Quarantined Safari .webloc Files

Opening a webloc file, for example by double-clicking in Finder, now triggers a Gatekeeper alert in the latest versions of macOS Golden Gate and Tahoe, 27.2 and 26.7.2 respectively, though oddly not in macOS Sequoia 15.8.2. I could not find anything relevant in the macOS 27.2 security release notes, but the document is extremely long and each entry terse, in typical Apple fashion.

I’ve seen this occasionally, over the years, with Web archives and downloaded PDF files, but now it seems to happen with every bookmark file. I’m not sure what the point of it is. These are not even downloaded files; they’re created by the user dragging a link, so presumably it’s not a surprise what the file contains. And if it is a surprise, the alert doesn’t help because it doesn’t show you a preview of the URL that would be opened. A malicious URL would probably hide anything suspicious behind a redirect, anyway.

So how is this actionable? What is the story where Apple thinks a user will accidentally end up with a bad .webloc file and be dissuaded from opening it by this alert? It just seems like pointless friction.

All that opening the file does is open the URL in Safari, which is the same thing that would have happened had you clicked the link in the browser window. What’s next—warnings for those clicks, too? They could market it as a reason to Switch to Safari.

Previously:

参与讨论