Com Apple Safari Safebrowsing Service Little Snitch Lyrics
Com Apple Safari Safebrowsing Service Little Snitch Rock

/Library/Preferences/com.apple.Safari.SafeBrowsing.plist:

Oct 12, 2011 Me too. After upgrading to iOS 5 I keep seeing the 'Downloading Safari safe browsing data' message even though neither of my Safaris (on MacBook Pro running on OS X 10.7.2 or iPhone running on iOS 5, with iTunes 10.5) are on Safe Browsing mode. Apr 14, 2012 safari Safe Browsing Service Unavailable? By Richard C. Do you use Little Snitch or some other outbound filtering firewall that might be interfering with the update? Apple MacOS; Safe.

defaults read com.apple.Safari.SafeBrowsing.plist
 {
 SafeBrowsingRemoteConfigurationLastUpdateDate = '2018-09-19 22:43:30 +0000';
 }

Or to wrap this into a command that just displays the last date updated:

defaults read /Users/charles.edge 1/Library/Preferences/com.apple.Safari.SafeBrowsing.plist SafeBrowsingRemoteConfigurationLastUpdateDate | awk ‘{print$1}’

The actual bad stuff file is tricky. A number of temporary dynamic files are stored in /var/folders, and then inside a hierarchy generated by guids for a given system. Here, you’ll find a couple of files, including /var/folders/r1/05ns3cqs0cg5c42x38gk0c0w0000gn/C/com.apple.Safari.SafeBrowsing and /var/folders/8s/s9k75nys3rb399w4fwwtk04h0000gn/C/com.apple.Safari.SafeBrowsing.
These files are binaries and cannot be viewed. They appear to be downloaded via the com.apple.Safari.SafeBrowsing.BrowsingDatabases.Update service routinely. Looking at their date and time stamp though, will give you a good idea of when the last update was run if you care to find that out.

Enable SafeBrowsing via the WarnAboutFraudulentWebsites key in ~/Library/Preferences/com.apple.Safari.plist as can be seen below:

Com Apple Safari Safebrowsing Service Little Snitch Lyrics

This is a tiny investigation of suspisious Mac OS Sierra connections reported by Little Snitch (commonly abbreviated as LS in current context), each section consists of quotes from the discussions in corresponding links. My own comments are marked with italic.

This document covers only recent network activity, for the detailed Mac OS security guide refer https://github.com/drduh/macOS-Security-and-Privacy-Guide

This gist with shell script for just disabling everything is related, though I'd recommend to be very careful with it: https://gist.github.com/pwnsdx/d87b034c4c0210b988040ad2f85a68d3

Few things to know:

To get the list of agents you can run: ls /System/Library/LaunchAgents/

Utility to operate them is called launchctl. To get info about certain service: launchctl list com.apple.whatever

Latest Mac OS versions include the System Integrity Protection (SIP) feature, that is controlled by csrutil util.

By default it restricts unloading system agents, so most launchctl unload commands in old (pre-Maverics) privacy guides will just fail with the following error: Operation not permitted while System Integrity Protection is engaged

Stopping certain deamon in current session is not restricted though:

sudo launchctl stop com.apple.whatever

You can disable SIP on your own risk, details here: https://developer.apple.com/library/content/documentation/Security/Conceptual/System_Integrity_Protection_Guide/ConfiguringSystemIntegrityProtection/ConfiguringSystemIntegrityProtection.html

`akd/gsa`

akd is part of the AuthKit (authentication/authorisation) framework. Also used in the process of authenticating of iCloud and other accounts using Apple ID.

It is used to authenticate the App Store. App Store login fails if you block it.

Looks like it's the one you'll really need to keep in order to get updates automatically.

`apsd`

That is the daemon which arbitrates push notifications and other cloud services.

Note: aspd rule is protected by Little Snitch (they consider it important enough for correct system functionality).

`captiveagent`

A captive portal is a network that forces an HTTP client to see a special web page (usually for authentication purposes) before using the Internet normally. A captive portal turns a Web browser into an authentication device. These are commonly used on wifi networks where authentication to the private network is done via a login browser page, rather than via the use of a WEP or WPA2 key, for example in some coffee shops and airports.

On Apple devices, if a captive portal is identified, a special application in /System/Library/CoreServices called Captive Network Assistant.app is opened. This is a very limited browser, separate to Safari, with no address bar or navigation buttons.

Pretty nice example of how things are messed up nowadays. I disabled it on a wi-fi connected computer and it seemes to be fine, but looks that's the thing to be accurate with, since wrong settings may cause problems with connecting to your own wi-fi networks.

`ckkeyrolld`

Looks like for now nobody is sure what it is:

ckkeyrolld is the system daemon that rolls and verifies encryption metadata.

No clue about what these metadata really are and why they need to be shared with Apple.

ckkeyrolld.plist is related to iCloud encryption I believe.

Soundes like a creepy crap to be disabled. At least if you are not using iCloud (I do not).

`com.apple.Safari.SafeBrowsing.Service`

This database, provided by Google, is used by mobile Safari to check for known malicious web sites.

Google is constantly updating this database, so your iDevice refreshes on every sync.

Suspicious is that OSX sometimes calls the service while Safari is off. But overall this is a useful one.

`gamed`

Obviously this framework is something to do with Apple's Game Centre, which I've only previously come across on iOS. What is it now doing on OSX, given that there seems to be no GUI 'front-end' for it? And how the **** do I disable it?

Definitely to be blocked or turned off.

possible way to disable:

In system settings, you have the panel with the notification center. I removed the game center from there. Hope it helps!

`geod.xpc`

It looks like this service is entirely related to Location Services. Blocking it with Little Snitch (as I have done) and/or disabling it with the launchctl command, will render Location Services inoperable. About the only down side I see to that (for my own usage scenario) is loss of the Find My Mac functionality. Otherwise, I've got no particular reason for apps and system services to be utilising my location. People who travel (across timezones) may find that automatic updating of their timezone and clock will fail.

Locationd is a daemon that provides location services for OS X's 'Core Location'. This uses skyhook technology to figure out your mac's location (using WiFi). It's the same system used by the iPod Touch, and is also used by the iPhone (The iPhone also uses cell tower triangulation and GPS).

Even if you were to process all the geo location aspects on developer.apple.com - it's widely used - far greater than just the Core Location API - https://developer.apple.com/documentation/corelocation.

Com Apple Safari Safebrowsing Service Little Snitch Rock

Weather
Calendar
Address Book
Maps
Siri
iCloud (finding the best data center to route uploads)
Store (which geographic region should your content be)
Time Zone and Night Shift
Safari location

possible way to disable:

Location Services can be turned off in System Settings (and is actually recommended for the desktops, since you'll hardly ever need them). In my case that didn's stop geod.xpc activity though.

`helpd`

helpd is the daemon that's running on your mac that gives you access to the help file