Quarantine flags first appeared in 2007. This explains how they work, what they do, and the differences between app and document quarantine.
extended attributes
Confused by this on APFS? So you should be, as it’s complicated by features like snapshots, sparse files, and the file system itself. There’s no single figure.
Tired of HFS+? Disenchanted by APFS? Why not copy or back up to a different file system? Here are crocodiles waiting to bite you.
Details the contents of files which are built into Spotlight’s index, its reliance on keys, how apps can perform Spotlight searches, and the three bundled tools for users.
AirDrop is very convenient, but sets the quarantine flag, which can break Apple’s installer apps. Here’s how to remove those flags in a couple of minutes.
Thirty years ago, many Macs were hit by the Wdef virus, which exploited a vulnerability which remains today: it travelled in an extended attribute. Should we be worried now?
So convenient to use – edit them in the Comments: section of Finder’s Get Info dialog. But as reliable as loose scraps of paper, and as easily lost.
Unlike file data, metadata has varying persistence. Some is ephemeral, others sticky. macOS has inbuilt mechanisms for managing the persistence of extended attributes.
Most quarantine flags in your Mac aren’t on apps but documents. Details of how they’re added, what info they contain, and what they do.
All about xattrs: their origin, where they’re stored, how they’re named and typed, how to find and work with them, and their common problems.
The Eclectic Light Company 