It's not exactly malicious, but weird "we know better than you" behavior like this ultimately drove me away from MacOS as a daily-driver.
These aren't scanned, they're located inside .png image files you can download or generate locally on your computer.
> You're going to be fetching/caching the favicon and framebuffer for the page anyways, there's literally no reason not to get that data at runtime rather than 3 hours later.
No one asked the OS to fetch the favicon/framebuffer. Also, I would prefer the favicon of an image containing a QR code to be a thumbnail of the QR code, not the page it points to. I expect this delay is not a nefarious Little Snitch bypassing tool but a search cache update process that only runs when the computer is very idle. Better to run background tasks lazily than every time you commit an image that might contain a QR code to the filesystem.
In general, these things frustrate me just as much as they did on Windows. I don't want random processes jumping up to use 100% of my CPU for no reason. I can't even count the number of times my Mac gets pinned by mdworker processes running in the background. It's reminiscent of pulling my hair out trying to understand why OneDrive or Edge is pinning one of my cores even though it isn't open.
My overall gripe is this pattern of behavior. I'd rather spend 2-5 seconds waiting for my QR code to load instead of my OS deciding to randomly cache it at some indeterminate point. Maybe other people disagree, though. Us HN users don't really tend to reflect the opinions of Joe Shmoe and his feelings towards modern computing.
...on the other hand, this is the exact same technology Apple lets China use to hunt down their religious and political minorities. Maybe they don't intend harm to Americans, but one thing is for certain; Apple doesn't treat privacy as a human right. If you can live with that, then more power to you.
QR codes? HTTP requests? I’m not sure what technology you’re referring to.
> one thing is for certain; Apple doesn't treat privacy as a human right.
They have put a huge amount of effort into privacy technology; more than any comparable company I can think of. I don’t think your certainty is even remotely justified.
Do you expect your images to be scanned on disk and the links in them to be opened, leaking your ip? What if you do something as simple as screenshot an address bar in a browser? Save a menu QR code?
Now you are sending out traffic, accidentally, with your full ip to random places due to a service Apple inserted that you have no knowledge of.
Do you know every site that has received your ip address?
I think the honest answer to both of these questions has to be no.
Throw that to disk for me so I can map where you are, where you go, when your machine is up and how often your search indexing runs.
I could send you a QR code that I've setup specifically to get your IP address.
facebookexternalhit/1.1 Facebot Twitterbot/1.0
What.
"This is the iMessages app's crawler [...] Apple has chosen to use this useragent in their iMessages app to ensure the unfurling of the URL and the rich preview works more often than not."²
And that's how the pegasus/etc. pwned iPhones
As for the high protection mode - of course that reduces the attack surface.
Or maybe we should group up a massive list of poor decisions into a formal complaint?
Neither of which require, nor to be honest even makes any sense to, go to the URL that the QR code represents.
But I wouldn't be surprised if it fetches URL's in QR codes in order to index the title text associated with the URL for Spotlight. It's not so different from when you text someone a URL in Messages, it automatically shows a title and thumbnail to both parties. Or, if it's just a shared "preview" library used across thumbnails and iMessage.
I'm not sure what to think about it. Previews, smart text, showing URL information on hover, prefetching, indexing, etc. -- it's all pretty standard stuff. On the other hand, it does feel a little weird for previews on a local filesystem to query the internet -- we're totally used to it in e-mail and messaging though. But, I used to keep bookmarks as URL (.url) files. It would seem natural for a thumbnail of the page to show up in Finder (though I don't think it does this?).
As for it being an "attack" to get someone's IP -- seems like that ship has long since sailed, as it's common for any messaging and e-mail client to already show previews. If you need to protect yourself against all of those, you pretty much need to figure out what level of Little Snitch or turning off internet or airgapping is required for your security concerns.