Your Mac Keeps A Log Of Your Downloads(macgasm.net) |
Your Mac Keeps A Log Of Your Downloads(macgasm.net) |
You can disable the warning by a command line:
xattr -d com.apple.quarantine <path_to_your_program>
Furthermore, even once a file is out of quarantine, the Get Info dialog can still tell you where it was downloaded from, precisely because of this database.
My first few files
* Symantec_Antivirus_Mac.dmg
* http://msdn01.e-academy.com|http://download.e-academy.com/do... (MSDN Alliance: Free Microsoft Software for Students)
* http://download2.vmware.com/software/fusion/VMware-Fusion-1....
* http://download.skype.com/macosx/Skype_2.7.0.330.dmg
Scary yes (The torrent files) but so much history to look at.
sqlite3 ~/Library/Preferences/com.apple.LaunchServices.QuarantineEvents 'SELECT datetime(LSQuarantineTimeStamp + 978307200, "unixepoch") as LSQuarantineTimeStamp, LSQuarantineAgentName, LSQuarantineOriginURLString, LSQuarantineDataURLString from LSQuarantineEvent' | sort
sudo launchctl -w com.apple.LaunchServices.QuarantineEvents[.plist]If you'd rename or copy the file, the "came form the Internet" tag will remain or be copied with the file. With the sqlite database approach, either this association breaks, or you need to check the database every time a file is copied, moved or renamed and if it's in there, update the database, if you want to be able to track a file when it's copied or renamed.
I don't know if OSX has extra logic for this, or if they just allow the association to break. But with the metadata tagging approach, you only have to run the tagging logic when the file is downloaded (to set the tag) and when it's about to be executed (to check the tag), not with every other file-operation.
A strange choice, IMO: the sqlite approach makes it harder to achieve the intended goal because you need extra effort/logic required to track a file as it's copied, renamed or moved, while at the same time it makes it easier for an unintended goal: tracking users by keeping the information about the file around even when it's deleted and the "came from the Internet" warning is no longer useful.
defaults write com.apple.LaunchServices LSQuarantine -bool NO
Works like a charm...
https://github.com/mathiasbynens/dotfiles/blob/master/.osx#L...
Not exactly shocking material. But thanks to OP for the heads up.
See also https://support.apple.com/kb/HT3662
That all makes perfect sense. It doesn’t provide perfect protection, but it does provide sensible protection.
Is it only listing things downloaded through Safari?
Maybe Firefox downloads aren't included? Maybe it's watching the ~/Downloads folder? Can you confirm either?
$ sqlite3 -column ~/Library/Preferences/com.apple.LaunchServices.QuarantineEvents <<END|pbcopy
> .mode tabs
> .headers on
> SELECT strftime('%Y-%m-%d %H:%M:%S', LSQuarantineTimestamp+ 978307200, 'unixepoch', 'localtime') as date,
> LSQuarantineAgentName as App,
> LSQuarantineDataURLString as URL
> FROM LSQuarantineEvent
> --where LSQuarantineDataURLString like '%bankofamerica%'
> order by LSQuarantineTimestamp;
> END
$
The 978307200 number corrects for the fact that Apple is using 2001-01-01, the year OS 10.0 was released, as its epoch.
I got way fewer rows than expected. Apparently, downloads by Firefox are not logged. When I screened for B of A downloads, I was puzzled to see only downloads in the past year or so. That's because I only recently started using Chrome to access that site.
This post also fails to mention that this is specific to Safari at last check. I don't think Google Chrome integrates with this functionality.
Also, some apps doesn't even need to integrate, as the OS will override and auto-apply files for some blacklisted apps, see /System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/Exceptions.plist for LSFileQuarantineEnabled
$ sqlite3 ~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV* 'select LSQuarantineAgentName from LSQuarantineEvent'|grep 'Google Chrome'|wc -l
35Depending on how long you have had your Mac, you will have both com.apple.LaunchServices.QuarantineEvents and com.apple.LaunchServices.QuarantineEventsV2
Naturally, both files will have to be cleansed.
I think this really can be a potential privacy issue. "Your computer having your files on it" is quite different:
a) You know that your files are on your computer
b) You know how to delete one of them in case you need to hide them from someone
1. A file on disk is the intended result of a download
2. A file is readily visible/alterable in a user interface provided for consumption of the same by the operating system
3. Removing a file means that, without serious effort, the information contained therein is gone
I would be irked if I had taken steps to remove a downloaded file from my laptop, including secure deletion, only to leave evidence that I'd downloaded it in a sqlite database.
"Safari can keep your browsing history private. When you turn on private browsing, Safari doesn’t remember the pages you visit, your search history, or your AutoFill information."
Well it does remember files you downloaded, even if you subsequently delete them.
In your user account.
There's quite a difference right there. I thought it was some kind of "hidden" file (not unlike the GPS location which was saved by default on any iPhone with a GPS -- up to the latest iPhone!?) which had now been discovered.
It's just in your user account so it's no big deal.
Everyone with access to your Mac can access it just as well, i assume. I guess it can also be read by applications, uploaded to the internet? I don't have a Mac so i don't know the restrictions but i would consider it privacy information that i would like to know if and where it's stored. There is a reason you can delete your browser history. Or your recently accessed files list.
If they're logged on to your account, but not if they are using a different account.
>I guess it can also be read by applications, uploaded to the internet?
Not Mac App Store apps - they're quarantined.
> "If you have something that you don’t want anyone to know, maybe you shouldn’t be doing it in the first place"
Here's the quote in full context:
"I think judgment matters. If you have something that you don’t want anyone to know, maybe you shouldn’t be doing it in the first place, but if you really need that kind of privacy, the reality is that search engines including Google do retain this information for some time, and it’s important, for example, that we are all subject in the United States to the Patriot Act. It is possible that, that information could be made available to the authorities."
"He, or whoever took that screenshot..." "Her, or whomever that screenshot was sent to..."
Not merely pondered upon it for 2 minutes and decided that Apple programmers were idiots for doing so, right?
<key>org.mozilla.firefox</key>
<dict>
<key>LSFileQuarantineEnabled</key>
<true/>Seems to me this would be a better way to do it, you're reading the resource fork for the file anyway, why also make a sqlite query as well?
The resource fork was designed for a different world. (A) In the old days, there was a blurry line between OS and app, so there was no reason to make the resource fork "opaque". Without opacity, there is no graceful way to use it in a preemptive multitasking environment. (B) In the old days, pointers were 24 bits. The high 8 bits didn't go anywhere, so people used these high bits to store extra data. Resource forks make use of 24-bit quantities for this reason — which went out of favor when Macs with the 68020 were introduced in 1987. (C) The real feature of resource forks was to reduce the disk space usage and load times when you have lots of small pieces of data, but — data is bigger and we have better archive formats.
So yeah, extended attributes are the way to go.