Mac OS X core utility Find and Extended Attributes

I’ve been writing backup scripts recently. I really like rsync and have been using it with Mac OS X’s smbfs quite successfully (under 10.5). But the other day I found some files that were created on the receiving file system but contained no data.

I really wanted to know how pervasive this was so I asked find to list the files that are zero bytes long. Needless to say I got a lot of false positives. It is not uncommon for the files I use to have zero bytes in the data fork. Usually these files will have some data in their resource fork. The find command only looks for data in the data fork. Files with zero bytes in both forks are rare and those are the files I needed to find.

I needed to change the behavior of find. Finding and compiling the source code for find was easy. My first thought was to add up all of the extended attributes each file has and use that as the total file size:


> #include <sys/xattr.h>


< off_t size;


> off_t size, calc_size;

>    ssize_t list_size;


>    calc_size = entry->fts_statp->st_size;


>    /* get list of extended attribute names */

>    list_size = listxattr(entry->fts_path, NULL, 0, XATTR_NOFOLLOW);


>    if( list_size > 0 )

>    {

>       char *namebuf, *current_name;

>       namebuf = malloc( list_size );

>       listxattr(entry->fts_path, namebuf, list_size, XATTR_NOFOLLOW);

>       current_name = namebuf;


>       /* iterate over list of extended attribute names */


>       while( current_name < namebuf+list_size )

>       {

>          calc_size += getxattr(entry->fts_path, current_name, NULL, 0, 0, XATTR_NOFOLLOW);

>          current_name += strlen(current_name) + 1;

>       }


>       free( namebuf );

>    }


< size = divsize ? (entry->fts_statp->st_size + FIND_SIZE - 1) /

<     FIND_SIZE : entry->fts_statp->st_size;


> size = divsize ? (calc_size + FIND_SIZE - 1) / FIND_SIZE : calc_size;

This worked well enough for my needs. Although it has some problems. The biggest one is that it doesn’t produce files sizes that match the Finder’s get info dialog box. It seems the Finder only adds the data fork with the resource fork. Where as the code above adds every available extended attribute. Common additional extended attributes include “” and “”.


I’d like to introduce you to Blocks. It’s an application I’ve had in my mind for a very long time. At it’s basic level it is about understanding data formats. Very geeky stuff.

I finally have something to show, so I’d like to tease you all with the folowing Quicktime screen cast:

I plan on more screen casts so show more functionality. Please, let me know what you think.

Here you find where I first write my thought down about all this. It’s interesting how the idea has changed since then.

Reoccurring Apple PubSub requests in my Apache logs

Frequently in my web servers logs I would see a request for an RSS feed I have available from a “PubSub” user agent from my IP address. It bothered me because the feedreader I use doesn’t use Apple’s PubSub library to read feeds.

So I figured Safari was the cause. I had tested Safari’s RSS support a long time ago, but didn’t like it. I took a quick look and found Safari was subscribed to zero feeds. Hmm. After some web searching I discovered the pubsub command line app Apple provides to manage the resource.

I told it to list all the feeds it knows about and sure enough, there was the offending URL plus some others. I promptly deleted them from the list. I figured all was well. But after a few hours, I found new log entries for the for the same feed. I queried the PubSub command again and found all of the entries restored. I discovered Safari would restore the feeds every time it launched. Safari’s GUI was no help. I looked everywhere for entries for the feeds and found nothing. So I started combing thru it’s preference files.

I finally found the feeds listed in the “TopSites.plist” file. The GUI displaying the top site in Safari did not list these feeds. Strange.

I used the plist editor to delete the references to the feeds in the top sites preference file, and now Safari no long repopulates PubSub. Happy days indeed.

I’m 37. I’m not old.

That line from Monty Python and the Holy Grail keeps going thru my mind. Mainly because I finally became 37 a few days ago. I’ve always hated people celebrating my birthday. I’ve never like to make a big deal about it. Fortunately my wife has finally understood this about me and had nothing planned.

Apple hates Color Computers

A long time ago Apple Computer released an operating system called Mac OS9. Microware, the makers of OS-9, sued for trademark infringement and lost. I was quite surprised. It seemed like classic trademark dilution to me.
Then a few years later Apple released Mac OS X. In Mac OS X, they included an Application Framework called Cocoa. That’s awfully close to the nick name of my favorite computer: The CoCo. Hmm, that’s suspicious.
Now I learn Apple is creating a new JavaScript engine called Nitro. Very similar to the OS-9 retooling called NitrOS-9. Well, now I am calling it: Apple hates Color Computers!