Mac Keeps a Log of All Your Downloads | Hacker News Reader

Mac Keeps a Log of All Your Downloads

macgasm.net

46 pointsanimationwill15 comments

This is from 2013.

COM.APPLE.LAUNCHSERVICES.QUARANTINEEVENTSV or more likely com.apple.launchservices.quarantineeventsv does not even exist any more..

You can test this yourself, the commands in the webpage still work. The Mac still keeps a log of all your downloads and so this discussion is very relevant for 2020.

I don't know what version of MacOS you're on, but the commands in this article, even de-styled to take them out of ALL-CAPS, do not work on macOS Catalina.

`ls ~/Library/Preferences/com.apple.lx` does not reveal com.apple.launchservices-anything.

`ls ~/Library/Preferences/xquaranx` does not reveal any file with quarantine in the name.

That my computer logs when it quarantines something, I don't doubt, but this article is very much out of date.

P.S. I couldn't figure out how to consistently include asterisks above, so I substituted 'x'

If you're a long-time user of macOS you should be aware by now that it uses a case-sensitive filesystem.

The `com.apple.LaunchServices` and `com.apple.LaunchServices.QuarantineEventsV2` (renamed) user-level preferences still very much exist.

The modern Mac can use two case-sensitive-capable file systems, HFS+ and APFS. Neither is case-sensitive by default and, at least for many years, formatting the system volume to be case-sensitive caused a lot of problems with applications.

yes case preserving not case sensitive

If you read the linked article, you'd note that the article completely destroyed any indication of case by forcing ALL COMMANDS INTO ALL-UPPER-CASE.

But yes, I guessed wrongly.

> If you're a long-time user of macOS you should be aware by now that it uses a case-sensitive filesystem.

No, by default it's case-insensitive.

Yes on a second read I meant a case-preserving, not case-sensitive filesystem. The results that `ls` gets are cased and so pattern matching (which is case sensitive by default) on those results will fail with the wrong casing.

The linked post shows the commands in allcaps (Safari/macOs) so the actual preference filename is: com.apple.LaunchServices.QuarantineEventsV2 That file contains very few tens of random, mostly old filenames, almost none from Safari which is my main browser.

So at the very least "a log of all your downloads" is a huge exaggeration.

Yes, this is a tiny subset of everything I've downloaded, and includes nothing recent at all.

It might contain everything I've ever double-clicked and been told wasn't safe, but I've long developed a habit of right-clicking and choosing "Open" to bypass that prompt, which seems to also result in no record here.

I'm just guessing, though. I just know this is very wrong: "This will be a list of everything you’ve downloaded on your Mac, regardless of which program you used. The only exception to this is apps from the Mac App Store."

Tl;dr One component of MacOS, involved with tracking downloads and ensuring an are-you-sure dialogue is presented when opening a download, does not appear to delete rows from its internal SQLite database after the file is deleted.

I’m not sure I’m too bothered about this. It might be quite hard to synchronise the database in a way that ensures the dialogue is always presented on first use.

I would be bothered about this. It shouldn't be that hard to include this in the metadata on the filesystem, similar to what Windows does.

There is, in fact, a quarantine bit, but that metadata isn't very hard to change for a process that has enough access to a file to run it. `xattr -rc` and you're in.

Disclaimer: I've not even begun to really dig into this, beyond reading a few assorted pages like this one: https://www.sentinelone.com/blog/macos-malware-researchers-h... and this one: https://blog.malwarebytes.com/101/2019/02/macos-protect-malw...

The real story is how the Mac keeps a log of every application you launch!

Most people don’t know this but there is a hidden app called Console, and in it you can see how much of your behavior the Mac is tracking!

Reply on news.ycombinator.com