Odd actions re Espionage 3 within F-Secure's new XFENCE

[desker]

I've been beta testing F-Secure's XFENCE (formerly Little Flocker) and have found that multiple apps including 1Password,  ClamXAV Sentry and Little Snitch all request access to ~/Library/Application Support/Espionage.

What possible need would there be for this?

I'm reluctant to grant such permission without knowing the reason.

Any ideas?

[zsolt]

Hello, you should ask the app devs what do they want with that folder...
The ClamXAV I would understand as it scans the entire disk, but for the rest, no idea, little snitch should not access folders at all, only monitor network traffic and 1Pass should not do anything but it's own stuff, so the question is valid.
Do they try to access other unexpected folders too or they just want Espionage's folder?

Cheers
Zsolt

[desker]

I've just taken a look at the attempts. More than 20 apps have asked for access. Many of them have asked for access to the Espionage folder and no other. Many have asked for access to other folders.

For example, 1Password has asked only for access to this folder and no others. On the other side, Malwarebytes has asked for access to Espionage and four other folders, Google, Firefox, Safari and its own folder. But then that would not be unexpected.

I'd have to say then that no, the apps do not ask for other unexpected folders.

Other requests for the Espionage folder have come from the likes of helpd, mapspushd, ksfetch, parsedc, Posterino, Barsoom, BetterZip and swcd.

Frankly, I can't see any real pattern, the only common item being Espionage.

[zsolt]

Then pick one of the apps, little snitch or 1P and contact their support, let me know what they said.
I had the little flocker for a while too, but without license it was not active all the time, and did not notice these requests, in spite of having both LS and 1P installed.

Thanks for keeping me in the loop
Zsolt

[desker]

I've contacted 1Password. I'll let you know what they say, if and when they get back to me.

Peter

[zsolt]

Thanks Peter,

Zsolt