3 ms·
> [workaround 2] Download the file with curl. Unix command-line tools like curl and tar don’t add the quarantine bit to the files they create on macOS, so it’s
by thrdbndndn 3y ago
> [workaround 2] Download the file with curl. Unix command-line tools like curl and tar don’t add the quarantine bit to the files they create on macOS, so it’s pretty easy to run software downloaded with them.
Wait I'm confused by this part (never used MacOS).
Which part of the chain mechanism mentioned above can be bypassed by just downloading the file via CURL?
I didn't seem to see the author mentioned (not explicitly at least) which steps added these "quarantine bits".
- tener 3y agoBrowsers tag downloaded files using filesystem features.
- thrdbndndn 3y agoDo untagged files (like downloaded via curl) not require signing at all, or it's just lenient enough to not trigger the bugs/issues mentioned in the article (since their app is actually signed, after all)?