Apple Crippled Its DTrace Port

Linnen writes in to note that one of developers of Sun's open source system tracing tool, DTrace, has discovered that Apple crippled its port of the tool so that software like iTunes could not be traced. From Adam Leventhal's blog: "I let it run for a while, made iTunes do some work, and the result when I stopped the script? Nothing. The expensive DTrace invocation clearly caused iTunes to do a lot more work, but DTrace was giving me no output. Which started me thinking... did they? Surely not. They wouldn't disable DTrace for certain applications. But that's exactly what Apple's done with their DTrace implementation. The notion of true systemic tracing was a bit too egalitarian for their classist sensibilities..."

And as quick as it is reported

[Evets]

As quickly as the issue is reported, a hack [bikemonkey.org]comes out to resolve it. Gotta love how quickly the community can respond to these things.

Re:And as quick as it is reported

[KublaiKhan]

The joy of open source--with that many brains working on a problem, odds are that someone already knows how to fix it.

Well, Apple is *my* friend! :-P

[Quiet_Desperation]

Oh, piffle. Without Apple DRM, iTunes (store) would be impossible due to the idiot record labels. Go grouse at them. Outside of iTunes, what is there in Mac OS X that's DRMed?

When Apple begins sending out legions of hunter-killer robots to take down open source projects and assassinate their maintainers, then you might have a point, Mr. Zombie, sir.

It's worse, they have broken DTrace

[mzs]

Basically profile and tick are useless since they will not fire if a thread with PT_DENY_ATTACH is on proc. Perfectly good DTrace scripts simply will not work correctly on OS X.

Thanks Community, now fix Quicktime 7.4

[voidstin]

It's nice that Dtrace works again. But I'm betting a lot more people use After Effects or Premiere. The QT 7.4 update which enables movie rentals from iTunes breaks any render that takes longer than 10 minutes. Thank god DRM is here to protect me from the work I need to do. Wasn't apple supposed to me the machine for media professionals?

http://blogs.adobe.com/keyframes/2008/01/dont_update_to_quicktime_74.html [adobe.com]

Re:The point of the article

[aberkvam]

Doh! "this feature actually does break iTunes" should have been "this feature actually does break DTrace". My bad.

Re:So what?

[SanityInAnarchy]

I've never seen Apple market OSX as a Unix system or even talk about the shell.

You obviously didn't look very hard. [apple.com]

Its main market is for an easy to use home computer and as a creative platform for video editing, graphic design and professional audio.

And software development. Or where did you think the developers of those video editors work and test their code?

If you want a command line you're fully in control of, use Linux or a BSD Unix.

No disagreement there, but it doesn't hurt to remind people that OS X is not that. People often leave Linux for OS X, claiming that it's basically an easier-to-use Linux than Linux, you still have all your stuff, etc. And you can always ssh to a Linux server to do real work.

It's a commercial OS and Apple will do what they like so long as its legal.

Why is this OK?

Re:So what?

[Stalin]

No disagreement there, but it doesn't hurt to remind people that OS X is not that. People often leave Linux for OS X, claiming that it's basically an easier-to-use Linux than Linux, you still have all your stuff, etc. And you can always ssh to a Linux server to do real work.

How about some examples of "real work" that can't be done in OS X's shell? Admittedly, I don't so as much via the command line in OS X as I did when using Linux for a desktop OS, but I haven't encountered anything preventing me from doing so. I can't attest to OS X's server version; I don't use it. I, like you mentioned, moved to OS X as a desktop Unix because it is easier to maintain. Instead of spending time keeping the underlying system in order, I can work in a cohesive GUI desktop environment with the comforting option of being able to fall back on traditional Unix technologies. E.g. I can run Xmaxima, or vanilla maxima, if I so choose. In the three years I've been using OS X as my primary OS, I haven't had to "ssh to a Linux server to do real work."

Re:So what?

[that this is not und]

Why is this OK?

Actually, it's fine, so long as there's a vigorous community ready to reveal what they're up to. As long as they don't do anything illegal, it's our prerogative to point out things they do that, while legal, are pretty sleazy.

Another black mark against Apple. It's almost like the 80's again, when Stallman and the FSF had well written anti-Apple essays about their Look-and-feel lawsuit.

Maybe the icon for apple.slashdot.org articles needs updating, though.

Re:One question:

[statusbar]

For now, yes... But apple has been in the process of creating cryptographically secure signing and verification of system applications. The next step for them will be to have system tools like this be executed ONLY if they are the unmodified, signed applications that apple originally released.

When that happens, it wouldn't matter if you recompile dtrace - your modified version would just not run.

for info on the current code signing specification from apple (which is pretty much benign for now), see:

• Code Signing [apple.com]

--jeffk++

Wow

[Lally Singh]

Mac haters really are drama queens, aren't they? Here, read this [steike.com].

Leopard's DTrace isn't broken. Apple put in an API for a program to request that debugging & dtrace be disabled for it. Clearly it's there to keep FairPlay from being broken (too easily). Something that commercial developers could understandably want for their software, to prevent keygen hacks, etc.

The link I provide shows a simple way to get around it. Hell, debugging iTunes is directly encouraged in an Apple Technote (linked in the article).

As listed in the article I linked to, you can get around it by trapping the API call in gdb and disabling it.

Re:Thanks Community, now fix Quicktime 7.4

[BrynM]

It's nice that Dtrace works again. But I'm betting a lot more people use After Effects or Premiere.

Don't know which DTrace you're thinking of (possibly a video editing program), but it most certainly isn't this [wikipedia.org] one.

Re:Wow

[ahl_at_sun]

Actually, Leopard's DTrace is broken, and that was the point of the blog post. Here's the issue: DTrace programs that would normally work and collect valid data will fail if a process is running with Apple's trace-me-not bit set. Forget tracing iTunes or other applications that don't want to be traced. It's that probes that should fire don't as an unintended side-effect of Apple's hack to obscure certain applications.

A much smarter approach would have been for Apple to deny visibility into such a process, but still allow a user to monitor system-level events (e.g. timers and system calls). This would have allowed for the (questionably motivated, and highly circumventable) protection while not damaging DTrace and correctly phrased queries.

Everyone needs to use this now

[Count Sessine]

The best thing to do now is to make DTrace as useless as possible until Apple removes this limitation.

Every developer reading this who cares about DTrace and wants to be able to use it for system-wide metrics should set the P_LNOATTACH flag in the next point release for their app. Apple won't like it, but if enough developers do it as a form of protest, it would effectively make DTrace/Instruments ineffective, eliminating a bullet-point feature from Leopard.

DTRACE

[ed.markovich]

Maybe everyone knows what dtrace is. I didn't. Then I watched this: link [google.com] and now I do.

Re:And as quick as it is reported

[Schmool]

Not really. OSX, as opposed to Linux, is a real UNIX. Apple bought NEXT and borrowed all that was good about NEXTSTEP. NEXTSTEP was based on the Mach kernel, with code from BSD. Soon after Apple purchased NEXT, Jobs was hired as a consultant. In the 10 years that followed, Apple changed the OS so that it is now a certified UNIX. http://www.theopengroup.org/openbrand/register/brand3555.htm [theopengroup.org]

Re:And as quick as it is reported

[Anonymous Coward]

Oh come on, being a "real UNIX" just means they had the money to pay for the expensive certification. OSX has as much in common with mach as windows NT does. If you think MacOS is a microkernel you are horribly mistaken.

Re:And as quick as it is reported

[larry bagina]

So how do I use Mach IPC in windows? Mach IPC and Mach messaging are the basis for much of the communication in Mac OS X [apple.com]

Re:Operating System Tying

[jocknerd]

Really? iTunes Plus is more expensive than DRM'ed music, and almost double the $ of some of the same songs on Amazon.

What hole did you just climb out of? iTunes Plus tracks are 99 cents.

Re:Yet another example of how Apple is not our fri

[toddestan]

That's because the CEO of Apple wrote and published an open letter on their website expressing his desire to rid their music store of DRM, and the CEO of Microsoft has done no such thing, instead integrating DRM support into their entire audio and video driver stack. (To the detriment of the stability and functionality of the rest of the OS, I might add...) Please, please, let me know when Microsoft (or a major figurehead thereof) takes an official position against DRM. I'll be waiting eagerly.

Remember, that's the same CEO that refused to remove the DRM off of non-RIAA tracks, even at the request of the copyright holders, until he had colluded with major labels to design iTunes Plus. Double standard indeed.

Re:And as quick as it is reported

[Schmool]

I never said OSX is a microkernel. OSX has XNU, a cozy blend of Mach, GNU and I/O Kit. To quote Apple:

"It is not technically a microkernel implementation, but still has many of the benefits of a microkernel, such as Mach interprocess communication mechanisms and a relatively clean API separation between various parts of the kernel."
http://developer.apple.com/documentation/Porting/Conceptual/PortingUnix/additionalfeatures/chapter_10_section_8.html [apple.com]

This one has pickshurez!!11!1!: http://developer.apple.com/documentation/Darwin/Conceptual/KernelProgramming/Architecture/chapter_3_section_2.html#//apple_ref/doc/uid/TP30000905-CH1g-TPXREF101 [apple.com]

Old is New Again

[HumanEmulator]

Back in 2000, if you installed MacsBug on a Mac you couldn't play DVDs. When you opened the DVD Player you got an error message telling you a debugger was installed. In these pre-memory protection days, MacsBug was the only debugger low-level enough to catch a whole mess of problems. Unfortunately, MacsBug was loaded when the system booted, so the only way to play a DVD was to remove MacsBug and restart your machine.

Long time Mac developer ally Bare Bones Software (they have a great text editor) created a patch that "fixed" this limitation. AFAIK, Apple never said anything about their patch and just quietly let it exist. http://www.macobserver.com/news/00/april/000418/dvdplayerhelper.shtml [macobserver.com]

This whole message mess came about because Macrovision didn't want people disabling their protection on video-output (there were Macs you could literally plug into VCRs then), and I suspect it was also to guard the CSS "encryption."

When Blu-ray movies finally show up in Macs, this kind of thing is probably going to get a lot worse than patches to D-Trace.

Re:Not equivalent, no double standard

[nguy]

We are more forgiving of people who aren't more chronically evil, life just is that way, get over it.

But Jobs is chronically evil.

Re:So what?

[ContractualObligatio]

Take a look at the way they go after the science market (http://www.apple.com/science/ [apple.com]).

Apple market OS X as a UNIX system and have done for a long time. They're just smart enough only to market it as a UNIX system to the markets that appreciate UNIX.

Re:OS-X itself

[zlogic]

They don't have BIOS, they have EFI instead. And there already exists a bootloader that emulates EFI and allows booting a non-patched OSX installation.

Re:From the article

[PopeRatzo]

From the article:

        To say that Apple has crippled DTrace on Mac OS X would be a bit alarmist...

That's some pretty sloppy critical work, Overly Critical Guy.

The line you quote is not "from the article", but rather from one of the comments on the blog's web page. Since that blog allows anonymous posting, it could well have been an Apple flack or fanboy who was trying to soften to blow of what is a very negative article.

Nice try, though.

Re:Luckily...

[Anonymous Coward]

This course will cause Apple to loose what they have gained in the last 5 years.

Lose! LOSE! You fucktard, the verb you're looking for only has one "o" in it, unless you mean to say that Apple is somehow going to set free "what they have gained." As if that statement isn't so vague that it could mean whatever you want it to mean in the first place. How did this ever get modded up at all?