Can't you just right click?

https://lapcatsoftware.com/articles/unsigned.html

1169 739 6 years ago

lucb1e7• 6 years ago

This makes me wonder how open source is supposed to work on macOS. People seem to become more and more aware of it and even enterprises that insisted on support contracts can see that they can't get around open source completely anymore. Meanwhile Apple is removing the ability for me to have a pet project without paying an Apple tax.

If the message were completely transparent, something like "The developer didn't pay $99 for us to do a cursory check on them (or whatever it is that Apple does with that money), are you sure you want to run their software? [Move to trash] [No] [?]", then that would give the user the relevant information to make this decision, but as it is, virtually no mac user will understand what is really going on.

I also can't imagine $100 is easy to come up with in countries below level 4[1]. The OpenStreetMap Foundation recently introduced a way to waive the yearly £15 fee for OSMF membership if you have a certain number of map edits or otherwise contributed to the project. The OSM community seems to be quite diverse, but I can't imagine that Apple computers are less widespread than OpenStreetMap.

[1] https://www.gatesnotes.com/Books/Factfulness#incomegroups

saagarjha57• 6 years ago

Many (often cross-platform) apps are no longer signed, so they throw up this warning–I assume that users of these have long since learned that the warning is just something they need to bypass. macOS-native apps have largely adopted notarization and the fee that comes with it. Open source command line tools do not need to be notarized.

Interestingly enough, it seems to be possible to notarize someone else's app, so perhaps it might be a worthwhile use of my developer ID to provide this service to people I trust but don't want to shell out money…

lucb1e7• 6 years ago

learned that the warning is just something they need to bypass

Note that I'm not necessarily arguing that training people to click "yes, yes, continue..." is a good idea. Digital security is my day job and I totally see why Apple wants digital signatures for software. However, the message is opaque about what is really going on and just tries to scare people into buying "trusted" software rather than using free software: that developer fee doesn't pay itself.

perhaps it might be a worthwhile use of my developer ID to provide this service to people I trust

I was thinking the same, we could pool the money, but figured Apple almost certainly prohibits that "for security".

_qulr16• 6 years ago

It's important to distinguish between Developer ID and notarization. Signing an app is done by the developer. Notarizing the app is done by Apple.

If you check the code signature of a Developer ID signed app, you'll see the developer's name and Team ID from the signing certificate. This guarantees the app was signed by that developer, as long as the developer has kept their private key secure.

First you sign the app, then you upload it to App Store Connect for notarization. It's an "open secret" that Apple has allowed any Apple Developer Program member to submit any app for notarization, even if the app wasn't signed by them. Apple really wanted all apps notarized. Whether Apple will crack down on this practice in the future, who knows.

The notarization "ticket" is signed by Apple, not by the developer. I've heard of developers who discovered that someone else notarized their app. But nobody else can put their "name" on the app except the owner of the Developer ID certificate. If you Developer ID sign someone else's unsigned binary, you're presenting it to the world as your own. But that's not the case with notarization. Nobody except Apple knows who submitted an app for notarization.

stefan_• 6 years ago

It mostly doesn't. That is 20% because of bullshit like this and 80% because Apple deprecates, removes, changes and otherwise encumbers their operating system so much that keeping track of it all is a full-time job.

oneplane4• 6 years ago

Open source projects sign their Apps like anyone else. Works fine.

They do the same on Windows of course and on Linux package managers.

oauea• 6 years ago

Who pays the apple tax?

nextaccountic• 6 years ago

Is there any Linux distribution charging an yearly fee for package signing?

recursive• 6 years ago

In my experience, open source installers for windows are mostly not signed. But windows has a button to let you run them though.

ryandrake• 6 years ago

It seems like the right balance. As the author says:

As a Mac developer, it's nearly impossible to run a viable software business when this is the first-run experience of new customers. You'll never get any new customers! This is why every Mac developer I know signs up for Developer ID and ships only signed, notarized apps. It would be financial suicide to do otherwise.

If you have hung your shingle out to make a profit, then the developer account, signing, notarizing, etc. is a cost of doing business, and you can easily justify it. The more customers you get, the more money you get, so you are motivated to reduce the first-run friction.

If you are not in it for profit, you probably have a lot more tolerance for a little first-run friction, and having users drop out of the funnel. Fewer users does not affect you financially. As a hobbyist programmer, I wouldn't care. I'm just releasing a program--not looking to dominate a market.

lucb1e7• 6 years ago

the developer account, signing, notarizing, etc. is a cost of doing business, and you can easily justify it.

But what if I'm not doing this for profit? Can Nirsoft or Mozilla apply for a waiver? Can I? We may not be looking to dominate the market, but it would be a shame if our work just went to waste because people would rather pay for something crappier that is closed source rather than our free (as in freedom & beer) software.

(Yes, Mozilla is a huge project where it isn't worth employee's time to apply for a waiver, I just needed at least one name that people know is a non-profit software developer as an example.)

KeepFlying3• 6 years ago

I appreciate this view except for the last point. As a hobbyist programmer, I am not "just releasing a program". I am usually "helping solve user's problems". And if my solution requires users to go through even more problems before they can use my tools, that's problematic.

I don't need to many money on my side projects. I do, however, want to help people. If I can't help people on a Mac because of the install friction, then it isn't worth my effort to create a MacOS port of my software at all.

saagarjha57• 6 years ago

I would generally like my open-source software not not be marked as malware.

dddddaviddddd• 6 years ago

There's a segment of open source users who understand these messages and aren't necessarily dissuaded by them. I make an open source app for merging audio files in iTunes/the Music app. The userbase are people who are technical enough to install Homebrew, (generally) use iTunes scripts, and manage Gatekeeper warnings, but not so determined as to replicate the app's functionality with their own set of shell scripts. https://www.davidschlachter.com/misc/trackconcat

xenadu023• 6 years ago

Please note that Apple's linker will automatically ad-hoc sign binaries if you aren't using a signing certificate so there is no impact to package managers or any other forms of building software to run locally. Xcode already automatically opts such software out of GateKeeper checks when built from the UI. Similarly adding Terminal to the Developer Tool category in System Preferences will do the same for anything you run or build there.

I should also note directly launching the binary inside the App bundle from Terminal bypasses the UI dialog. The assumption is you know what you are doing in that case.

wila4• 6 years ago

You can run your own binaries locally because they do not have quarantine flags, not because they are locally signed.

You can also remove quarantine flags from anything you download and after that you don't have the right click option either.

For example:

    xattr -dr com.apple.quarantine ~/Downloads/Absolutely-Not-Malware.dmg

jmull• 6 years ago

I've got to say, I think your proposed message is considerably less clear than the actual one.

E.g., a reader would have to understand the perspective of the developer to even start to guess what that might mean. (Why would a developer pay or not pay $99 to Apple for verification? How do the implications of that affect my decision to run this program?) It would be pretty much meaningless to the average non-developer user.

I agree the price of notarization should be a nominal incremental cost. I don't know if there are many level 3 people doing MacOS development, but if so, there needs to be a cheaper price for them. (The numbers of level 1 and 2 MacOS developers must be practically nothing.)

usrusr3• 6 years ago

Could that be turned into a little funding opportunity?

"Here are the sources, here are the binaries, here you subscribe to get access to signed binaries that run without the scare quotes"

_qulr16• 6 years ago

The developer who signs the software is thereby taking legal responsibility for the software, and taking the blame if anything is wrong with it. That's not a good risk unless you're signing for someone you trust completely.

csande17• 6 years ago

I've seen a couple projects do this by publishing a Mac App Store version. Completely identical to the open source release, but it pays the Apple tax to run without warnings, and it gets App Store-powered auto updates.

m4635• 6 years ago

I remember RMS saying that the GPL was updated because one "obvious" freedom was not so obvious -- you could meet all the requirements of the GPL, without giving the right to RUN the software.

GPL3 allows that. And looking backwards, apple shipped software that was GPL2, but would not ship software that was GPL3. As one example, bash and make all quietly stopped getting updates from apple when the GPL3 versions came out. (although apple sort of broke GPL with bash as it never shipped all the source for it -- missing the header file rootless.h)

One other point about these dialogs + the help message. You are required to contact apple to even see this online help. Apple deals itself into the equation no matter what.

Something1234• 6 years ago

What's in rootless.h?

cel1ne• 6 years ago

AFAIK, you don't have to ship the source to be GPL-compliant, you just have to provide it upon request.

diminish• 6 years ago

as an ex-apple employee and long time developer, glad people start to see apple is an open source foo creating prisons of software to lure the obsessive brand fanatics and get a fee selling them as users to the other parties.

- in apple tech, the users are volunteer products where servicing them gets a myriad of monetization, notarization etc.

- hope open source starts to ignore apple platforms as a target at some point. Being "*nixy" and presence of "brew" etc gave the false impression apple is in the open source camp.

HappyDreamer2• 6 years ago

required to contact apple to even see this online help.

What's that about? The "macOS User Guide" is available online only?

bonzini2• 6 years ago

rootless.h is a missing system header, not a missing part of the Bash sources (the function it declares is part of libSystem.dylib; it is not part of bash). So leaving it out falls under the system library exception and does not violate the GPL.

_qulr16• 6 years ago

In addition to paying the Apple Developer Program fee, you as an open source or hobbyist developer are required to sign a legal contract with Apple in order to be able to code sign your software. This can be even more problematic than the fee.

jyrkesh• 6 years ago

In my day job, I work on a relatively large open-source non-GUI application

macOS is becoming an increasingly difficult platform on which to release software. We're going down the notarization rabbit hole (which is a nightmare), but given that we don't fit on the App Store, it's very obvious that Apple doesn't want us on the platform.

My suspicion is that they will eventually charge $$$ for a "developer unlock" on Apple Silicon, a move that I think will make both Windows and Linux look increasingly attractive to developers.

baq• 6 years ago

Microsoft with WSL2 is pretty much ready to go for the jugular IMHO.

dasKrokodil• 6 years ago

If developers move from Apple to Windows because of this, they haven't learned from their mistakes.

GnarfGnarf3• 6 years ago

I agree. Coming from Windows, preparing an installer for macOS is insanely complicated, a huge consumption of developer time.

Abishek_Muthian3• 6 years ago

Apple is an aspiration selling company.

>I also can't imagine $100 is easy to come up with in countries below level 4[1]

Someone who is developing for Apple platform in specific, has already spent ~$1000 in devices. Say they couldn't afford to build explicitly for Apple[1], they instead develop for web using a Raspberry Pi and try to leverage smartphone capabilities using PWAs; Alas Apple throws in hurdles there as well so that your PWA doesn't function properly on Apple devices[2].

I get it, perhaps this is part of Apple's aspiration i.e. 'You should deserve to be part of the Apple ecosystem' which is enticing to its customers.

But what's overwhelming to me is, Apple's blatant hypocrisy.

Exihibit -1: Data

Apple calls Google by name, questioning its business model around data and proudly calims 'they chose not to do business with data'.

Then why does Apple advertise its products using Google Ads?

So, it's like 'I will call out dirty work, but I will use the results of that dirty work for my own advantage'.

Exihibit -2 : Values

Apple claims itself to be the beacon of human rights.

a. We know Apple was included among list of other companies supplying user data for snooping in the documents highly regarded to be genuine.

b. We know Apple actively cooperates with an autocratic regime and its highly publicised 'Privacy features' isn't applicable there. But, Apple never includes 'USA only' when it advertises it's 'Privacy'. More over when confronted with proof of Apple's platform being actively used for exploitation of minorities, it outright downplayed/dismissed the impact of it.

[2]https://ionicframework.com/blog/is-apple-trying-to-kill-pwas...

Gorbzel• 6 years ago

PWAs are terrible, but that debate has nothing on the real gem here:

...Then why does Apple advertise its products using Google Ads?

Congratulations, this cracks top 5 oddest Apple hater argument ever posted in this land of many of 'em.

gonzo41• 6 years ago

You forgot about your Apple watch and phone being made by tiny human slave robots in china.

onion2k• 6 years ago

Someone who is developing for Apple platform in specific, has already spent ~$1000 in devices.

Ignoring the fact someone might have been given a Mac by someone else, or bought one second-hand for less, or that they might be working on a computer they don't own themselves, why is it that someone who can afford $1000 for a Mac can automatically afford another $100? Surely there has to be an amount that you assume they can't afford, right? If they can afford 10% more then why not 15%? Or 20% or 100%?

You're applying a sort of reverse of Zeno's Arrow[1] to affordability, and I think shows a distinct lack of understanding of how money works when you don't have all that much of it.

[1] https://en.wikipedia.org/wiki/Zeno%27s_paradoxes#Arrow_parad...

thinkloop2• 6 years ago

or whatever it is that Apple does with that money

What they primarily "do" is have an identity to sue or pursue in case of issues. That keeps everyone in line.

teekert• 6 years ago

Aren't the new ARM macs going to support Docker in a nice way? Wouldn't that solve it? You can have what you want in your Docker, Apple can do whatever it wants (short of blocking the Dockers essential capabilities of course) to isolate said Docker.

saagarjha57• 6 years ago

But then you have to use Docker. It’s be nice to have something like that on iOS where it’d be an improvement, but on macOS, it’s a step down in a sense.

Cthulhu_4• 6 years ago

Like all other legitimate software on MacOS; they get a developer account and distribute it via the app store.

For years, Windows got laughed at by EVERYONE because there was so much malware on it - in part because of its laissez-faire approach to letting the user install anything from anywhere.

Mac went for the closed garden approach and there's hardly any malware, adware, scareware or whatever -ware you can think of on the platform, which is one of the reasons why Mac is safer and considered to have a better user experience.

Curation is not a bad thing. And if an open source application wants to become popular for the masses - not the HN power user crowd, which represents only a small percentage of potential customers - they have to conform to its rules.

Likewise, they will want to be available through the Windows store as well.

Using the tools and platforms offered by the OS developers is the lowest friction option for installing software.

As for poorer people and countries, isn't this where the open source charities come in? Isn't this where the big FAANGs - including Apple - and the investors and everyone that earned billions off of software should come in? I mean come on, it's only $99.

classics22• 6 years ago

And yet people would vomit blood being asked to pay $99 for an app.

bromuro• 6 years ago

As you say it already worked great for preventing malware. No reason to make changes like they are doing.

mih• 6 years ago

... in part because of its laissez-faire approach to letting the user install anything from anywhere.

This comment makes it seem like installing software outside of a curated store is responsible for security issues, but this is exactly what Linux and other like OSes do. You can install apps from anywhere and I'll wager you'll find less malware, adware etc. for them in the wild, than the Mac. Granted usage of these platforms as a Desktop is way lower making it a less attractive target for bad actors, but much of it owes to inherent OS design.

And if an open source application wants to become popular for the masses - not the HN power user crowd, which represents only a small percentage of potential customers - they have to conform to its rules.

Open source applications have been popular with the masses way before the curated store app store model came into place. Publishing on an app store has a good chance for increasing outreach, but it should not make distribution and installation of applications in the classical way more cumbersome, should the user so desire.

toyg• 6 years ago

The substantial lack of malware in the Mac world pre-dates the Mac AppStore, and numbers have not changed significantly since the introduction of that and/or Gatekeeper.

Gatekeeper is a commercial boiling-frog lock-in strategy sold as a security feature nobody asked for.

open-source charities

Open-source, as a term, was invented in order to sell what was then called Free Software. It has nothing to do with charity.

Curation is not a bad thing

Apple does little or no curation on the Mac AppStore, because the amount of developers using it is still relatively low.

vincnetas• 6 years ago

You know that you could install on mac anything you wanted before appstore, and they were similarly malware free as now with appstore

zelly5• 6 years ago

As for poorer people and countries, isn't this where the open source charities come in? Isn't this where the big FAANGs - including Apple - and the investors and everyone that earned billions off of software should come in?

It would be hilarious if Facebook, Apple, Google, Microsoft, Amazon, Netflix, etc. decide to start a charitable foundation which just deposits $99 checks into Apple's bank account. They should do it. I wouldn't be able to stop laughing.

fauigerzigerk• 6 years ago

Curation is not a bad thing

Curation, in the sense that Apple uses the term, is a bad thing because it creates a false sense of security. It blurs the line between protecting users from security threats and protecting Apple's business interests.

If Apple was truly interested in protecting users, they would keep these things separate as much as possible.

But they're doing the exact opposite. They keep mixing these things up as much as they can in order to shield their questionable business practices from scrutiny.

On top of that, the iOS side-loading ban is clearly aiding and abetting human rights violations.

matsemann3• 6 years ago

Like all other legitimate software on MacOS; they get a developer account and distribute it via the app store (...) I mean come on, it's only $99.

So small utils and stuff, smaller open source projects etc. are not legitimate? Or should they shell out $99 extortion fee to have the pleasure of giving stuff away for free? This is just one of thousands cuts that will kill traction for Mac software.

stereo• 6 years ago

OpenStreetMap treasurer here to jump on the tangent. Hi!

Apple's focus is on maximising profit, and ours is on maximising mapping and the width of our membership, especially after the entryism attempt last year ( https://news.ycombinator.com/item?id=19008792 ).-

We've also recently received a non-profit signing certificate from Apple through our German local chapter, and two of us are working on getting JOSM automatically signed and notarized. Our workflow is at https://github.com/thomersch/josm/blob/master/.github/workfl... and a JOSM.app built yesterday can be downloaded at https://github.com/thomersch/josm/actions/runs/214334897 .

nanna2• 6 years ago

I'm happy for OSM, that's great for you and in turn the community. But what about small open source projects? One-person projects where the idea of having several people working on securing legal non-profit status and then acquiring non-profit signing certificates from Apple is for all intents and purposes impossible? And certainly not worth just coughing up the annual $99 fee (+tax) to Apple?

$99+ every year is a lot of money to an independent open source developer who's in most cases losing money for their work. The fact that a company worth $2 trillion is demanding it - it's really beyond outrageous.

IndySun2• 6 years ago

Interjecting a side note - while you're here.... a building nr me, was a pub 15 years ago, then it was empty for 5 years, until it became a convenience store. It's still listed as a pub, 2 years after I, and others, have sent corrections. I'd love to love OSM but....

Apologies for the hijack...

Back to the main issue with right click.....

zelly5• 6 years ago

I also can't imagine $100 is easy to come up with in countries below level 4[1].

Apple has as low as 0% penetration in those countries. The market has solved this problem. They still use technology; there are alternative platforms. Android, Windows, ChromeOS, KaiOS, and desktop Linux (which has as high as 5% market share in India) are cheap to use and develop for. It was always going to end up this way. There's the brand for the haves and the brand for the have-nots. Although even people on welfare in the United States have iPhones, consider that they're still the elite in global terms.

wjdp• 6 years ago

I publish a CLI app for many platforms, including osx, on GitHub. Using the cross-compile feature of Go it just spits out a binary that Macs can run from a Linux build host. I don't own a Mac so don't see what my users do.

Does this change affect running unsigned binaries from the terminal?

tombell• 6 years ago

I've never had an issue running binaries written in Go I've compiled myself. From what I've experienced, only appears to affect .app binaries.

pjmlp13• 6 years ago

Just like it worked on any commercial UNIX, FCC's rise to fame was thanks to Sun no longer offering Solaris SDK as free beer.

indigochill• 6 years ago

This makes me wonder how open source is supposed to work on macOS.

It isn't. Apple's view of the world is that computer users are non-technical consumers who need to be protected from others and themselves, and that Apple are the ones to offer that protection. Open source is antithetical to this view because it puts the responsibility on the user, which is the last thing Apple wants.

I can sympathize to some extent with this view. There's obviously a large (perhaps majority) share of computer users who it describes - just not small/independent developers/hackers. Those users are better served elsewhere.

mlindner6• 6 years ago

You can still disable Gatekeeper with:

sudo spctl --master-disable

This removes all of these dialog boxes entirely.

LeoPanthera• 6 years ago

This behavior frustrates me, as a seasoned (=old) Mac user, but I am simultaneously quite grateful for it existing on my parents Macs.

It would be nice if there was a Sys Prefs option to add a "run anyway" button to the initial prompt. It wouldn't even need to be on by default. Just give me the option.

lstamour2• 6 years ago

But then you’ll have websites that walk you through changing the setting. At least this way you have to make a decision every time, even if it costs you a few clicks each time you do it.

themacguffinman2• 6 years ago

They can do the same for the right-click technique. Omitting a setting does not change the user's understanding of the decision, it just makes this completely undiscoverable and tedious for users who know what they're doing.

ttys0002• 6 years ago

If you want your computer back, use this to disable the protections. In the system preferences, a new option is enabled under the security section, "Allow apps downloaded from: Anywhere"

sudo spctl --master-disable
sudo defaults write /Library/Preferences/com.apple.security GKAutoRearm -bool false
:> ~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2
sudo chflags simmutable ~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2

You may need to disable system integrity protection to do this

csrutil disable

If you know what you're doing, like probably everyone here, you don't need any of this junk. I didn't need it in 1998, and I don't need it now either.

dwaite9• 6 years ago

It would be a command-line option. They used to have a system preference to disable signing, but a lot of software (including Minecraft, for a while) walked users through disabling gatekeeper security for the whole system rather than sign their individual software or try and explain right-clicking.

justaguy88• 6 years ago

Can't you just [give up on macos as a general computing platform]

d_tater• 6 years ago

Windows is starting to pull the same shit. Walled garden OS's are the future for most regular users.

dmart• 6 years ago

Good. Regular users are not sufficiently computer-savvy to avoid being tricked into installing malware.

Shared4043• 6 years ago

Bad. Users will get more trapped and have less mobility to become computer-savvy.

That, or their "techy friend" will jailbreak it for them, and now we're worse off in every way.

wvenable• 6 years ago

I developed a pretty cool piece of freeware to control a consumer hardware device and I ran into this "very scary Windows dialog" problem. I specifically don't want to charge for this application as then it's a business and it's just a hobby for me.

Thankfully one of my users is also a developer and now he signs all my releases.

What does this have to do with users being savvy or not? Unsurprisingly nothing at all.

rpdillon• 6 years ago

I mean, you're right, but I feel like the approach we're taking is that we have to cater to the least tech-savvy person that might every use the computer, even if that damages the experience for millions of folks that are tech-savvy. I really disagree with this this one-size-fits-all approach. It seems like a local optimum, at best.

Of course, more tech-savvy users can always use a system that doesn't impose this on them, but I really wish Apple would provide different experiences to different users. If they hadn't diluted the "Pro" moniker, I'd advocate for "Pro" editions of MacOS that remove all this stuff. As it is, every amateur user thinks they should get a Macbook Pro, and my user experience on any distro of Linux is miles ahead of any other platform available. That's fine for me (I'll probably never leave Linux unless something drastic changes), but what about folks that love Apple and are tech-savvy? Why should they have to jump through increasingly arcane hoops to do very reasonable things (like run unsigned code) on a machine they bought? It seems like a massive missed opportunity.

userbinator3• 6 years ago

Apply that thinking to all the other "bad things people could be tricked into doing" and that's how you end up with an authoritarian government controlling every aspect of our lives...

cuddlybacon2• 6 years ago

This feature is at about the right spot for me.

It is still convenient enough for me to run software I want that isn't signed, but sufficiently obtuse that neither of my parents have figured it out. Given they are both prone to running any executable that any website tells them to download and run, this feature has probably save me several dozen hours of fixing their computers.

tracker1• 6 years ago

My answer to that was chromebooks.

saagarjha57• 6 years ago

Chromebooks are in a pretty good spot of balancing security with hackability. Apple should take a couple leaves out of their book…

oneplane4• 6 years ago

To be honest, I hoped microsoft and their windows rt experiment would be the 'alternative' to that so you have three choices for the end-user (get chromeOS, iPadOS or Window RT). To get 'stuff done' a user really has no business having access to the system or circumventing controls.

Currently most desktop management structures try to do it backwards by taking an OS, i.e. macOS or Windows, and then trying to glue restrictions on top of it which always leaves holes or undesired side-effects.

The best 'middle of the road' so far seems to be active monitoring with Apple's or Microsoft's native management tools or with stuff like OSQuery; it also tends to be less intrusive for people that are convinced they are 'better than average' (nobody is) and don't need to have an MDM babysitting them.

But even then, there will always be people thinking their personal preference definitely means the big bad corp did it wrong or their personal need is more important than trying to do something about the constant barrage or crap any machine faces during its lifetime.

For the home user, all bets are off.

npunt2• 6 years ago

Chromebooks are definitely one way to solve it. The Apple ecosystem is also pretty fantastic for family though - iMessage, Photos, Safari etc.

Personally I'd prefer family to be on iOS than MacOS, there's even less rope to hang yourself with there.

yaur• 6 years ago

I believe this is bubbling up because apple recently revoked Epic's certificate (sorry if that isn't quite the right term) and these are now the steps required to run Fortnight on Mac.

saagarjha57• 6 years ago

Technically Apple has (or will) terminate Epic's developer program access, which means that they will no longer be able to sign new builds. They have not revoked the certificate at this time, so those binaries should still continue to run until the certificates expire.

bzb42• 6 years ago

I think people are mostly bitching about iOS, since it will be impossible to run the game on iPhones and iPads anymore at all.

koyote• 6 years ago

As someone whose elderly parents run Windows and have never run 'any executable that any website tells them to download', and I myself have not seen a website that gives me a random executable in over a decade:

Out of curiosity, how often do your parents encounter the dialog in the article?

cuddlybacon2• 6 years ago

I don't know how often they see it.

But in the Windows days every time I'd visit, they'd say there computer was "fucked" and had been put away until I could look at it.

LeanderK• 6 years ago

I really don't know how they end up with this, but my grandparents run windows and regularly have some kind of malicious advertisement installed. It's a not easy to keep their computers clean.

user5994461• 6 years ago

Try using safari on a MacBook. Last time I spent 10 minutes on my wife's laptop, every website was filled with garbage ads saying your Mac is infected with a virus you must download an anti virus quick (#malware). The shadier websites (streaming) sent a dmg executable as soon as they were opened.

It's shocking, it's worse than Windows (sad fact: Mac has more malware/adware than Windows since the last 3 years).

Of course you can't see that if you're not on Mac or if you have an adblocker. Ads detect the browser and specifically target Safari. Safari removed support for extensions last year, dropping all adblockers, it's wide open to targeting.

kjksf• 6 years ago

Apple has been making things more and more restrictive over a decade now.

New versions of mac os introducing new restrictions.

Doesn't take a genius to see that their end goal is to make mac os as restrictive as ios.

When that happens, will it still be the right spot for you?

brundolf3• 6 years ago

As long as there's software there will be devs who need machines with which they can build it. Those machines will always need mechanisms for circumventing safety constraints, almost by definition. I guess it's possible Apple could decide, one day, "macOS isn't for developers anymore, it's just like iOS, devs will just have to go elsewhere". But that seems like it would be a profoundly stupid thing to do.

I do wish they would just bundle up all of the safety-guards under a single toggle - put it in the recovery UI for maximum obscurity - to make this stuff as convenient for developers as possible. But I take the fact that they don't to be a shortcoming of product development, not malice.

npunt2• 6 years ago

To be fair, the world itself has changed a lot in a decade. Risks are much higher now than before, as malicious actors have become much more sophisticated, and we're running much more of our lives through software. The downside of insecure systems is orders of magnitude greater - life savings wiped, every personal detail leaked, etc.

manquer3• 6 years ago

You stop using Apple and go to a reasonable OS. You and I are not going to help Apple keep their $2T valuation, we are no longer the market not been one for 5 + years for Apple

Apple moved their focus from the professional market who were willing to pay premium for productivity with better UX/Hardware/Software, to people paying just the premium .

It is a lifestyle brand now, people money because it is Apple, not because there is real value they gain for the higher cost.

Depending on what you work with, Windows or Linux is by far better option today. MS listens to developers (eventually), WSL , professional support, a lot of graphical professional grade applications all make it attractive. Linux is lot more flexible, works with less friction makes it easy to work with containers servers etc,

If you really need Apple hardware dual boot or flash a sensible OS .

sneak• 6 years ago

Doesn't take a genius to see that their end goal is to make mac os as restrictive as ios.

I don’t see that. I see them trying to protect average users from malware, something they have done a pretty decent job of.

It’s the job of a gui shell (finder/explorer) to discern user intent and do the thing it thinks the user wants. This is that happening. Users don’t want to run malware.

I’ve not seen anything that suggests that Apple wants to remove the ability of people to run arbitrary programs. Indeed, it is essential for developers to run novel binaries.

spideymans3• 6 years ago

Doesn't take a genius to see that their end goal is to make mac os as restrictive as ios.

I've been hearing that for the past decade. With the exception of some reasonably deprecated technologies (32-bit support, etc...), to this day I'm able to run essentially all of the software on my Mac that I did back in 2010.

If and when Apple does prohibit the running of third party apps, I'll switch to another platform. Until then, this is all just FUD.

nuker• 6 years ago

to see that their end goal is to make mac os as restrictive as ios.

Well, there is no Mac ransomware, right?

Razengan3• 6 years ago

https://en.wikipedia.org/wiki/Slippery_slope

Cthulhu_4• 6 years ago

For 99% of customers that is just fine. I don't know how old you are but think back of the early / mid 2000's where everyone and their dog got computers and went on the internet, while the main operating systems then - Windows XP - were not ready yet, in that they couldn't protect their users.

whywhywhywhy3• 6 years ago

I'd really be interested to hear someone who defended Apple's 30% cut battle against Epic on why Macs shouldn't be locked down and everything forced through the store.

People like Gruber coined the term "App Console" to try and justify locked down iOS yet we're also told how powerful iPads are and how they're computers.

Why is it ok for the iPads to be locked down "App Consoles", if that's ok shouldn't it also be fine to lock down Macs and force everything through the App Store and make sure Apple gets a cut from say Creative Cloud subscriptions and Alberton Live installations?

I personally don't agree with any of it but I'd like to try and understand why people think one is ok but also not the other.

mlindner6• 6 years ago

Corporations don't sign the apps they run on company-owned computers all the time. This isn't going away unless Apple wants to dump the very valuable business customers. You don't need to worry.

stevefan1999• 6 years ago

And it's right, Apple is more and more being a China

badsectoracula10• 6 years ago

Well, yes, until you get to the point where (as the article shows) you cannot run unsigned applications on Apple Silicon. How much more slippery does this slope needs to get?

xenadu023• 6 years ago

It is important to understand what this requirement is and isn't. The requirement on Apple Silicon is only that the binary be codesigned. That ensures the binary is unmodified when it is encountered again later. You do not need an Apple-approved signing key for this. Ad-hoc signing works just fine.

Apple's new linker automatically adds an ad-hoc signature to ensure people building outside Xcode don't experience any disruptions as part of this new requirement.

This requirement does not change GateKeeper or Notarization.

saagarjha57• 6 years ago

To be clear, this just means all binaries need codesign --sign - run on them before they will run. You don't need to pay to do this, so it's a minor annoyance rather than Apple centralizing control of app distribution.

xenadu023• 6 years ago

I think you've misunderstood the article. Ad-hoc signing is absolutely supported on Apple Silicon Macs. You don't need Apple's permission to build your own software on your machine, nor to distribute it to others.

_qulr16• 6 years ago

This feature is at about the right spot for me.

The issue is not whether expert users can run unsigned software, the issue is whether unsigned software will even be written and distributed by developers. Perhaps some free software, but it's not a viable way to distribute paid software.

gramakri• 6 years ago

Don't they need admin privileges to install? Why give them admin ?

aequitas2• 6 years ago

You don’t need admin to simply run software on macOS. And even then installed is (or should be) nothing more than extracting the app to a directory and running it. Installers are and anti pattern in macOS afaic.

ineedasername3• 6 years ago

From the article, it seems like things have gradually become more & more restrictive though. My interpretation is that Apple is gradually shifting macOS to the same application distribution model as iOS: Complete walled garden, attempts to bypass are against ToS, actively closed off with every update, and warranty-breaking.

However my impression is also that it's mostly non Mac users who are concerned with this, so it seems unlikely that Apple will have much incentive to reverse course unless they screw up and go a few steps too far too soon and create a bigger outcry. Even that would probably just delay the process.

mlindner6• 6 years ago

From the article, it seems like things have gradually become more & more restrictive though. My interpretation is that Apple is gradually shifting macOS to the same application distribution model as iOS: Complete walled garden, attempts to bypass are against ToS, actively closed off with every update, and warranty-breaking.

Nothing has really changed in this article though. You can still run software just as before.

gtm1260• 6 years ago

I kind of agree. I think the right click option is actually kind of genius since it gives people who somewhat know what they're doing a very easy to way to open unsigned software, while protecting people who don't know what's going on on their computers.

throwawayffffas• 6 years ago

I see this argument repeated whenever there is a conversation about issues like this.

But I almost never see anyone pointing out this is the equivalent of think of the children applied to software distribution.

While indeed this kind of control reduces the chance less informed users run random code downloaded from sketchy sites. I think it does little to actually curb malware, since all you have to do to pass the bar is pay 100 dollars to apple.

I believe this is Apples attempt to fully control the software distribution business for macs the way they do for iphones. Eventually mandating that all software comes through their store, uses their payment provider, etc.

FreakyT2• 6 years ago

I still believe that Gatekeeper is a blatant cash grab and not a legitimate security feature.

$100/year to avoid a scary warning about how your app is definitely a virus? It's like a protection racket.

turblety4• 6 years ago

It absolutely is a cash grab, and part of a series of unethical behaviour from Apple.

Since the latest awful hardware products (terrible keyboard, control strip thing that breaks, no escape key) with MacBooks and a great improvement with using Linux via Purism and System76 I've managed to move away from Apple.

Shared4043• 6 years ago

great improvement with using Linux via Purism and System76

I look forward to the day when I can afford a System76 laptop.

FabHK8• 6 years ago

latest awful hardware

The latest round fixed all of these problems.

dividedbyzero2• 6 years ago

The newest iteration of Macbooks has a very nice new keyboard (no butterfly mechanics anymore) that reminds me of the really old models, better than my 2013 model IMO, one of the best in a laptop that I've used, though it doesn't beat the really old Thinkpad ones; those were incredible. Of course, this sort of thing is a matter of taste to some degree, but my private 2020 13" and my work 2018 13" are several worlds apart, they've really fixed that issue for me.

There's also a physical ESC key now, and for me, personally, the touchbar is a pretty neat feature after a bit of getting used to it, and some tweaking.

No idea if it is prone to fail, but I believe the rather sizeable fleet of touchbar Macbooks at work hasn't had a broken touchbar yet (there have been other failures)

I've yet to see anyone get a Linux machine and not struggle with something; maybe that'll happen someday soon, but so far everyone seems to have issues that I'd find unacceptable.

vortico• 6 years ago

It's not the $100/yr that benefits Apple the most, in my judgement. It's the ability for Apple to control what software its users can use, e.g. to promote App Store sales. If they don't like your company, they can switch off your software remotely on all your end users' computers. If you have a competing product, they can just switch it off and there's nothing you can do about it except develop for Windows and Linux.

kelnos2• 6 years ago

It's hard to believe that this would be a cash grab. Even if there are 1M developers in the world, that's only $100M, which should not be worth the friction and cost to implement and maintain this scheme. Consider that Apple's most recent quarterly revenue was just under $60B. Apple made $260B in all of 2019; $100M is not even four hundredths of a percent.

Developer time to build out the signing and notarization features is not free, and running the notarization servers in a highly-available manner is also not free. As much as we all like to call out Apple sometimes for how they don't take good care of their developers, adding hoops for your developers to jump through is not a great idea.

So I think in some ways Apple really does it for the security aspects, and also probably just because Apple likes to maintain rigid control over their experience.

PandaHug• 6 years ago

Not exactly how it works though, in a corporation as big as Apple each business unit has it's own budget and profit/loss margins. Apple is simply too big and complex for someone or a group of someones to look at it in the way you are describing.

So while $100M might not look like a ton to Apple as a hole, it might look like a lot to the business unit responsible for apps on macOS

tauwauwau• 6 years ago

Not going to argue about the profit based motivations, I'm sure someone else would do it. How about the power that it gives Apple over developers, is that worth their time?

cytzol5• 6 years ago

As much as we all like to call out Apple sometimes for how they don't take good care of their developers, adding hoops for your developers to jump through is not a great idea.

Why not?

Apple has been pushing very hard lately to increase their 'services' revenue, by getting users to sign up for Apple Music, iCloud, etc. It makes perfect sense for Apple to force developers to jump through hoops, not because it makes the developers' lives worse, but because it gives Apple a leg up! Some examples:

• When launching Chrome for the first time, you have to opt-in to Chrome notifications, but macOS pops up its own notification telling you to use Safari instead.

• Similarly, Apple News notifications are allowed by default, but you have to explicitly opt-in to notifications from other news websites.

• Again, similarly, you'll get Apple Music adverts through push notifications, something that's explicitly disallowed in the App Store guidelines.

• System Preferences gets an obnoxious (1) badge next to it, because I haven't signed in to iCloud.

I use SyncThing, rather than iCloud Drive. It definitely benefits Apple to waste the SyncThing developers' time and money keeping up with things the iCloud Drive team doesn't need to deal with — do you really think the sort of company that pulls shit like the above would do anything different?

pier253• 6 years ago

Even if there are 1M developers in the world

There are +20M registered Apple developers.

https://techcrunch.com/2018/06/04/app-store-hits-20m-registe...

KeepFlying3• 6 years ago

Exactly. I'm sure they do basic vetting of tools in their store, and I suspect they will remove the most eggregious offenders. But that doesn't make all of the tools in their store safe, and all of the tools OUTSIDE of their store unsafe.

Especially when it comes to privacy protections, where every user's standard for privacy is going to be unique.

cytzol5• 6 years ago

Don't forget that after you've paid them your money, they can revoke your certificate and spread lies about your software, and there's nothing you can do!

https://blog.charliemonroe.net/a-day-without-business/

rsfinn4• 6 years ago

Well, you can voice your complaint on the Internet and hope that Apple notices this problem and fixes it in less than 24 hours. I wouldn’t advise betting one’s business on this, but it did work in this case.

(Hopefully Apple comes up with a more formal process going forward...)

lucb1e7• 6 years ago

It might be different if it went to a charity of your choice. I've been to conferences where the entrance fee was just a token amount to make sure you didn't register, reserve a spot, and didn't show. Or first-class train tickets: you don't pay for more expensive seats, you pay for it being expensive and keeping other people away.

People from rich countries that have the spare time and skills to write reasonably decent software are likely to have $100 of disposable money per year and would probably be donating anyway, so a donation might be reasonable, and I'd understand if Apple takes a few dollars to do <whatever they claim to currently use this money for, I imagine there is some sort of vetting going on even if it's only to check that you're not on their malware authors blacklist> but it really won't cost a full $100 per developer per year. For that money they can fly in from the nearest English-speaking country to verify my scowl.

rurp• 6 years ago

I think this is part of a longer term and much larger cash grab of eventually forcing all Mac software to go through the app store. Apple will of course require a modest 30% cut of all sales for providing their benevolent oversight.

dwaite9• 6 years ago

It seems infeasible that this is a long-term cash grab. The Mac App Store will be ten years old this October.

The most recent opportunity to attempt this would be with the architecture change this fall, which they have not taken.

jojobas2• 6 years ago

It's more of a choke hold than a cash grab. Your app broke our store rules, we removed it and you're suing us? We'll terminate your dev account so your apps won't run.

dwaite9• 6 years ago

Assuming you mean Epic, Apple has only given a deadline to cease breaking their developer agreement before their developer account is terminated.

Epic is empowered to get their app back in the store tomorrow if they want to release an updated build without the contract-infringing functionality.

They probably have lost their chance to be features by Apple or to be invited back on stage in future keynotes, but at least to me it appears Apple is trying to not be punitive in their reactions. Epic has consistently been given a no-nonsense way to recover.

mpartel4• 6 years ago

That's peanuts. The 30% cut of revenue for app and in-app purchases is the real cash grab.

bangonkeyboard• 6 years ago

On a related note, the macOS 11 Beta 5 released today reveals that Apple silicon Macs will require all ARM executables to be signed: https://mjtsai.com/blog/2020/08/19/apple-silicon-macs-to-req..., https://developer.apple.com/documentation/macos-release-note...

wtracy• 6 years ago

From Apple's documentation:

There isn’t a specific identity requirement for this signature: a simple ad-hoc signature issued locally is sufficient, which includes signatures which are now generated automatically by the linker. This new behavior doesn’t change the long-established policy that our users and developers can run arbitrary code on their Macs

So, the sky isn't falling yet, but it is reasonable to be concerned.

marcuskaz• 6 years ago

This new behavior doesn’t change the long-established policy that our users and developers can run arbitrary code on their Macs

This irks me, I don't know why. Maybe because calling it an Apple policy is something that can be changed. I consider it more a right that I can run arbitrary code on my computer.

So yes, I would agree, quite reasonable to be concerned.

fluffything2• 6 years ago

So, the sky isn't falling yet,

Now we are literally only one step away from not being able to run our own software on Macs without paying Apple 100$/year (or whatever amount they want).

They just need to disable adhoc blocking, and require a signed developer. All systems are in place for this. The only thing they need to justify such a change is a "catastrophe". For example, next year, some macos malware might pop up, that could have been prevented with this signing. And Apple could just use that as an excuse to fully lock their platform.

simonklitj• 6 years ago

Should be possible to get around, no? I guess technically they could lock us out, but my naïve self is thinking that surely there would always be a way to disable it, like how we can disable SIP now, through Recovery-mode?

saagarjha57• 6 years ago

I know exactly why this requirement exists (parts of the OS have entirely different code paths depending on whether a binary is signed or not) but it is still annoying to have to ad-hoc sign everything.

emsy• 6 years ago

Judging from Apple's past behavior, I have no doubt this feature will also be used to "enhance the user experience".

white-flame• 6 years ago

The fact that the standard model of computing is that applications are opaque machine code blobs that can access everything in your user permission space is the core problem in privacy and malware. Applications should see nothing but their executable jail, and whatever was intentionally allowed to them by the user (eg, Open file dialog giving the application an opaque file handle, etc, not carte blanche access to the entire filesystem). Ideally, the notion of machine code blobs should be done away with as well.

Mobile OSes got to rethink everything in an era of constant adversarial connectivity and started off on a better foot in this regard.

saagarjha57• 6 years ago

macOS ships with a quite strong and granular capability-based security model with its sandboxing mechanism (at least, when it works and is applied correctly). The feature is there, advanced applications already make use of it, but it is difficult to get arbitrary applications to adopt it (its inner workings are declared SPI after all) and it is not really exposed to the user at all except via App Sandbox, which is fairly limiting.

andrekandre2• 6 years ago

but it is difficult to get arbitrary applications to adopt it

just curious, but what makes it specifically hard?

hyperdimension• 6 years ago

What does SPI stand for?

shakna2• 6 years ago

Applications should see nothing but their executable jail, and whatever was intentionally allowed to them by the user

Whilst this works for some programs, it gets... Difficult... When dealing with others.

What permissions should sh get, for example? And do the programs it will call inherit the same, or do they get their own permissions, or a hybrid?

dwaite9• 6 years ago

What permissions should sh get, for example?

The permission model works pretty similar here to a restricted user account. It sees system files as read-only, cannot see the contents of certain files and directories, etc. The root of the filesystem might be of the parent system or of the sandbox itself.

On macOS, reading certain directories (like the user's Desktop) will result in a user consent prompt due the sensitive contents. There is, after all, no guarantee that the request was directly initiated by the user, and not some curl-pipe shell script. There is however a "Developer Tools" entitlement that encompasses all of these sorts of prompts - but this is meant to be enabled through a developer action and not any user-presented prompt.

On macOS, there are basically higher-than-root system integrity protections, such as modifying files that the OS maintains. You can disable this system protection by booting into recovery mode and running a command-line tool.

Generally, the goal with system integrity protection is not to restrict professional work but to restrict the ability to publish software that tells the user to disable system-wide protections. There was recently an issue with the Google installer where a Chrome update wiped out part of the system when these protections were disabled, primarily noticed on hackintoshes and video production Macs where tools require SPI to be disabled to run unsigned kernel extensions, etc. Oops.

Apple has been trying to reduce the need across macOS releases to have applications need to be installed at all, with recent releases making items like browser, system, and kernel extensions bundled inside the application itself rather than being distributed across the filesystem. The goal is likely to eliminate app installation on macOS from needing to be a privileged operation.

badsectoracula10• 6 years ago

This works for some type of software, but not all type of software. For example a file server or a file manager wont work. A VCS client wont work. A game engine that needs to keep track of imported resources (especially when you want automatic imports when the file is saved via a 3rd party tool - e.g. saving a model on Blender or a texture on Krita causes an automatic reimport/convert to the engine's format). Basically any sort of content management software that doesn't provide everything itself but relies on 3rd party tools already installed on the user's machine wont work.

Software like clipboard managers also wont work. Screen sharing and remote desktop software similarly wont work. Screencast software wont work. Hotkeys software wont work. Most desktop automation software wont work.

I could go on and start looking at what i have installed to extend this list (i'm sure most of the software i have on my PC wont work), but i guess you get the idea. Almost everything that doesn't fit in the media consumption model that you'll often find on a phone or a tablet wont work (and amusingly enough, at least on my Android, stuff like a file server does work, though i've heard Google wants to remove that functionality).

josephg2• 6 years ago

Sure it does! We just need sufficiently granular permissions for all of this stuff. “Do you want to give ClipboardManager access to your clipboard?” Yes. “Do you want to give TikTok access to your clipboard?” No. I agree that clicking a million permission boxes is annoying but ideally it should only be something needed for apps that don’t fit the media consumption model.

The real problem is that the desktop security model is outdated - it was designed for a world where software developers are trusted by default and users need to protect their data from each other. Today we can’t trust that developers will respect my data. I mean, the fact that any application I run or any npm module I transitively install could upload or delete any of my personal documents is insane. We absolutely need to preserve my ability to run software I write, and run screencast software, file servers, etc. But permission to read my data should not be given by default to any software I happen to run. The Epic thing makes me nervous but generally I think Apple’s direction here is the right one.

WorldMaker2• 6 years ago

A game engine that needs to keep track of imported resources (especially when you want automatic imports when the file is saved via a 3rd party tool - e.g. saving a model on Blender or a texture on Krita causes an automatic reimport/convert to the engine's format)

A game engine isn't likely to do that in a production build. Even if it wanted to though, these sorts of "file ticket" sandboxes still has support for "directory ticket" and "file watchers". Even if storage specifics like "drive" or "path" are opaque to the application, they can still ask the user for permission to an entire directory (either explicitly in an "Open Directory" or implicitly in directories they naturally own such as "app data" and "resources" directories). Figuring out "where" that directory is for the user in Blender or Krita might not be straightforward, but just because those "tickets" are designed to be opaque to applications doesn't mean they have to be opaque to users and the operating system has lots of interesting possibilities to answer user questions about where things are, such as smarter Save File dialogs that are "ticket aware". ("Open Tickets > Game X has an Active File Watcher on this Resource Directory")

Almost all the same applies to other similar tools like file servers, file managers, VCS clients. Opaque/transparent is a "cone" in "ticket" based systems. It probably should be opaque where exactly my "file share" folder is stored, and all of my folders that are not my file share folder to a file server, so long as the contents inside that file share are transparent enough. The hard thing is defining those "cones", but the past default of "everything is transparent" is a problem and the over-correction in some systems to "nothing is transparent" sometimes blinds us to finding better ways to define these visibility cones rather than complain that they exist at all.

(Fwiw, all of the above is possible in the strict UWP Windows sandbox today: you can ask for directory tickets, you can ask for file watchers with those tickets. This isn't entirely theoretical, there have been practical applications, if not enough.)

dwaite9• 6 years ago

It is possible to still make all of these work by having frameworks that hold the permission to access the functionality, or by having entitlements to more tightly restrict which applications have access to a feature.

For example, some backgrounding modes on iOS require an app to get an entitlement to act as a VOIP client, or a mapping directions app. The system access is limited to only give access to the things which a VOIP client or map should need in the background.

On iOS, ReplayKit allows apps to participate in screen casting - both with first party support for an app being cast, and for an app which wants to share a video stream out.

Screen sharing on macOS also will likely move to ReplayKit, but it currently requires the user to approve a request to share the screen.

You can open a 'folder' rather than individual files to gain access to a full project structure.

Clipboard managers are difficult in a sandbox model where the clipboard manager has no permission to stay running in the background. Similar applications like custom keyboards on iOS solved this by having a smaller 'extension' stay resident, and having that extension run with a very restricted set of permissions. For instance, no access to shared storage, IPC, or to the network. A keyboard must work without these permissions to get in the App Store, but they may prompt the user to elevate permissions.

stjohnswarts2• 6 years ago

That should probably be an option, but I'll take ownership of my hardware and data not you or Apple. I don't mind having the checks in there as long as I can overrule them. Otherwise you just get the Epic treatment and you don't really own your hardware, you're just loaning it from Apple and you can only do what they let you do. That, to me, is a losing proposition in the long haul.

kumarvvr• 6 years ago

The average user would be terribly confused by all this and would hardly bother to even analyze requirements that are asked by any app. They will simply allow everything.

More importantly, if they see something like a permissions screen, they will have a false sense of security.

And severe restrictions on the app, would hamper user experience. Code signing and developer ID are the most practical means to ensure quality software.

angry_octet• 6 years ago

Users of iOS seem capable of forming nuanced views of the permissions each app should have. I don't see why this shouldn't be done for macos. The problem is 'everything' apps like browsers -- you need to be able to enforce permissions for individual sites.

With weak sandboxing we're still left with the problem of LPE -- once you're on the box (with, by default, unlimited network access!) you can gain root quite quickly, because the kernel interface is rather large. So you still need code signing and developer IDs. However dev IDs could be a federated system -- user's shouldn't have to accept Apple as the total and sole authority for accepting or rejecting apps/developers.

necovek• 6 years ago

You get that with "snaps" on Ubuntu (and I imagine flatpak too).

bagacrap• 6 years ago

I don't think the permissions model in mobile OSes was good to start although now it's slightly better. The web is where "they" got it right.

nippoo• 6 years ago

I've seen a few apps get around this by packaging them in a standard .dmg and giving the user clear instructions ("just right-click") as the background image of the opened container, or as the name of the app, or on the download website, etc. Although generally these have been fairly tech-oriented apps where the users would be likely to know the shortcut anyway!

oneplane4• 6 years ago

I'm not sure what the point of that page or posting it here is. This system (and others like it) is neither new nor special. It's also not a bad thing, and I haven't seen anyone come up with a better alternative.

Generally you see all major distribution options have signatures with a CA-type trust structure no matter what you use, be it open-source, free or commercial paid software. On Windows, macOS and at least all Linux distros based on dpkg or rpm you have signatures and circumventing that requires a bunch of steps that will prevent most users from shooting themselves in the foot.

saagarjha57• 6 years ago

Question for you: what exactly does Notarization protect against? I have watched all the videos about it, I read the developer documentation, I notarize my apps because it is required by the OS…but I still have not gotten a single good explanation as to why it's useful. Apple claims that the process is extremely tolerant…so does it try to accept everything but blatant malware? Does it let malware through? What happens if malware does get through? Why does having build-specific certificates help security–is there any reason why Apple would disable a single build of an app from a malware publisher?

oneplane4• 6 years ago

As far as I know it is intended to prevent identity abuse in both the IRL sense as cryptographic sense.

It means that it is harder for an attacker to abuse your systems or key material to sign something in your name.

Perhaps the best analogy I can come up with is the dns-01 verification with ACME and a lower TTL. You need to compromise more pieces of the puzzle on a shorter timeline to attack that specific part of the system.

crooked-v• 6 years ago

Apple claims that the process is extremely tolerant…so does it try to accept everything but blatant malware?

From what I understand, the most common use case here is to match against known malware inserted into an otherwise normal release, either from an infected dev machine or by way of an attacker coopting stolen credentials. It's not going to guard against truly novel malware for obvious reasons, but the vast majority of malware is a repackaging of stuff that's already out there.

donarb• 6 years ago

If you remember Handbrake had a version of their app hacked and uploaded to a distribution server.

raxxorrax2• 6 years ago

They would never admit it, but gate keeping is another factor from their perspective. I don't judge them on that, it does filter out some crapware, but I don't use OSX or any OS that tries to pull this stuff.

turblety4• 6 years ago

This is just a cash grab from Apple, and part of a series of unethical behaviour by a monopoly (eg app store dictatorship).

This would be totally unnessisary if apps could run in a sandbox. It wouldn't matter if I run some random game I downloaded off the internet if it can't do anything on my computer outside of its own sandbox.

And to the people that say it's not possible, just look at web browsers. Each website runs in a complete sandbox.

For apps that do need to use operating system functions, then you can escalate privellages with user consent. For example, mobile apps, that ask: "This app wants access to your camera"

saagarjha57• 6 years ago

macOS ships with some of that already; users immediately complained that it turned their OS into Windows Vista. Perhaps the underlying problem is that Apple's sandbox is not under the control of the user, it's mostly controlled by Apple and (to a lesser extent) by the developer of the software itself. It's really a strange model if you think about it…

turblety4• 6 years ago

Perhaps the underlying problem is that Apple's sandbox is not under the control of the user, it's mostly controlled by Apple

Absolutely agree. There is a risk of prompt fatigue but that's a UX problem that can be solved during the installation process or first run.

lucb1e7• 6 years ago

That's actually an interesting way of looking at the problem of untrusted code. We might still need a way to signal to people what pop-ups really mean so we avoid the blindly yes-yes-continue clicking, but in general if things are as sandboxed as they are on mobile (sans the sensor and network access that still allows you to do a million invasive things, so perhaps more like websites where the software is closed when you close it) then we might not need this sort of scheme.

dec0dedab0de4• 6 years ago

I dont see any problem with this. If you don't feel comfortable doing this then you definitely shouldn't be running random code from the internet. I would take it a step further and force it to be run from the command line.

Also, what kind of "viable software business" has trouble paying $100 a year?

aaomidi9• 6 years ago

Any open source developer?

Do you know how much $100 is in Iran?

toast0• 6 years ago

Do you know how much $100 is in Iran?

It doesn't really matter, because for developers in Iran, the question becomes do you know how hard it is to pay US companies from Iran?

dec0dedab0de4• 6 years ago

I just looked it up, and it seems like $100 is worth less than half a week of an average developers salary in Iran.

gowld2• 6 years ago

You need $100 fundraised across the entire userbase.

If this is a problem, projects can join together into one large app.

aaomidi9• 6 years ago

Also this is a fun thing Snapp did in Iran: https://www.theverge.com/2020/1/28/21112467/iran-ridesharing...

FabHK8• 6 years ago

Do you know how much $100 is in Iran?

Much less than a Mac that you need to develop macOS software.

_qulr16• 6 years ago

Also, what kind of "viable software business" has trouble paying $100 a year?

The issue isn't the money. The blog post was written in the context of the widely reported story of Apple threatening to terminate the developer account of Epic Games, which would prevent them from signing and notarizing their Mac software.

dec0dedab0de4• 6 years ago

Ahh, that makes a bit more sense. If only had they the same policy on the iphone it wouldnt be as big of an issue.

cytzol5• 6 years ago

The blog post was written in the context of the widely reported story of Apple threatening to terminate the developer account of Epic Games, which would prevent them from signing and notarizing their Mac software.

This part is key. It shows that Apple's signing and notarising requirement isn't about money, nor is it about security. Epic broke the rules of the iOS store, and now they'll be forbidden from developing on a completely different platform, just because Apple doesn't like them.

kelnos2• 6 years ago

The issue isn't from the user side, but from the developer side. Most potential users will see the dialog, not even know they can work around it, and trash the app.

Whether or not this is a good thing for most users is certainly arguable, but it still doesn't sit right that you have to pay Apple and get their permission to distribute macOS software that isn't presented to the user as likely malware.

dwaite9• 6 years ago

Apple does not indicate it is 'likely' malware.

antipaul• 6 years ago

Here is Apple’s calculus:

What fraction of unsigned app openings, across the entire world each and every day, are safe?

If 99% of these events are unsafe, then such an experience seems warranted, given real malware and security threats.

The question is, what is that fraction?

Folks may say I want my computer to be “open” but do you want it open in the same way for your grandad and grandma?

Animats• 6 years ago

That's how Apple protects its 30% cut.

saagarjha57• 6 years ago

Actually, this specific behavior applies exclusively to applications distributed outside of the Mac App Store.

tzs• 6 years ago

A couple other ways to deal with it (at least for some instances--not sure this applies to every kind of executable).

1.1 Hit "Cancel" in the warning dialog.

1.2 Open "System Preferences" / "Security & Privacy" and select the "General" tab.

1.3 It should have a notice about the unverified app being blocked, and offer the chance to approve it. Do so.

1.4 Try to launch the app again. You'll get the dialog again, but this time it should have a button to tell it to go ahead and launch it. That will also remember that you have approved the app so you should be OK from them on (or at least until the app updates, and you will have to redo this).

Another way is to fix it from the command line.

2.1 Locate the executable.

2.2 Do "xattr -d com.apple.quarantine /path/to/executable"

I just hit this today when doing some web testing with Selenium, and it could not use chromedriver because the developer was not verified. My chromedriver is installed via Homebrew and evidently it had been updated since I last used it. A search for how to deal with that turned up both of the above solutions as part of this Stackoverflow question [1].

[1] https://stackoverflow.com/questions/60362018/macos-catalinav...

saagarjha57• 6 years ago

Homebrew Cask specifically opts into Quarantine, interestingly; I believe this behavior was to match the general behavior of the system to add this at most places where you could download an app. Very few other third parties opt into this.

onemiketwelve• 6 years ago

I have to look up this fucking procedure every time I update our internal executable tools. And for whatever reason the security setting loads up some sub tab for me and I always forget you have to go back to general to find the little thing at the bottom to allow the app.

This is so far beyond reasonable from a ux standpoint and they have no reason to improve because what am I going to do? Not use macos to work on iOS stuff? It pisses me off so much

dwaite9• 6 years ago

If you have an automated process to update internal tools, you will likely have a much better UX with updating that process to appropriately deal with quarantine.

dingaling• 6 years ago

I'm glad it "just works"

saagarjha57• 6 years ago

On macOS Catalina, Gatekeeper not only checks whether the software was signed by a valid Developer ID certificate, it also "phones home" to check whether Apple has notarized the software, again refusing to run it if the check fails.

Nit: I believe stapling is supposed to fix this issue.

_qulr16• 6 years ago

Nit: I believe stapling is supposed to fix this issue.

No, even stapled apps phone home. The difference is that stapled apps can still run if Catalina can't contact Apple (e.g., no internet), whereas unstapled apps can't.

Look closely at the Gatekeeper dialog with and without your internet connected.

saagarjha57• 6 years ago

…wait, what? Why is this designed like that? Surely downloading a revocation list is not that onerous…

euske• 6 years ago

This would make sense if Apple guaranted that my machine is "more secure" with this feature and offered some compensation or extra services for it.

unlog• 6 years ago

How do you ad-hoc from windows? I run into this just yesterday and had to explain people to CTRL+CLICK. I'm not planning to give apple anything and the users already know that. Whats funny is that on windows you can also get an app signed via a third party(not sure if this applies this day) and avoid this kind of scary dialogues.. just because you paid someone.

shuringai• 6 years ago

software security 101: if there is an "accept the obvious risk" button, the user WILL DEFINITELY CLICK IT. No matter how clear you make the danger, they always choose potential malware instead of inconvenience. It's better hide because, otherwise that button would be the center of any social engineering attack

wruza2• 6 years ago

I thought that a developer status will autosave me either from malware or from being babysitted, but then [1] happened. No matter how hard I tried to start that binary, OSX didn't allow me to do that. Damn OS which knows better, who do yo think you are? Did you see checksums, site certs, my competence, my willpower? I thought that it must be something with a build process that transmission uses, some signature didn't get into the bundle, etc, and went to their forum for help, while trying to self-sign that app and to reduce the system protection level in a console. As I found out later, that was yet another snafu that happens with transmission every few years, and it's not that it is a particularly small or inactive project.

Moral of the story is, if you want to protect your users, you have to bring some level of inconvenience and frustration to them. Or be sure that I will run that malware no matter what you say.

[1] https://forum.transmissionbt.com/viewtopic.php?f=4&t=17834

kohtatsu• 6 years ago

https://unit42.paloaltonetworks.com/new-os-x-ransomware-kera...

It turned out to be ransomware, for anyone not following.

throwaway133372• 6 years ago

So the moral is that we should give up freedom for security?

Because that's a bad moral.

nemothekid• 6 years ago

Like anything in life there is balance, and anyone living in any sort of society today has already given up some freedom for some security.

Razengan3• 6 years ago

So is the moral that we should give up security for freedom?

saagarjha57• 6 years ago

You will note that macOS identified the software as malware 1. because it was actually malware and 2. without notarization.

kfarr• 6 years ago

Yeah I read the forum expecting to find a false positive but then it turns out the build included malware and the OS worked as expected to identify it?

usui• 6 years ago

Since you mentioned self-signing, I always laugh whenever I see people mention this on threads related to iOS apps and "being able to use your own software". These self-signed apps last for only 7 days before it expires, and then it needs to be sideloaded again with another self-signing, otherwise you can't run the app.

Being required to load your app every 7 days is such a major pain in the ass. Does anyone actually think that sideloading/self-signing is a realistic and viable way to build your own software stack (that can also be shared with other people) on an iOS device? It's obvious that this mechanism is only for development environments and the intention is that the app will eventually be signed with the $99/year version.

hardmath123• 6 years ago

I came across this problem when I wrote a small program for a humanities professor to help him draw some diagrams. He didn't want a web app ("it'll disappear once you graduate!") so I wrote him a mac app and emailed it... it was such an adventure getting him to ignore the security warnings to run it...

FabHK8• 6 years ago

The alternative (that macOS not display security warnings when trying to run unsigned software that someone emailed you) doesn't seem better.

sm4rk0• 6 years ago

Can't you just use a PC?

henvic• 6 years ago

I've ran into this signing issue a few years ago when trying to distribute a binary for applications (tips, if you need to do so here: https://henvic.dev/posts/cs-security/), and while it's a hassle for developers I really appreciate that this is making using computer applications safer.

The next step is naturally adding boundaries about what applications can do just akin to containers, sandboxes, or permissions found on smartphones operating systems. I just hope some sort of standard emerges so we don't have each major vendor implementing their own incompatible system (okay, too late).

csense• 6 years ago

"Y'know, it sure would be a shame if our OS went around telling users your software's a virus. Now we c'n make sure this little problem doesn't happen to you, all you gotta do is fork over the $300 (yearly of course) to join our developer program."

Nothing like a good old protection racket. No wonder Apple's worth trillions of dollars.

saagarjha57• 6 years ago

$100/year

irrational• 6 years ago

The crazy thing is that I had no idea those dialog boxes have the malware warnings. I just look for the buttons and click.

ineedasername3• 6 years ago

As I understand it, the article was referring to applications built with Apple development tools. How does Gatekeeper treat applications developed in some other way, say an Electron app?

arkanciscan• 6 years ago

I don't understand how anyone with self-respect uses AAPL products. I guess it's true what they say about fools and their money.

rmrfrmrf2• 6 years ago

Now do this thought experiment again with MyTrojanKeylogger.app instead of MyGreatApp.app.

danShumway3• 6 years ago

Can you distribute Mac software over the internet without signing it, thereby avoiding Developer ID and notarization entirely? Technically, currently, yes, although Apple has indicated that a future version of macOS may not allow unsigned code to run at all.

I don't mean to keep beating a dead horse on this subject, but why are we acting like this is only a possibility? Apple is almost certainly going to remove the ability to run unsigned code in the future.

A day or two I wrote[0] about the timeline that took Facebook from guaranteeing that you'd never need to sign into an account on Oculus to requiring a Facebook account on Oculus. Different company, same story.

We spent a long time having concerns dismissed, and then once everyone was used to the idea and the uproar had been reduced to a manageable level, Facebook did it. People get told that they're paranoid when they express concerns about the future. Then those concerns turn out to be correct, but by then the concerns seems less dystopian, and we've moved on to dismissing other concerns even farther down the road.

I'm not going to find the other threads and articles, but:

Voice assistants: same story different companies. Concerns about recordings leaking, being distributed outside of the company to 3rd-party contractors were all paranoia until they weren't.

Facebook, again: same story different company. Facebook would need to be stupid to use 2-factor phone numbers for advertising and promotion services, the people worrying about that scenario were paranoid. Until they were proven right.

Browsers: same story different companies. You can not run unsigned extensions in Chrome. You can not run unsigned extensions in Firefox unless you are on the beta-version developer branch. In both cases, even though Firefox technically has an escape hatch, the effect is the same: normal no longer have the unrestricted ability to write software for their own devices.

I'm not going to argue that Mozilla's worries about malware aren't real, I'm not even going to argue about whether or not they made the right decision overall. BUT, anyone who thinks for one second that Apple isn't in a position to bring up the exact same security justifications for removing unsigned code from the Mac is fooling themselves.

We keep on taking these companies at face value, assuming the most permissive, conservative version of their policies, and then using that assumption to avoid talking about the real dangers of a corporate war on user-controlled general-purpose computing.

When Mac signing came out, so many people were telling me that it was stupid to object, because this was just about stopping specific malware. It would never be used to enforce a ToS or directly punish another company. So when we have conversations about Apple's dominance in the space, about what walled gardens mean for Apple, we need to have those conversations under the assumption that the most likely future is one where those same exact policies apply to both Apple phones and Apple desktop computers.

[0] https://news.ycombinator.com/item?id=24202879

stevage• 6 years ago

Personally, I don't think $99USD/year is an unreasonable burden for any business selling software targeted primarily at the MacOS platform.

konaraddi• 6 years ago

Can you distribute Mac software over the internet without signing it, thereby avoiding Developer ID and notarization entirely? Technically, currently, yes, although Apple has indicated that a future version of macOS may not allow unsigned code to run at all.

To my knowledge, this depends on what APIs you wanna use. Using certain capabilities like Network Extensions (the on-device low-level networking APIs) requires paying $99/year for the Apple Developer Program. See https://developer.apple.com/support/app-capabilities/ for more details.

sevensor2• 6 years ago

Hold on a minute -- MacOS phones home every single time you launch an application? As a non-user of MacOS, this strikes me as utterly bonkers. You'd have to place a massive level of trust in the developers of your OS to accept this. And furthermore, surely the constant attempts to phone home have a negative effect on the user experience when the computer's network connection is missing or slow!

Perhaps the fine article has mischaracterized this behavior?

obelix150• 6 years ago

This is correct, it attempts to check for notarization each time it is launched. In the case where there is no network connection most apps have the notarization "stapled" to the app meaning it actually carries the successful notarization authorization attached to the binary. This may short circuit checking for notarization with Apple's servers but I don't know if that happens for sure.

userbinator3• 6 years ago

As a non-user of MacOS, this strikes me as utterly bonkers.

I assume you use Linux or anything other than Windows? Because the "SmartScreen"[1] feature in the newer versions of Windows does the same thing.

[1] A common trend in these times: the word "smart" really means "we think you are stupid"

sevensor2• 6 years ago

You assume correctly. Although I do use Windows for my day job, my expectations for that OS are so low that I ascribed its performance shortcomings to incompetence. I'm not tremendously surprised to learn that self-sabotage was involved. Sometimes after I type my password at the Windows 10 lock screen, I'm treated to a 5 minute wait during which I get to speculate about what terrible decisions have got us to this point. I could cold-boot Arch on a ten-year-old netbook, use it to check the weather, and shut it back down in that amount of time.

rsfinn4• 6 years ago

As I understand it: If the application has been notarized before distribution, it should contain a signed “ticket” which allows the app to run immediately. If not, it will hit a server, but it caches the result on success, so it should not have to repeat the check.

_qulr16• 6 years ago

Hold on a minute -- MacOS phones home every single time you launch an application?

It's on first launch of an application, but not on subsequent launches of that application.

jeroenhd2• 6 years ago

Yes, this happens and it does cause slowdowns[1]. It can take several seconds to check an application if you're on a very slow internet connection.

The same happens on Windows through SmartScreen, but you can easily turn that off[2] at least. As far as I know, you can't disable this on macOS.

[1] https://sigpipe.macromates.com/2020/macos-catalina-slow-by-d... [2]: https://www.tenforums.com/tutorials/5593-turn-off-smartscree...

Marcus10110• 6 years ago

I deal with this every day, because we only notarize our electron app in CI if we're building the master branch or an RC branch. I don't see it mentioned in the article, but what gets me every time is that the "right-click" trick only works the second time you try to launch the app. The first time, right-click or not, MacOS won't let you launch the app.

I do wish Apple had a free tier for open source projects, just like many other tools on the web.

As an alternative, I wish there was an easy way to "sponsor" open source projects for this sort of thing. (I guess there is in some cases, but it's pretty hit or miss)

On Windows, although it's pretty easy to run unsigned applications, it's a huge pain to install unsigned 64 bit drivers, even if it's just the inf file that's custom. I've ended up signing open-source drivers several times with my own code signing certificate (a few hundred bucks every few years) although I haven't distributed the result. Drivers for things like USB SDRs.

_qulr16• 6 years ago

I don't see it mentioned in the article, but what gets me every time is that the "right-click" trick only works the second time you try to launch the app. The first time, right-click or not, MacOS won't let you launch the app.

Thanks for the comment! I've referenced this in a new addendum to the article.

waheoo3• 6 years ago

Why do so many in tech buy into a walled garden and then bitch about it later?

I could say whinge but it doesn't quite convey what I'm seeing here.

kalleboo• 6 years ago

We want our cake and to eat it too

_qulr16• 6 years ago

The problem is that we didn't buy into a walled garden. Mac OS X was an open platform from 2000 until 2012, when Gatekeeper was added, ostensibly for security. It's very difficult if you've invested in a platform for many years, and then the platform slowly transforms into something different.

waheoo3• 6 years ago

Its 2020.

Apple has been hostile to openness since inception, see: right to repair or basically any Louis Rossman video on YouTube.

Not to mention years of news stories showing how little apple cares for developers or individuals.

sergiotapia• 6 years ago

I miss the wild west of download random .exes and discovering news software. Time to sandbox a win95 box?

gfxgirl2• 6 years ago

Just thought I'd point out this is bad for Unity and Unreal. Tons of student devs making small games putting their apps on itch.io to share, no longer allowed unless they pony up $99 to Apple.

slmjkdbtl2• 6 years ago

This is my biggest concern too, cross-platform game dev is just so hard to do and you even have to deal with stuff like gatekeeper. I was just thinking about giving up cross-platform entirely now and just do the web which is plain simple

fizzled• 6 years ago

All of these people saying: switch to Windows, its better than mac!

Have you really done that? REALLY? Because I work on Mac, Win10 and Linux every day. And Win10 doesn't even come close to the other two in terms of reliability, stability, and lack of unnecessary bullshit.

I just don't understand who can make this claim that Win is better than Macos with a straight face. Maybe for gaming. Maybe. The cost/fps is clearly better for Windows machines, but Apple puts so much more thought into their OS than windows. Hell, Windows still pops a Win95 dialog for drivers. Come on, man. Seriously? MacOs doesn't have built in ads on the home screen. MacOS has no REAL viruses, and clicking on malware is even harder now than Windows.

Downvote me all you want, but I think a lot of people on this thread have never even used a mac for more than five minutes, let alone developed on one. HN monoculture is real.

arczyx• 6 years ago

but I think a lot of people on this thread have never even used a mac for more than five minutes, let alone developed on one. HN monoculture is real.

I for one, use mac and develop on it for my job, and I like windows significantly more than mac. Dunno how many people here are like me, but I don't think this kind of assumption is fair.

PetahNZ• 6 years ago

Number 2 here, use Mac as my day job, Windows for side jobs/home, Linux for server and things like media boxes. I prefer Windows.

lawl• 6 years ago

I think a lot of people on this thread have never even used a mac for more than five minutes, let alone developed on one.

I have when I started a new job and they gave me a macbook and said it's the only option. After 2 weeks I told them I'll need a linux box asap or I'll look for a different job.

It's in my opinion the absolute worst garbage of an operating system I've ever had the displeasure of using and their window manager is a completely unusable pile of shit. Their hardware doesn't have proper cooling and burns your hands if you actually use your CPU.

People have different tastes and I really don't think you should assume people haven't tried.

Yes, I too think windows is way better than OSX, but well I also think windows is pretty shit. However, I wouldn't quit my job over having to use windows, I would have for OSX.

realusername2• 6 years ago

I have the same opinion as well, to each their own. On my case Mac OS is dead last in my personal list when it comes to developing, I would even put it behind windows despite all the windows issues I hate.

hu32• 6 years ago

I had similar experience. They gave me a brand new beefed up macbook. I tried to like that thing. I really did. For months.

One day I just got tired of that thing overheating and being loud. Was given a real linux machine to work with.

SyneRyder• 6 years ago

Have you really done that? REALLY?

I did that after 13 years as an Apple/Mac customer. I was enough of an Apple fanboy that I queued on Day 1 for iPhone 4, and did various other things that only diehard Mac users who obsessively read Daring Fireball and MacRumors do.

I use a ThinkPad X1 running Windows 10 as my daily driver now.

The last Mac I bought was so unreliable that it had to be repaired six times by the Apple Store. Every six months the internal SATA cable failed. (Mid-2012 MBP, it's a known design flaw.) On one of those occasions, I had to help the Apple "Genius" understand what a SATA flex cable was, how it plugs into a drive, and provide him with part numbers because he couldn't find the parts on his Genius iPad. Apple refused to give me a replacement machine when I saw the manager after the second incident. It wasn't until the 5th time (!) that they finally offered a replacement Mac laptop... however, it would have been a 1st Gen butterfly keyboard model. Y'know, the model known to break so often that Apple introduced a separate "warranty" just for the keyboards.

It honestly took me until the 6th repair to understand that being an Apple customer (nevermind an Apple developer) is being in an abusive relationship. I had to get out, because frankly I needed to get work done instead of all this Apple Store repair downtime.

And that's not counting the $100s of App Store software I've lost when Apple forgot to renew their App Store Developer certificates & now the OS thinks those apps are corrupt, and I can't redownload them because the App Store doesn't keep old versions. Or how Apple mistakenly revoked the developer certificate for Charlie Munroe Software, so now the Eon business timer app I use has been remotely disabled by Apple, even though there's nothing wrong with it and Apple admits it was a false positive. Much like the false positive that won't let me launch my old REALbasic compiler anymore because Apple has flagged it as malware too. At least I stayed on High Sierra, so the 32-bit software that interfaces with my digital hardware guitar amp still works.

I've had my ThinkPad a couple of years now. I don't "love" it, but it hasn't broken on me in all that time, making it more reliable than all 4 Mac laptops I've owned. The keyboard is better than any Mac keyboard I've used, except maybe the 2000-era Pismo G3. Sometimes reliability and stability is more important - just get work done with the least downtime. I can run more audio software on Windows than was ever available for my Mac. I've never had a virus on Windows and I only run the built-in firewall & anti-virus, and I don't need to deal with that Xcode worm that's going around right now. And while there's a ton of apps that don't use it yet, the Windows approach to HiDPI works better for me than the Mac 2x / 4x system... being able to run a crisp 1.5x on my external monitor instead of jumbo 2x icons is bliss.

Honestly, I do understand where you're coming from, there's a lot Mac OS X got right and a ton of areas for Windows still to improve, but this is not the Snow Leopard era Apple anymore. Apple just doesn't care, unless it's an iPhone. And I switched to Android years ago....

reportgunner5• 6 years ago

Perhaps it's you who is bad if you need handrails to not fall off the stairs when using Win10.

I'm not claiming it's a good OS, but it is definitely possible to make it usable if you spend 20 minutes reading and 1 hour configuring.

habosa2• 6 years ago

I used exclusively Mac on my personal machines from 2005 to 2018. Then I switched to a Windows 10 laptop mostly because I was curious and it was cheap.

Windows 10 + WSL is amazing. It's definitely getting better all the time while macOS is getting worse each year. Plus more and more I just seem to only need Chrome, VSCode, and a Terminal.

So yes I have done it, and I now prefer Windows.

tomp2• 6 years ago

Windows 10 + WSL is amazing.

It truly is. Especially Surface Go - the best portable computer IMO (iPads aren't real computers).

Until it forcefully restarts to update overnight, killing all you apps.

IshKebab2• 6 years ago

Windows 10 is fine in terms of reliability and stability. In fact I find it better than Mac.

However in terms of the actual topic - code signing, Windows is almost as bad. If you run an unsigned program now you get a Smart Screen prompt and you have to click a small "More info" link and then "Run anyway".

It's a bit more obvious than Mac, and I believe there is some system to recognise common but unsigned binaries, but they're still clearly trying to head in the same direction, Apple are just a bit further down the slope.

whywhywhywhy3• 6 years ago

I use both daily, I love a lot of things about MacOS but I also love how insanely powerful my PC is for the price, OS preferences stop mattering when one machine can render a 4K image in 40 seconds using CUDA GPUs and the other it would take hours.

Windows 10 is slowly getting better every year and honestly there are only a handful of things left that I think really lag behind Mac, Explorer being the main one.

reliability, stability,

They're basically identical at this point, my PC runs for months on end just fine. One of my macs does the same, my USB-C MBP is the only standout as it kernel panics in it's sleep most nights.

If your Windows machine is having stability issues you probably have bad hardware, like my USB-C MacBook.

and lack of unnecessary bullshit.

I'd say they're both about the same, windows has it's issues but so does MacOS, my mac asks me every single day if I want to update the OS and there is no "No" option only "Restart" and "Later", it also warns me 10 times a day that the disk space is running low, yep I know it's low because it's a 128GB machine, nothing I can do to fix that.

The days of Apple being against this sort of stuff is over, my iPhone asks me once a month to subscribe to Apple music when I open my Music app, out of the box iPhones have Apple News notifications. Daily OS upgrade request on MacOS

davidwparker• 6 years ago

I switched to Win10 last November after 7 years on OSX (and 9 years before that on Linux). I've had no issues with it. Are you sure you use Win10 everyday?

tflinton• 6 years ago

Dear Mac, where the developer goes, your revenue goes.

userbinator3• 6 years ago

Is this only for GUI applications? Admittedly I have not done much development on Macs, but have done some exclusively-command-line work post-Gatekeeper, and have never seen that dialog (or a textual equivalent) appear when running binaries I compiled and even copied across machines; from the Terminal.

Incidentally I have never run those binaries via the Finder either, so it makes one wonder where exactly this check is --- is it something Finder does when you open apps, or when GUI libraries are loaded, or something much lower-level in the kernel, like on an exec() call? I don't have a suitable machine around at the moment to check, but the need to right-click suggests Finder is doing this?

slmjkdbtl2• 6 years ago

What about cli applications / scripts? Why macOS doesn't seem to prevent users from using those downloaded from the internet when they can also very likely be malicious according to apple

40four2• 6 years ago

Man, I really love my Macbook pro. Such a nice piece of hardware, and the OS is a joy to use. But the more and more I learn about about their business practices, the more I wonder if they are really in line with my own values, and the more I think about how much benefit I really gain from the OS.

Probably not as much as I used to think.

I'm starting to realize something. I'm almost certain I would be just as happy with a Linux capable laptop, loaded up with Ubuntu 20.04. I'm pretty sure my next laptop purchase will not be another Macbook pro. It will surely save me a ton of money, and I'm just not convinced the walled garden is adding enough to my life to make it worth it.

cryptica2• 6 years ago

I highly recommend Kubuntu. It looks ugly initially but you can customize it to look really good. There is even an OSX theme that you can download.

keyb0ardninja• 6 years ago

While I second the Kubuntu/KDE recommendation, I would suggest not using a Mac theme. Because that might get you in the mentality of trying to make a Mac out of Linux, which it is not. I recommended learning to use Linux like Linux with all its unique ideas and it's a joy to use.

Andrex• 6 years ago

I cannot recommend elementary OS enough, especially for those coming from macOS.

40four2• 6 years ago

I've been interested to try it out, but I've never hated Ubuntu desktop as much as some seem to, so I've never gotten up the motivation up to give it a go. My boss is very adamant about Linux Mint, and I tried one if his installations before, but I guess I just don't care enough about the desktop experience to make it worth it. Give me a terminal, a text editor, and a browser and I'm happy :)

pkamb• 6 years ago

I would have assumed that double-clicking is functionally equivalent to selecting “Open” from the context menu.

At least in Vista it was a separate command “Run as administrator”...

nojvek• 6 years ago

Well. This is how you make 2 trillion dollars right? Make tightly controlled marketplace where you are the king and tax the shit out of it.

Like it or not, America’s founders didn’t bow to the European kings, but now we have new tech emperors that we must bow to.

gspr• 6 years ago

I really don't mean this in an inflammatory way. Please take the question at face value.

Why does anyone who's a creator of anything stand for this?

danjc• 6 years ago

Fellow devs, I have to take the minority view here. How is $99/yr a number that any business should even care about? Even for OSS.

The reality is that the HN audience are complete outliers. Just look at the junk your friends and family install on their machines.

On a related note, the equivalent in Windows is SmartScreen. It prompts similarly to Mac for unsigned downloads as well as signed ones where there isn't yet sufficient reputation on the signing key. That last part is frustrating - we have a downloadable software component for our SaaS. It's not that frequently used and every time we renew the cert (third party BTW, not with MS), it takes a few weeks for SmartScreen to start trusting it.

latexr• 6 years ago

How is $99/yr a number that any business should even care about? Even for OSS.

If you’re including solo non-business programmers in that, I’ll say I find it unreasonable to ask of an open-source developer that in addition to giving their time to develop and support their software, they should also give their money.

It’s great that $100 is chump change for you. That’s not the case for everyone, certainly not all open-source developers.

But the issue isn’t about money, it’s about the control a petty company exerts on what you can develop: https://news.ycombinator.com/item?id=24217921

mpartel4• 6 years ago

The power that tech companies accumulate with tactics like this, and the justifications for that power, are strangely reminiscent of autocratic governments: we decide which programs you can develop and run, and we can levy an arbitrary 30% income tax (on top of regular VAT). But don't worry, it's all for your safety and security!

We are fast becoming corporate citizens, for better and for worse: https://www.youtube.com/watch?v=l3pkkSNRug4

While there is some truth to the security argument - security after all is sometimes at odds with freedom - good computer security can certainly be achieved without this degree of centralization of power. Maybe you can't protect a determined user from hurting themselves, but that seems like an acceptable price for freedom.

eecc2• 6 years ago

Frankly, I’m afraid your premise is a bit of a straw man argument.

I’m constantly running npm, mvn, sbt, docker and some that download hundreds of megabytes from unknown organizations, hosted on unknown servers, written by unknown developers.

Next to that, I’m running desktop applications downloaded roughly under the same circumstances, and was the update image it just installed when I opened it genuine? Transmission was 0wned, as well as Handbrake. Any other I was never aware of? Perhaps one that I’m currently using?

I have several GB of irreplaceable (to me) photos and financial documents on this laptop. When was the last time I tested my cold-storage restore procedure? (Hint: never.) What if I get hit by a ransomware? What if they grab my GAccount cookie and run away with my identity?

All this makes me fret, and aware of how much vulnerable my information persona has become.

I can run Linux, and trust Ubuntu or Debian or whatever to thoroughly audit and verify every line before PGP signing any package released for distribution (riiight, it’s already a gift out of free will, am I going to make demands now?) I could manage, begrudgingly though because I’m more interested in using the tool than to constantly grind it’s sharp edges.

But what about normal users? Not necessarily idiots. Just people that haven’t explored the dense thicket of Linux on the desktop and ACPI, and kernel driver (oh, by the way... what about those drivers?) Don’t they have the right to some trust and expectation of privacy? (that they can immediately forego and upload to Facebook)

Why must everyone constantly have to risk their own neck to defend someone else’s perception of freedom. Why should they all pay (in terms of risk and time mitigating against it) for something that someone else presumes it would benefit them?

Apple can abuse their grip on their integrated platform. Apple can turn this infrastructure into a rent-seeking scheme, into extortion.

But for the time being, they can’t deliver cryptographic app control soon enough.

mpartel4• 6 years ago

Heavily sandboxing apps by default is fine, and some Linux distros are, slowly, moving to do this - see e.g. AppArmor and Snap.

Even giving warnings by default about unsigned apps requesting high privileges would be fine if the implied message weren't basically "everything we haven't checked is malware". Something like "We nor any other provider you've chosen to trust have no idea who made this and we haven't checked if it contains malware. This program may steal and delete all your files. Be really sure you trust the author before running this." would be much more honest.

Good security does not require a single entity becoming the sole gatekeeper and taxman for a huge fraction of users.

Why must everyone constantly have to risk their own neck to defend someone else’s perception of freedom. Why should they all pay (in terms of risk and time mitigating against it) for something that benefits someone else alone?

I'm not advocating for Windows-levels of "install anything with access to everything with barely any warnings". And I wouldn't say you're "constantly risking your own neck" if you deliberately ignore warnings.

In computing as in society, I don't see how we can remove all possibility of getting cheated into hurting yourself (by installing malware in this case) without essentially submitting to some form of autocracy. And I think freedom benefits almost everyone, at least indirectly. As a concrete example, in the Apple/Epic case, an alternative game store would likely result in healthier competition i.e. lower prices. As another example, Hong Kong protesters with iPhones would have had an alternative way to coordinate: https://www.bbc.com/news/technology-49919459

kinglawrence• 6 years ago

"Apple has indicated that a future version of macOS may not allow unsigned code to run at all"

Anyone have a source for when Apple has indicated this?

hans_castorp• 6 years ago

How does this work for Java programs?

The actual java binary (JVM) can be (is?) signed and used for many different apps/programs. But the .jar file that is executed probably can't be signed.

(Note: I have never done any "native" Mac programming)

kossmoboleat• 6 years ago

I think it's fine to have more checks for "normal" users, but I'd like to see a better UI for experienced users.

Either there could be a pro-mode app/setting that let's use tone down the warnings a bit and give the extra "allow" option already in the first dialog.

And/or let app developers add an extra dialog to ask for ermissions on install (e.g. in Homebrew).

I haven't tested this but apparently you can disable Gatekeeper completely using:

sudo spctl --master-disable

from https://help.apple.com/xcode/mac/10.2/index.html?localePath=...

yreg• 6 years ago

although Apple has indicated that a future version of macOS may not allow unsigned code to run at all

Where is this comming from? I doubt Apple indicated such a thing.

devboxr• 6 years ago

I'm actually a big fan of this. Since macOS has become a lot more prevalent and most of my family and friends use it, I was asked A LOT less for IT support.

classics22• 6 years ago

It costs $349/yr to rent the magic number required to ship signed drivers for Windows. $99 seems pedestrian by comparison.

bencollier49• 6 years ago

I have a 2015 Macbook, and for the last year or so I've known it'll be my last Apple product. Perhaps in fifteen years when they've been displaced and have made a semi-contrite return a la Microsoft, I might look at buying their stuff again.

pkphilip• 6 years ago

The approach may be to start educating the Apple users to understand that these messages do not necessarily mean that the app itself is malicious or from a malicious source.

Yes, I know that ideally Apple should be allowing opensource apps or at least have a mechanism for opensource apps also to be verified by the gatekeeper and that is something we can campaign for, but in the absence of that, we can atleast educate the users.

guytv• 6 years ago

Free computing is dead. Apple and Google killed it.

cryptica2• 6 years ago

I don't understand how any developer can willingly use a Mac these days. When you buy a Mac, you don't own it.

I have a similar idea about services like Amazon Lambda; why would developers build apps tightly integrated with a product that they don't own.

Most millennials these days own nothing because they keep perpetually accepting their position as 'renters' through every decision they make.

scoot_718• 6 years ago

It hasn't been worth it to develop for Mac for a good while now.

mcintyre1994• 6 years ago

Also importantly Apple consider it legitimate to refuse to notarise apps if you break unrelated rules that have nothing to do with distributing malware and don't give any reason to think you're shipping anything dangerous. This was part of their threat to Epic Games.

stunt• 6 years ago

As macOS market share increases, Apple definitely doesn't want to become another attractive platform for malware developers like windows XP.

I guess if they make it more intuitive for users to run unsigned apps when they want to, everyone would be still happy with those restrictions. It's just about adding clear message and additional buttons. So I would be happy with having the option and my grandmother is also happy with some level of protection.

greatgib• 6 years ago

It's hard for me to understand how so many in their right mind can spend thousands of dollars to buy Apple stuff that are made to screw them and to transform them into toddlers!

habosa2• 6 years ago

I have yet to get a good answer to this question: what do these checks do?

They just confirm the developer has $100? Does Apple actually make sure signed binaries don't do anything bad?

jeroenhd2• 6 years ago

When an application turns out to be malicious, Apple can remotely disable it by invalidating the developer certificate globally.

This is how some mac viruses were stopped; the developer license was retracted, making the executables hard to open in the background, slowing the spread or even killing the virus during its infection track.

It also maintains Apple as the administrator of your computer. You may have paid Apple for your laptop, but it is Apple who decides what you can and cannot execute. Options to work around the blocks Apple throws up are reduced and made harder with every new release. I predict that eventually all binaries will need to have Apple's blessing or be signed with a corporate certificate, just like on iOS. It's still years away, but the direction Apple is taking this is obvious.

einpoklum• 6 years ago

I would say this is an example of how the user interface - and some of back-end plumbing - of a desktop environment [1] is not designed to serve users, their needs and interests. Instead, it's designed to serve Apple's needs and interests at the expense of users.

For me, this is a much stronger reason to avoid Apple software than whether it's FOSS or not. I can live with a company which makes some proprietary app. I mean, I am annoyed that access to it is restricted, but at least the "deal" is upfront.

When what I see and what I can run and how it runs is the object of direct partisan manipulation, and trade between commercial companies for epistemic access to a captive user-base, that's a whole other story and it just makes me sick.

---

[1] : I'm letting Apple enjoy the benefit of the doubt and assuming the "signing" business is not enforced at kernel-level, only by the graphical desktop environment's application launching mechanism.

the_other• 6 years ago

I wish Apple would apply this sort of security protocol to code which wanted to fingerprint my browser and identify my kids’ habits on the web.

realistcake• 6 years ago

It's good that at least one company these days still cares about protecting its users from viruses and malicious software. I feel like most other companies are just not doing enough.

blauditore• 6 years ago

To me, this is a lazy solution by Apple. It's easy to keep a whilelist of apps that were manually reviewed (for money!) and just block everything else, leaving out anyone who's not willing to join the club (or cannot afford it) out in the rain.

A more appropriate approach would be to use an actual malware detection system, similar to what AVs to when checking binaries (check fingerprints etc.). AFAIK this is what Windows does, and it's way more inclusive.

ronreiter• 6 years ago

The whole idea here is to protect the user. If it's important enough for you to have your app signed then you will do it.

iOS does this in a much more violent approach - the app verification process.

iso16312• 6 years ago

I'm the user, where can I disable this on my machine?

mFixman2• 6 years ago

I was surprised to find out the something even worse is happening on default installations of Windows 10: you cannot install non-Microsoft software at all unless you go to the system settings and disable "S mode".

It's impossible for someone who's not technically oriented to know how to disable S mode or even what it is, and trying to get my mum to install Google Chrome on her new computer was harder than it has any right to be.

When did the ability to run software get this bad?

benhurmarcel4• 6 years ago

Only some PC models come with S mode by default (notably the Surface do).

mFixman2• 6 years ago

S mode is active by default in regular, non-Surface Lenovo Ideapad laptops.

axilmar• 6 years ago

Why operating systems don't provide a sandbox for running unsigned apps by default?

Is your app signed and secured? it runs in the current environment. Otherwise it runs in a copy of the current environment, with restrictions as to what it can send/receive from the world.

tromp• 6 years ago

I'm very happy to have come across this sentence:

Finally, we see the instructions to right click. Err, control click.

Just recently I was on my iMac playing the "free guess" minesweeper where guessing is safe whenever you're forced to guess. The game needed a right-click to mark mines, and I got frustrated by Apple's magic mouse being prone to misinterpret right-clicks as left-clicks.

Now I know how to be in control with my right-clicks!

m12k• 6 years ago

You can ensure it doesn't interpret a right-click as a left click by lifting the fingers on the left side before right-clicking, then it'll work every time. Or do like me and ditch the magic mouse, since it's insane that a mouse would force you to do that just to be able to right click with any consistency.

catmistake2• 6 years ago

Disabling Gatekeeper From the Apple menu, open the "System Preferences" application. Click on Security & Privacy > General tab. If the lock in the left-hand corner is locked, click on it, then enter your Mac's username and password. This may not be required. Click "Anywhere" under "Allow applications downloaded from:". If you followed Step 3, please click the lock in the left-hand corner to return it to its locked state. Close "System Preferences".

jbergens• 6 years ago

Sounds like a security disaster for non-technical users. It is much better to trust a specific app from now on than to trust the entire internet from now on.

catmistake2• 6 years ago

The assumption is that developers need free reign. One would hope a developer is a technical and savvy user.

Not for nothing, Gatekeeper once did not exist. Myriads of Mac OS X users were not p0wned. But your point is not lost on me.

ttepasse• 6 years ago

Since MacOS Sierra the “Anywhere” option is not visible per default in the System preferences. To set Gatekeeper to “Anywhere” you‘ll need to do it via terminal:

  $ sudo spctl --master-disable

Then the “Anywhere” option is visible in the System Preferences UI. But only while active.

the_af• 6 years ago

As a data point: I am indeed a new Mac user, and I would never have guessed how to override gatekeeper and run the app if it weren't for (I think) stackexchange or a similar site providing detailed step-by-step instructions on how to do it. I'm a Linux power user so googling is no strange thing to me, but still, macOS really goes out of the way to hide this choice!

In my opinion, it's simply not possible to learn how to override it by following macOS UI "hints". Every step of the way seems designed to hide this possibility, instead of giving users a warning and a clear choice.

ho_schi• 6 years ago

Apple doesn't provide a good documentation and tools about manually creating Apple Bundles, Signing, Notarization and Stapling. When you cannot use XCode or don't want use XCode you're in the Apple Hell.

I've ported an already running and shipped desktop application from Linux and Windows to Mac. First and foremost you save some time with the network stuff because there is still some POSIX in MacOS and you got a usable shell also.

We cannot use reliable XCode, because it doesn't support Meson or anything else outside of Apples own world reliable. Compiling code with 'homebrew' works, yes.

Creating the App Bundle itself is the first big burden, because outside of XCode you have to create them fully manually and using 'otool' to adjust every library path which is used internally. Even the icons hurt you, you cannot provide one big PNG or SVG (Linux) or melt it into the executable (Windows), but a icon for every size someone can imagine. ImageMagick is your friend. What year is it? 1995?

Because we cannot use XCode and have to build stuff repeatable, we also stick with 'codesign'. Which is horrible to use, because it's recursive option is not reliable and you have to sign nearly every bit in an App Bundle. On Windows you sign the executable or the howl installer, here you sign nearly everything.

But watch out. The certificates included by default in your Apple Account are likely all false friends. There badly name and desribed and you cannot see that you don't get the needed type of certificate as non account owner. So be careful with company accounts! Always ensure that multiple people have permanent access to this as owners and can immediately accept the new terms - or you cannot ship anything anymore. Happened this spring/summer to me :(

Signing done? Fine. Now hope that your 3rd party code doesn't show nasty bugs after signing, like the code from our partner. Furthermore don't expect that MacOS tell you via console what is going wrong and what you need. But itt could maybe help a little.

Then uploading for "notarization" follows. I hope you didn't make something bad and placed the right file in the wrong directory of the bundle or it is declined.

Finally attach (staple) the notarization to your bundle! Or every Mac there will ask the Apple Servers if it is "okay to execute this code now". Without it privacy is lost. And the startup is slowed down also.

If your going to support MacOS, don't assume that portable code is portable. The shipping is actually the hard part.

lordgrenville• 6 years ago

I (a savvy and sophisticated dev who knows all about right-clicking) got stuck with this today with an unsigned binary of a command-line program. Right-click open didn't work since the OS didn't know which program to use to open it, so there was no "open anyway" option. Launching from the Terminal gave me the familiar MALWARE! PRIVACY! pop-up. Solution was to open System Preferences -> Security, click the lock, then below the radio button for "allow apps from App Store/identified developers" there was a button allowing a manual override.

Dahoon• 6 years ago

And yet Apple is supposedly better at UI and UX than anyone else. I still can't see it no matter how many times I use Apple software.

lwouis• 6 years ago

I'm the main contributor of an app that emulates Windows's alt-tab feature on macOS (https://github.com/lwouis/alt-tab-macos). I researched this topic extensively, and eventually decided that I would bite the bullet and pay from my own pocket, so that users get a good UX when launching the app.

It is displeasing to see Apple not having an open-source program in-which they give free certificates for popular open-source projects after a review. They are a large beneficiary of OSS after all.

Furthermore, smaller companies do it frequently these days: Jetbrains gave me free IDE licenses, poeditor gave me a free account, github hosts the project code, ticketing system, and is the distribution channel for first downloads and updates, appcenter hosts crash reports for free, travis does the CI for free, etc.

Can't you just right click?

Related Stories