Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Can't you just right click?

lapcatsoftware.com

Post reply on HN
Print view View original

41–50 of 765 posts

Re: Can't you just right click?

#41

Post by turblety »

FreakyT wrote: post #7

I still believe that Gatekeeper is a blatant cash grab and not a legitimate security feature. $100/year to avoid a scary warning about how your app is definitely a virus? It's like a protection racket.

It absolutely is a cash grab, and part of a series of unethical behaviour from Apple.

Since the latest awful hardware products (terrible keyboard, control strip thing that breaks, no escape key) with MacBooks and a great improvement with using Linux via Purism and System76 I've managed to move away from Apple.

Re: Can't you just right click?

#42

Post by [deleted] »

saagarjha wrote: post #36
lucb1e wrote: post #22

Earlier quoted context omitted.

> learned that the warning is just something they need to bypass Note that I'm not necessarily arguing that training people to click "yes, yes, continue..." is a good idea. Digital security is my day job and I totally see why Apple wants digital signatures for software. However, the message is opaque about what is really going on and just tries to scare people into buying "trusted" software rather than using free sof…

Not only is the message opaque, but it is intentionally misleading. I know the security team at Apple occasionally has trouble coming up with good explanations of what is going on, but this message really can't be looked at in any way other than being misleading, sorry. And you are absolutely right that misleading messages like these train users to click through warnings.

[deleted]

Re: Can't you just right click?

#43

Post by andrekandre »

saagarjha wrote: post #29
white-flame wrote: post #10

The fact that the standard model of computing is that applications are opaque machine code blobs that can access everything in your user permission space is the core problem in privacy and malware. Applications should see nothing but their executable jail, and whatever was intentionally allowed to them by the user (eg, Open file dialog giving the application an opaque file handle, etc, not carte blanche access to the…

macOS ships with a quite strong and granular capability-based security model with its sandboxing mechanism (at least, when it works and is applied correctly). The feature is there, advanced applications already make use of it, but it is difficult to get arbitrary applications to adopt it (its inner workings are declared SPI after all) and it is not really exposed to the user at all except via App Sandbox, which is fa…

> but it is difficult to get arbitrary applications to adopt it

just curious, but what makes it specifically hard?

Re: Can't you just right click?

#44

Post by koyote »

cuddlybacon wrote: post #6

This feature is at about the right spot for me. It is still convenient enough for me to run software I want that isn't signed, but sufficiently obtuse that neither of my parents have figured it out. Given they are both prone to running any executable that any website tells them to download and run, this feature has probably save me several dozen hours of fixing their computers.

As someone whose elderly parents run Windows and have never run 'any executable that any website tells them to download', and I myself have not seen a website that gives me a random executable in over a decade:

Out of curiosity, how often do your parents encounter the dialog in the article?

Re: Can't you just right click?

#45

Post by DoreenMichele »

toast0 wrote: post #39
aaomidi wrote: post #27

Earlier quoted context omitted.

Any open source developer? Do you know how much $100 is in Iran?

> Do you know how much $100 is in Iran? It doesn't really matter, because for developers in Iran, the question becomes do you know how hard it is to pay US companies from Iran?

The minute you admit you are in Iran, American companies aren't supposed to sell to you, generally speaking. So, yeah, that seems like a weird comment.

Re: Can't you just right click?

#46

Post by saagarjha »

oneplane wrote: post #19

I'm not sure what the point of that page or posting it here is. This system (and others like it) is neither new nor special. It's also not a bad thing, and I haven't seen anyone come up with a better alternative. Generally you see all major distribution options have signatures with a CA-type trust structure no matter what you use, be it open-source, free or commercial paid software. On Windows, macOS and at least all…

Question for you: what exactly does Notarization protect against? I have watched all the videos about it, I read the developer documentation, I notarize my apps because it is required by the OS…but I still have not gotten a single good explanation as to why it's useful. Apple claims that the process is extremely tolerant…so does it try to accept everything but blatant malware? Does it let malware through? What happens if malware does get through? Why does having build-specific certificates help security–is there any reason why Apple would disable a single build of an app from a malware publisher?

Re: Can't you just right click?

#47

Post by turblety »

saagarjha wrote: post #40
turblety wrote: post #20

This is just a cash grab from Apple, and part of a series of unethical behaviour by a monopoly (eg app store dictatorship). This would be totally unnessisary if apps could run in a sandbox. It wouldn't matter if I run some random game I downloaded off the internet if it can't do anything on my computer outside of its own sandbox. And to the people that say it's not possible, just look at web browsers. Each website ru…

macOS ships with some of that already; users immediately complained that it turned their OS into Windows Vista. Perhaps the underlying problem is that Apple's sandbox is not under the control of the user, it's mostly controlled by Apple and (to a lesser extent) by the developer of the software itself. It's really a strange model if you think about it…

> Perhaps the underlying problem is that Apple's sandbox is not under the control of the user, it's mostly controlled by Apple

Absolutely agree. There is a risk of prompt fatigue but that's a UX problem that can be solved during the installation process or first run.

Re: Can't you just right click?

#48

Post by [deleted] »

saagarjha wrote: post #32
yaur wrote: post #24

Earlier quoted context omitted.

I believe this is bubbling up because apple recently revoked Epic's certificate (sorry if that isn't quite the right term) and these are now the steps required to run Fortnight on Mac.

Technically Apple has (or will) terminate Epic's developer program access, which means that they will no longer be able to sign new builds. They have not revoked the certificate at this time, so those binaries should still continue to run until the certificates expire.

[deleted]

Re: Can't you just right click?

#49

Post by lucb1e »

ryandrake wrote: post #30
lucb1e wrote: post #2

This makes me wonder how open source is supposed to work on macOS. People seem to become more and more aware of it and even enterprises that insisted on support contracts can see that they can't get around open source completely anymore. Meanwhile Apple is removing the ability for me to have a pet project without paying an Apple tax. If the message were completely transparent, something like "The developer didn't pay…

It seems like the right balance. As the author says: > As a Mac developer, it's nearly impossible to run a viable software business when this is the first-run experience of new customers. You'll never get any new customers! This is why every Mac developer I know signs up for Developer ID and ships only signed, notarized apps. It would be financial suicide to do otherwise. If you have hung your shingle out to make a p…

> the developer account, signing, notarizing, etc. is a cost of doing business, and you can easily justify it.

But what if I'm not doing this for profit? Can Nirsoft or Mozilla apply for a waiver? Can I? We may not be looking to dominate the market, but it would be a shame if our work just went to waste because people would rather pay for something crappier that is closed source rather than our free (as in freedom & beer) software.

(Yes, Mozilla is a huge project where it isn't worth employee's time to apply for a waiver, I just needed at least one name that people know is a non-profit software developer as an example.)

Re: Can't you just right click?

#50

Post by saagarjha »

andrekandre wrote: post #43
saagarjha wrote: post #29

Earlier quoted context omitted.

macOS ships with a quite strong and granular capability-based security model with its sandboxing mechanism (at least, when it works and is applied correctly). The feature is there, advanced applications already make use of it, but it is difficult to get arbitrary applications to adopt it (its inner workings are declared SPI after all) and it is not really exposed to the user at all except via App Sandbox, which is fa…

> but it is difficult to get arbitrary applications to adopt it just curious, but what makes it specifically hard?

> its inner workings are declared SPI after all

SPI is system private interface, also known as private API–Apple doesn't document it, can change it at any time, and usually discourages its use.

Post reply on HN