Sloth – A Mac app that shows all open files, directories, sockets, etc.(github.com)
github.com
Sloth – A Mac app that shows all open files, directories, sockets, etc.
https://github.com/sveinbjornt/Sloth
132 comments
Oh wow, thank you!
I'd been poking through them with plain old `sqlite3` and then deserializing all the plist data with something like `pbpaste | xxd -r -p > foo.plist` for examination, but had no idea datasette existed and https://datasette.io/plugins/datasette-bplist#user-content-t... seems like the ticket for browsing these.
For others: all the Caches.db files are the per-process HTTP cache that NSURLRequest/NSURLSession keeps, so if you peek at it you can see (partially) a history of network requests that process has made. Most of them seem to pull feature flag configuration from https://bag.itunes.apple.com/bag.xml, but others do more interesting things.
I'd been poking through them with plain old `sqlite3` and then deserializing all the plist data with something like `pbpaste | xxd -r -p > foo.plist` for examination, but had no idea datasette existed and https://datasette.io/plugins/datasette-bplist#user-content-t... seems like the ticket for browsing these.
For others: all the Caches.db files are the per-process HTTP cache that NSURLRequest/NSURLSession keeps, so if you peek at it you can see (partially) a history of network requests that process has made. Most of them seem to pull feature flag configuration from https://bag.itunes.apple.com/bag.xml, but others do more interesting things.
Example for Photos.app https://medium.com/@mustafaakin/how-to-organize-your-messy-a...
You can also use this for things like exporting your notes and imessage history to plain text.
Didn't know that, had to look into it immediately! Looks like a lot of the stuff in the Notes sqlite file is encrypted, though. Will need to look into this some more, would be nice to make a nice little exporter.
Last I checked it was not encrypted (unless you explicitly asked it to encrypt a note). Just gzipped protobuf data. I wrote an extractor about six years ago, maybe it'll help:
https://github.com/dunhamsteve/notesutils
It seems to still work for text. It looks like it doesn't dump tables anymore, so that bit may have changed (it was pretty convoluted). I think the extraction of drawing information doesn't work anymore, but they provide a fallback PNG file.
I wanted it to be self-contained, so it has a little hand-rolled protobuf decoder and might be a little code-golfy.
https://github.com/dunhamsteve/notesutils
It seems to still work for text. It looks like it doesn't dump tables anymore, so that bit may have changed (it was pretty convoluted). I think the extraction of drawing information doesn't work anymore, but they provide a fallback PNG file.
I wanted it to be self-contained, so it has a little hand-rolled protobuf decoder and might be a little code-golfy.
That's fantastic, thanks for sharing this! I'll give it a spin on the weekend and see what I can get out of it.
Probably find *.etilqs files as well (believe Firefox uses that). It’s sqlite backwards to avoid rampant google hordes descending on the developer.
I think because Core data is SQL lite?
I believe you can choose the kind of store you want for Core Data. (SQL is probably the most popular though.)
You can choose between:
1. XML-based (the entire database is one xml file)
2. SQLite-based
3. Roll your own (by providing an implemention)
#1 is terribly slow for most cases and not publicly available on iOS.
#3 was released early in the ioS lifecycle (iOS 3 or iOS 5, depending which piece we're talking about)
SQL is, for most purposes, the only implementation, except for iTunes which used #1 for a decade after #2 clearly won.
1. XML-based (the entire database is one xml file)
2. SQLite-based
3. Roll your own (by providing an implemention)
#1 is terribly slow for most cases and not publicly available on iOS.
#3 was released early in the ioS lifecycle (iOS 3 or iOS 5, depending which piece we're talking about)
SQL is, for most purposes, the only implementation, except for iTunes which used #1 for a decade after #2 clearly won.
iTunes uses a proprietary database format IIRC, but keeps a copy of it in XML on the side so other people can read it if they want.
Ah, yes, nothing like running an unaudited application as root for security! Especially love the part where the developer signs with a 1024-bit DSA key and then uses ssh as root to deploy to a public webserver the sparkle updates:
> scp SlothAppcast.xml [email protected]:/www/sveinbjorn/html/files/appcasts/SlothAppcast.xml
The references to "Mac OS X" (now over 10 years old) are the cherry on top.
> scp SlothAppcast.xml [email protected]:/www/sveinbjorn/html/files/appcasts/SlothAppcast.xml
The references to "Mac OS X" (now over 10 years old) are the cherry on top.
Are there obvious or latent vulnerabilities present in the app that needs to be called out so that devs can take precautions?
Also, mind sharing where you found this information about the public server bit?
Also, mind sharing where you found this information about the public server bit?
https://github.com/sveinbjornt/Sloth/blob/master/sparkle/upd...
I haven't reviewed obj-c code in over a decade, but I do know anything running with root authorization needs to be scrutinized carefully. And seeing blocks of code copy-pasted from stackoverflow, references to a 10 year old operating system, use of SIGKILL instead of the proper SIGTERM, for example, does not exactly inspire the necessary confidence.
I haven't reviewed obj-c code in over a decade, but I do know anything running with root authorization needs to be scrutinized carefully. And seeing blocks of code copy-pasted from stackoverflow, references to a 10 year old operating system, use of SIGKILL instead of the proper SIGTERM, for example, does not exactly inspire the necessary confidence.
Sloth author here. To clarify, Sloth does not run with or require root privileges. However, it allows you to (optionally) run lsof itself with root privileges via Apple's Authorization framework. The application is Developer ID signed, but not notarized by Apple (which is a PITA). I guess it's "unaudited", but the source code is right there for anyone to view, analyze and build from scratch.
Also, I'd be curious to know what "blocks of code copy-pasted from stackoverflow" you found. As far as I know, I wrote all of Sloth myself, starting 19 years ago. As for references to "Mac OS X" in code comments, that seems rather pedantic given that this is very old code and Apple keeps changing the name of their operating system: Mac OS X -> OS X -> macOS.
That being said, thank you for identifying the appcast deployment script, which shouldn't have been in version control to begin with.
Also, I'd be curious to know what "blocks of code copy-pasted from stackoverflow" you found. As far as I know, I wrote all of Sloth myself, starting 19 years ago. As for references to "Mac OS X" in code comments, that seems rather pedantic given that this is very old code and Apple keeps changing the name of their operating system: Mac OS X -> OS X -> macOS.
That being said, thank you for identifying the appcast deployment script, which shouldn't have been in version control to begin with.
Love this, reminds me of the BeOS process controller that permitted killing individual threads IIRC. useful when you need to unfreeze an app without losing your work in that app!
Ref image here:
http://www.lucidelectricdreams.com/2010/10/haiku-remember-wh...
Ref image here:
http://www.lucidelectricdreams.com/2010/10/haiku-remember-wh...
All this time, and BeOS still schools modern operating systems
Something like this should be a standard tool in every operating system no different from a task manager application.
The built-in Activity Monitor in macOS also has the ability to show open descriptors for a process. Double-click a process and go into the "Open Files and Ports" tab.
That leaves lots to be desired
lsof ?
Exactly.
lsof | fzf
lsof | fzf
This is it right here. Works fantastic and its just a pipe of 2 commands.
They also develop an app for that I have used for years to open Burp Suite on Mac called Platypus — https://github.com/sveinbjornt/Platypus
Platypus allows you to create a Mac [dot]app wrapper around any type of scripts.
Platypus allows you to create a Mac [dot]app wrapper around any type of scripts.
Love Platypus, but can I ask how and why do you use burp suite through it instead of installing burp suite on macos normally?
Burp Suite does not create a [dot]app folder, so every time I want to start it I have to open the Terminal and run "java -jar /path/to/burpsuite.jar", which is not a big problem but I very much prefer to press Cmd+Space, quickly type "burp" and then press the Return key to start the Platypus wrapper.
This can also be done using Automator. Application -> Run shellscript
Community edition must be different then? It seems I have a .app folder and I don't remember having to do anything special for that to happen.
I have both community and professional editions installed (trial expired), and would always open via spotlight or the dock shortcut... not sure what's going on with the parent comment's application.
Reminds me of the awesome Gnome2 widgets that were so simple and elegant.
Very cool. One of the things I would love to be able to do is to track all file reads and writes that traverse a network connection. You can kind of do this using a combination of fs_usage/iftop/lsof in the moment but it's rough. Can Sloth or something like little snitch do it?
Sometimes I'll see my network spike via menumeters but I have no idea what caused it. Was it Google drive syncing something? Something else? What files were accessed?
Sometimes I'll see my network spike via menumeters but I have no idea what caused it. Was it Google drive syncing something? Something else? What files were accessed?
This is one of those no-brainer features that really should ship by default with any machine.
As it happens, there are GUIs that kinda do this, though not intentionally. Charles Proxy comes close, though the interface was a bit rough the last time I used it (2016).
As it happens, there are GUIs that kinda do this, though not intentionally. Charles Proxy comes close, though the interface was a bit rough the last time I used it (2016).
Not quite what you were describing, but perhaps Netiquette [0] would be of help here?
[0] https://objective-see.org/products/netiquette.html
[0] https://objective-see.org/products/netiquette.html
Cool app, is this essentially a visual representation of the ‘lsof’ command?
I believe you're correct according to the linked Github repo:
> Sloth is essentially a friendly, exploratory graphical user interface built on top of the lsof command line tool. The output of lsof is parsed and shown in a sortable, searchable outline view with all sorts of convenient additional functionality.
> Sloth is essentially a friendly, exploratory graphical user interface built on top of the lsof command line tool. The output of lsof is parsed and shown in a sortable, searchable outline view with all sorts of convenient additional functionality.
[deleted]
Name probably comes from rearranging the letters (slof)
They should have rolled with “Slof” and use the “f” as a phonetic writing of “th”
BSD userland has fstat. Arguably no need for lsof but I guess some people might prefer lsof.
> Nice GUI for lsof.
Yep!
Yep!
This was my exact thought too. How is it any different from it?
It’s says on their page it’s a GUI for lsof.
There should be more GUI's for the command line tools, imho. Imagine if we could get a parsable json from the cmd line tools that allows for a standard UI to be built ..
There's a cli/python utility called jc, which can parse some cmd line tool outputs (including lsof) and convert them to JSON (can also convert many file formats to JSON..)
https://kellyjonbrazil.github.io/jc/
https://kellyjonbrazil.github.io/jc/
Would be nice to have a dedicated "ports" view as this is what I most commonly use lsof for.
I wish there was a way to see which files were being actively written to sorted by amount of data written. Various times I've seen my disk space rapidly dwindling with no way of know what file was responsible..
If you'd rather spend some of your time than your money on this, you can use the built-in fs_usage terminal command and filter its output (e.g. with grep). Works even with SIP enabled, but will then obviously only return information that SIP doesn't cover.
More info:
More info:
man fs_usage
sudo fs_usage -ew -f pathnameI used this incantation in the past to get the hottest file paths
$ sudo fs_usage -w -t 5 -f filesys | tee fs_usage.log | egrep -o '(/.+?) {3}' | sed -e 's/\/dev\/disk[^ ]+ //' | sort | uniq -c | sort -nr
I'm going to start calling command line commands "incantations"
I think you might enjoy this poster then: https://www.reddit.com/r/linux/comments/ifmoua/ive_finally_f...
Have a look at the writings on the books, the pots, etc, in that picture and I think you will see what I mean ;)
You might have to open the picture on a laptop or desktop computer to get a good look at it. On mobile it might be more difficult to see it proper.
It’s my favorite poster that I have ever seen. One of these days I will get myself a nice physical copy of it.
Have a look at the writings on the books, the pots, etc, in that picture and I think you will see what I mean ;)
You might have to open the picture on a laptop or desktop computer to get a good look at it. On mobile it might be more difficult to see it proper.
It’s my favorite poster that I have ever seen. One of these days I will get myself a nice physical copy of it.
And as (American?) English speakers tend to abbreviate almost everything ("app", "fridge" ...) we might end at "cantos" then.
https://en.wikipedia.org/wiki/Canto ... I'm currently reading Dan Simmons' Hyperion/Endymion again, which might have pushed that into my mind.
https://en.wikipedia.org/wiki/Canto ... I'm currently reading Dan Simmons' Hyperion/Endymion again, which might have pushed that into my mind.
FSMonitor[0] is similar to the old FileMon[1] but for macOS.
In the default tree view, as new data is written, the entries are highlighted and sort of throb, so it's easy to track what's going on.
[0] https://fsmonitor.com/
[1] https://learn.microsoft.com/en-us/sysinternals/downloads/fil...
In the default tree view, as new data is written, the entries are highlighted and sort of throb, so it's easy to track what's going on.
[0] https://fsmonitor.com/
[1] https://learn.microsoft.com/en-us/sysinternals/downloads/fil...
On Linux, this can be done using BPF (Berkley Packet Filter). In fact there is a tool in BCC[0] called filetop, which lists reads/writes by process and file[1].
0. https://github.com/iovisor/bcc
1. https://github.com/iovisor/bcc/blob/master/tools/filetop.py
0. https://github.com/iovisor/bcc
1. https://github.com/iovisor/bcc/blob/master/tools/filetop.py
Activity monitor shows what’s being written and the accumulative R/W by process. Wouldn’t be too hard to look at lsof and figure it out.
Happened to me this morning, something filled up my drive in minutes. I used dust[1] to look for large files while it was happening but knowing what was doing it would've been a big help.
[1] https://github.com/bootandy/dust
[1] https://github.com/bootandy/dust
Not sure you can do that 100% of the time, since programs can write to unlinked files and I'm not sure those remember what their paths were.
Check out rwsnoop, included in macOS. It use Dtrace to trace the read/write syscalls. You need to turn off SIP for Dtrace though afaik.
[deleted]
iotop ?
[deleted]
This is the beauty of a non-walled-garden, general-purpose computer. I really hope that Apple keeps macOS this way, and doesn't try to close it off like iOS. There are many worrisome trends...
macOS is already a walled garden in many ways
This is definitely something that benefits from a UI. I can always `lsof` and `fzf` my way to it, but this helps. Thanks.
I guess that I'm not the target audience for this - I like grep as UI on top of lsof, maybe in combination with less, and I've always found it fast and easy to use.
For people that are the target audience of this, I'm curious - what do you like about putting the information into a gui and using a mouse instead of a keyboard?
For people that are the target audience of this, I'm curious - what do you like about putting the information into a gui and using a mouse instead of a keyboard?
>what do you like about putting the information into a gui and using a mouse instead of a keyboard?
I don't have to remember anything to use it, I just click self-explaining buttons and the thing works. The search function is also very nice, and navigating an outline view with the arrow keys, quickly collapsing subtrees as needed, is a very useful tool. Also, drag and drop.
I don't have to remember anything to use it, I just click self-explaining buttons and the thing works. The search function is also very nice, and navigating an outline view with the arrow keys, quickly collapsing subtrees as needed, is a very useful tool. Also, drag and drop.
For guis in general, I like how the actions available to me are much easier to learn, and therefore use. The information conveyed through the layout often provides context for related actions.
In my experience, CLIs are great for efficiency, if I am doing a task so often that it becomes rote behavior and learning the tool is no longer helpful, or if I want to automate it. I find my real world need for either of these to be relatively slim, but I am not surprised that it is common for others.
In my experience, CLIs are great for efficiency, if I am doing a task so often that it becomes rote behavior and learning the tool is no longer helpful, or if I want to automate it. I find my real world need for either of these to be relatively slim, but I am not surprised that it is common for others.
What do you like about having to remember and execute a series of precise and arcane text commands instead of seeing everying comfortably and accessibly presented to you in a graphical form?
It's ok to like different things - there is no need to attack a different approach. If you find the visual layout comfortable and accessible then thank you for answering the question.
It’s interesting that you found my question to be an attack. Does that mean your question was an attack too?
Speed.
This is awesome! Well done OP!
For those looking for a way to filter open ports, check "IP sockets" and type "listen" in the search bar.
Haven't used them for a while, but IIRC, the combination of lsof (which Sloth is based on) and fuser (including with the -k option) can be useful.
In fact I first found lsof when working on HP-UX servers. IIRC, it was written by an Indian-named guy who may have worked at HP.
In fact I first found lsof when working on HP-UX servers. IIRC, it was written by an Indian-named guy who may have worked at HP.
Nice desktop UI, simple yet effective!
Looks good from what I see in the screenshots. I'd like to find something similar for Windows.
Sysinternal’s Process Explorer might be what you’re looking for.
https://learn.microsoft.com/en-us/sysinternals/downloads/pro...
Process Monitor ("an advanced monitoring tool for Windows that shows real-time file system, Registry and process/thread activity") may be the closer parallel:
https://learn.microsoft.com/en-us/sysinternals/downloads/pro...
https://learn.microsoft.com/en-us/sysinternals/downloads/pro...
System Informer (formerly Process Hacker) might also have what you're looking for
https://systeminformer.sourceforge.io/
https://systeminformer.sourceforge.io/
Not similar, but look into the Microsoft Powertoys tool for other cool utilities on Windows. There is a Spotlight search tool, OCR text, Zones etc.
As others have said, Sysinternals Process Explorer and Process Monitor.
https://helpdeskgeek.com/windows-10/how-to-use-process-monit...
As others have said, Sysinternals Process Explorer and Process Monitor.
https://helpdeskgeek.com/windows-10/how-to-use-process-monit...
Press Windows+R to show Run, input resmon.exe and hit OK.
The thing you want to google is "sysinternals".
great little app. I had to approve it specifically in System Preferences > Security & Privacy > General because it's not signed, but that's a minor detail.
lsof for linux was awesome when I discovered that.
This is wonderful! Thank you for writing this.
Isn’t this just a glorified lsof?
There's a fine line between glorified and shoulder-standing.
This project gives full credit to the giant it stands upon.
README.md:
> Sloth is essentially a friendly, exploratory graphical user interface built on top of the lsof command line tool. The output of lsof is parsed and shown in a sortable, searchable outline view with all sorts of convenient additional functionality.
This project gives full credit to the giant it stands upon.
README.md:
> Sloth is essentially a friendly, exploratory graphical user interface built on top of the lsof command line tool. The output of lsof is parsed and shown in a sortable, searchable outline view with all sorts of convenient additional functionality.
It’s literally right there in the first line of the description, yes.
What would be the use cases for such tool? If I need to ask, I won’t need it?
[deleted]
what does it do more than 'lsof' in gnu/linux systems?
No offense but the logo looks disgusting.
Posting a reply since there is validity to the terse comment.
I clicked out of curiosity and my trypophobia was definitely triggered. Probably due to the numerous “holes” around the edges of the sloth.
Those who don’t have trypophobia understandably would think it’s ridiculous. But as someone who feels it for whatever reason, it’s totally real.
I clicked out of curiosity and my trypophobia was definitely triggered. Probably due to the numerous “holes” around the edges of the sloth.
Those who don’t have trypophobia understandably would think it’s ridiculous. But as someone who feels it for whatever reason, it’s totally real.
Definitely one of the ugliest looking logos I've seen in a long time
Sharing the sentiment.
The logo looks competently drawn and is better at bigger scales where the details are clearer, but from a distance it caused me a visceral rejection reaction.
A sloth drawn with less fur detail would be simply cute, for instance: https://media.tenor.com/yypYI980ipUAAAAC/sloth-animal.gif
The logo looks competently drawn and is better at bigger scales where the details are clearer, but from a distance it caused me a visceral rejection reaction.
A sloth drawn with less fur detail would be simply cute, for instance: https://media.tenor.com/yypYI980ipUAAAAC/sloth-animal.gif
Disgusting is harsh, but it does look weird. It makes me think of some kind of single-celled organism or maybe an upside down turkey head and neck.
I thought it was a bloodworm at first: https://www.youtube.com/watch?v=o7aM5gU8mFY
Somebody needs Cayce Pollard (https://www.goodreads.com/en/book/show/22320) to have a look.
Somebody needs Cayce Pollard (https://www.goodreads.com/en/book/show/22320) to have a look.
It reminds me of a white grub.
https://extension.entm.purdue.edu/fieldcropsipm/insects/corn....
https://extension.entm.purdue.edu/fieldcropsipm/insects/corn....
Some constructive advice to the author, if they're lurking: "Good" logos economize on details to maximize impression and versatility. Use fewer and simpler shapes to communicate better. Or maybe let an AI tool have at it?
Another note to the author if they see this. I don’t find the logo offensive like the sibling commenters. I love the creative process and wasted days making logos which other people found unpalatable. People have visceral responses to logos for better or worse, which is why logos have become so boring over time - it’s just safer. But I do not hate the sloth
Not sure if it still works, but on macOS previously you could Command-I (Info) on two files, click the icon in one info window (highlighting it), and copy-paste on the other.
Quick fix for ugly app icons.
Quick fix for ugly app icons.
Agreed. The style looks nice and idea clear. But the details make this look unsettling, like early versions of AI generated human faces, resulting in creepy output
As a simple alternative, I had good results using Craiyon with prompts like "cute sloth, company logo, vector art, simple".
[deleted]
One things I envy about the macOS users is how obstinate they are to better macOS for free to Apple. While Linux users with the time tend to just be satisfied with the CLI tools and ignore GUI. At best, you would have a curses app to this.
That’s a rather backhanded compliment, but yes, when you use slick tools on a daily basis there’s a halo effect. Mac developers have, for decades now, taken pride in writing native applications that run well and look clean.
I suspect this also has to do with the presence of a native first-party GUI toolkit and app framework that deeply integrates with the rest of the system.
There are plenty of developers who also take pride in developing native applications on Linux that run well and look good, but from what little I know about GUI app dev, it's harder to do that in a way that runs well and looks good on the wide range of Linux-based systems that exist out there.
There are plenty of developers who also take pride in developing native applications on Linux that run well and look good, but from what little I know about GUI app dev, it's harder to do that in a way that runs well and looks good on the wide range of Linux-based systems that exist out there.
That’s an excellent point, Linux is definitely hampered, but Windows doesn’t seem to have benefited much from having a first-party toolkit and framework.
Windows doesn't have a first-party toolkit and framework. They have a multitude of them, with a new one every few years—each one bringing conflicting philosophies and design patterns.
The fragmentation is almost as bad as on Linux: an admin tool that looks at home alongside Microsoft Management Console will never fit in with the Windows 10 or Windows 11 Settings applications.
The fragmentation is almost as bad as on Linux: an admin tool that looks at home alongside Microsoft Management Console will never fit in with the Windows 10 or Windows 11 Settings applications.
Exactly the problem that Android has compared to iOS. There isn't a "wide range of iOS-based systems" that are different enough that you invent your own way of doing things.
Allows for greater control over your own expression, while having to support many possible platforms.
Allows for greater control over your own expression, while having to support many possible platforms.
What would "first-party" even mean on Linux?
[deleted]
lsof provides this information
> Sloth is essentially a friendly, exploratory graphical user interface built on top of the lsof command line tool. The output of lsof is parsed and shown in a sortable, searchable outline view with all sorts of convenient additional functionality.
Yeah, but I always forget the relevant flags.
man lsof
You seem to have forgotten your usual HN username ;)
If commands and manpages make you angry enough to threaten people online, it's time to take a little break from the Internet.
[deleted]
Try "\.sqlite" too.
This is fun: