Hacker News Reader

Is "last modified" the time of the beginning of the write?

Never even thought of that; I don’t know. I assumed it was when a write was done. Whatever that means, I don’t know either.

Would this mean that fs event based antivirus scanners could be side-stepped by writing a payload to a file and then never closing the handler?

Good point here, I will definitely check this and report back. :)