Der Flounder

Apple has done silent updates for Gatekeeper, the macOS code signing/file quarantine/light anti-malware framework ever since Yosemite. These are done silently unless you explicitly disable all updates and only show up as a visible item when you manually list updates using the softwareupdate command line tool, I think. AFAIK these are just config files and hash databases or similar.

You can view the history of these installs by running softwareupdate --history | grep -E "^MRT|^Gatekeeper"

I see an average of 2 updates per month.

FWIW Apple can also mark something as visible (but install automatically) with a certain config file key. A blog mentions this as being done for patching the NTP bug from a while back:

> Marking these updates as ConfigData cues the App Store to not display these as available software updates in the App Store’s list of software updates. These updates are meant to be under Apple’s control and to be as invisible as possible.

> Meanwhile, an automatically installed software update like OS X NTP Security Update 1.0 shows up as a normal software update, but has extra keys in its catalog listing to mark it as a critical update whose automatic installation is set to occur as soon as possible.

https://derflounder.wordpress.com/2014/12/27/managing-automatic-installation-of-configdata-and-security-software-updates-on-yosemite/

blah alot of yours are ai and javascript stuffs..

i love rss and i mainly use it to stay up to date on sysadmin stuff..
https://hnrss.org/frontpage

https://news.ycombinator.com/showrss

https://hnrss.org/ask

https://hnrss.org/polls

https://www.reddit.com/r/technology+SCCM+DNS+virtualization+talesfromtechsupport+sysadmin+usefulscripts+homelab+itdept+powershell+Fedora+sysadmindiaries+devops+k12sysadmin+higheredsysadmin+netsec+linuxadmin+websec+networking+macsysadmin+worldnews+synology+AsahiLinux+NextCloud+apple+archlinux+openwrt+AZURE+wazuh+linux+mac+kde+ubuntu+linux4noobs+linux_gaming+nvidia+amd+macos+InformationTechnology+dell+msp+raspberry_pi+ubiquti+homelab+elementchat+proxmox+vyos+PrometheusMonitoring+pihole+MSI_Gaming/.rss

http://decentsecurity.com/blog?format=RSS

https://coffee-and-dreams.uk/feed.xml

https://derflounder.wordpress.com/feed/

https://fedoramagazine.org/rss

http://krebsonsecurity.com/feed/

https://krypted.com/feed

https://www.malwaretech.com/feed

https://managingosx.wordpress.com/feed/

https://matrix.org/blog/feed

https://orowith2os.gitlab.io/feed.xml

http://paradisefacade.com/?format=rss

https://sinrega.org/index.xml

http://eclecticlight.co/feed/

https://blog.vyos.io/rss.xml

https://worldofmatthew.com/index.xml

> I am not a coder (much), but I have to wonder if my experience is common in the coding world?

It is, yes. Surely someone will come and tell you it doesn’t happen to them, but all that tells you is that it ostensibly isn’t universal, but still common enough you’ll find no end of complaints.

> Maybe there are ways to avoid this (and others) pitfall with prompting?

Prompting can’t help you with things not in the training set. For many languages, all LLMs absolutely suck. Even for simple CLI tools, telling an LLM you are on macOS or using the BSD version may not be enough to get them to stop giving you the GNU flags. Furthermore, the rsync change in macOS is fairly recent so there’s even fewer data online on it.

https://derflounder.wordpress.com/2025/04/06/rsync-replaced-with-openrsync-on-macos-sequoia/

> As it is, I do not see at all how LLMs could really save time on programming tasks without also costing more time dealing with its quirks.

And that’s the best case scenario. It also happens that people blindly commit LLM code and introduce bugs and security flaw they cannot understand or fix.

https://secondthoughts.ai/p/ai-coding-slowdown

https://arxiv.org/abs/2211.03622

Is there a particular reason you’re not putting .zshrc in the user’s home folder ~/.zshrc?

In any case, / root and /etc (to an extend) are part of the system volume (or rather the system volume snapshot if we want to be pedantic). With some exceptions Apple considers that fair game.

There’s a bunch of symlinking and firmlinking done to make it look like one coherent whole but only the stuff on the data volume is safe.

That said, if for whatever reason you need to put something in root you can create your own synthetic firmlink[0] with /etc/synthetic.conf.

I believe some also reported success by simply making a subdirectory under /etc and use that instead but YMMV.

hoakly goes into extensive detail with what changed with volumes on macOS (back in 2019 I believe): https://eclecticlight.co/2021/01/13/big-sur-boot-volume-layout/

0: https://derflounder.wordpress.com/2020/01/18/creating-root-level-directories-and-symbolic-links-on-macos-catalina/

This blog post[1] has a good explanation of ConfigData updates. The flag would appear to force the install of new Gatekeeper configuration updates.

>To help distinguish Gatekeeper and XProtect updates from other updates in the software update feed, Apple marks them as being ConfigData updates.

>Marking these updates as ConfigData cues the App Store to not display these as available software updates in the App Store’s list of software updates. These updates are meant to be under Apple’s control and to be as invisible as possible.

[1] https://derflounder.wordpress.com/2014/12/27/managing-automatic-installation-of-configdata-and-security-software-updates-on-yosemite/

MissTake makes a good point regarding MDM. Google around to learn more. I found this stackexchange entry which says "To clean up after removing MDM, you want to follow the steps for your hardware and your macOS level to erase and reinstall a clean OS. Also confirm the company or school has released the device serial number from enrollment if you are taking ownership of the device from them."

https://apple.stackexchange.com/questions/442147/how-to-check-if-my-device-is-owned-on-mdm

Also, this looks really helpful:

https://derflounder.wordpress.com/2018/03/30/detecting-user-approved-mdm-using-the-profiles-command-line-tool-on-macos-10-13-4/