Checking Mac profiles, plists and .DS_Store files

Macs are configured by files most people never open: profiles that change security settings, property lists that hold every app’s preferences and every background job, and hidden .DS_Store files in every folder. These tools read and write them in your browser.

1. Before installing a profile

Someone asks you to install a .mobileconfig file for Wi-Fi, a VPN or work email. Open it first in the Configuration Profile Viewer. The list at the top picks out what matters, worst first:

• A root certificate, which can vouch for any website, so its owner could read your encrypted traffic.
• Device management (MDM) enrolment, and what the server could then do to the Mac.
• Proxies, DNS settings, VPNs and content filters that route your traffic elsewhere.
• Apps given privacy permissions without asking, and profiles that ask not to be removed.

A signed profile is checked against its signature, but that only shows it hasn’t changed since it was signed, not that the signer is trustworthy.

2. Read a property list

Preferences, app settings and profiles are property lists. Open one in Plist ⇄ JSON, or drop it on the page, to read it as JSON; most preferences in ~/Library/Preferences are binary, and it reads those too. To write one, edit the XML or JSON and convert it the other way.

To see what runs in the background, look in ~/Library/LaunchAgents and /Library/LaunchAgents (⌘⇧G in the Finder goes to a folder). Each plist there is a launchd job: Program or ProgramArguments is what it runs, and RunAtLoad, StartInterval or StartCalendarInterval say when. When it runs a program rather than a script, choose that file (⌘⇧G and its path) in the Mach-O Inspector to see who signed it and their team ID, or that it isn’t signed at all. To make a job of your own, see Customising your Mac.

3. What a .DS_Store gives away

Finder leaves a .DS_Store in folders it shows, and they end up in ZIPs, on shared drives and on web servers. Drop one on the .DS_Store Viewer to see the names of files and folders it records, which can include some that have since been deleted or renamed, or that weren’t meant to be shared. Press ⌘⇧. in a file dialog to show hidden files so you can choose it. The tool gives the command to stop Finder writing them on network drives.