Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Catalina is checking notarization of unsigned executables

lapcatsoftware.com

Post reply on HN
Print view View original

91–100 of 182 posts

Re: Catalina is checking notarization of unsigned executables

#91

Post by usmannk »

_qulr wrote: post #75
usmannk wrote: post #57

Earlier quoted context omitted.

This is odd, my proxy doesn't seem to show this. I will try to load my root cert into Wireshark and check. Edit: Checked and double checked: When I run a new shell script, syspolicyd just makes a connection with no application data

I'd recommend trying this: Download a notarized Mac app, delete any stapled notarization ticket (.app/Contents/CodeResources), and then trace the launch. What do you see, and does the system let you open the app? Does it say it checked for malware?

Ah I see, looks like we're not running quite the same experiment. I suspect that anything including an app bundle ID is going to see some more interesting traffic.

Re: Catalina is checking notarization of unsigned executables

#92

Post by abjKT26nO8 »

MintelIE wrote: post #73
FpUser wrote: post #72

Earlier quoted context omitted.

> "99% of people do everything in a browser these days anyhow." This exaggeration is clearly absurd.

Are you certain about this? I think I was being conservative. It's easy for us tech nerds in our little gadget bubbles to suppose that everybody is like us. But most people are simple browser users, and Office 365 and Google Docs have all but killed off office software on the desktop for many users.

On the contrary, it's easy in our tech bubble to assume that everybody else uses a computer just for mail, netflix and spreadsheets, when in reality most people have niche needs. It's just that there are many niches. E.g. I know people from scientific circles who use CAS software I've never even heard of, my sister is an architect and needs to use CAD software. YouTube video authors often use advanced video editing software. Musicians use audio editing software. Publishers use Adobe InDesign. Then there are gamers. This "not geek => mainly spreadsheet user" stereotype is really strange.

And basically everybody, whom I know personally, complains about the UX of anything web-based, so don't even think about putting CAD, CAS or InDesign into the browser.

Re: Catalina is checking notarization of unsigned executables

#93

Post by saagarjha »

MintelIE wrote: post #62

Why don't companies come out and tell people what they're doing these days? Telemetry is getting to the point where people such as doctors and lawyers might be violating the law by using a modern computer. And people in the defense industry? Doesn't Apple employ thousands of forns? Who's audited their datasystems and ensured that this stuff stays private? Much easier and better to just stop using it all and move to a…

Sorry, what's a forn?

Re: Catalina is checking notarization of unsigned executables

#94

Post by _qulr »

usmannk wrote: post #91
_qulr wrote: post #75

Earlier quoted context omitted.

I'd recommend trying this: Download a notarized Mac app, delete any stapled notarization ticket (.app/Contents/CodeResources), and then trace the launch. What do you see, and does the system let you open the app? Does it say it checked for malware?

Ah I see, looks like we're not running quite the same experiment. I suspect that anything including an app bundle ID is going to see some more interesting traffic.

Don't suspect, test. ;-)

I'm running both experiments. I've tested and compared script notarization to app notarization.

You're getting apparently unusual results with script notarization. So the natural next step would be to compare against app notarization.

Re: Catalina is checking notarization of unsigned executables

#95

Post by saagarjha »

72deluxe wrote: post #39
rimliu wrote: post #29

Earlier quoted context omitted.

I upgraded my 2015 MBP 13" to Catalina and happily continue to Mac stint since 2006.

What does df -h in the terminal say? It'll show the total of each partition (the normal, and the new read-only system partition) on their own line, thereby giving a false total. e.g. 1x 100GB disk, 50GB normal, 50GB system partition will show as capacity 100GB for both partitions which would mean a 200GB disk. Small things like this just make me completely lose faith in Catalina. EDIT: Other "fun" things I noticed wi…

> Text search in PDF no longer works

In Safari or in general? I have only noticed the former.

> I have to use synthetic.conf to map paths from / to my real partition, but the parser of synthetic.conf is very particular to tabs/spaces unlike any other /etc/ file format

You may already know this, but man synthetic.conf will explain that you must use tabs.

> Xcode wants to ask for my password to debug every single time I reboot and debug a C++ app. This is incredibly incredibly incredibly incredibly annoying.

I can only offer you my condolences as I cruise by with SIP off.

Re: Catalina is checking notarization of unsigned executables

#96

Post by saagarjha »

takeda wrote: post #52
Gaelan wrote: post #35

Earlier quoted context omitted.

It's probably Radar, which is Apple's internal issue tracker, which isn't public (you can see issues you submitted, but nothing else). Sometimes people cross-post issues they submit to http://openradar.appspot.com , so you might be able to find it there.

The issue is FB7674490 but it is not on the OpenRadar. Looks like OpenRadar is not Apple's services and issues appear there only if author (which has access to the issue in the Apple system) submits them there.

Open Radar is community maintained and fairly poorly at that these days :(

Re: Catalina is checking notarization of unsigned executables

#97

Post by saagarjha »

Gaelan wrote: post #35
usmannk wrote: post #33

Earlier quoted context omitted.

I did see the previous article (another comment of mine should be easy to find on its HN post). Do you know how to find the issue that was referenced? There was an ID given but I have no clue what tracker that was on.

It's probably Radar, which is Apple's internal issue tracker, which isn't public (you can see issues you submitted, but nothing else). Sometimes people cross-post issues they submit to http://openradar.appspot.com , so you might be able to find it there.

FB numbers come from Feedback Assistant, which are similarly non-public and feed into Radar through a convoluted process.

Re: Catalina is checking notarization of unsigned executables

#98

Post by katmannthree »

saagarjha wrote: post #93
MintelIE wrote: post #62

Why don't companies come out and tell people what they're doing these days? Telemetry is getting to the point where people such as doctors and lawyers might be violating the law by using a modern computer. And people in the defense industry? Doesn't Apple employ thousands of forns? Who's audited their datasystems and ensured that this stuff stays private? Much easier and better to just stop using it all and move to a…

Sorry, what's a forn?

Foreign national, probably.

Re: Catalina is checking notarization of unsigned executables

#99

Post by saagarjha »

huslage wrote: post #45

This is a specious problem _at best_. We have a very secure operating system doing things that others don't even try to do (notary) and we are complaining because our shell scripts take n seconds to run? Really people? If you are running signed and notarized (stapled) binaries, the system never even reports them to Apple in the first place. This is the height of insanity to think that Apple or anyone else would want…

> We have a very secure operating system doing things that others don't even try to do

Perhaps because such a system is extremely centralized?

> we are complaining because our shell scripts take n seconds to run?

Yes? If I buy a computer and it spends time doing stupid stuff, then I think I am fairly justified in being angry.

> If you are running signed and notarized (stapled) binaries, the system never even reports them to Apple in the first place.

Great, let's notarize and staple tickets to every little piece of software you write…

> This is the height of insanity to think that Apple or anyone else would want this data or use it for some nefarious purposes...anonymous hashes of junk data are essentially useless outside of this purpose.

Executable hashes tell you if someone is running a specific piece of code.

> It's fine to claim not to trust anyone for anything, but most of us aren't willing or able to build our own hardware, write our own operating system, and write our own applications.

That's why I buy them from other people and would desire them to be good.

> We have asked our vendors for devices and code that are more trustworthy, and when they give them to us we COMPLAIN about it incessantly.

How exactly does this make the device more trustworthy?

Re: Catalina is checking notarization of unsigned executables

#100

Post by cschep »

72deluxe wrote: post #39
rimliu wrote: post #29

Earlier quoted context omitted.

I upgraded my 2015 MBP 13" to Catalina and happily continue to Mac stint since 2006.

What does df -h in the terminal say? It'll show the total of each partition (the normal, and the new read-only system partition) on their own line, thereby giving a false total. e.g. 1x 100GB disk, 50GB normal, 50GB system partition will show as capacity 100GB for both partitions which would mean a 200GB disk. Small things like this just make me completely lose faith in Catalina. EDIT: Other "fun" things I noticed wi…

Checkout `DevToolsSecurity` on the command line. Could help with d. :)
Post reply on HN