Not sure if this is directly related, but… When a non-sandboxed application presents the Open or Save panel, the program starts opening files in the currently selected directory. Move to a different directory, and the application will start pounding on the files in that directory. This seems to be the case with most (all?) non-sandboxed apps, so it is probably part of the Apple library code. This is a pain in the butt for me when I do audit trail analysis.
Sandboxed applications don’t do this. An Apple daemon does this on the application’s behalf (presumably the “power box”), but from a security point of view, this is much easier to analyze. I encourage developers and users to move to sandboxed apps ASAP. :) For a detailed video on this problem, see Data Fence: Audit Data vs. Last Access Time http://www.toddheberlein.com/videos/2014/1/27/data-fence-audit-data-vs-last-access-time Todd On Mar 6, 2014, at 11:20 AM, [email protected] wrote: > What’s Adobe’s beef with NSSavePanel? I found this while running fs_usage on > my computer. > > Adobe Easter Egg? > > 11:14:46 getattrlist /Volumes/DriveA/030514 0.000014 Adobe > Photos > 11:14:46 getattrlist es/DriveA/030514/TestSave 0.000010 Adobe > Photos > 11:14:46 lstat64 __NSSAVEPANEL_IS_SO_L.AME 0.000007 Adobe > Photos > 11:14:46 lstat64 es/DriveA/030514/TestSave 0.000011 Adobe > Photos > 11:14:46 getattrlist es/DriveA/030514/TestSave 0.000007 Adobe > Photos > 11:14:46 lstat64 __NSSAVEPANEL_IS_SO_L.AME 0.000006 Adobe > Photos > 11:14:46 getattrlist __NSSAVEPANEL_IS_SO_L.AME 0.000004 Adobe > Photos > 11:14:46 write 0.000024 > screensharin > 11:14:46 select 0.250128 W > netsession_m > 11:14:46 getattrlist es/DriveA/030514/TestSave 0.000015 Adobe > Photos > 11:14:46 getattrlist es/DriveA/030514/TestSave 0.000006 Adobe > Photos > 11:14:46 getattrlist /Volumes/DriveA/030514 0.000007 Adobe > Photos > 11:14:46 getattrlist es/DriveA/030514/TestSave 0.000006 Adobe > Photos > 11:14:46 getattrlist es/DriveA/030514/TestSave 0.000005 Adobe > Photos > 11:14:46 write 0.000017 > screensharin > 11:14:46 getattrlist TESTSAVE_2.psd 0.000013 Adobe > Photos > _______________________________________________ > > Cocoa-dev mailing list ([email protected]) > > Please do not post admin requests or moderator comments to the list. > Contact the moderators at cocoa-dev-admins(at)lists.apple.com > > Help/Unsubscribe/Update your Subscription: > https://lists.apple.com/mailman/options/cocoa-dev/todd_heberlein%40mac.com > > This email sent to [email protected]
signature.asc
Description: Message signed with OpenPGP using GPGMail
_______________________________________________ Cocoa-dev mailing list ([email protected]) Please do not post admin requests or moderator comments to the list. Contact the moderators at cocoa-dev-admins(at)lists.apple.com Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/cocoa-dev/archive%40mail-archive.com This email sent to [email protected]
