ParetoSecurity / pareto-mac

Automatically audit your Mac for basic security hygiene.
https://paretosecurity.com
GNU General Public License v3.0
326 stars 24 forks source link

[Bug]: False positive #136

Closed Robert-M-Muench closed 1 year ago

Robert-M-Muench commented 1 year ago

What happened?

image

Version

Latest

Relevant log output

No response

dmurko commented 1 year ago

Click "Run Checks" - it's been one year since the last check. Which is a different thing we should look into. :)

Robert-M-Muench commented 1 year ago

🫤🙄🫢 ... yes, like re-running it automatically on start. That's what I expected.

dfjs commented 1 year ago

I've also just had a false positive, despite the last check being run minutes before (rather than a year!). Re-running resolved it, but is there something more to this?

e.g. I noticed that there was an update due

image

Let me know if there's any additional info I can share 🙏

dz0ny commented 1 year ago

@dfjs Do you have the app running in the background?

About the update Setapp has a strict rule that it won't update an app once you decline the app or Setapp update. From that point on you have to manually trigger the update from the Setapp by checking for Setapp updates.

dfjs commented 1 year ago

thanks for getting back to me @dz0ny, and yes I have it running in the background.

I don't believe I've declined app updates (Setapp Settings > Updates > Install automatically is checked, and is successfully checking for updates). Would that have a bearing on the false positives?

dfjs commented 1 year ago

Trying to make sure I've not disabled anything on my side, in doing so have just seen that in Setapp's Version info for Pareto, the changelog / version history shows this:

image

Related? (looks like I'm on .62)

dz0ny commented 1 year ago

thanks for getting back to me @dz0ny, and yes I have it running in the background.

I don't believe I've declined app updates (Setapp Settings > Updates > Install automatically is checked, and is successfully checking for updates). Would that have a bearing on the false positives?

What happens if you click on "Check for updates..."

image

This is from their docs https://docs.setapp.com/docs/faq#can-somebody-setapp-or-i-force-users-to-update-setapp-and-consequently-setapp-apps

dfjs commented 1 year ago

@dz0ny yes that triggers the Setapp update flow, I ran this after you got back to me the first time and am updated now. Do you think this should have a bearing on the false positive?

dz0ny commented 1 year ago

@dz0ny yes that triggers the Setapp update flow, I ran this after you got back to me the first time and am updated now. Do you think this should have a bearing on the false positive?

No, since the background operation should happen at least once a day. Can you email the output of paretosecurity://logs to support@paretosecuritry.com?

dz0ny commented 1 year ago

There are a couple of exceptions where macOS would not run the background job, as we use it to schedule the scanning process, however from the logs I don't see the case yet. I will close this issue and reopen it if we get another report.