I use a tool called Sloth[0] for showing all the open files and connections of running processes. It does pretty much the same thing. Unfortunately I didn't hav

I use a tool called Sloth[0] for showing all the open files and connections of running processes. It does pretty much the same thing. Unfortunately I didn't have the presence of mind to take a memory dump of TextEdit before I quit it while it was doing this. I'm gonna take your advice and not freak out, and try to prove that the behavior is benign. I think I'll just set up a shell script on TextEdit to alert if it ever opens anything inside /users, and watch it for awhile. I'm still pretty unhappy that it seemed to home in on scanning my tax returns, out of a folder with thousands of other things. The read pattern looked human-guided, like what you'd do if you were browsing around someone else's filesystem. [0] https://sveinbjorn.org/sloth https://sveinbjorn.org/sloth