Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Can't you just right click?

lapcatsoftware.com

Post reply on HN
Print view View original

121–130 of 765 posts

Re: Can't you just right click?

#121

Post by brundolf »

the8472 wrote: post #119
brundolf wrote: post #113

Earlier quoted context omitted.

As long as there's software there will be devs who need machines with which they can build it. Those machines will always need mechanisms for circumventing safety constraints, almost by definition. I guess it's possible Apple could decide, one day, "macOS isn't for developers anymore, it's just like iOS, devs will just have to go elsewhere". But that seems like it would be a profoundly stupid thing to do. I do wish t…

Look at iOS, you need to pay for a developer account and the signed applications can't be distributed (otherwise they'll revoke your account) and have short-lived certs.

You're not listening: you don't make software on iOS.

Re: Can't you just right click?

#122

Post by tauwauwau »

kelnos wrote: post #64
FreakyT wrote: post #7

I still believe that Gatekeeper is a blatant cash grab and not a legitimate security feature. $100/year to avoid a scary warning about how your app is definitely a virus? It's like a protection racket.

It's hard to believe that this would be a cash grab. Even if there are 1M developers in the world, that's only $100M, which should not be worth the friction and cost to implement and maintain this scheme. Consider that Apple's most recent quarterly revenue was just under $60B. Apple made $260B in all of 2019; $100M is not even four hundredths of a percent. Developer time to build out the signing and notarization feat…

Not going to argue about the profit based motivations, I'm sure someone else would do it. How about the power that it gives Apple over developers, is that worth their time?

Re: Can't you just right click?

#123

Post by _qulr »

dec0dedab0de wrote: post #23

I dont see any problem with this. If you don't feel comfortable doing this then you definitely shouldn't be running random code from the internet. I would take it a step further and force it to be run from the command line. Also, what kind of "viable software business" has trouble paying $100 a year?

> Also, what kind of "viable software business" has trouble paying $100 a year?

The issue isn't the money. The blog post was written in the context of the widely reported story of Apple threatening to terminate the developer account of Epic Games, which would prevent them from signing and notarizing their Mac software.

Re: Can't you just right click?

#124

Post by coldtea »

saagarjha wrote: post #97
badsectoracula wrote: post #85

Earlier quoted context omitted.

I would generally like my software, regardless of it is open source or not, not be marked as malware when it is not malware.

Sure, but I picked that specifically because it seemed to be what the parent comment was talking about.

Is there any automatic way to tell your software apart from malware?

Because that's part of what this mechanism tries to provide...

Re: Can't you just right click?

#125

Post by the8472 »

brundolf wrote: post #121
the8472 wrote: post #119

Earlier quoted context omitted.

Look at iOS, you need to pay for a developer account and the signed applications can't be distributed (otherwise they'll revoke your account) and have short-lived certs.

You're not listening: you don't make software on iOS.

Those people already pay for that account and thus could sign whatever they need to work. For them it wouldn't change a thing. It's just everyone else.

Re: Can't you just right click?

#126

Post by jentist_retol »

brundolf wrote: post #121
the8472 wrote: post #119

Earlier quoted context omitted.

Look at iOS, you need to pay for a developer account and the signed applications can't be distributed (otherwise they'll revoke your account) and have short-lived certs.

You're not listening: you don't make software on iOS.

I have a feeling that this is going to change in the next year or two.

Re: Can't you just right click?

#127

Post by _qulr »

saagarjha wrote: post #61

> On macOS Catalina, Gatekeeper not only checks whether the software was signed by a valid Developer ID certificate, it also "phones home" to check whether Apple has notarized the software, again refusing to run it if the check fails. Nit: I believe stapling is supposed to fix this issue.

> Nit: I believe stapling is supposed to fix this issue.

No, even stapled apps phone home. The difference is that stapled apps can still run if Catalina can't contact Apple (e.g., no internet), whereas unstapled apps can't.

Look closely at the Gatekeeper dialog with and without your internet connected.

Re: Can't you just right click?

#128

Post by saagarjha »

PandaHug wrote: post #100
kelnos wrote: post #64

Earlier quoted context omitted.

It's hard to believe that this would be a cash grab. Even if there are 1M developers in the world, that's only $100M, which should not be worth the friction and cost to implement and maintain this scheme. Consider that Apple's most recent quarterly revenue was just under $60B. Apple made $260B in all of 2019; $100M is not even four hundredths of a percent. Developer time to build out the signing and notarization feat…

Not exactly how it works though, in a corporation as big as Apple each business unit has it's own budget and profit/loss margins. Apple is simply too big and complex for someone or a group of someones to look at it in the way you are describing. So while $100M might not look like a ton to Apple as a hole, it might look like a lot to the business unit responsible for apps on macOS

Apple is fairly well known to not do P/L this way.

Re: Can't you just right click?

#129

Post by xfer »

DoreenMichele wrote: post #45
toast0 wrote: post #39

Earlier quoted context omitted.

> Do you know how much $100 is in Iran? It doesn't really matter, because for developers in Iran, the question becomes do you know how hard it is to pay US companies from Iran?

The minute you admit you are in Iran, American companies aren't supposed to sell to you, generally speaking. So, yeah, that seems like a weird comment.

There are a lot of third world countries that america does business with so not that weird of a comment.

Re: Can't you just right click?

#130

Post by josephg »

badsectoracula wrote: post #93
white-flame wrote: post #10

The fact that the standard model of computing is that applications are opaque machine code blobs that can access everything in your user permission space is the core problem in privacy and malware. Applications should see nothing but their executable jail, and whatever was intentionally allowed to them by the user (eg, Open file dialog giving the application an opaque file handle, etc, not carte blanche access to the…

This works for some type of software, but not all type of software. For example a file server or a file manager wont work. A VCS client wont work. A game engine that needs to keep track of imported resources (especially when you want automatic imports when the file is saved via a 3rd party tool - e.g. saving a model on Blender or a texture on Krita causes an automatic reimport/convert to the engine's format). Basical…

Sure it does! We just need sufficiently granular permissions for all of this stuff. “Do you want to give ClipboardManager access to your clipboard?” Yes. “Do you want to give TikTok access to your clipboard?” No. I agree that clicking a million permission boxes is annoying but ideally it should only be something needed for apps that don’t fit the media consumption model.

The real problem is that the desktop security model is outdated - it was designed for a world where software developers are trusted by default and users need to protect their data from each other. Today we can’t trust that developers will respect my data. I mean, the fact that any application I run or any npm module I transitively install could upload or delete any of my personal documents is insane. We absolutely need to preserve my ability to run software I write, and run screencast software, file servers, etc. But permission to read my data should not be given by default to any software I happen to run. The Epic thing makes me nervous but generally I think Apple’s direction here is the right one.

Post reply on HN