Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Validating Your Version of Xcode

developer.apple.com

Post reply on HN
Print view View original

21–30 of 101 posts

Re: Validating Your Version of Xcode

#21

Post by e28eta »

X-Istence wrote: post #12
devit wrote: post #6

Earlier quoted context omitted.

One should of course verify its integrity BEFORE installing it and letting it replace spctl. The real question is whether the spctl tool displays "Apple" in case of a valid (relative to generic CAs) certificate issued to "Apple". Hopefully that's not the case. Another risk is a specifically designed executable capable of compromising spctl.

On machines with Gatekeeper enabled you won't be able to open the application without it verifying the signature. Devs would have to on purpose remove that protection to run this bad version of Xcode, and after that it is practically game over.

How about an "install" script, written in your scripting language of choice? Sufficiently obscure language, obfuscate the code, leave misleading comments and copyright statements to look like its from Apple...

Re: Validating Your Version of Xcode

#22

Post by kitsunesoba »

joosters wrote: post #7
kitsunesoba wrote: post #4

Earlier quoted context omitted.

That'd be fairly difficult under El Capitan as long as the user hasn't disabled rootless (even su/sudo can't modify system files with rootless on). Not sure about the signing part.

Just put a copy elsewhere and surreptitiously edit PATH so that the malicious one gets picked first. No need to delete any files.

Unless the binary is signed properly, that'll trigger the gatekeeper warning, with the the dialog mentioning a cryptically-named binary and the icon showing as a generic "headless program" terminal-looking icon. If that doesn't set off all kinds of red flags you probably deserve infection.

Re: Validating Your Version of Xcode

#23

Post by gpvos »

nadams wrote: post #15
jlarocco wrote: post #13

Earlier quoted context omitted.

I don't think having Gatekeeper disabled is a very big deal. It's one of the first things I disable on a new Mac. I've never had it stop an actual piece of malware, and it triggers false positives on practically everything. That said, I have no idea why anybody would download XCode from a third party...

> That said, I have no idea why anybody would download XCode from a third party... Easily explainable really. Went to [their favorite search engine], searched for "Xcode download" and clicked the first result which may not be from Apple (or an advertising).

If you do that, you're too stupid to be a developer, really.

Re: Validating Your Version of Xcode

#24

Post by klausa »

cjensen wrote: post #8

Am I understanding this correctly: the devs who downloaded Xcode from an unknown source disabled gatekeeper to get it to run? That's unbelievably stupid dev behavior, if true.

I see a lot of people saying they disable Gatekeeper on purpose.

Is the "right-click and open" trick that disables Gatekeeper for that app generally unknown? Or do people value not being assed to do it more than (potential) security upsides?

Re: Validating Your Version of Xcode

#25

Post by loumf »

deathanatos wrote: post #19
joosters wrote: post #5

Earlier quoted context omitted.

I can't remember if Xcode asks for admin privileges or not when you install it... ...mind you, I guess that doesn't matter. If I unknowingly had a hacked version and it prompted me for my password at install, I would enter it.

It does — it requires root to agree to the XCode license: https://stackoverflow.com/questions/26197347/agreeing-to-the... This seems to even be required to run things like the stock git or gcc, which I've always wondered how that isn't a violation of the GPL.

You need it for the installer to install it. I haven't read the agreement, but perhaps it makes clear that it only applies to the Apple licensed products.

Re: Validating Your Version of Xcode

#26

Post by untog »

cjensen wrote: post #8

Am I understanding this correctly: the devs who downloaded Xcode from an unknown source disabled gatekeeper to get it to run? That's unbelievably stupid dev behavior, if true.

disabled gatekeeper to get it to run

Not necessarily - they might have disabled GateKeeper a long time ago and never re-enabled it. I have the same complain with Android's "allow software from third parties" checkbox - it's a little useless because you uncheck it for one specific app you downloaded, but probably leave it unchecked forever more.

Re: Validating Your Version of Xcode

#27

Post by kitsunesoba »

masklinn wrote: post #17
cjensen wrote: post #8

Am I understanding this correctly: the devs who downloaded Xcode from an unknown source disabled gatekeeper to get it to run? That's unbelievably stupid dev behavior, if true.

Disabling gatekeeper is not uncommon, and was really common early on as many applications were not signed yet. Downloading Xcode from a third party, now that's stupid.

I personally leave gatekeeper enabled. If I really need to run unsigned binaries I can just right-click -> open in the Finder. This way, any runs of unsigned code is only allowed because of an explicit per-instance decision on my part. It may be overkill, but I think the extra safety gained is worth it.

EDIT: I should mention that I work as an iOS engineer. Gatekeeper has not once impeded my work.

Re: Validating Your Version of Xcode

#28

Post by simonvc »

What output is expected when you run the command? I get:

  $ spctl --assess --verbose /Applications/Xcode.app
  /Applications/Xcode.app: rejected
  source=obsolete resource envelope
I downloaded XCode via the app store, but have disabled gatekeeper (re-enabled it before running this command).

Re: Validating Your Version of Xcode

#30

Post by 0x0 »

Some news sources said Angry Birds 2 was trojanized, but "only" for the Chinese version. Anyone have any more info on that? Because I didn't think you could have separate binaries per location? Unless it is actually two entirely separate apps? And why would they even have a separate binary for the Chinese market (and why would they use a different build environment?)
Post reply on HN