191–200 of 765 posts
Earlier quoted context omitted.
Yes, which is why i wrote "you cannot run unsigned software" and the part about slippery slope.
That's exactly what I'm confused about, where is the slippery slope? It's an extra step in your build process–an annoyance, not a slope. It's like if there was a requirement that macOS would not run binaries unless you stuck "APPLEISCOOL" at the front of all your binaries.
Earlier quoted context omitted.
It's more of a choke hold than a cash grab. Your app broke our store rules, we removed it and you're suing us? We'll terminate your dev account so your apps won't run.
Assuming you mean Epic, Apple has only given a deadline to cease breaking their developer agreement before their developer account is terminated. Epic is empowered to get their app back in the store tomorrow if they want to release an updated build without the contract-infringing functionality. They probably have lost their chance to be features by Apple or to be invited back on stage in future keynotes, but at least…
Earlier quoted context omitted.
It is important to understand what this requirement is and isn't. The requirement on Apple Silicon is only that the binary be codesigned. That ensures the binary is unmodified when it is encountered again later. You do not need an Apple-approved signing key for this. Ad-hoc signing works just fine. Apple's new linker automatically adds an ad-hoc signature to ensure people building outside Xcode don't experience any d…
The certificate is only checked on initial load. If the application gets changed afterwards then it will still load. It is not an integrity check. More details here: https://eclecticlight.co/2019/07/09/understanding-signature-...
Yes, it's just an initial check. But is it necessary? What exactly is the use case basis for Apple transmitting and logging data on every application you run on an operating system you have a consumer guarantee of zero-tampering post-sale.
So, let's work this out: How easy is it to not upgrade macOS, retain consistent performance as usual, and not lose support if the userbase remains unsatisfied with Apple's change to an exchanged good? By my understanding, as with Windows 10, Apple will eventually require you to upgrade. If you're upgrading to a system that maintains the same performance and does not introduce express limitations to the product post-sale, that's great! Go for it, live merry. However, in this case, the userbase has zero clarification on both co-owned data transmission and a remote check that appears to trigger a constraint on workflow. There's no use case basis that makes sense for doing this, because Apple has established guarantees for decades prior to this new process that claim macOS is not susceptible to malware. So, it begs the question: Was Apple violating consumer protections by making false guarantees, or is Apple violating consumer protections by limiting the function and utility of the product post-sale?
That's what people are asking right now. We don't care about the nuance of the check. We care about the basic characteristics of, and more importantly the legitimacy of any use case for this check, given promises made to consumers at a prior time of purchase.
Earlier quoted context omitted.
> Also, what kind of "viable software business" has trouble paying $100 a year? The issue isn't the money. The blog post was written in the context of the widely reported story of Apple threatening to terminate the developer account of Epic Games, which would prevent them from signing and notarizing their Mac software.
> The blog post was written in the context of the widely reported story of Apple threatening to terminate the developer account of Epic Games, which would prevent them from signing and notarizing their Mac software. This part is key. It shows that Apple's signing and notarising requirement isn't about money, nor is it about security. Epic broke the rules of the iOS store, and now they'll be forbidden from developing…
Apple has a single developer program for all platforms. Epic has been given a deadline to stop breaking the contract terms - submit a new version of the application which reverts the remotely activated payment logic.
I'm not sure what the point of that page or posting it here is. This system (and others like it) is neither new nor special. It's also not a bad thing, and I haven't seen anyone come up with a better alternative. Generally you see all major distribution options have signatures with a CA-type trust structure no matter what you use, be it open-source, free or commercial paid software. On Windows, macOS and at least all…
Question for you: what exactly does Notarization protect against? I have watched all the videos about it, I read the developer documentation, I notarize my apps because it is required by the OS…but I still have not gotten a single good explanation as to why it's useful. Apple claims that the process is extremely tolerant…so does it try to accept everything but blatant malware? Does it let malware through? What happen…
Earlier quoted context omitted.
As someone whose elderly parents run Windows and have never run 'any executable that any website tells them to download', and I myself have not seen a website that gives me a random executable in over a decade: Out of curiosity, how often do your parents encounter the dialog in the article?
Try using safari on a MacBook. Last time I spent 10 minutes on my wife's laptop, every website was filled with garbage ads saying your Mac is infected with a virus you must download an anti virus quick (#malware). The shadier websites (streaming) sent a dmg executable as soon as they were opened. It's shocking, it's worse than Windows (sad fact: Mac has more malware/adware than Windows since the last 3 years). Of cou…
Safari has ad-blockers. It also has extensions. Just google it.
I dont see any problem with this. If you don't feel comfortable doing this then you definitely shouldn't be running random code from the internet. I would take it a step further and force it to be run from the command line. Also, what kind of "viable software business" has trouble paying $100 a year?
The issue isn't from the user side, but from the developer side. Most potential users will see the dialog, not even know they can work around it, and trash the app. Whether or not this is a good thing for most users is certainly arguable, but it still doesn't sit right that you have to pay Apple and get their permission to distribute macOS software that isn't presented to the user as likely malware.
Earlier quoted context omitted.
Please note that Apple's linker will automatically ad-hoc sign binaries if you aren't using a signing certificate so there is no impact to package managers or any other forms of building software to run locally. Xcode already automatically opts such software out of GateKeeper checks when built from the UI. Similarly adding Terminal to the Developer Tool category in System Preferences will do the same for anything you…
You can run your own binaries locally because they do not have quarantine flags, not because they are locally signed. You can also remove quarantine flags from anything you download and after that you don't have the right click option either. For example: xattr -dr com.apple.quarantine ~/Downloads/Absolutely-Not-Malware.dmg
This makes me wonder how open source is supposed to work on macOS. People seem to become more and more aware of it and even enterprises that insisted on support contracts can see that they can't get around open source completely anymore. Meanwhile Apple is removing the ability for me to have a pet project without paying an Apple tax. If the message were completely transparent, something like "The developer didn't pay…
> I also can't imagine $100 is easy to come up with in countries below level 4[1]. While money for a Mac is?