Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Can't you just right click?

lapcatsoftware.com

Post reply on HN
Print view View original

161–170 of 765 posts

Re: Can't you just right click?

#161

Post by FabHK »

saagarjha wrote: post #148
FabHK wrote: post #134

Earlier quoted context omitted.

How is it "intentionally misleading"?

Because it says the binary is damaged/malware/sketchy and that is not correct.

It doesn't say that. It says that it can't verify the developer, and can't verify that the software is free of malware. It's just some arbitrary piece of software, could be written by anyone, and/or could be software that purports to be Word or Photoshop or whatever, but has been modified.

Granted, you could quibble with the details (does pointing out that you can't verify that it's free from malware imply that you could verify that it's free from malware if there were a certificate?). But calling the message "intentionally" (!) misleading?

Re: Can't you just right click?

#162

Post by wila »

xenadu02 wrote: post #92
badsectoracula wrote: post #83

Earlier quoted context omitted.

Well, yes, until you get to the point where (as the article shows) you cannot run unsigned applications on Apple Silicon. How much more slippery does this slope needs to get?

It is important to understand what this requirement is and isn't. The requirement on Apple Silicon is only that the binary be codesigned. That ensures the binary is unmodified when it is encountered again later. You do not need an Apple-approved signing key for this. Ad-hoc signing works just fine. Apple's new linker automatically adds an ad-hoc signature to ensure people building outside Xcode don't experience any d…

The certificate is only checked on initial load. If the application gets changed afterwards then it will still load. It is not an integrity check.

More details here: https://eclecticlight.co/2019/07/09/understanding-signature-...

Re: Can't you just right click?

#163

Post by recursive »

oneplane wrote: post #15
lucb1e wrote: post #2

This makes me wonder how open source is supposed to work on macOS. People seem to become more and more aware of it and even enterprises that insisted on support contracts can see that they can't get around open source completely anymore. Meanwhile Apple is removing the ability for me to have a pet project without paying an Apple tax. If the message were completely transparent, something like "The developer didn't pay…

Open source projects sign their Apps like anyone else. Works fine. They do the same on Windows of course and on Linux package managers.

In my experience, open source installers for windows are mostly not signed. But windows has a button to let you run them though.

Re: Can't you just right click?

#164

Post by kohtatsu »

wruza wrote: post #152

I thought that a developer status will autosave me either from malware or from being babysitted, but then [1] happened. No matter how hard I tried to start that binary, OSX didn't allow me to do that. Damn OS which knows better, who do yo think you are? Did you see checksums, site certs, my competence, my willpower? I thought that it must be something with a build process that transmission uses, some signature didn't…

https://unit42.paloaltonetworks.com/new-os-x-ransomware-kera...

It turned out to be ransomware, for anyone not following.

Re: Can't you just right click?

#165

Post by dwaite »

cytzol wrote: post #133
kelnos wrote: post #64

Earlier quoted context omitted.

It's hard to believe that this would be a cash grab. Even if there are 1M developers in the world, that's only $100M, which should not be worth the friction and cost to implement and maintain this scheme. Consider that Apple's most recent quarterly revenue was just under $60B. Apple made $260B in all of 2019; $100M is not even four hundredths of a percent. Developer time to build out the signing and notarization feat…

> As much as we all like to call out Apple sometimes for how they don't take good care of their developers, adding hoops for your developers to jump through is not a great idea. Why not? Apple has been pushing very hard lately to increase their 'services' revenue, by getting users to sign up for Apple Music, iCloud, etc. It makes perfect sense for Apple to force developers to jump through hoops, not because it makes…

> • When launching Chrome for the first time, you have to opt-in to Chrome notifications, but macOS pops up its own notification telling you to use Safari instead.

Link to a screenshot of this Safari notification when Chrome is run?

> Similarly, Apple News notifications are allowed by default, but you have to explicitly opt-in to notifications from other news websites.

Reference to an article about this?

> • System Preferences gets an obnoxious (1) badge next to it, because I haven't signed in to iCloud.

This is something other apps can't display...?

Re: Can't you just right click?

#166

Post by hardmath123 »

I came across this problem when I wrote a small program for a humanities professor to help him draw some diagrams. He didn't want a web app ("it'll disappear once you graduate!") so I wrote him a mac app and emailed it... it was such an adventure getting him to ignore the security warnings to run it...

Re: Can't you just right click?

#167

Post by wila »

xenadu02 wrote: post #110
lucb1e wrote: post #2

This makes me wonder how open source is supposed to work on macOS. People seem to become more and more aware of it and even enterprises that insisted on support contracts can see that they can't get around open source completely anymore. Meanwhile Apple is removing the ability for me to have a pet project without paying an Apple tax. If the message were completely transparent, something like "The developer didn't pay…

Please note that Apple's linker will automatically ad-hoc sign binaries if you aren't using a signing certificate so there is no impact to package managers or any other forms of building software to run locally. Xcode already automatically opts such software out of GateKeeper checks when built from the UI. Similarly adding Terminal to the Developer Tool category in System Preferences will do the same for anything you…

You can run your own binaries locally because they do not have quarantine flags, not because they are locally signed.

You can also remove quarantine flags from anything you download and after that you don't have the right click option either.

For example:

    xattr -dr com.apple.quarantine ~/Downloads/Absolutely-Not-Malware.dmg

Re: Can't you just right click?

#169

Post by FabHK »

saagarjha wrote: post #142
coldtea wrote: post #124

Earlier quoted context omitted.

Is there any automatic way to tell your software apart from malware? Because that's part of what this mechanism tries to provide...

In theory no, that's impossible. In practice, I publish checksums on my website and people trust that I am not malicious.

The thing is, your friendly scammer could also publish checksums on their website.

It is clear to you that you're writing fine open source software, not malware. But how is the consumer supposed to tell?

If people trust you, why bother with the checksums? (Over HTTPS, the downloaded content cannot be tampered with. If someone tampered with the content on your website, or performs a MITM, they can also replace the checksums.)

Re: Can't you just right click?

#170

Post by kinkrtyavimoodh »

cytzol wrote: post #147
_qulr wrote: post #123

Earlier quoted context omitted.

> Also, what kind of "viable software business" has trouble paying $100 a year? The issue isn't the money. The blog post was written in the context of the widely reported story of Apple threatening to terminate the developer account of Epic Games, which would prevent them from signing and notarizing their Mac software.

> The blog post was written in the context of the widely reported story of Apple threatening to terminate the developer account of Epic Games, which would prevent them from signing and notarizing their Mac software. This part is key. It shows that Apple's signing and notarising requirement isn't about money, nor is it about security. Epic broke the rules of the iOS store, and now they'll be forbidden from developing…

Yeah it's as simple and clear a Fuck You as can be.
Post reply on HN