Interesting. I've never seen this before and I've downloaded and opened/unarchived tens of files.

Could there be something else? The Leopard I'm running is from an update DVD dropped into a new mac and then used to upgrade a 10.4.10 (Tiger) installation.

Can anyone else vouch for this?

---
"The best way to accelerate a PC is 9.8 m/s2"

[ Reply to This | # ]

I might add that I immediately changed all of my download locations to my desktop -- safari, mail and ichat -- so maybe it's just the actual system created "Downloads" folder that has this 'feature'?

---
"The best way to accelerate a PC is 9.8 m/s2"

[ Reply to This | # ]

Nupe, not just ~/Downloads. I get the warning when I download to e.g. ~/Desktop as well. But note that this applies to applications and scripts, not "regular" files. So you should see it if you download and then try to open this file: http://henrik.nyh.se/filer/test.sh

[ Reply to This | # ]

Well, I'll be. Guess so. Thx

---
"The best way to accelerate a PC is 9.8 m/s2"

[ Reply to This | # ]

Isn't there a checkbox on the dialog that says something like: Don't warn me again?

[ Reply to This | # ]

Afraid not. See the screenshot of the dialog in the original blog post: http://henrik.nyh.se/uploads/unquarantine.png

[ Reply to This | # ]

You've gotta love an anonymous submission that includes a link to the submitter's blog!

[ Reply to This | # ]

Could developers run this on a file before posting it for download?

---
Doug's AppleScripts for iTunes
dougscripts.com

[ Reply to This | # ]

I (the submitter) don't think so. You get the warning because an extended attribute (xattr) named com.apple.quarantine is set on the file when it's downloaded. To my knowledge, xattrs are not stored in the file itself but are file system metadata, so they don't stay with the file as it's uploaded and later downloaded. And even if they did, they would likely be overwritten on download.

[ Reply to This | # ]

I don't think this is "Vista-like," and I don't want to remove this reminder. If you know where the file comes from and you trust it, it's one keypress added. It doesn't happen all the time, just the first click on a downloaded file. There will be more attempts to breach OS X. This is a needed barrier.

---
------------------------
Screenplays for Royalty
since 1749

[ Reply to This | # ]

I don't see how reminding me of what I just told the computer to do is "needed", but okay, if you like it nobody is forcing you to disable it. This is MacOSXHints, not MacOSXMandatoryChanges.

[ Reply to This | # ]

"Vista-like" is certainly arguable.

You're certainly free to keep the alert. :) I (the submitter) agree that warnings like these are a good thing for non-expert users, but I dislike that there isn't an option to disable it, for users that know what they're doing. You will probably agree that warnings you don't need are annoying.

[ Reply to This | # ]

Finally, a solution to this irritating "feature"! Thanks a million, I was hoping somebody would some day find a way to stop this behavior.

[ Reply to This | # ]

This is not "vista-esque." Vista asks you to "cancel or allow" hundreds of ordinary behaviors that users do every day, several times a day--like plugging in an external drive, a thumb drive, even modifying the UAC settings. (Think of how many things Microsoft must believe could possibly be hijacked in a Vista system to require UAC warnings on so many things. They don't even trust the UAC control panel to remain secure, as shown by their requiring the user to confirm that they want to Allow changes in its settings.) Leopard is warning of a SINGLE known potential route of system infection: downloaded executables. And even then it is giving you intelligent options.

Get rid of it if you wish, but it's just not true that it's like Vista.

---
David

[ Reply to This | # ]

Hi, David,

I beg to differ. Ok, perhaps .php is a potential executable but not when I'm trying to open it in a text editor. Example: I download ZenCart, expand it, look at some of the .php files in SubEthaEdit, and this warning comes up. For every .php I'm opening in a text editor. I could run them in Apache localhost (only because I've gone through the trouble to enable a MAMP stack on localhost), and I'll bet they execute without warning. How helpful (or secure) is that?

I'm going to find the disabling of this feature a definite time-saver. Most of my work is in web application programming, and I'm not new to the internet (obviously) -- I'm aware that things that come via the web are potentially dangerous. I need to disable this feature in order to work quickly, sanely, and with the least abuse of my hands possible. For me, one more click per file I open actually matters, not to mention that this is a change from my prior workflow habits that I would have to get used to. Next I need an automator action that will recurse a directory dropped on it and remove this flag so I can get on with my work when I download client files from a live server.

[MacOSXHints: Thanks for the script!]

Criss

---
Liberate Your Website

[ Reply to This | # ]

Although I like the warning when I open a program for the first time, if I've decided to keep it I don't want to be warned every time I try to open it thereafter, so I think this hint is great. But instead of having it as a folder action (which effectively obliterates the feature completely), I prefer it as an Automator Finder plug-in, which allows me to change the setting for an individual application that I've decided to keep. For anyone who's interested, here's how I made it (based off of the code in the original hint):

Create a new workflow in Automator and pick Get Selected Finder Items as the first action. Drag Run AppleScript in as the second one, and paste in the following lines:

on run {input, parameters}
	
	repeat with i from 1 to count of input
		
		set thisInput to quoted form of POSIX path of item i of input
		
		do shell script "xattr -d com.apple.quarantine " & thisInput
		
	end repeat
	
end run

Now choose "Save as Plug-In" from the File menu, make sure the Finder is selected as the plug-in type, and give it a name (I named mine "Remove Quarantine Flag").

Do keep in mind that you have to have permissions set on the file you're trying to modify such that you can write to the file. This script will silently fail if you don't have write access to the file. I'd like to include a prompt for administrator authentication, but I don't know how to do that. If anyone does, please jump in with a solution.

[ Reply to This | # ]

if I've decided to keep it I don't want to be warned every time I try to open it thereafter

Like someone else wrote earlier: I only get the warning once, in a quite intelligent manner. If you're getting the warning each time you open the file then some bug might be bothering you.

[ Reply to This | # ]

Update: In 10.6, this should be created as a Service, not a Workflow, as 10.6 does not offer the option to save it as a Finder plugin any more.

As a service, the "Get Selected Finder items" step is not necessary any more - instead one configures the Service at the top to receive selected "files or folders" in "Finder.app".

I also suggest to wrap the "do shell script" line between a "try" and "end" so that it will not abort the processing of a larger selection when a single selected file is not quarantined.

[ Reply to This | # ]

To be able to do this on files that you don't have privileges for, simply append 'with administrator privileges' (without the quotes) at the end of the do shell script line. AppleScript will then present a dialog asking for your admin password.

[ Reply to This | # ]

I don't mind this feature, I just don't like that the OS doesn't provide a way to turn it off! Or at LEAST to turn it off after the first time you open a program (I'm getting it every time). Very un-apple of them to not let you customize this.

[ Reply to This | # ]

I think this "feature" is buggy.

When I build a machine, I download and install all the apps from my own file server, using my own login. When I subsequently log in as another user and run the apps I am constantly annoyed with the "do you want to open this?" pop-up. And the only way to get rid of it is to download the app as this other user and install them. Then I only get asked once and never again. If I log back in as myself, no warning. Soo... they don't want me to download & install from a file server? Yet another reason I think Leopard is junk.

[ Reply to This | # ]

hell yeah this is extremely annoying..

I'm not to fond of applescript/folderactions, but I'll try this.. thanks.

would be good if there was a way like setting a hidden value somewhere in a plist and be done with it..

[ Reply to This | # ]

I think maybe this is behaving as designed on my Mac, and that those who it's annoying are seeing a bug not a design feature.

For me, I download an application, usually as a .dmg or a .zip file, and get no warning at all when I mount the .dmg or extract the .zip. I then install the application by dragging the .app to Applications, and still no warning. I then run the app, and get a warning the first time ONLY, reminding me where it came from (see http://homepage.ntlworld.com/mark.berry93/warning.png). Even scripts executed directly from the download location (such as the test.sh someone posted) only show the warning once.

Pretty logical and sensible, and surely a long way from annoying.

And no, I don't agree there should be an easy way to turn it off. A hidden hack yes, but one of the reasons I moved to Macs in the first place was that I got totally fed up with my daughters wrecking their XP machines doing stupid things they didn't understand, having turned off warnings they also didn't understand. Yes they can just click through this dialogue too, but at least it's written in layman's terms, and is not one of hundreds I have to educate them to take notice of.

Make it easy to turn off, and it'll be turned off by the people who most need it!

[ Reply to This | # ]

If you reassign read/write permissions to all users from Get Info, quit the app and open it again, it may also be fixed. Worked for me on both Firefox and Thunderbird.

[ Reply to This | # ]

Yes, only a user with read/write permissions can clear the flag by opening the application. If the user is not an admin user, then the flag will not clear on the first open and the message will keep appearing. Another way to clear the flag for a single application is to open the app in terminal while logged in as an admin user by typing

open /Applications/AppName.app

Yet another way is to have a separate applications folder in ~/, and install your applications in that location first, open them, then move them to /Applications.

[ Reply to This | # ]

Cool, now do you have a hint for getting folder action to work reliably in Leopard?

[ Reply to This | # ]

The thing that gets me is that it is constantly saying, you downloaded this file from the internet, and I'm like, yeah? Fairies didn't fly it onto my machine?

I mean, I use Safari to go to MacUpdate for what reason: to download files off the internet.

Sorry, but no one need be scolded here, of all places, for seeking a workaround to shut the damn thing off. After 12 years on the Mac, I deserve my peace and quiet.

[ Reply to This | # ]

This quarantine thing drives me nuts. It is so irritating. Imagine I downloaded a new python library with 100+ files inside. All those files are quarantined. I must click 100 times to open the files!!!! First off, super user or not, when I double-click a file, I just want it to open. I bloody well know that I downloaded it from internet! Second, I want to have the possibility to turn the damn "feature" off. Vista-esque is cruel but perfectly true. This is by very, very far the most annoying, stupid idea that I ever saw Apple developers come up with.

[ Reply to This | # ]

I wrote a program in C that removes the quarantine attributes from files and folders. If it gets a directory as an argument it traverses it and removes the quarantine attribut from everything below it. You have to compile it and then it can be used either in a folder action or manually.

/* Compile by
 * gcc -O2 -Wall removexattr.c -o removexattr
 *
 * Run it on a file or a directory (it traverses down a directory)
 * Example: ./removexattr Downloads
 * will strip everything in the directory Downloads of the quarantine attribute.
 */

#include <stdio.h>
#include <stdlib.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <dirent.h>
#include <sys/errno.h>
#include <sys/xattr.h>
#include <ctype.h>
#include <limits.h>


static void traverse_tree(const char * path);

/* You can add more attributes below if you want to */
static const char * const xattr_list[] = {
	  "com.apple.quarantine",
	  /* "com.apple.FinderInfo",*/
	  NULL
	};

static __inline__ void remove_xr(const char * path)
{
  int i = 0;

  for(i = 0; xattr_list[i]; i++) {
	 if(getxattr(path, xattr_list[i], NULL, 0, 0, XATTR_NOFOLLOW) > 0)
		removexattr(path, xattr_list[i], XATTR_NOFOLLOW);
  }
}

int main(int argc, char ** argv)
{
	struct stat stbuf;
	int i;

   if(argc < 2) {
	  fprintf(stderr, "Usage: %s <file || directory ...>\n", argv[0]);
      exit(1);
   }
	
	for(i = 1; i < argc; i++) {
	  if(stat(argv[i], &stbuf)) {
		 perror(argv[i]);
		 continue;
	  }
	  if(S_ISREG(stbuf.st_mode))
		 remove_xr(argv[i]);
	  else if(S_ISDIR(stbuf.st_mode))
		 traverse_tree(argv[i]);
	}

	return(0);
}

#define BUFSIZE (PATH_MAX + 1)

static void traverse_tree(const char * path)
{
  DIR * dirp;
  struct dirent * dp;
  char * npath = NULL;

  if((dirp = opendir(path)) == NULL) {
	 perror(path);
	 return;
  }

  if(!(npath = malloc(BUFSIZE * sizeof(char)))) {
	 perror("malloc");
	 exit(EXIT_FAILURE);
  }
  while((dp = readdir(dirp))) {
	 if(!((dp->d_name[0] == '.' && dp->d_name[1] == '\0') ||
			(dp->d_name[0] == '.' && dp->d_name[1] == '.' && dp->d_name[2] == '\0'))) {
		snprintf(npath,  BUFSIZE, "%s/%s", path, dp->d_name);
		remove_xr(npath);
		if(dp->d_type == DT_DIR) {
		  traverse_tree(npath);
		}
	 }
  }
  closedir(dirp);
  free(npath);
}

[ Reply to This | # ]

Couldn't you just make all file types safe?

You can make one safe as described here (except for me the file exists and I can add file extensions not only full identifiers) make safe

[ Reply to This | # ]

Ok, one more way to accomplish this same thing... in terminal only

(by the way, I compiled the c code above and it works like charm (10.5.5). but you need Xcode etc. It's very fast)

The apple script in this hint uses the xattr program which comes with Leopard. But it doesn't support folder recursion (and doesn't have a man page). To apply xattr to all files in a a folder tree, use xargs

find folderpath -print | xargs xattr -d com.apple.quarantine

(replace folder path with your folder, e.g. ~/downloads)

Since xattr doesn't have a man page, here's the output from xattr -h Thanks very much to the original poster for figuring out this command in the first place.

usage: xattr [-l] file [file ...]
       xattr -p [-l] attr_name file [file ...]
       xattr -w attr_name attr_value file [file ...]
       xattr -d attr_name file [file ...]

The first form lists the names of all xattrs on the given file(s).
The second form (-p) prints the value of the xattr attr_name.
The third form (-w) sets the value of the xattr attr_name to attr_value.
The fourth form (-d) deletes the xattr attr_name.

options:
  -h: print this help
  -l: print long format (attr_name: attr_value)

[ Reply to This | # ]

If you want to change this on the command line as suggested above, you need to escape the spaces in filenames using the "-print0" in find and the "-0" in xargs, e.g.,
find folderpath -print0 | xargs -0 xattr -d com.apple.quarantine
in fact, I plan to use this frequently (I find it particularly annoying the ACL is inherited into all the files in an archive you have downloaded), so I have an alias in my .cshrc (which I prefer to a Folder Action because I have control over when to use it):
alias noquar 'find !$ -print0 | xargs -0 sudo xattr -d com.apple.quarantine'

[ Reply to This | # ]

There is a freeware application called Deeper that allows you to disable this alert.

The feature can be accessed from Deeper's "General" tab. Under the General tab you will find a checkbox called "Remove the alert message at first launch of downloaded applications".

Problem solved!

[ Reply to This | # ]

This has proven robust for me:

find -x <insert_directory_this_should_work_on_here> -type f -print 0 | xargs -0 xattr * | grep "quarantine" | awk -F: '{print $1}' | xargs -I {} xattr -d com.apple.quarantine '{}'


it looks daunting, but is in fact trivial:

find: find all files in the current file system (don't bother external disks or usb sticks by default)

xargs v1: show the attributes of the found files

grep: filter all those with a qarantine attribute

awk; get the filename

xargs v2: strip the attribute

[ Reply to This | # ]

There is a typo above: not '-print 0' but '-print0'

The whole string:
find -x <DIR_TO_WORK_ON> -type f -print0 | xargs -0 xattr * | grep "quarantine" | awk -F: '{print $1}' | xargs -I {} xattr -d com.apple.quarantine '{}'

[ Reply to This | # ]

Can anyone also please supply a remedy for the consistent NZB files alerts that comes up when you've got Mac OS X 10.5.8 Leopard? Is there a particular folder actions for this? These alerts are very similar to the Downloads Applications alert.

[ Reply to This | # ]

does this work for 10.6(.2)?

[ Reply to This | # ]

Wow, some people sure make stuff WAY more complicated than they need to be.
Simply run...
defaults write com.apple.LaunchServices LSQuarantine -bool NO
...in the Terminal and your problem is solved.

[ Reply to This | # ]

"Wow, some people sure make stuff WAY more complicated than they need to be.
Simply run...
defaults write com.apple.LaunchServices LSQuarantine -bool NO
...in the Terminal and your problem is solved."

I just did this and see no change in behavior- OSX 10.6.7.

The Folder Actions script has never worked consistently for me (it works for a while and then the probem recurs), so I'm kind of hoping there IS a single terminal command which can succesfully turn this nasty behavior off.

[ Reply to This | # ]

I would also add that I just tried applying this script to a folder with no results whatsoever, even after log-in/log-out.

Does it need updating for 10.6.x???

[ Reply to This | # ]

It's Vista-like to let the user disable this annoying behavior.

Here is a simple line to remove the quarantine flag from the contents of a directory:
[code]xattr -d com.apple.quarantine /path/to/target/*.* [/code]

It only works on files with extensons. You can paste the first part into Terminal and then drag your target into the Terminal window.

[ Reply to This | # ]

You can use:

find <path> -xattrname "com.apple.quarantine" -exec xattr -sd "com.apple.quarantine" '{}' \;

The -s option makes sure that com.apple.quarantine is removed from symbolic links, too.

[ Reply to This | # ]