Howard Oakley (Hacker News): What happens in macOS Ventura is essentially the same until the moment that quarantine is cleared, when macOS now attaches a new extended attribute (xattr) of type com.apple.provenance to the file. This contains an 11-byte binary reference unique to that quarantine event, and may be protected by SIP to make it […]