defaults write com.apple.LaunchServices LSQuarantine -bool false
I download almost everything from the net - how else would I install? CD? Floppy? Telling me that it's downloaded from the internet doesn't do anything to identify that it's dangerous and so I ignore the warning.
Under what circumstance would I go "whoa, maybe it's dangerous this time"???
Mac's don't have auto-install .exe files. Yet we get warning for everything from JPEGs to TXT to DMG. Ridiculous.
If there's a vulnerability in the application used to open a JPEG or whatever, you can execute code.
It's less asking "is this dangerous?" and more "did you download and open this?"
1. Download the file. Any website can do this by design.
2. Get LaunchServices to open the file. This requires at least one vulnerability.
3. Bypass quarantine. This requires at least one additional vulnerability.
I don't know why it cares about the executable bit(?) in this case, though.
Now, you could hardcode a list of "safe" apps, or add some kind of "I swear I'm safe" declaration to the app's plist, but that has its own set of problems. A one-time "this seems funky to me, are you actually intending to do this?" is a simple and safe default.
But in that sense an executable file isn't any different from a non-executable file, is it? The default app for the file could do equally dangerous things with a non-executable.
Also, how many applications actually _execute_ (bare machine, vm's don't count) content? My guess is that few if any of the applications a user opens that isn't executed by finder itself is going to execute the file's contents.
That said, even the author notes that this is designed to be forked. It's not a script to run on one's own machine blindly, the idea being to exclude what is not to your taste/while demonstrating features which can't be changed inside the gui. (It's also very helpful if setting up multiple accounts.)
A much more likely threat is a malformed jpg or pdf designed to exploit a decoder, in which case the executable bit is completely irrelevant. Warning the user about the executable bit protects them from nothing, unless Finder is preparing to execute the file itself. It is a warning that is always ignored, and pointless warnings only make the system less secure.
And working with multiple quarantined documents exposes more bugs.
It's not a thoughtfully designed feature. If they ever fix it I would gladly reenable it.
Its 'guess the character encoding' code also might have a 'wait a minute, this is RTF/PDF' feature.
Of course, Apple could trust its own apps, but I think they should not (why increase the attack surface?) and that would lead to complaints "why can't I tell this OS that my text editor can be trusted?".
I also think (but have no data on it) that this "open a .txt file you downloaded" check is very rare for 'normal' users. If they download at all, it is Word documents, PDFs, movies, and applications.
A shell script.
jtm@socrates ~ $ cat ~/Local/bin/unquarantine
#!/bin/sh
for i in com.apple.metadata:kMDItemDownloadedDate \
com.apple.metadata:kMDItemWhereFroms \
com.apple.quarantine; do
xattr -r -d $i "$@"
done