OS X El Capitan GM Candidate available | Hacker News Reader

OS X El Capitan GM Candidate available

developer.apple.com

115 pointsPascLeRasc107 comments

Just a reminder: installing this will enable System Integrity Protection (aka rootless, prevents even root from modifying system files), but it can be disabled by rebooting into recovery mode and selecting Utilities -> Security Configuration.

Edit: Actually, some webpage says that the method was changed in a later beta. Let me actually do the update and see how it works now...

What's the definition of system files in this context? I run ssh on alternate port by editing /System/Library/LaunchDaemons/ssh.plist . Will that not be editable anymore or is this applicable to executables only?

That won't be editable anymore. But you could disable SIP from recovery mode, make the change, then re-enable it.

"csrutil disable" from within a terminal in recovery mode will do it

Here's what you have to do now: http://i.imgur.com/L1pCBxG.png and then http://i.imgur.com/UKMhB1n.png

http://discuss.binaryage.com/t/totalspaces2-status-under-os-...

And that bash 3.2 is one of the reasons I want to turn off rootless so I can install modern bash 4.3 in /bin/bash, so that scripts that have #/bin/bash continue to work unmodified.

Apple will most likely never update their bash to GPL 3.0 bash 4 or later.

You can set your shell per user in /etc/passwd (or similar, can't remember the name)

It's easy to change your default shell, but if you got a shell script that explicitly specifies #!/bin/sh (and they all do) then /bin/sh will be invoked, regardless what your default shell is. So your options are to modify every script file to invoke your default shell (usually #!/usr/local/bin/sh ) or to install your default shell in /bin.

Is editing /etc/hosts allowed in rootless mode?

/etc/ and /usr/local/ are still editable.

So then what is considered to be a system file? Any definition or documentation from Apple?

Security Configuration is no longer an option in Utilities in recovery mode

Anyone find a secret command line 'default' setting to change how Mission Control / Spaces works so it shows the previews without having to go to the top of the screen?

+1, also annoyed by this change/regression.

What gets me is the useless numeric desktop naming. I'm shocked that we still can't rename a desktop, eg. TaskXDesktop instead of Desktop 4.

I hate this change too, but I believe this was done to improve the frame rates. 10.11 finally has smooth Mission control animations on a retina display, even when a lot of apps are up and running, which is great.

I don't see any other reason why they would hide this from showing up by default.

If you use you display in some Scaled mode it could be the culprit of low framerate as it then runs at something like 3k by 2k resolution which is then downscaled to your selection.

I think the improvements are more around Metal and such. It see improvements everywhere not just Mission Control, especially when hooked up to my 4K monitor.

Does anybody else cringe when clicking on os update announcements wondering what the heck they are going to break in the next release? Are they going to add DRM? Telemetry? Remove Key features? Make disk encryption less secure? Make it harder to install non-appstore apps? It just feels like technology is going backwards with each new release of os software.

Feature wise OS X is still fine. You can run everything as long as you unlock it manually, which I find actually valuable since most users should not use unsigned applications. I also trust the software more than Windows (still far less than Linux). Unlike Microsoft, Apple recently stood up for the user's privacy. DRM is still mostly a problem that you can control by buying DRM free. The key point will be stability. Yosemite is a mess. If they fix that it'll be fine.

They actually improve the use of disk encryption and security of OS X in every release (including this one).

There cannot possibly enough friction between an end-user and the video player they just downloaded from a porn site. There is absolutely no reason for every piece of software you run to have access to your entire filesystem except that we didn't know better 30 years ago.

As long as there's a sensible override system that lets users make informed decisions about trust, I can't wait for OSX to converge on the iOS sandboxing model

FWIW, FileVault has been getting better, and recent versions have come with other security fixes like defeating Thunderbolt DMA attacks.

To anyone trying to install the GM while running a OS X dev build: https://neosmart.net/blog/2015/upgrade-to-os-x-el-capitan-gm...

You'll need the whole 6 GiB download, there's (currently) no delta upgrade available. It also doesn't seem there will be, based off of the note from Apple (see link).

ya i just went from 5-> GM, which worked out for me because stupid 6 update always failed to install.

For those wondering about `rootless`, it is implemented as an extended attribute on files/directories.

$ xattr /usr

com.apple.FinderInfo

com.apple.rootless

Running `sudo rm -rf /usr` fails.

$ sudo rm -rf /usr

rm: /usr: Operation not permitted

Here is a list of all of the `rootless` files and directories on my system. It appears to be mostly kext files, and Apple applications.

https://gist.github.com/bobbyburden/4ce5c42044e5a9967b25

I'm pretty sure that rootless is a good thing. I've seen Macs bricked by seemingly harmless operations like changing important permission settings, or by damaged installer packages.

Locking the system down will make it a bit harder to shoot yourself in the foot. Besides the obvious advantage of reducing the attack surface of vulnerabilities.

That won't brick your OS X installation. Just boot from external drive and fix the permissions. It's not really that hard, and there is even a recovery partition exactly for problems like that.

Yep, the recovery partition is also a pretty great feature. But it's even better if you never need it!

Seeing `sudo rm -rf /usr` makes me cringe.

A more harmless way to check: `sudo touch -a /usr`.

I did it in a VM. :)

So how does the installer deal with files that are installed in say /usr/bin that should not be there? Does it leave them there or does it move them? Does it put "rootless" attribute on them?

Can you turn off rootless during installation or is this post installation thing only?

Does rsync backup continue to work with rootless? I have a feeling that booting from external partition and restoring from backup won't work for system files with rootless attribute on them.

Some questions for testers:

- Does homebrew still work?

- Does this fix the mdnsresponder stuff if you had WiFi probs with Yosemite? I've heard they removed mdnsresponder in recent Yosemite updates but I still haven't got WiFi working as reliably as 10.9.

- Is it true there's no more OpenSSL binary out of the box?

If the upgrade process from 10.9 to 10.10 regarding homebrew is the same I'd disable and remove homebrew before upgrading. It made the upgrade process come to a complete crawl.

>Does homebrew still work?

When I installed it I just had to manually restore write permission on /usr/local/bin, which it allowed me to do with SIP still on.

I've looking at https://www.apple.com/osx/elcapitan-preview/, and I can't see one thing that looks interesting to me. Is there anything exciting, for a developer type, that they are excluding?

Public transit info, for the dev on the go! And I guess the extra language support is always good for our South East brethren.

Split view support sounds good. Let's see how it measures up against things like Spectacle and Amethyst.

To be honest I've almost never used the Maps app. Google Maps does public transportation very well.

Most important change for me: speed. The performance improvements in El Capitan are absolutely amazing compared to the disaster Yosemite is.

This sounds absolutely great, hope it's the same for me (haven't tried El Capitan yet)! On a rMBP with integrated graphics, moving from Mavericks to Yosemite made everything noticeably more sluggish, and everytime I happened to use Mavericks after that, I was struck by how responsive it was.

I have stayed on Mavericks for this reason. I likely will move to El Capitan, but I'll wait until the release and see what people say.

That would is of course always welcome. Can't say my early 2011 MBP with an SSD has ever felt underpowered on Yosemite though.

They fixed many issues with default user interface elements.

For example, it's almost impossible to see if a control is disabled or not in Yosemite. Or the default, white, borderless buttons on don't work very well on a bright background.

In El Capitan they fixed a lot of these problems. All buttons now have a border, and their state is clearly visible.

So essentially they fixed a regression bug.

Nostalgic memories of the few things that ran good on your S3 cards back in 1998?

More seriously, from that list at least for me: - Speed and battery life from Metal, to start - Better window management - Bug fixes - Spotlight improvements (if you don't use Alfred already) - Audio indicator in Safari Tabs

Although I will likely wait and see whether all of my dev tools are going to shatter by letting someone else at work do it first :)

As an FYI, Apple typically releases multiple GM candidates before a final OS X release. (I think it was three each for Yosemite and Mavericks, although it's surprisingly hard to find a comprehensive list of builds).

If memory serves GMs are normally a one and done thing. It may be buggy and inadvisable (wait for 10.x.1), but the GM normally ships more or less unchanged.

Yeah, there are often several RCs, but usually only one GM. I do vaguely remember some Apple OS release in the past, in which they released a GM and then had to do a second one, but I can't recall the details (even if it was iOS or MacOS).

GMs have gone up to at most 3, I believe.

http://www.macrumors.com/2014/10/09/third-yosemite-golden-ma...

GM (Golden Master) = RTM (Release To Manufacturing) = the point where it becomes a bit of a hassle to do a recall because you've started putting copies of your OS in boxes somehow (whether pressed on a disc, or flashed to new machines' SSDs, or whatever.)

If Apple does a second GM on a product, they're likely "rewinding" their pipeline, reopening sealed boxes to re-image computers. Not something they will do if they can at all help it!

They're calling this a "GM Candidate"

  https://www.dropbox.com/s/a2ge8vhirmine5o/Screenshot%202015-09-09%2022.16.22.png?dl=0

Could be an evolution of lingo, or just that they're saying GM are always a candidate but oh god please almost always the same as RTM.

Historically GM's were pretty rock solid. Not anymore. Apple is now like everyone else -- release early/often.

More an effect than a cause. When it was hard to convince people to update, and an automatically-updating OS was scary, and pipes were too small to download big patches, then you had to get it right the first time. Nowadays, as long as the OS works well-enough out of the box to suck down the newest point release, all is well from the end-user's perspective. Except maybe there's some weird out-of-box bugs until they've let their computer sit around for a few hours and restarted it once.

That sounds like an excuse.

I think the goal should always be to ship as bug free as possible. Having the mindset that you can push bug fixes later is just pure laziness.

There are other things than laziness that push the scale toward shipping bugs. In Apple's case, there's the fact that they only have so many OS engineers, and those engineers have to ship new code with each release, to, for example, create drivers and expose APIs to enable software to take advantage of new hardware features. Bugs are strictly less important to solve than making sure that everything shown in the keynote—every feature that sells the new computers each year—actually works on release.

The real problem is the yearly release cadence. Apple's hardware pipeline is maybe too good—it's not giving the software engineers enough time to polish the software.

The El Capitan beta was pretty solid in my experience. I've been using it as my primary OS since a month and there have been only minor bugs.

Related information: According to an email in a live demo from Apple's iPhone event, El Capitan is set to be released on September 30th. [0]

[0]: http://9to5mac.com/2015/09/09/apple-reveals-os-x-el-capitan-...

User focused question: will this seamlessly upgrade to the release stream when installed?

Yes.

Also, more often than not, OS X GM is the version that's released to the public.

Even if they do update GM versions, it's still a delta update between the final GM and the subsequent release (10.11.1 in this case)

I believe in the past, it was not the case. I remember once I downloaded the GM and a day later there was a new one. I went to software update and there were no pending changes. I had to wipe/start over.

With the 10.9 first GM you couldn't update to the second GM, but updating to 10.9.1 worked fine.

How can you be certain that the result was identical?

Because science. Also deltas.

It's because "new one" wasn't actually new, only difference was in naming.

Did anyone else here have this issue with Dropbox & Finder in Yosemite where newly added files in Dropbox show up in terminal, but not in Finder. And to force finder to refresh, you need to use a workaround like creating a temporary folder and deleting it? [1]

If you did, then do you still see this issue in El Capitan? I may be willing to upgrade to the GM if this issues gets resolved.

[1] https://www.dropboxforum.com/hc/en-us/community/posts/201166...

Can anyone comment if the GM fixes the battery problems Beta 1 had? I was on the first beta awhile back, and my 2012 rMBP got about an hour battery life (I usually get closer to ~3-4) and was always hot to the touch.

The same thing happened to me with Mavericks, so I chalked it up to Apple not optimizing the early betas for battery life.

I'm on beta 5, on a 2009 macbook 15 in, I'm getting great battery life, but i feel like my lap is on fire.

ya ya ya i know its not good for the boys down here but i had no choice!

I'm on DP 8 on a 2015 rMP, Sitting reading documents and playing music in iTunes without doing too much I get around 11 hours battery life, with moderate use of git, sublime text 3 and some Firefox (Nightly) I get between 5-7 hours depending on how much I use Firefox which is the main battery killer.

Excellent! I guess now is the time for me to finally make the move over to El Capitan, since your usage seems pretty similar to mine. Thanks!

There are lots of diagnostic reports that are run in beta versions.

On the latest beta of 10.11, I easily get 8-9 hours battery life with brightness set to the middle with Safari, iTerm, Mail and iTunes running.

Are you using Chrome/flash at all?

>Can anyone comment if the GM fixes the battery problems Beta 1 had? I was on the first beta awhile back, and my 2012 rMBP got about an hour battery life (I usually get closer to ~3-4) and was always hot to the touch.

Those are usually no battery or power management related problems, but "rogue program eating too much CPU" problems.

Usually it's Spotlight, but a look in Activity Monitor would have shown the culprit.

Am I the only one whose Mail.app chose to re-download every message in GMail and mark it unread?

Nope, same here.

Just upgraded. Too early to say, but so far everything works except Little Snitch.

Install the nightly build, it works :)

Does it work with System Integrity IForgetTheName turned on?

I've been trying to keep tabs on what does/doesn't break w/ that addition (totalspaces/totalfinder appear to be having a rough time, for instance), trying to hunt the Little Snitch forums now

Yes, it works on stock El Cap

Thanks! Installing Nightly Build 3.6 fixed it (it's El Capitan compatible)

Does it appear as an App Store update to anyone running the latest dev build?

I redeemed my copy but it indicated I should update from the Updates page rather than downloading the full package, however the updates page is empty.

It's listed as "OS X El Capitan GM Candidate" under the Purchases tab. Full 6 GB download like the final release will be for users coming from Yosemite, rather than an incremental update on top of the beta.

Unless I'm missing something, anyway.

It shows up there as 'Downloaded' for me, but it hasn't actually downloaded anything. http://i.imgur.com/dumxAMQ.jpg

Me too MrMondo :<

Did you manage to get round this & force the install?

PSA: Do not upgrade to El Capitan if you use Outlook 2011. It's completely broken right now with no fix that I can find.

However, on the plus side, they have upgraded openssh to have ed25519 support. Yay.

Hi, Im new to macs and OS X so can anyone please tell me, whether the El capitan GM will wipe out my mac if Im running El Capitan beta? Or is it safe like any other beta udate?

If it does, it should say so before you install the update.

It should be safe. But for good measure do a Time Machine backup beforehand, if something should go wrong.

Whilst there's always a hypothetical risk, the installer should simply overlay the GM on top - you'll keep all your settings, documents, and other data, with only the OS being updated, just as with any other update.

The installer does recommend having a fresh Time Machine backup available. Just kick one off manually and let that complete, then proceed with the update, so if anything should go awry, you can recover from it easily.

Thanks guys for fast answers :)

GM Candidate, what does it mean?

Is this a new beta version or final?

Gold Master, I think

Golden master candidate, which means that, barring the discovery of a horrendous bug, this will be what ships. So, known bugs, however impactful, will not stop the release.

Shipping a second or third GM candidate is not unheard of. See for example http://www.macrumors.com/2014/10/09/third-yosemite-golden-ma...

Anyone know if it's possible to disable Intel turboboost or having the same "Power Options" like Windows has for years?

Anyone know if the Heroku Toolbelt issues still exist?

the toolbelt should be working under el capitan

What's the difference between OS X El Capitan Beta and Candidate? Do we get other perks that other won't when the final Version is out?

What are you talking about? There have never been perks to downloading betas.

The perk of a beta is getting to try it first. The purpose of a beta is for Apple to get test-users that are willing to provide feedback that they can use to perfect the official release of the final version. The final version is the only one that is going to have all the 'perks'.

*Edit: Fixed my issue trying to get the latest download, I had to clear the software update catalogue as so: `sudo softwareupdate –clear-catalog`

Still waiting for Apple to approve my new developer account, A direct link to the download would be appreciated.

I have been running the developer and public beta's since they were released, right from beta 1 I found it more stable and 'faster' than Yosemite which my team has had endless problems with beach balls, crashes etc... We were thinking that Apple had given up on OS-X and were almost entirely focusing on iOS development but with our experiences running and developing on El Capitan I truly believe we were wrong - it reminds me of how fast and reliable OS-X 3-4 years ago much to my (our) relief.

that's not how it works, it's delivered via the app store

App Store > Purchases tab > OS X El Capitan GM Candidate > Download

As I said: "Still waiting for Apple to approve my new developer account, A direct link to the download would be appreciated."

Generally once a GM has been released and a download is available the .dmg installer is available if not from Apple's website, from application download or update cache after installing it from the app store.

OS X beta doesn't require a developer account, you can enroll in the Apple Beta Software Program with any Apple ID. I don't have a developer account and got beta access very quickly.

https://beta.apple.com/sp/betaprogram/welcome

Hey thanks for the link, I didn't realise it was available for the Public as well as the Developer betas, I managed to get it to download by clearing the software update catalog as so: `sudo softwareupdate –clear-catalog`

You're welcome!

iOS 9 beta is devs only, so I'm stuck waiting for that one. El Cap has been very stable for me though!

iOS 9 has a public beta too, it's different from the dev betas though and has no GM.

Just looked again and found it a few minutes ago! Beta is installing.

Along with Xcode 7, which you would think would be on the Apple Beta Software Program page, but isn't.

Xcode betas are now made publicly available. I don't think you even need an Apple ID anymore.

Yeah, I found that too. I was just thinking "now that I stopped being a dumbass and found that the iOS beta right there, I bet the Xcode betas are in the same place." Nope!

Reply on news.ycombinator.com