Sloth – A Mac app that shows all open files, directories, sockets, etc. | Hacker News Reader

Sloth – A Mac app that shows all open files, directories, sockets, etc.

github.com

787 pointskruuuder124 comments

Opening this and then searching for "\.db$" reveals all of the processes that are (probably) using SQLite, which is fun for finding things you can poke around in.

Try "\.sqlite" too.

This is fun:

    brew install datasette
    datasette ~/Library/Calendars/Calendar.sqlitedb

I think because Core data is SQL lite?

Yup - as a result, there's usually a TON of interesting SQLite files on any Mac (and iPhone too if you can get at them).

Sometimes you can pull the phone ones out of backups. You used to be able to mount an application's full directory tree, but Apple killed that API years ago.

I believe you can choose the kind of store you want for Core Data. (SQL is probably the most popular though.)

You can choose between:

1. XML-based (the entire database is one xml file)

2. SQLite-based

3. Roll your own (by providing an implemention)

#1 is terribly slow for most cases and not publicly available on iOS.

#3 was released early in the ioS lifecycle (iOS 3 or iOS 5, depending which piece we're talking about)

SQL is, for most purposes, the only implementation, except for iTunes which used #1 for a decade after #2 clearly won.

iTunes uses a proprietary database format IIRC, but keeps a copy of it in XML on the side so other people can read it if they want.

Example for Photos.app https://medium.com/@mustafaakin/how-to-organize-your-messy-a...

You can also use this for things like exporting your notes and imessage history to plain text.

Didn't know that, had to look into it immediately! Looks like a lot of the stuff in the Notes sqlite file is encrypted, though. Will need to look into this some more, would be nice to make a nice little exporter.

Last I checked it was not encrypted (unless you explicitly asked it to encrypt a note). Just gzipped protobuf data. I wrote an extractor about six years ago, maybe it'll help:

https://github.com/dunhamsteve/notesutils

It seems to still work for text. It looks like it doesn't dump tables anymore, so that bit may have changed (it was pretty convoluted). I think the extraction of drawing information doesn't work anymore, but they provide a fallback PNG file.

I wanted it to be self-contained, so it has a little hand-rolled protobuf decoder and might be a little code-golfy.

That's fantastic, thanks for sharing this! I'll give it a spin on the weekend and see what I can get out of it.

Probably find *.etilqs files as well (believe Firefox uses that). It’s sqlite backwards to avoid rampant google hordes descending on the developer.

Oh wow, thank you!

I'd been poking through them with plain old `sqlite3` and then deserializing all the plist data with something like `pbpaste | xxd -r -p > foo.plist` for examination, but had no idea datasette existed and https://datasette.io/plugins/datasette-bplist#user-content-t... seems like the ticket for browsing these.

For others: all the Caches.db files are the per-process HTTP cache that NSURLRequest/NSURLSession keeps, so if you peek at it you can see (partially) a history of network requests that process has made. Most of them seem to pull feature flag configuration from https://bag.itunes.apple.com/bag.xml, but others do more interesting things.

Ah, yes, nothing like running an unaudited application as root for security! Especially love the part where the developer signs with a 1024-bit DSA key and then uses ssh as root to deploy to a public webserver the sparkle updates:

> scp SlothAppcast.xml root@sveinbjorn.org:/www/sveinbjorn/html/files/appcasts/SlothAppcast.xml

The references to "Mac OS X" (now over 10 years old) are the cherry on top.

Are there obvious or latent vulnerabilities present in the app that needs to be called out so that devs can take precautions?

Also, mind sharing where you found this information about the public server bit?

https://github.com/sveinbjornt/Sloth/blob/master/sparkle/upd...

I haven't reviewed obj-c code in over a decade, but I do know anything running with root authorization needs to be scrutinized carefully. And seeing blocks of code copy-pasted from stackoverflow, references to a 10 year old operating system, use of SIGKILL instead of the proper SIGTERM, for example, does not exactly inspire the necessary confidence.

Sloth author here. To clarify, Sloth does not run with or require root privileges. However, it allows you to (optionally) run lsof itself with root privileges via Apple's Authorization framework. The application is Developer ID signed, but not notarized by Apple (which is a PITA). I guess it's "unaudited", but the source code is right there for anyone to view, analyze and build from scratch.

Also, I'd be curious to know what "blocks of code copy-pasted from stackoverflow" you found. As far as I know, I wrote all of Sloth myself, starting 19 years ago. As for references to "Mac OS X" in code comments, that seems rather pedantic given that this is very old code and Apple keeps changing the name of their operating system: Mac OS X -> OS X -> macOS.

That being said, thank you for identifying the appcast deployment script, which shouldn't have been in version control to begin with.

Love this, reminds me of the BeOS process controller that permitted killing individual threads IIRC. useful when you need to unfreeze an app without losing your work in that app!

Ref image here:

http://www.lucidelectricdreams.com/2010/10/haiku-remember-wh...

All this time, and BeOS still schools modern operating systems

Something like this should be a standard tool in every operating system no different from a task manager application.

lsof ?

Exactly.

lsof | fzf

This is it right here. Works fantastic and its just a pipe of 2 commands.

The built-in Activity Monitor in macOS also has the ability to show open descriptors for a process. Double-click a process and go into the "Open Files and Ports" tab.

That leaves lots to be desired

They also develop an app for that I have used for years to open Burp Suite on Mac called Platypus — https://github.com/sveinbjornt/Platypus

Platypus allows you to create a Mac [dot]app wrapper around any type of scripts.

Love Platypus, but can I ask how and why do you use burp suite through it instead of installing burp suite on macos normally?

Burp Suite does not create a [dot]app folder, so every time I want to start it I have to open the Terminal and run "java -jar /path/to/burpsuite.jar", which is not a big problem but I very much prefer to press Cmd+Space, quickly type "burp" and then press the Return key to start the Platypus wrapper.

This can also be done using Automator. Application -> Run shellscript

Community edition must be different then? It seems I have a .app folder and I don't remember having to do anything special for that to happen.

I have both community and professional editions installed (trial expired), and would always open via spotlight or the dock shortcut... not sure what's going on with the parent comment's application.

Reminds me of the awesome Gnome2 widgets that were so simple and elegant.

Very cool. One of the things I would love to be able to do is to track all file reads and writes that traverse a network connection. You can kind of do this using a combination of fs_usage/iftop/lsof in the moment but it's rough. Can Sloth or something like little snitch do it?

Sometimes I'll see my network spike via menumeters but I have no idea what caused it. Was it Google drive syncing something? Something else? What files were accessed?

This is one of those no-brainer features that really should ship by default with any machine.

As it happens, there are GUIs that kinda do this, though not intentionally. Charles Proxy comes close, though the interface was a bit rough the last time I used it (2016).

Does istat menus not show this? Is it just not detailed enough? I guess some stuff like backups show up under “kernel”…

Charles Web Proxy will still feel a bit like 2016, not that much changed unter last few years. But it still works and does all the things it needs.

Not quite what you were describing, but perhaps Netiquette [0] would be of help here?

[0] https://objective-see.org/products/netiquette.html

Cool app, is this essentially a visual representation of the ‘lsof’ command?

This was my exact thought too. How is it any different from it?

It’s says on their page it’s a GUI for lsof.

There should be more GUI's for the command line tools, imho. Imagine if we could get a parsable json from the cmd line tools that allows for a standard UI to be built ..

There's a cli/python utility called jc, which can parse some cmd line tool outputs (including lsof) and convert them to JSON (can also convert many file formats to JSON..)

https://kellyjonbrazil.github.io/jc/

> Nice GUI for lsof.

Yep!

Name probably comes from rearranging the letters (slof)

I believe you're correct according to the linked Github repo:

> Sloth is essentially a friendly, exploratory graphical user interface built on top of the lsof command line tool. The output of lsof is parsed and shown in a sortable, searchable outline view with all sorts of convenient additional functionality.

They should have rolled with “Slof” and use the “f” as a phonetic writing of “th”

BSD userland has fstat. Arguably no need for lsof but I guess some people might prefer lsof.

Would be nice to have a dedicated "ports" view as this is what I most commonly use lsof for.

I wish there was a way to see which files were being actively written to sorted by amount of data written. Various times I've seen my disk space rapidly dwindling with no way of know what file was responsible..

Activity monitor shows what’s being written and the accumulative R/W by process. Wouldn’t be too hard to look at lsof and figure it out.

FSMonitor[0] is similar to the old FileMon[1] but for macOS.

In the default tree view, as new data is written, the entries are highlighted and sort of throb, so it's easy to track what's going on.

[0] https://fsmonitor.com/

[1] https://learn.microsoft.com/en-us/sysinternals/downloads/fil...

Check out rwsnoop, included in macOS. It use Dtrace to trace the read/write syscalls. You need to turn off SIP for Dtrace though afaik.

Happened to me this morning, something filled up my drive in minutes. I used dust[1] to look for large files while it was happening but knowing what was doing it would've been a big help.

[1] https://github.com/bootandy/dust

If you'd rather spend some of your time than your money on this, you can use the built-in fs_usage terminal command and filter its output (e.g. with grep). Works even with SIP enabled, but will then obviously only return information that SIP doesn't cover.

More info:

  man fs_usage

Example showing pathname-only events but otherwise unfiltered:

  sudo fs_usage -ew -f pathname

I used this incantation in the past to get the hottest file paths

  $ sudo fs_usage -w -t 5 -f filesys | tee fs_usage.log | egrep -o '(/.+?) {3}' | sed -e 's/\/dev\/disk[^ ]+  //' | sort | uniq -c | sort -nr

From https://www.jakobstoeck.de/2017/ramdisk-for-faster-applicati...

I'm going to start calling command line commands "incantations"

I think you might enjoy this poster then: https://www.reddit.com/r/linux/comments/ifmoua/ive_finally_f...

Have a look at the writings on the books, the pots, etc, in that picture and I think you will see what I mean ;)

You might have to open the picture on a laptop or desktop computer to get a good look at it. On mobile it might be more difficult to see it proper.

It’s my favorite poster that I have ever seen. One of these days I will get myself a nice physical copy of it.

I have a copy of that poster hanging on my wall!!

Even better!

And as (American?) English speakers tend to abbreviate almost everything ("app", "fridge" ...) we might end at "cantos" then.

https://en.wikipedia.org/wiki/Canto ... I'm currently reading Dan Simmons' Hyperion/Endymion again, which might have pushed that into my mind.

iotop ?

On Linux, this can be done using BPF (Berkley Packet Filter). In fact there is a tool in BCC[0] called filetop, which lists reads/writes by process and file[1].

0. https://github.com/iovisor/bcc

1. https://github.com/iovisor/bcc/blob/master/tools/filetop.py

Not sure you can do that 100% of the time, since programs can write to unlinked files and I'm not sure those remember what their paths were.

This is the beauty of a non-walled-garden, general-purpose computer. I really hope that Apple keeps macOS this way, and doesn't try to close it off like iOS. There are many worrisome trends...

macOS is already a walled garden in many ways

This is definitely something that benefits from a UI. I can always `lsof` and `fzf` my way to it, but this helps. Thanks.

I guess that I'm not the target audience for this - I like grep as UI on top of lsof, maybe in combination with less, and I've always found it fast and easy to use.

For people that are the target audience of this, I'm curious - what do you like about putting the information into a gui and using a mouse instead of a keyboard?

>what do you like about putting the information into a gui and using a mouse instead of a keyboard?

I don't have to remember anything to use it, I just click self-explaining buttons and the thing works. The search function is also very nice, and navigating an outline view with the arrow keys, quickly collapsing subtrees as needed, is a very useful tool. Also, drag and drop.

What do you like about having to remember and execute a series of precise and arcane text commands instead of seeing everying comfortably and accessibly presented to you in a graphical form?

Speed.

It's ok to like different things - there is no need to attack a different approach. If you find the visual layout comfortable and accessible then thank you for answering the question.

It’s interesting that you found my question to be an attack. Does that mean your question was an attack too?

For guis in general, I like how the actions available to me are much easier to learn, and therefore use. The information conveyed through the layout often provides context for related actions.

In my experience, CLIs are great for efficiency, if I am doing a task so often that it becomes rote behavior and learning the tool is no longer helpful, or if I want to automate it. I find my real world need for either of these to be relatively slim, but I am not surprised that it is common for others.

This is awesome! Well done OP!

For those looking for a way to filter open ports, check "IP sockets" and type "listen" in the search bar.

Haven't used them for a while, but IIRC, the combination of lsof (which Sloth is based on) and fuser (including with the -k option) can be useful.

In fact I first found lsof when working on HP-UX servers. IIRC, it was written by an Indian-named guy who may have worked at HP.

Nice desktop UI, simple yet effective!

Looks good from what I see in the screenshots. I'd like to find something similar for Windows.

Sysinternal’s Process Explorer might be what you’re looking for. https://learn.microsoft.com/en-us/sysinternals/downloads/pro...

Process Monitor ("an advanced monitoring tool for Windows that shows real-time file system, Registry and process/thread activity") may be the closer parallel:

https://learn.microsoft.com/en-us/sysinternals/downloads/pro...

The thing you want to google is "sysinternals".

System Informer (formerly Process Hacker) might also have what you're looking for

https://systeminformer.sourceforge.io/

Not similar, but look into the Microsoft Powertoys tool for other cool utilities on Windows. There is a Spotlight search tool, OCR text, Zones etc.

As others have said, Sysinternals Process Explorer and Process Monitor.

https://helpdeskgeek.com/windows-10/how-to-use-process-monit...

Press Windows+R to show Run, input resmon.exe and hit OK.

great little app. I had to approve it specifically in System Preferences > Security & Privacy > General because it's not signed, but that's a minor detail.

lsof for linux was awesome when I discovered that.

This is wonderful! Thank you for writing this.

It would be cool if this was platform independent, since lsof exists on many UNIX-like platforms.

You mean an Electron 'app' that takes 30 Gb of ram? :)

Isn’t this just a glorified lsof?

It’s literally right there in the first line of the description, yes.

There's a fine line between glorified and shoulder-standing.

This project gives full credit to the giant it stands upon.

README.md:

What would be the use cases for such tool? If I need to ask, I won’t need it?

what does it do more than 'lsof' in gnu/linux systems?

No offense but the logo looks disgusting.

Posting a reply since there is validity to the terse comment.

I clicked out of curiosity and my trypophobia was definitely triggered. Probably due to the numerous “holes” around the edges of the sloth.

Those who don’t have trypophobia understandably would think it’s ridiculous. But as someone who feels it for whatever reason, it’s totally real.

I don’t have trypophobia, but the logo reminds me of some sort of hideous alien slug

> Probably due to the numerous “holes” around the edges of the sloth.

Isn't it sort of the point? Since the app is showing you all the ports (i.e. "holes") that are open?

Definitely one of the ugliest looking logos I've seen in a long time

Some constructive advice to the author, if they're lurking: "Good" logos economize on details to maximize impression and versatility. Use fewer and simpler shapes to communicate better. Or maybe let an AI tool have at it?

Another note to the author if they see this. I don’t find the logo offensive like the sibling commenters. I love the creative process and wasted days making logos which other people found unpalatable. People have visceral responses to logos for better or worse, which is why logos have become so boring over time - it’s just safer. But I do not hate the sloth

Agreed. The style looks nice and idea clear. But the details make this look unsettling, like early versions of AI generated human faces, resulting in creepy output

Disgusting is harsh, but it does look weird. It makes me think of some kind of single-celled organism or maybe an upside down turkey head and neck.

I thought it was a bloodworm at first: https://www.youtube.com/watch?v=o7aM5gU8mFY

Somebody needs Cayce Pollard (https://www.goodreads.com/en/book/show/22320) to have a look.

It reminds me of a white grub.

https://extension.entm.purdue.edu/fieldcropsipm/insects/corn....

Sharing the sentiment.

The logo looks competently drawn and is better at bigger scales where the details are clearer, but from a distance it caused me a visceral rejection reaction.

A sloth drawn with less fur detail would be simply cute, for instance: https://media.tenor.com/yypYI980ipUAAAAC/sloth-animal.gif

Not sure if it still works, but on macOS previously you could Command-I (Info) on two files, click the icon in one info window (highlighting it), and copy-paste on the other.

Quick fix for ugly app icons.

As a simple alternative, I had good results using Craiyon with prompts like "cute sloth, company logo, vector art, simple".

One things I envy about the macOS users is how obstinate they are to better macOS for free to Apple. While Linux users with the time tend to just be satisfied with the CLI tools and ignore GUI. At best, you would have a curses app to this.

That’s a rather backhanded compliment, but yes, when you use slick tools on a daily basis there’s a halo effect. Mac developers have, for decades now, taken pride in writing native applications that run well and look clean.

I suspect this also has to do with the presence of a native first-party GUI toolkit and app framework that deeply integrates with the rest of the system.

There are plenty of developers who also take pride in developing native applications on Linux that run well and look good, but from what little I know about GUI app dev, it's harder to do that in a way that runs well and looks good on the wide range of Linux-based systems that exist out there.

That’s an excellent point, Linux is definitely hampered, but Windows doesn’t seem to have benefited much from having a first-party toolkit and framework.

Windows doesn't have a first-party toolkit and framework. They have a multitude of them, with a new one every few years—each one bringing conflicting philosophies and design patterns.

The fragmentation is almost as bad as on Linux: an admin tool that looks at home alongside Microsoft Management Console will never fit in with the Windows 10 or Windows 11 Settings applications.

What would "first-party" even mean on Linux?

Exactly the problem that Android has compared to iOS. There isn't a "wide range of iOS-based systems" that are different enough that you invent your own way of doing things.

Allows for greater control over your own expression, while having to support many possible platforms.

lsof provides this information

Yeah, but I always forget the relevant flags.

man lsof

You seem to have forgotten your usual HN username ;)

If commands and manpages make you angry enough to threaten people online, it's time to take a little break from the Internet.

Gotta love that guy

Right? He is the "man"

Reply on news.ycombinator.com