6 ms·

Other thread on this: https://news.ycombinator.com/item?id=33095608 https://news.ycombinator.com/item?id=33095608 My comment from there: I'll be interested to

Other thread on this: https://news.ycombinator.com/item?id=33095608 https://news.ycombinator.com/item?id=33095608 My comment from there: I'll be interested to see if anyone else can reproduce this. I created a request bin [0], then created a QR code pointing at it, then downloaded that QR code. I'm not sure how often this "image scanning" is supposed to occur but just downloading it didn't cause a hit nor did the 10min I waited, nor did using QuickLook, nor opening it Preview, nor scanning it with my iPhone, the only thing that caused a request was clicking on the detected link in my iPhone camera app. Obviously if this is a background daemon that runs periodically then my test wouldn't catch it (unless I got "lucky") and for a longer-term test I'd probably want to use something other than request bin. That said request bin says it keeps bins for 48 hours so that might be enough time. [0] https://requestbin.io/ https://requestbin.io/

bobviolier 4y ago
The original twitter threads talks about "a couple of days ago".. so that it didn't do it in 10 minutes, is not that surprising. Also not sure if your 48 hours will be enough if I go from the original thread from the person who found the issue.
f1shy 4y ago
I've just reproduced it. Went to a qr-code generator online, generated a code with an url http://xxx.xxx.xxx.xxx http://xxx.xxx.xxx.xxx In a terminal i did "sudo tcpdump ip host xxx.xxx.xxx.xxx" Then I do a screen capture of the QR code, and save it. At that moment I see an http query to the ip. uname -a: Darwin Kernel Version 21.6.0: Mon Aug 22 20:17:10 PDT 2022; root:xnu-8020.140.49~2/RELEASE_X86_64 x86_64 Really shitty idea from apple... EDIT!!! Sorry, I think I know where the problem was: I was testing with a site I visited in safari already. It happens that after you type a couple of characters in safari address bar, and you have a cache hit in your history, safari already loads the site. While doing the experiment I visited sites which triggered hits in the history with my test site... so no. I could not really reproduce it. Maybe original tweet comes from similar error.
- rgovostes 4y ago
  Counterpoint: I did the same thing and used Little Snitch to try to catch a request, and did not see one. If there had been one, it would have attributed it to a particular process.
  - deleted 4y ago
    [deleted]
  - mixmastamyk 4y ago
    Hours/days later.
    - joshstrange 4y ago
      > Then I do a screen capture of the QR code, and save it. At that moment I see an http query to the ip. The person they are replying to said it happened instantly in their test.
      - mixmastamyk 4y ago
        But not necessarily.
  - sleepybrett 4y ago
    My understanding is that little snitch doesn't catch some requests by apple owned processes.
    - zimpenfish 4y ago
      That's what I thought but on checking, it seems they've been stripped back to a bunch of Apple domains rather than blanket permissions for daemons, etc.
    - Nextgrid 4y ago
      I believe that's now been rolled back - at least on my machine, LS is indeed catching a lot of Apple processes.
captainmuon 4y ago
My M1 Mac does OCR on images. You can select text in bitmaps, look up words, and it highlights phone numbers and dates. Maybe this feature is related? Try highlighting the file using finder or viewing with quickview. Maybe you have to be on M1, too.
- joshstrange 4y ago
  I'm on an M1 Max, I tried QL and opening it preview but it didn't trigger anything. I also tried scanning the QR from my iPhone and nothing came through until I clicked on the link.
_visgean 4y ago
most of the photos context scans (face detection etc) occurs when the computer is idle and plugged in.. I am sure this is just another background task..
expensive_news 4y ago
For what it’s worth I was also unable to reproduce this. I’ve tried scanning but not clicking, AirDropping, iMessage, adding to Photos library, getting the url from Photos library… nothing triggered as a page visit. Relatedly, searching for the url in my photos library does not return the picture as a result, indicating that the scanning is not being used for indexing currently. I was trying to test with other QR codes that I happened to have in my photos library, but every one of them has the website name in the picture. I will keep the files on my computer and continue monitoring but I am becoming very skeptical of the Twitter thread author’s methodology.
joshstrange 4y ago
Just over 23 hours later and my QR code in my downloads folder has still not been "tripped". I guess I have another 24 hours before my requestbin expires but so far it seems there has been no reproduction of this.

bobviolier 4y ago

The original twitter threads talks about "a couple of days ago".. so that it didn't do it in 10 minutes, is not that surprising. Also not sure if your 48 hours will be enough if I go from the original thread from the person who found the issue.

f1shy 4y ago

I've just reproduced it. Went to a qr-code generator online, generated a code with an url http://xxx.xxx.xxx.xxx http://xxx.xxx.xxx.xxx In a terminal i did "sudo tcpdump ip host xxx.xxx.xxx.xxx" Then I do a screen capture of the QR code, and save it. At that moment I see an http query to the ip. uname -a: Darwin Kernel Version 21.6.0: Mon Aug 22 20:17:10 PDT 2022; root:xnu-8020.140.49~2/RELEASE_X86_64 x86_64 Really shitty idea from apple... EDIT!!! Sorry, I think I know where the problem was: I was testing with a site I visited in safari already. It happens that after you type a couple of characters in safari address bar, and you have a cache hit in your history, safari already loads the site. While doing the experiment I visited sites which triggered hits in the history with my test site... so no. I could not really reproduce it. Maybe original tweet comes from similar error.

rgovostes 4y ago
Counterpoint: I did the same thing and used Little Snitch to try to catch a request, and did not see one. If there had been one, it would have attributed it to a particular process.
- deleted 4y ago
  [deleted]
- mixmastamyk 4y ago
  Hours/days later.
  - joshstrange 4y ago
    > Then I do a screen capture of the QR code, and save it. At that moment I see an http query to the ip. The person they are replying to said it happened instantly in their test.
    - mixmastamyk 4y ago
      But not necessarily.
- sleepybrett 4y ago
  My understanding is that little snitch doesn't catch some requests by apple owned processes.
  - zimpenfish 4y ago
    That's what I thought but on checking, it seems they've been stripped back to a bunch of Apple domains rather than blanket permissions for daemons, etc.
  - Nextgrid 4y ago
    I believe that's now been rolled back - at least on my machine, LS is indeed catching a lot of Apple processes.

captainmuon 4y ago

My M1 Mac does OCR on images. You can select text in bitmaps, look up words, and it highlights phone numbers and dates. Maybe this feature is related? Try highlighting the file using finder or viewing with quickview. Maybe you have to be on M1, too.

joshstrange 4y ago
I'm on an M1 Max, I tried QL and opening it preview but it didn't trigger anything. I also tried scanning the QR from my iPhone and nothing came through until I clicked on the link.

_visgean 4y ago

most of the photos context scans (face detection etc) occurs when the computer is idle and plugged in.. I am sure this is just another background task..

expensive_news 4y ago

For what it’s worth I was also unable to reproduce this. I’ve tried scanning but not clicking, AirDropping, iMessage, adding to Photos library, getting the url from Photos library… nothing triggered as a page visit. Relatedly, searching for the url in my photos library does not return the picture as a result, indicating that the scanning is not being used for indexing currently. I was trying to test with other QR codes that I happened to have in my photos library, but every one of them has the website name in the picture. I will keep the files on my computer and continue monitoring but I am becoming very skeptical of the Twitter thread author’s methodology.

joshstrange 4y ago

Just over 23 hours later and my QR code in my downloads folder has still not been "tripped". I guess I have another 24 hours before my requestbin expires but so far it seems there has been no reproduction of this.