<story><title>QR code images in macOS are silently executed in the background hours/days later</title><url>https://twitter.com/simonw/status/1577674380133269504</url></story><parent_chain><item><author>joshstrange</author><text>Other thread on this: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;news.ycombinator.com&amp;#x2F;item?id=33095608&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;news.ycombinator.com&amp;#x2F;item?id=33095608&lt;/a&gt;&lt;p&gt;My comment from there:&lt;p&gt;I&amp;#x27;ll be interested to see if anyone else can reproduce this. I created a request bin [0], then created a QR code pointing at it, then downloaded that QR code. I&amp;#x27;m not sure how often this &amp;quot;image scanning&amp;quot; is supposed to occur but just downloading it didn&amp;#x27;t cause a hit nor did the 10min I waited, nor did using QuickLook, nor opening it Preview, nor scanning it with my iPhone, the only thing that caused a request was clicking on the detected link in my iPhone camera app.
Obviously if this is a background daemon that runs periodically then my test wouldn&amp;#x27;t catch it (unless I got &amp;quot;lucky&amp;quot;) and for a longer-term test I&amp;#x27;d probably want to use something other than request bin. That said request bin says it keeps bins for 48 hours so that might be enough time.&lt;p&gt;[0] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;requestbin.io&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;requestbin.io&amp;#x2F;&lt;/a&gt;</text></item></parent_chain><comment><author>expensive_news</author><text>For what it’s worth I was also unable to reproduce this. I’ve tried scanning but not clicking, AirDropping, iMessage, adding to Photos library, getting the url from Photos library… nothing triggered as a page visit.&lt;p&gt;Relatedly, searching for the url in my photos library does not return the picture as a result, indicating that the scanning is not being used for indexing currently. I was trying to test with other QR codes that I happened to have in my photos library, but every one of them has the website name in the picture.&lt;p&gt;I will keep the files on my computer and continue monitoring but I am becoming very skeptical of the Twitter thread author’s methodology.</text></comment>
<story><title>QR code images in macOS are silently executed in the background hours/days later</title><url>https://twitter.com/simonw/status/1577674380133269504</url></story><parent_chain><item><author>joshstrange</author><text>Other thread on this: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;news.ycombinator.com&amp;#x2F;item?id=33095608&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;news.ycombinator.com&amp;#x2F;item?id=33095608&lt;/a&gt;&lt;p&gt;My comment from there:&lt;p&gt;I&amp;#x27;ll be interested to see if anyone else can reproduce this. I created a request bin [0], then created a QR code pointing at it, then downloaded that QR code. I&amp;#x27;m not sure how often this &amp;quot;image scanning&amp;quot; is supposed to occur but just downloading it didn&amp;#x27;t cause a hit nor did the 10min I waited, nor did using QuickLook, nor opening it Preview, nor scanning it with my iPhone, the only thing that caused a request was clicking on the detected link in my iPhone camera app.
Obviously if this is a background daemon that runs periodically then my test wouldn&amp;#x27;t catch it (unless I got &amp;quot;lucky&amp;quot;) and for a longer-term test I&amp;#x27;d probably want to use something other than request bin. That said request bin says it keeps bins for 48 hours so that might be enough time.&lt;p&gt;[0] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;requestbin.io&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;requestbin.io&amp;#x2F;&lt;/a&gt;</text></item></parent_chain><comment><author>bobviolier</author><text>The original twitter threads talks about &amp;quot;a couple of days ago&amp;quot;.. so that it didn&amp;#x27;t do it in 10 minutes, is not that surprising. Also not sure if your 48 hours will be enough if I go from the original thread from the person who found the issue.</text></comment>