On Mar 6, 2014, at 4:18 PM, Todd Heberlein <todd_heberl...@mac.com> wrote:

> Not sure if this is directly related, but…
> 
> When a non-sandboxed application presents the Open or Save panel, the program 
> starts opening files in the currently selected directory. Move to a different 
> directory, and the application will start pounding on the files in that 
> directory. This seems to be the case with most (all?) non-sandboxed apps, so 
> it is probably part of the Apple library code. This is a pain in the butt for 
> me when I do audit trail analysis.
> 
> Sandboxed applications don’t do this. An Apple daemon does this on the 
> application’s behalf (presumably the “power box”), but from a security point 
> of view, this is much easier to analyze. I encourage developers and users to 
> move to sandboxed apps ASAP. :)

Well, we all would, if it wasn’t such an occasional pain in the ass.

> 
> For a detailed video on this problem, see
> 
> Data Fence: Audit Data vs. Last Access Time
> http://www.toddheberlein.com/videos/2014/1/27/data-fence-audit-data-vs-last-access-time
> 
> Todd
> 
> 
> On Mar 6, 2014, at 11:20 AM, livinginlosange...@mac.com wrote:
> 
>> What’s Adobe’s beef with NSSavePanel? I found this while running fs_usage on 
>> my computer.
>> 
>> Adobe Easter Egg?
>> 
>> 11:14:46  getattrlist       /Volumes/DriveA/030514       0.000014   Adobe 
>> Photos
>> 11:14:46  getattrlist       es/DriveA/030514/TestSave    0.000010   Adobe 
>> Photos
>> 11:14:46  lstat64           __NSSAVEPANEL_IS_SO_L.AME    0.000007   Adobe 
>> Photos
>> 11:14:46  lstat64           es/DriveA/030514/TestSave    0.000011   Adobe 
>> Photos
>> 11:14:46  getattrlist       es/DriveA/030514/TestSave    0.000007   Adobe 
>> Photos
>> 11:14:46  lstat64           __NSSAVEPANEL_IS_SO_L.AME    0.000006   Adobe 
>> Photos
>> 11:14:46  getattrlist       __NSSAVEPANEL_IS_SO_L.AME    0.000004   Adobe 
>> Photos
>> 11:14:46  write                                          0.000024   
>> screensharin
>> 11:14:46  select                                         0.250128 W 
>> netsession_m
>> 11:14:46  getattrlist       es/DriveA/030514/TestSave    0.000015   Adobe 
>> Photos
>> 11:14:46  getattrlist       es/DriveA/030514/TestSave    0.000006   Adobe 
>> Photos
>> 11:14:46  getattrlist       /Volumes/DriveA/030514       0.000007   Adobe 
>> Photos
>> 11:14:46  getattrlist       es/DriveA/030514/TestSave    0.000006   Adobe 
>> Photos
>> 11:14:46  getattrlist       es/DriveA/030514/TestSave    0.000005   Adobe 
>> Photos
>> 11:14:46  write                                          0.000017   
>> screensharin
>> 11:14:46  getattrlist       TESTSAVE_2.psd               0.000013   Adobe 
>> Photos
>> _______________________________________________
>> 
>> Cocoa-dev mailing list (Cocoa-dev@lists.apple.com)
>> 
>> Please do not post admin requests or moderator comments to the list.
>> Contact the moderators at cocoa-dev-admins(at)lists.apple.com
>> 
>> Help/Unsubscribe/Update your Subscription:
>> https://lists.apple.com/mailman/options/cocoa-dev/todd_heberlein%40mac.com
>> 
>> This email sent to todd_heberl...@mac.com
> 
> _______________________________________________
> 
> Cocoa-dev mailing list (Cocoa-dev@lists.apple.com)
> 
> Please do not post admin requests or moderator comments to the list.
> Contact the moderators at cocoa-dev-admins(at)lists.apple.com
> 
> Help/Unsubscribe/Update your Subscription:
> https://lists.apple.com/mailman/options/cocoa-dev/sevenbitstech%40gmail.com
> 
> This email sent to sevenbitst...@gmail.com

Attachment: signature.asc
Description: Message signed with OpenPGP using GPGMail

_______________________________________________

Cocoa-dev mailing list (Cocoa-dev@lists.apple.com)

Please do not post admin requests or moderator comments to the list.
Contact the moderators at cocoa-dev-admins(at)lists.apple.com

Help/Unsubscribe/Update your Subscription:
https://lists.apple.com/mailman/options/cocoa-dev/archive%40mail-archive.com

This email sent to arch...@mail-archive.com

Reply via email to