4 ms·

Can you please explain it a little bit more? I am just curious.

eropple 8y ago
Browsers on OS X store this information in extended file system attribtes (accessible via the xattr command). It's also how the OS knows to prompt you the first time you open an executable--"you downloaded this from googlechrome.com via Safari, are you sure you want to run this?". Calling it "secret", as the article does, seems disingenous. (Further, even if somebody downloads an application in an incog window, it is probably better for the system's security posture to record these xattrs for such a "hey, is this what you actually meant to download and execute?" situation.)
- yasp 8y ago
  So, if I send the file to someone else, (1) on Linux and (2) on Mac, does this URL metadata come along, or no? Sounds like no, and the issue is just your device being compromised.
  - eropple 8y ago
    I could be wrong, but my understanding matches yours and that, this data is not ever read back in by common HTTP clients (browsers, curl, etc.).
  - icebraining 8y ago
    They might if you package the file in some archive format that stores xattrs. For example, tar(1) can store them, although it doesn't by default (you must pass --xattrs).
- RaleyField 8y ago
  Users could reasonably expect that that information be stored in a separate database. My Linux distro doesn't make it immediately obvious that user.xdg.* attributes are attached with the file system. Normal users don't read EULAs, but we should expect them to read in-depth manuals to be up to speed on every gotcha that the operating system and browser could throw at them?
  - eropple 8y ago
    I consider XDG to be pretty critical to a Linux desktop environment, so...yeah, kinda? Like, if you are going to Have Opinions about something like this--you are of the temperament to care (which is a way of saying "I don't and you probably shouldn't either, tbh, encrypt your drive if you're that geeked up about it")--you should probably know.
- iscrewyou 8y ago
  Thank you. Appreciate the response.
sitkack 8y ago
xattr -p com.apple.metadata:kMDItemWhereFroms <file downloaded with chrome> | xxd -r -p | plutil -convert json -o - - | jq "." And one can catalog the sources of downloads made with Chrome.

Browsers on OS X store this information in extended file system attribtes (accessible via the xattr command). It's also how the OS knows to prompt you the first time you open an executable--"you downloaded this from googlechrome.com via Safari, are you sure you want to run this?". Calling it "secret", as the article does, seems disingenous. (Further, even if somebody downloads an application in an incog window, it is probably better for the system's security posture to record these xattrs for such a "hey, is this what you actually meant to download and execute?" situation.)

yasp 8y ago
So, if I send the file to someone else, (1) on Linux and (2) on Mac, does this URL metadata come along, or no? Sounds like no, and the issue is just your device being compromised.
- eropple 8y ago
  I could be wrong, but my understanding matches yours and that, this data is not ever read back in by common HTTP clients (browsers, curl, etc.).
- icebraining 8y ago
  They might if you package the file in some archive format that stores xattrs. For example, tar(1) can store them, although it doesn't by default (you must pass --xattrs).
RaleyField 8y ago
Users could reasonably expect that that information be stored in a separate database. My Linux distro doesn't make it immediately obvious that user.xdg.* attributes are attached with the file system. Normal users don't read EULAs, but we should expect them to read in-depth manuals to be up to speed on every gotcha that the operating system and browser could throw at them?
- eropple 8y ago
  I consider XDG to be pretty critical to a Linux desktop environment, so...yeah, kinda? Like, if you are going to Have Opinions about something like this--you are of the temperament to care (which is a way of saying "I don't and you probably shouldn't either, tbh, encrypt your drive if you're that geeked up about it")--you should probably know.
iscrewyou 8y ago
Thank you. Appreciate the response.

sitkack 8y ago

xattr -p com.apple.metadata:kMDItemWhereFroms <file downloaded with chrome> | xxd -r -p | plutil -convert json -o - - | jq "." And one can catalog the sources of downloads made with Chrome.