Downloaded to Seahaven Island

More real than reality itself.

Get It Try It

Here's your typical Apple download. A download of one of our own files. CLIX.zip.



Check the blue field above. The size field. It's blue and not white because there's something unusual about it.

So click the field again.



Now that field says 354,906 bytes. And it's in white again. This is the actual size of the download, minus...



Minus the 199 bytes the Creator glued onto it.

What's in those 199 bytes?



com.apple.lastuseddate#PS. A date/time value, indicating when an item was last used. It's not known what this is used for, and no one at Apple is telling.

com.apple.metadata/kMDItemDownloadedDate. A property list (PLIST) file, a type of XML file, with an array with date values.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
"http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<array>
    <date>2019-09-18T19:50:00Z</date>
</array>
</plist>:

com.apple.metadata/kMDItemWhereFroms. This attribute is expressed in the plural. Another property list with an array of string values for the download URLs.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
"http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<array>
    <string>ftp://rixstep.com/CLIX.zip</string>
</array>
</plist>

com.apple.quarantine. The key. You won't normally see this, not with the tools they gave you.

As soon as the system launch services get a whiff of this extended attribute, the files in question are truly treated as being in 'quarantine', and the new 'ballgame' begins. Once your download ends up in this corral, you can be done for. 'Restrictions' on 'application behaviour' begin to apply.

From now on, you're walking through your walled garden in a straitjacket.

See Also
Red Hat Diaries: Apple's Truman Show