email address is a@foo.com, but you receive a maliciously crafted email addressed to b@bar.com, Mail app will still send your reply from a@foo.com, thereby disclosing your Apple account address.
Apple addressed a vulnerability in Hide My Email that exposed a user's real email address, reports 404 Media. Apple told the site the issue was fully fixed in a patch released on July 3.
[…]
While the bug has now been addressed, email logs that pre-date the fix could still expose user email addresses.
Login
