Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Validating Your Version of Xcode

developer.apple.com

Post reply on HN
Print view View original

41–50 of 101 posts

Re: Validating Your Version of Xcode

#41

Post by pilif »

e28eta wrote: post #14
pilif wrote: post #3

Earlier quoted context omitted.

> seems like the right combination of a custom Certificate Authority added to the keychain and signing your malicious Xcode with a certificate signed by the CA would help nope. Gatekeeper only accepts certificates issued by Apple. The trojan would have to patch gatekeeper itself which will be difficult once people upgrade to 10.11 and keep the System Integrity Protection enabled. Even with all the bad feelings about…

I think this Tech Note says otherwise. It talks about Enterprise being able to manage code signing outside of Apple, and I believe it says with admin privileges a user can mark a CA as valid for code signing. I think code signing is voodoo for most developers, and therefore believe you could fool most of them into accepting the change if an appropriately worded dialog preceded it. https://developer.apple.com/library/…

I'm not sure. The way I read this is that enterprises can disable Gatekeeper and then add a CA by which the binaries need to be signed.

Gatekeeper seems to really be tied to Apple's CAs.

Of course, if you're willing to download XCode from a shady source, you're also willing to disable Gatekeeper when it prevents you from launching your shady copy, so the point is moot I guess.

edit: Stackoverflow seems to agree: http://stackoverflow.com/questions/11833481/non-apple-issued...

Re: Validating Your Version of Xcode

#43

Post by Eric_WVGG »

soccerdave wrote: post #36
klausa wrote: post #24

Earlier quoted context omitted.

I see a lot of people saying they disable Gatekeeper on purpose. Is the "right-click and open" trick that disables Gatekeeper for that app generally unknown? Or do people value not being assed to do it more than (potential) security upsides?

I wasn't aware of this shortcut until now. I've been going the long route through Settings. Thanks for the tip!

same. Awesome, but unlikely to be common knowledge IMO.

Re: Validating Your Version of Xcode

#44

Post by justinzollars »

Laaw wrote: post #37
simonvc wrote: post #28

What output is expected when you run the command? I get: $ spctl --assess --verbose /Applications/Xcode.app /Applications/Xcode.app: rejected source=obsolete resource envelope I downloaded XCode via the app store, but have disabled gatekeeper (re-enabled it before running this command).

I got: /Applications/Xcode.app: accepted source=Mac App Store override=security disabled Which I think means I have Gatekeeper disabled, but it still gave me the 'accepted' response.

Okay, yes it means Gatekeeper is disabled after enabling the feature I see the expected output.

jzollars$ spctl --assess --verbose /Applications/Xcode.app /Applications/Xcode.app: accepted source=Mac App Store

Re: Validating Your Version of Xcode

#45

Post by seiji »

deathanatos wrote: post #19
joosters wrote: post #5

Earlier quoted context omitted.

I can't remember if Xcode asks for admin privileges or not when you install it... ...mind you, I guess that doesn't matter. If I unknowingly had a hacked version and it prompted me for my password at install, I would enter it.

It does — it requires root to agree to the XCode license: https://stackoverflow.com/questions/26197347/agreeing-to-the... This seems to even be required to run things like the stock git or gcc, which I've always wondered how that isn't a violation of the GPL.

Yeah, I ran across "You must agree to Apple Terms and Conditions" when running command line make after an Xcode update last week.

So, then you have to run sudo make to invoke the global license agreement console interface, then you manually type 'agree', then it runs the original command, except now you're running under sudo. In this case, that means it ran make as root, leaving root-owned artifacts all over my source tree.

Re: Validating Your Version of Xcode

#46

Post by eevilspock »

simonvc wrote: post #28

What output is expected when you run the command? I get: $ spctl --assess --verbose /Applications/Xcode.app /Applications/Xcode.app: rejected source=obsolete resource envelope I downloaded XCode via the app store, but have disabled gatekeeper (re-enabled it before running this command).

Even if you download from the AppStore, if any bits are corrupted it will be rejected, and rightly so.

Re: Validating Your Version of Xcode

#49

Post by liquidise »

cjensen wrote: post #8

Am I understanding this correctly: the devs who downloaded Xcode from an unknown source disabled gatekeeper to get it to run? That's unbelievably stupid dev behavior, if true.

I'm fascinated that there are people on HN who have not disabled GateKeeper. I'm not sure i've used a machine since it was added where i haven't disabled it within an hour of setting up a machine.

Re: Validating Your Version of Xcode

#50

Post by epmatsw »

liquidise wrote: post #49
cjensen wrote: post #8

Am I understanding this correctly: the devs who downloaded Xcode from an unknown source disabled gatekeeper to get it to run? That's unbelievably stupid dev behavior, if true.

I'm fascinated that there are people on HN who have not disabled GateKeeper. I'm not sure i've used a machine since it was added where i haven't disabled it within an hour of setting up a machine.

How often do you install new software that's unsigned? I've only done it a couple of times, and once you override Gatekeeper for a specific app it never asks you for that one again.
Post reply on HN