Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

macOS gatekeeper and file quarantine bypass

objective-see.com

Post reply on HN
Print view View original

51–60 of 125 posts

Re: macOS gatekeeper and file quarantine bypass

#51

Post by vbezhenar »

setr wrote: post #24
Closi wrote: post #21

Earlier quoted context omitted.

It's also unchecked in Windows by default - I suspect that in reality the concept of extensions probably confuses some users, who end up changing the extension and then struggle to work out how to open their saved files. ( I always prefer to see the extensions too though :) )

Windows gives you a big warning when you change the extension, which seems to me both sufficient and better than hiding the extension altogether (which, like URL hiding, is a fairly dangerous and largely unnecessary convenience)

Users are well-trained to ignore warnings.

Re: macOS gatekeeper and file quarantine bypass

#52

Post by Klonoar »

lovelyviking wrote: post #13
kstrauser wrote: post #4

Earlier quoted context omitted.

What frustrates you about it? I rarely bump into Gatekeeper and I'm doing the normal dev things.

Sometimes I compile my program and when I move it to the Applications folder and trying to run MacOS says, you do not have permission to do it. May be it's not a gatekeeper, who knows. The keyword here is sometimes This is what I Love about current state of MacOS. To fix it nothing works until you delete it completely and only then if you lucky etc ... It just reminds me those old good days with Microsoft many years…

Is this an Xcode project, or something outside of it?

I regularly build both and have run them in the same way you're talking about here, without issue... the latter migth be a bit more nuanced, but when set up properly does work fine, so I'm inclined to think this is more a problem with how you're doing things.

Re: macOS gatekeeper and file quarantine bypass

#53

Post by phnofive »

submeta wrote: post #50
jdlshore wrote: post #43

Fascinating article. Short version: there was a bug in the part of Apple’s Gatekeeper code that checked whether a file was an application bundle. Bundles that only contained a script, and not a plist file, were considered “not a bundle,” and this bypasses the Gatekeeper checks. The issue is fixed in the latest version of Big Sur. Be sure to upgrade. It’s being exploited in the wild.

What about macOS Catalina users? Any updates / fixes for them? Do you happen to know?

It appears this behavior was introduced in Catalina, so I’d assume a complimentary fix to 11.3 will be available for 10.x - no word on timing AFAIK.

Re: macOS gatekeeper and file quarantine bypass

#54

Post by setr »

Isthatablackgsd wrote: post #48
kstrauser wrote: post #36

Earlier quoted context omitted.

You're hugely misreading my intentions. I'm an engineer: I see something unexpected, I want to figure out what's happening. You and I are both using the same software and you're seeing problems that I didn't even know affected some people. I'm not saying "this works for me so I don't know what you're complaining about". I'm saying "huh, this works for me. I wonder what's different between our systems? Is this somethi…

Apologies for misreading you, I'm just frustrated and accepted the fact that it is by design. I been reading other comments and as someone (xrisk) pointed out that it is Homebrew Casks which it made sense since all of the gatekeeper alerts is coming from 'Cask-ed' apps. I could disable Gatekeeper but I rather not because MacOS is not my daily driver. I rather to keep Gatekeeper active to protect itself from moronic m…

Probably the simplest thing then would be to alias brew install to something like spctl —master-disable; brew install $1; spctl —master-enable

Re: macOS gatekeeper and file quarantine bypass

#55

Post by mlindner »

lovelyviking wrote: post #13
kstrauser wrote: post #4

Earlier quoted context omitted.

What frustrates you about it? I rarely bump into Gatekeeper and I'm doing the normal dev things.

Sometimes I compile my program and when I move it to the Applications folder and trying to run MacOS says, you do not have permission to do it. May be it's not a gatekeeper, who knows. The keyword here is sometimes This is what I Love about current state of MacOS. To fix it nothing works until you delete it completely and only then if you lucky etc ... It just reminds me those old good days with Microsoft many years…

I've always found it to be extremely consistent and never does anything strange like you're describing. Works for me.

Re: macOS gatekeeper and file quarantine bypass

#56

Post by mlindner »

Isthatablackgsd wrote: post #5
kstrauser wrote: post #4

Earlier quoted context omitted.

What frustrates you about it? I rarely bump into Gatekeeper and I'm doing the normal dev things.

I'm assuming you don't use the package manager like Homebrew or MacPorts? this is where the gatekeeper will annoy the hell out of me. Apps installed via Homebrew often will encounter Gatekeeper alerts. Half of them will give the option to open it and the other half, the gatekeeper --demands-- gently ask me to put it in the Trash without the option to open it.

A simple right click on the app and selecting the open dialogue and it works fine.

Re: macOS gatekeeper and file quarantine bypass

#57

Post by davemp »

setr wrote: post #24
Closi wrote: post #21

Earlier quoted context omitted.

It's also unchecked in Windows by default - I suspect that in reality the concept of extensions probably confuses some users, who end up changing the extension and then struggle to work out how to open their saved files. ( I always prefer to see the extensions too though :) )

Windows gives you a big warning when you change the extension, which seems to me both sufficient and better than hiding the extension altogether (which, like URL hiding, is a fairly dangerous and largely unnecessary convenience)

Like browsers, file navigation UIs could also just grey out the file extension.

Re: macOS gatekeeper and file quarantine bypass

#58

Post by benatkin »

jdlshore wrote: post #43

Fascinating article. Short version: there was a bug in the part of Apple’s Gatekeeper code that checked whether a file was an application bundle. Bundles that only contained a script, and not a plist file, were considered “not a bundle,” and this bypasses the Gatekeeper checks. The issue is fixed in the latest version of Big Sur. Be sure to upgrade. It’s being exploited in the wild.

> Be sure to upgrade.

This is a technical crowd, so some of us don't need to rush to download things like this. I'll upgrade when it's convenient, thank you very much.

Re: macOS gatekeeper and file quarantine bypass

#59

Post by Someone »

fryktelig wrote: post #44
xrisk wrote: post #39

Earlier quoted context omitted.

He’s talking about Homebrew Cask.

I've been having issues with non-cask Homebrew packages getting blocked by some Gatekeeper/SIP related watchdog on my new M1 system. Stuff would just get insta-killed at load. Anyway, it seems to have been sorted now, and through identifying which packages were having the issue in Console and reinstalling them, I've resolved the issues.

Slightly educated guess: did you install the x64 emulator between when you had the problems and when they went away?

I can see brew trying to run x64 code while the emulator isn’t there blocking code from running in weird ways.

Alternatively, it might be that package updates fixed the packages that behaved incorrectly. Again, just a slightly educated guess.

Re: macOS gatekeeper and file quarantine bypass

#60

Post by jcelerier »

Wowfunhappy wrote: post #9
smoldesu wrote: post #2

Gatekeeper is one of the most frustrating things I have to fight whenever I try using MacOS. It feels like DRM for my applications, which in turn makes everything feel clunkier, and less integrated. I would genuinely pay Apple extra for a version of MacOS that just trusts me and lets me install what I want without the some esoteric mechanism stopping me at every step of the way...

Then turn it off. Open the Terminal and run: sudo spctl --master-disable That's it, it will never bother you again, unless you turn it back on or reinstall the OS from scratch. If macOS is still too limiting, you can also turn off System Integrity Protection, at which point you can do just about whatever the heck you want. I personally kept both Gatekeeper and SIP turned off, back when I used modern macOS. But if the…

No, this still keeps some gatekeeper checks, popups when downloading files, weird arguments being passed to apps on first launch, etc. Even if doing it in the root recovery mode.
Post reply on HN