Re: MacOSX-admin Digest, Vol 90, Issue 11

> Check the mdworker or mds crashlogs for what .importer is instigating the crash. Often you'll find the .importer buried somewhere inside the application package. For example for LibreOffice, right click and click on Show Package Contents, navigate to Library?Spotlight and inside is the OOoSpotlightImporter.mdimporter.
>
> Yank it and embargo it. I throw them in the trash, because if they are crashing mdworker, they are useless. Send the crash logs to the developer. And if you're a developer I'd send the crash log to Apple, esp if this is 10.7.x that you're running. Doesn't matter how crappy the importer file is, mdworker shouldn't be crashing, becoming poorly behaved and not embargoing the importer on its own, IMO.

I smell trouble. Please, someone, tell me that this idea of mine will not work:

1. /Applications can be written to (well, added to) by any user of the system.
2. So a user can create an app in this folder, with a .importer.
3. Said app can be created by scanning the hard drive for a file owned
by a target account, with a dot in the name, that is updated; claim to
be the importer for that file extension.
4. When that file is next updated, mdworker will run your .importer
code as the target user -- account compromised.