Why Some Apps Sometimes Launch Extremely Slowly
I can now try to explain why some apps may launch extremely slowly, occasionally taking more than 30 seconds, and on some Macs several minutes.
[…]
Log entries don’t provide any information as to what SecTrustEvaluateIfNecessary is likely to perform on these frameworks that can take anything from 0.03-9.96 seconds for each framework.
[…]
The most likely activity to account for these long checking times is computation of SHA-256 hashes for the contents of each item in the app’s Frameworks folder. Thus, these occasional extremely long launch times are most probably due to time taken ‘evaluating trust’ by computing hashes for protected code in the Frameworks folder in the app bundle, when those hashes have been flushed from their cache.
[…]
The only strategy that does appear to stop long launch times in most cases is to disable SIP and, in the case of Apple silicon Macs, to set the security mode to Permissive.
I think it used to be that, once an app passed the initial Gatekeeper check and was no longer quarantined, that was the end of the security checks. Now, Oakley has a chart showing how even code that is no longer quarantined will be rechecked if Launch Services no longer has a record of it, or if the app has been moved. Even if Launch Services does know about it, macOS will do malware and notarization checks if it doesn’t find the app in the cache.
I’m often in Activity Monitor, and a lot of what I see going on is security checks, both when launching apps and also continually checking that apps have proper access to the files they’re working with and the processes they’re sending Apple events to. Sometime I’d like to try turning off SIP and see whether everything feels snappier.
Previously:
- Mac App Launches Slowed by Malware Scan
- How Ventura Checks the Security of Apps and Tools
- Privacy and Security in macOS 14
- Apple Server Outage Makes Mac Apps Hang on Launch
- Faster Xcode Updates
- macOS 10.15: Slow by Design
2 Comments RSS · Twitter · Mastodon
@Michael you could try something like this, which I just ran myself (and have also run previously).
xattr -d -r com.apple.quarantine /Applications/*
VLC.app, which is over 150 MB of compiled binary code, launched at exactly the same speed before and after, though.
I am also constantly clearing this flag from the entire Downloads folder, due to a bug going back at least 5 years now, where "Last Opened Date" will never be set on anything with a quarantine flag.
The human race is screwed, I think. For example, we will never get to explore space if this is an acceptable level of quality for software. We'll spend an astronomical amount of money, and then years later learn that some very fine men and woman perished because of something like "Keyboard Error, Press Any Key To Continue".
