61–70 of 101 posts
What output is expected when you run the command? I get: $ spctl --assess --verbose /Applications/Xcode.app /Applications/Xcode.app: rejected source=obsolete resource envelope I downloaded XCode via the app store, but have disabled gatekeeper (re-enabled it before running this command).
Am I understanding this correctly: the devs who downloaded Xcode from an unknown source disabled gatekeeper to get it to run? That's unbelievably stupid dev behavior, if true.
I see a lot of people saying they disable Gatekeeper on purpose. Is the "right-click and open" trick that disables Gatekeeper for that app generally unknown? Or do people value not being assed to do it more than (potential) security upsides?
Am I understanding this correctly: the devs who downloaded Xcode from an unknown source disabled gatekeeper to get it to run? That's unbelievably stupid dev behavior, if true.
I see a lot of people saying they disable Gatekeeper on purpose. Is the "right-click and open" trick that disables Gatekeeper for that app generally unknown? Or do people value not being assed to do it more than (potential) security upsides?
Earlier quoted context omitted.
I'm fascinated that there are people on HN who have not disabled GateKeeper. I'm not sure i've used a machine since it was added where i haven't disabled it within an hour of setting up a machine.
How often do you install new software that's unsigned? I've only done it a couple of times, and once you override Gatekeeper for a specific app it never asks you for that one again.
Earlier quoted context omitted.
How often do you install new software that's unsigned? I've only done it a couple of times, and once you override Gatekeeper for a specific app it never asks you for that one again.
I rarely find apps on the Mac app store, they're usually always from the app's creator's website. Recent ones I can think of include Bowtie and Sublime Text 3.
Am I understanding this correctly: the devs who downloaded Xcode from an unknown source disabled gatekeeper to get it to run? That's unbelievably stupid dev behavior, if true.
This is generally known as hubris. We think we're smart and that the rules don't apply to us, because we know better than the other people. Turns out they can protect us too. Who knew?
In this instance, I'd give the Chinese developers the benefit of the doubt, having recently had first hand experience myself of just how obstructive and irritating the great firewall can be (I was struggling to download small files my entire visit, like a 10MB pdf; I can't imagine trying to download a multi-gigabyte file). So perhaps this was the only way they could get work done–in which case it's on Apple to improve their CDN within China.
More broadly, it seems like though there's a careful line to be walked between locking down a computer (e.g. gatekeeper, system integrity protection) and keeping it 'open', I'm personally much more in favour of the former by default provided that the end user can disable it if necessary. It seems like the only realistic option going forward. Perhaps Xcode should be included under the SIP umbrella too?
So, the next Trojan version of Xcode also needs to replace or corrupt spctl. I should look at it (on iPad currently), but it seems like the right combination of a custom Certificate Authority added to the keychain and signing your malicious Xcode with a certificate signed by the CA would help. Maybe also change the quarantine metadata on the file?
I think that's what SIP is for: https://en.wikipedia.org/wiki/System_Integrity_Protection
Presuming, of course, that whatever process may have corrupted your version of Xcode didn't also corrupt spctl. Heh.
Earlier quoted context omitted.
disabled gatekeeper to get it to run Not necessarily - they might have disabled GateKeeper a long time ago and never re-enabled it. I have the same complain with Android's "allow software from third parties" checkbox - it's a little useless because you uncheck it for one specific app you downloaded, but probably leave it unchecked forever more.
If you run an app that gatekeeper forbids, when you go into settings to fix that there is a button to approve that single app. There's no need to let everything through.