4 ms·

Mac Keeps a Log of All Your Downloads

46 points by animationwill 6y ago

orf 6y ago
Tl;dr One component of MacOS, involved with tracking downloads and ensuring an are-you-sure dialogue is presented when opening a download, does not appear to delete rows from its internal SQLite database after the file is deleted. I’m not sure I’m too bothered about this. It might be quite hard to synchronise the database in a way that ensures the dialogue is always presented on first use.
- breakingcups 6y ago
  I would be bothered about this. It shouldn't be that hard to include this in the metadata on the filesystem, similar to what Windows does.
  - pwinnski 6y ago
    There is, in fact, a quarantine bit, but that metadata isn't very hard to change for a process that has enough access to a file to run it. `xattr -rc` and you're in. Disclaimer: I've not even begun to really dig into this, beyond reading a few assorted pages like this one: https://www.sentinelone.com/blog/macos-malware-researchers-how-to-bypass-xprotect-on-catalina/ https://www.sentinelone.com/blog/macos-malware-researchers-h... and this one: https://blog.malwarebytes.com/101/2019/02/macos-protect-malware/ https://blog.malwarebytes.com/101/2019/02/macos-protect-malw...
pehtis 6y ago
This is from 2013. COM.APPLE.LAUNCHSERVICES.QUARANTINEEVENTSV or more likely com.apple.launchservices.quarantineeventsv does not even exist any more..
- animationwill 6y ago
  You can test this yourself, the commands in the webpage still work. The Mac still keeps a log of all your downloads and so this discussion is very relevant for 2020.
  - pwinnski 6y ago
    I don't know what version of MacOS you're on, but the commands in this article, even de-styled to take them out of ALL-CAPS, do not work on macOS Catalina. `ls ~/Library/Preferences/com.apple.lx` does not reveal com.apple.launchservices-anything. `ls ~/Library/Preferences/xquaranx` does not reveal any file with quarantine in the name. That my computer logs when it quarantines something, I don't doubt, but this article is very much out of date. P.S. I couldn't figure out how to consistently include asterisks above, so I substituted 'x'
    - filleduchaos 6y ago
      If you're a long-time user of macOS you should be aware by now that it uses a case-sensitive filesystem. The `com.apple.LaunchServices` and `com.apple.LaunchServices.QuarantineEventsV2` (renamed) user-level preferences still very much exist.
      - bydo 6y ago
        The modern Mac can use two case-sensitive-capable file systems, HFS+ and APFS. Neither is case-sensitive by default and, at least for many years, formatting the system volume to be case-sensitive caused a lot of problems with applications.
        filleduchaos 6y ago
        yes case preserving not case sensitive
      - pwinnski 6y ago
        If you read the linked article, you'd note that the article completely destroyed any indication of case by forcing ALL COMMANDS INTO ALL-UPPER-CASE. But yes, I guessed wrongly.
zepto 6y ago
The real story is how the Mac keeps a log of every application you launch! Most people don’t know this but there is a hidden app called Console, and in it you can see how much of your behavior the Mac is tracking! /s

46 points by animationwill 6y ago

orf 6y ago

Tl;dr One component of MacOS, involved with tracking downloads and ensuring an are-you-sure dialogue is presented when opening a download, does not appear to delete rows from its internal SQLite database after the file is deleted. I’m not sure I’m too bothered about this. It might be quite hard to synchronise the database in a way that ensures the dialogue is always presented on first use.

breakingcups 6y ago
I would be bothered about this. It shouldn't be that hard to include this in the metadata on the filesystem, similar to what Windows does.
- pwinnski 6y ago
  There is, in fact, a quarantine bit, but that metadata isn't very hard to change for a process that has enough access to a file to run it. `xattr -rc` and you're in. Disclaimer: I've not even begun to really dig into this, beyond reading a few assorted pages like this one: https://www.sentinelone.com/blog/macos-malware-researchers-how-to-bypass-xprotect-on-catalina/ https://www.sentinelone.com/blog/macos-malware-researchers-h... and this one: https://blog.malwarebytes.com/101/2019/02/macos-protect-malware/ https://blog.malwarebytes.com/101/2019/02/macos-protect-malw...

pehtis 6y ago

This is from 2013. COM.APPLE.LAUNCHSERVICES.QUARANTINEEVENTSV or more likely com.apple.launchservices.quarantineeventsv does not even exist any more..

animationwill 6y ago
You can test this yourself, the commands in the webpage still work. The Mac still keeps a log of all your downloads and so this discussion is very relevant for 2020.
- pwinnski 6y ago
  I don't know what version of MacOS you're on, but the commands in this article, even de-styled to take them out of ALL-CAPS, do not work on macOS Catalina. `ls ~/Library/Preferences/com.apple.lx` does not reveal com.apple.launchservices-anything. `ls ~/Library/Preferences/xquaranx` does not reveal any file with quarantine in the name. That my computer logs when it quarantines something, I don't doubt, but this article is very much out of date. P.S. I couldn't figure out how to consistently include asterisks above, so I substituted 'x'
  - filleduchaos 6y ago
    If you're a long-time user of macOS you should be aware by now that it uses a case-sensitive filesystem. The `com.apple.LaunchServices` and `com.apple.LaunchServices.QuarantineEventsV2` (renamed) user-level preferences still very much exist.
    - bydo 6y ago
      The modern Mac can use two case-sensitive-capable file systems, HFS+ and APFS. Neither is case-sensitive by default and, at least for many years, formatting the system volume to be case-sensitive caused a lot of problems with applications.
      - filleduchaos 6y ago
        yes case preserving not case sensitive
    - pwinnski 6y ago
      If you read the linked article, you'd note that the article completely destroyed any indication of case by forcing ALL COMMANDS INTO ALL-UPPER-CASE. But yes, I guessed wrongly.

zepto 6y ago

The real story is how the Mac keeps a log of every application you launch! Most people don’t know this but there is a hidden app called Console, and in it you can see how much of your behavior the Mac is tracking! /s