Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Can't you just right click?

lapcatsoftware.com

Post reply on HN
Print view View original

21–30 of 765 posts

Re: Can't you just right click?

#21

Post by saagarjha »

tracker1 wrote: post #17
cuddlybacon wrote: post #6

This feature is at about the right spot for me. It is still convenient enough for me to run software I want that isn't signed, but sufficiently obtuse that neither of my parents have figured it out. Given they are both prone to running any executable that any website tells them to download and run, this feature has probably save me several dozen hours of fixing their computers.

My answer to that was chromebooks.

Chromebooks are in a pretty good spot of balancing security with hackability. Apple should take a couple leaves out of their book…

Re: Can't you just right click?

#22

Post by lucb1e »

saagarjha wrote: post #13
lucb1e wrote: post #2

This makes me wonder how open source is supposed to work on macOS. People seem to become more and more aware of it and even enterprises that insisted on support contracts can see that they can't get around open source completely anymore. Meanwhile Apple is removing the ability for me to have a pet project without paying an Apple tax. If the message were completely transparent, something like "The developer didn't pay…

Many (often cross-platform) apps are no longer signed, so they throw up this warning–I assume that users of these have long since learned that the warning is just something they need to bypass. macOS-native apps have largely adopted notarization and the fee that comes with it. Open source command line tools do not need to be notarized. Interestingly enough, it seems to be possible to notarize someone else's app , so…

> learned that the warning is just something they need to bypass

Note that I'm not necessarily arguing that training people to click "yes, yes, continue..." is a good idea. Digital security is my day job and I totally see why Apple wants digital signatures for software. However, the message is opaque about what is really going on and just tries to scare people into buying "trusted" software rather than using free software: that developer fee doesn't pay itself.

> perhaps it might be a worthwhile use of my developer ID to provide this service to people I trust

I was thinking the same, we could pool the money, but figured Apple almost certainly prohibits that "for security".

Re: Can't you just right click?

#23

Post by dec0dedab0de »

I dont see any problem with this. If you don't feel comfortable doing this then you definitely shouldn't be running random code from the internet. I would take it a step further and force it to be run from the command line.

Also, what kind of "viable software business" has trouble paying $100 a year?

Re: Can't you just right click?

#24

Post by yaur »

cuddlybacon wrote: post #6

This feature is at about the right spot for me. It is still convenient enough for me to run software I want that isn't signed, but sufficiently obtuse that neither of my parents have figured it out. Given they are both prone to running any executable that any website tells them to download and run, this feature has probably save me several dozen hours of fixing their computers.

I believe this is bubbling up because apple recently revoked Epic's certificate (sorry if that isn't quite the right term) and these are now the steps required to run Fortnight on Mac.

Re: Can't you just right click?

#25

Post by antipaul »

Here is Apple’s calculus:

What fraction of unsigned app openings, across the entire world each and every day, are safe?

If 99% of these events are unsafe, then such an experience seems warranted, given real malware and security threats.

The question is, what is that fraction?

Folks may say I want my computer to be “open” but do you want it open in the same way for your grandad and grandma?

Re: Can't you just right click?

#26

Post by Shared404 »

dmart wrote: post #12
d_tater wrote: post #5

Windows is starting to pull the same shit. Walled garden OS's are the future for most regular users.

Good. Regular users are not sufficiently computer-savvy to avoid being tricked into installing malware.

Bad. Users will get more trapped and have less mobility to become computer-savvy.

That, or their "techy friend" will jailbreak it for them, and now we're worse off in every way.

Re: Can't you just right click?

#27

Post by aaomidi »

dec0dedab0de wrote: post #23

I dont see any problem with this. If you don't feel comfortable doing this then you definitely shouldn't be running random code from the internet. I would take it a step further and force it to be run from the command line. Also, what kind of "viable software business" has trouble paying $100 a year?

Any open source developer?

Do you know how much $100 is in Iran?

Re: Can't you just right click?

#28

Post by themacguffinman »

lstamour wrote: post #8
LeoPanthera wrote: post #3

This behavior frustrates me, as a seasoned (=old) Mac user, but I am simultaneously quite grateful for it existing on my parents Macs. It would be nice if there was a Sys Prefs option to add a "run anyway" button to the initial prompt. It wouldn't even need to be on by default. Just give me the option.

But then you’ll have websites that walk you through changing the setting. At least this way you have to make a decision every time, even if it costs you a few clicks each time you do it.

They can do the same for the right-click technique. Omitting a setting does not change the user's understanding of the decision, it just makes this completely undiscoverable and tedious for users who know what they're doing.

Re: Can't you just right click?

#29

Post by saagarjha »

white-flame wrote: post #10

The fact that the standard model of computing is that applications are opaque machine code blobs that can access everything in your user permission space is the core problem in privacy and malware. Applications should see nothing but their executable jail, and whatever was intentionally allowed to them by the user (eg, Open file dialog giving the application an opaque file handle, etc, not carte blanche access to the…

macOS ships with a quite strong and granular capability-based security model with its sandboxing mechanism (at least, when it works and is applied correctly). The feature is there, advanced applications already make use of it, but it is difficult to get arbitrary applications to adopt it (its inner workings are declared SPI after all) and it is not really exposed to the user at all except via App Sandbox, which is fairly limiting.

Re: Can't you just right click?

#30

Post by ryandrake »

lucb1e wrote: post #2

This makes me wonder how open source is supposed to work on macOS. People seem to become more and more aware of it and even enterprises that insisted on support contracts can see that they can't get around open source completely anymore. Meanwhile Apple is removing the ability for me to have a pet project without paying an Apple tax. If the message were completely transparent, something like "The developer didn't pay…

It seems like the right balance. As the author says:

> As a Mac developer, it's nearly impossible to run a viable software business when this is the first-run experience of new customers. You'll never get any new customers! This is why every Mac developer I know signs up for Developer ID and ships only signed, notarized apps. It would be financial suicide to do otherwise.

If you have hung your shingle out to make a profit, then the developer account, signing, notarizing, etc. is a cost of doing business, and you can easily justify it. The more customers you get, the more money you get, so you are motivated to reduce the first-run friction.

If you are not in it for profit, you probably have a lot more tolerance for a little first-run friction, and having users drop out of the funnel. Fewer users does not affect you financially. As a hobbyist programmer, I wouldn't care. I'm just releasing a program--not looking to dominate a market.

Post reply on HN