Hey y'all, I've been playing around with some queries, and I think the docs for the

xprotect_meta

table might be wrong: https://fleetdm.com/tables/xprotect_meta

min_version

- The minimum allowed plugin version.

But when I query some Macs, I see "com.viewanysearch", which looks pretty sketchy, with its minimum version listed as "any". Should this actually say:

min_version

- The minimum banned plugin version

Maybe better for #macos channel?

Seems like it should be the opposite though, right? I would think "minimum ALLOWED plugin version" If it was a block, I would think "maximum banned version" e.g. if com.anysearch has a vulnerability ≤v4.0.2, then we'd want to allow only versions above that version. (Not ban) But if com.anysearch is inherently something that should be blocked, then it should be banned at any version (and no version should be allowed- not any version)

Apple doesn't document this but people's analysis generally seems to be that this is a blocklist of safari extensions based on known malware. I think the reason for a minimum version is because of some extensions that have started out good but then later introduced malware.

Ah, I see so then

min_version

is actually min_version blocked Looks like it's set for some other random things like flash player and Java:

Since it's not documented, we can only speculate. They don't seem to set any versions for

ExtensionBlacklist

entries (which is where the

anysearch

is). They do set it for

PluginBlacklist

where it might actually be correct as documented.

👍 k, got it. Thanks! I'll unroll all those goodies into the issue so someone can grab it and run with it. If you're a contributor reading this and want to take a pass at updating the docs, feel free to jump in! (You can actually make the edit in the browser on fleetdm.com/tables/xprotect_meta by hitting the "Edit this page" button. For tips on formatting, see the other tables)

Arguably these could be separate tables since it's not sure that the columns apply across all the types.