{"id":43439,"date":"2024-05-29T13:59:44","date_gmt":"2024-05-29T17:59:44","guid":{"rendered":"https:\/\/mjtsai.com\/blog\/?p=43439"},"modified":"2024-05-29T15:46:57","modified_gmt":"2024-05-29T19:46:57","slug":"app-store-apps-can-be-translocated","status":"publish","type":"post","link":"https:\/\/mjtsai.com\/blog\/2024\/05\/29\/app-store-apps-can-be-translocated\/","title":{"rendered":"App Store Apps Can Be Translocated"},"content":{"rendered":"<p><a href=\"https:\/\/eclecticlight.co\/2024\/05\/27\/app-store-apps-can-be-translocated\/\">Howard Oakley<\/a>:<\/p>\n<blockquote cite=\"https:\/\/eclecticlight.co\/2024\/05\/27\/app-store-apps-can-be-translocated\/\">\n<p>This article demonstrates that the last of those isn&rsquo;t necessarily true, and what happens when an App Store app ends up being translocated.<\/p>\n<p>The combination of an App Store app with a quarantine xattr is a particular problem for users, as those apps are installed direct to their intended final destination, and their permissions discourage the user from trying to move them from there. That combination therefore defaults to satisfying all three requirements for app translocation to occur, which it will every time that app is run.<\/p>\n<p>Without using Terminal&rsquo;s command tools or third-party utilities like xattred and Mints, there&rsquo;s no way for the user to discover whether an App Store app has a quarantine xattr, nor to check whether the app is being translocated. As (almost?) all other App Store apps don&rsquo;t have a quarantine xattr and aren&rsquo;t translocated, the user is unlikely to suspect those might be occurring, and could account for problems with that App Store app. In this case, purchasing and using the App Store version of UTM puts the app and its user at significant disadvantage compared to obtaining the app direct.<\/p>\n<\/blockquote>\n<p>It&rsquo;s not clear to me how the App Store download got the quarantine attribute. My guess was that this could happen if you do a direct download, don&rsquo;t move it to <tt>\/Applications<\/tt>, and then the App Store updates it to a newer version. In other words, the quarantined app <em>becomes<\/em> the App Store version. But that doesn&rsquo;t seem to be what happened here.<\/p>\n\n<p><a href=\"https:\/\/eclecticlight.co\/2021\/04\/19\/ios-apps-are-translocated-when-run-in-macos\/\">Howard Oakley<\/a>:<\/p>\n<blockquote cite=\"https:\/\/eclecticlight.co\/2021\/04\/19\/ios-apps-are-translocated-when-run-in-macos\/\">\n<p>When you run an iOS\/iPadOS app on an M1 Mac, if it has been downloaded from the App Store (currently the only supported method, as sideloading is forbidden), it doesn&rsquo;t have a quarantine flag. Not only that, but app translocation has only occurred with apps undergoing their first run: once that flag has been unset, further translocations don&rsquo;t occur. Thus, under the original rules for app translocation, there&rsquo;s no way that it should occur in this case.<\/p>\n<p>I&rsquo;m going to look in more detail at how macOS launches and runs iOS\/iPadOS apps in future articles, but here I&rsquo;ll show some relevant log entries which demonstrate what happens, including the translocation.<\/p>\n<\/blockquote>\n<p><a href=\"https:\/\/eclecticlight.co\/2021\/04\/19\/ios-apps-are-translocated-when-run-in-macos\/#comment-60029\">John Smith<\/a>:<\/p>\n<blockquote cite=\"https:\/\/eclecticlight.co\/2021\/04\/19\/ios-apps-are-translocated-when-run-in-macos\/#comment-60029\">\n<p>iOS apps are translocated on macOS because of the possibility of spaces in app names (and in &ldquo;Group Containers&rdquo;). Some iOS apps expect GUID-based names and may not properly escape spaces, hence the translocation, whose name has no spaces.<\/p>\n<\/blockquote>\n\n<p><a href=\"https:\/\/eclecticlight.co\/2021\/04\/19\/ios-apps-are-translocated-when-run-in-macos\/#comment-60078\">Pico<\/a>:<\/p>\n<blockquote cite=\"https:\/\/eclecticlight.co\/2021\/04\/19\/ios-apps-are-translocated-when-run-in-macos\/#comment-60078\">\n<p>[Another]\/related factor is that <a href=\"https:\/\/developer.apple.com\/videos\/play\/wwdc2020\/102\/\">the user could rename the apps<\/a>, which is something that isn&rsquo;t allowed or accounted for when run on iOS.<\/p>\n<\/blockquote>\n\n<p>Previously:<\/p>\n<ul>\n<li><a href=\"https:\/\/mjtsai.com\/blog\/2023\/05\/10\/app-translocation-in-ventura\/\">App Translocation in Ventura<\/a><\/li>\n<li><a href=\"https:\/\/mjtsai.com\/blog\/2016\/12\/16\/untranslocating-an-app\/\">&ldquo;Untranslocating&rdquo; an App<\/a><\/li>\n<li><a href=\"https:\/\/mjtsai.com\/blog\/2016\/06\/16\/gatekeeper-path-randomization\/\">Gatekeeper Path Randomization<\/a><\/li>\n<\/ul>","protected":false},"excerpt":{"rendered":"<p>Howard Oakley: This article demonstrates that the last of those isn&rsquo;t necessarily true, and what happens when an App Store app ends up being translocated. The combination of an App Store app with a quarantine xattr is a particular problem for users, as those apps are installed direct to their intended final destination, and their [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"apple_news_api_created_at":"2024-05-29T17:59:47Z","apple_news_api_id":"8ee6c705-9dde-45e2-b74b-03117d53bbec","apple_news_api_modified_at":"2024-05-29T17:59:48Z","apple_news_api_revision":"AAAAAAAAAAD\/\/\/\/\/\/\/\/\/\/w==","apple_news_api_share_url":"https:\/\/apple.news\/AjubHBZ3eReK3SwMRfVO77A","apple_news_coverimage":0,"apple_news_coverimage_caption":"","apple_news_is_hidden":false,"apple_news_is_paid":false,"apple_news_is_preview":false,"apple_news_is_sponsored":false,"apple_news_maturity_rating":"","apple_news_metadata":"\"\"","apple_news_pullquote":"","apple_news_pullquote_position":"","apple_news_slug":"","apple_news_sections":"\"\"","apple_news_suppress_video_url":false,"apple_news_use_image_component":false,"footnotes":""},"categories":[2],"tags":[1902,465,2255,30,39,2385,2202],"class_list":["post-43439","post","type-post","status-publish","format-standard","hentry","category-technology","tag-extended-attributes","tag-gatekeeper","tag-ios-apps-on-macos","tag-mac","tag-macappstore","tag-macos-14-sonoma","tag-utm"],"apple_news_notices":[],"_links":{"self":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts\/43439","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/comments?post=43439"}],"version-history":[{"count":1,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts\/43439\/revisions"}],"predecessor-version":[{"id":43440,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts\/43439\/revisions\/43440"}],"wp:attachment":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/media?parent=43439"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/categories?post=43439"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/tags?post=43439"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}