macOS 13: Solve the stream of "Background Items Added" notifications
Posted: Wed Feb 08, 2023 1:04 pm
macOS 13.2 adds a new bug that causes it to pester you with an endless stream of weird notifications like these here:
This is already a bit better than a similar notification we are also seeing, which doesn't even contain any text at all:
What does that all mean and how can you fix that bug?
It seems that Apple wanted to increase security in macOS 13, and tell you when applications add items to the list of apps that automtically get launched when you login to macOS.
This is often used for background helpers, such as cloud sharing services, VPN tools, or simple main menu plugins that show up in the right border of your main menu. NeoFinder uses that for its search tool that you can use directly from the menu bar in all applications.
The new bug in macOS 13.2 can hopefully be fixed by using Apples Terminal.app and paste and run this command:
sfltool resetbtm
You may need to restart your Mac once to see this in effect.
Unfortunately, the resetbtm option for the sfltool command line tool is not documented by Apple, the man page does not list it. Big surprise.
This is a serious security threat!
What most people writing about this are missing is that this is a serious security problem in macOS 13.
Let's look at the text of the message. It says that some software had added items that can run in the background. Whatever that means. But instead of telling the user a) the actual NAME of the software and ). the actual NAME or path of the "item" that may now run in the background, Apple has decided to print the Apple Developer Account name of the person that has "notarized" the application. Or the item, we don't know that.
What are you supposed to do as the user now?
Apple recommends you can "manage this in the Login Items Settings".
How are you supposed to do that if you don't even know the name of the software that is causing this? Or the name and path of the item that actually does get added to the Login Items?
And what is more, the ill fated new "System Settings" doesn't even allow you to edit the actual LaunchAgents of the local user! Only the apps that have been added by the user or some older macOS API to the kLSSharedFileListSessionLoginItems are shown and edited there.
This notification is extremely badly designed.
Instead of increasing security by explaining in clear words what is happening, then asking the user for permission, this incomprehensible and confusing notification generates a latent feeling of impending doom.
The user is not in control, the deed has already be done, and cannot be prevented. The advice given by Apple is actually wrong, and not working. The user is left helpless and confused.
We are really appalled that this notification was designed and created this way by Apple.
It actually damages the trust of the user in macOS and the applications installed by the user.
Apple urgently needs to improve that.
- macOS13 BIA notifications.jpg (149.39 KiB) Viewed 2838 times
This is already a bit better than a similar notification we are also seeing, which doesn't even contain any text at all:
- macOS 13.2 login items notification.png (123.21 KiB) Viewed 2838 times
What does that all mean and how can you fix that bug?
It seems that Apple wanted to increase security in macOS 13, and tell you when applications add items to the list of apps that automtically get launched when you login to macOS.
This is often used for background helpers, such as cloud sharing services, VPN tools, or simple main menu plugins that show up in the right border of your main menu. NeoFinder uses that for its search tool that you can use directly from the menu bar in all applications.
The new bug in macOS 13.2 can hopefully be fixed by using Apples Terminal.app and paste and run this command:
sfltool resetbtm
You may need to restart your Mac once to see this in effect.
Unfortunately, the resetbtm option for the sfltool command line tool is not documented by Apple, the man page does not list it. Big surprise.
This is a serious security threat!
What most people writing about this are missing is that this is a serious security problem in macOS 13.
Let's look at the text of the message. It says that some software had added items that can run in the background. Whatever that means. But instead of telling the user a) the actual NAME of the software and ). the actual NAME or path of the "item" that may now run in the background, Apple has decided to print the Apple Developer Account name of the person that has "notarized" the application. Or the item, we don't know that.
What are you supposed to do as the user now?
Apple recommends you can "manage this in the Login Items Settings".
How are you supposed to do that if you don't even know the name of the software that is causing this? Or the name and path of the item that actually does get added to the Login Items?
And what is more, the ill fated new "System Settings" doesn't even allow you to edit the actual LaunchAgents of the local user! Only the apps that have been added by the user or some older macOS API to the kLSSharedFileListSessionLoginItems are shown and edited there.
This notification is extremely badly designed.
Instead of increasing security by explaining in clear words what is happening, then asking the user for permission, this incomprehensible and confusing notification generates a latent feeling of impending doom.
The user is not in control, the deed has already be done, and cannot be prevented. The advice given by Apple is actually wrong, and not working. The user is left helpless and confused.
We are really appalled that this notification was designed and created this way by Apple.
It actually damages the trust of the user in macOS and the applications installed by the user.
Apple urgently needs to improve that.