usr/bin/open what is it? is it safe?

Kenneth Sinchak wrote:

I got a notice about a file called open. When I went to the source it was located at usr/bin/open

Not sure what this is? is it safe? should I remove it? If so, how do I do this?

Any help would be appreciated.

As already said, 'open' is part of every mac system.

The question has to be WHAT is it that is trying to use open at login? Only you can tell us...

FWIW, you can use open at Terminal to er... open something (a file, an application...). For example

open a.pdf

will open the file a.pdf (assuming it exists in the local directory) in Preview (or whatever application is your default to open pdf files).

Or

open -a Skim a.pdf

will open the same file using Skim (a free pdf application), and so on.

Bottom line, open is not the problem, what is to be open may (or may not).

ben-kropf wrote:

This appears to be resolved on 13.2.1

Not for me it isn't. Or for most people. Actually 'open' wasn't even added until I updated to 13.2.1.

On my 14-inch MacBook Pro, with M1 Max chip, the 13.2.1 Ventura update appears to have removed the 'run' item from my background items, just FYI.

It's part of the Apple operating system. What you are experiencing is a really bad idea that Apple rolled out in macOS Ventura. It is confusing lots of people.

Unfortunately, I can't tell you any more. I simply don't know what is running on your machine. Apple knows, but they choose to confuse you instead of simply telling you. Sorry.

You cannot remove /usr/bin/open without disabling security, as it is part of macOS.

You probably can remove whatever is calling /usr/bin/open, but it’s likely some app you’ve installed.

As mentioned above, these messages are less than useful.

Kenneth Sinchak wrote:

Thanks for both of your responses.

I was concerned because when I received the system notice I went to the login items that it referred me to. When I went there it listed "open" and under it it said item from unidentified developer.

That is almost certainly false. The app that “open” is opening is probably correctly signed and identified. It is just an Apple bug, and a really annoying one.

If you run the diagnostic tool Etrecheck, its report will provide information about Login Items, Launch Agents, etc.

You should be able to see exactly in what way the open command is being used.

You are welcome to post the report here. It includes no private information, as you can attest for yourself before posting anything.

Here it is, under the Login Items section of the report:

[Loaded] com.goto.GoToNetworkTest.launch.plist (LogMeIn, Inc. - installed 2023-01-15)

Command: open --wait-apps '~/Applications/GoTo Network Test/GoTo Network Test.app'

So it is something from LogMeIn that calls open to, apparently test the network.

It calls the application in question, and waits until it quits before exiting.

I have not used LogMeIn in years, and had only used the then existing free version.

If this is something that you rely on, I guess it's probably fine, but you may ask them about it.

Not suspicious as such. I would not let Chrome on any of my macs, as it is a shameless resource hog and data siphon... it positively kills Final Cut Pro by hogging the system videotoolbox via its keystone agents, and I suspect that it may also affect iMovie, which you did install. If you find that iMovie is slow or crashing on your amazing Mac Studio, there is your main suspect.

It could be this one too:

[Loaded] com.adobe.ccxprocess.plist (Adobe Inc. - installed 2023-02-14)

Command: /usr/bin/open -a '/Applications/Utilities/Adobe Creative Cloud Experience/CCXProcess/CCXProcess.app'

Regardless, there is nothing suspicious in your report.

Do NOT install any third party antivirus.

Read this excellent post about keeping your mac secure:

Effective defenses against malware and other threats

Kenneth Sinchak wrote:

What do you recommend I do.

FWIW, I left 'open' active. So far, my M1 MacBook Air hasn't blown up. 😎

This appears to be resolved in 13.2.1