Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

macOS gatekeeper and file quarantine bypass

objective-see.com

Post reply on HN
Print view View original

111–120 of 125 posts

Re: macOS gatekeeper and file quarantine bypass

#111

Post by lilyball »

Isthatablackgsd wrote: post #5
kstrauser wrote: post #4

Earlier quoted context omitted.

What frustrates you about it? I rarely bump into Gatekeeper and I'm doing the normal dev things.

I'm assuming you don't use the package manager like Homebrew or MacPorts? this is where the gatekeeper will annoy the hell out of me. Apps installed via Homebrew often will encounter Gatekeeper alerts. Half of them will give the option to open it and the other half, the gatekeeper --demands-- gently ask me to put it in the Trash without the option to open it.

Homebrew and MacPorts don't add the quarantine flag to the software they're installing. If you're getting Gatekeeper alerts for software installed this way, then something else must be going on.

Re: macOS gatekeeper and file quarantine bypass

#112

Post by dannyw »

ziml77 wrote: post #93
Closi wrote: post #21

Earlier quoted context omitted.

It's also unchecked in Windows by default - I suspect that in reality the concept of extensions probably confuses some users, who end up changing the extension and then struggle to work out how to open their saved files. ( I always prefer to see the extensions too though :) )

Isn't it also confusing for the average user when they end up with identical looking files? I didn't realize that macOS had per-file extension hiding until I synced some images over from my iPad. I ended up with files that I couldn't tell apart at a glance because they had the same name but were different image file types. I'm now torn if I actually want to force all extensions to show because I think showing applica…

Nothing stops you from putting the same label on multiple boxes in real life.

Re: macOS gatekeeper and file quarantine bypass

#113

Post by tinus_hn »

healsjnr1 wrote: post #107
benatkin wrote: post #58

Earlier quoted context omitted.

> Be sure to upgrade. This is a technical crowd, so some of us don't need to rush to download things like this. I'll upgrade when it's convenient, thank you very much.

Given the ease and severity of this I don't think being technical does anything for you. I am grateful for the "upgrade now" message being pushed it. As a technical user I can't trust my skills and knowledge to truly keep me safe from this one.

How did you ever survive all that time where you had to decide for yourself whether to run a program or not, without Gatekeeper holding your hand?

Re: macOS gatekeeper and file quarantine bypass

#115

Post by inb4_cancelled »

symlinkk wrote: post #109
Closi wrote: post #21

Earlier quoted context omitted.

It's also unchecked in Windows by default - I suspect that in reality the concept of extensions probably confuses some users, who end up changing the extension and then struggle to work out how to open their saved files. ( I always prefer to see the extensions too though :) )

This is an outdated mindset. Literally everyone knows the difference between .docx and .jpg in 2021.

You're living in a beautiful bubble.

Re: macOS gatekeeper and file quarantine bypass

#116

Post by dizzystar »

sildur wrote: post #84
benatkin wrote: post #58

Earlier quoted context omitted.

> Be sure to upgrade. This is a technical crowd, so some of us don't need to rush to download things like this. I'll upgrade when it's convenient, thank you very much.

Funny that when you started with "this is a technical crowd" I thought you will continue with "we don't need to be reminded to upgrade".

We may be technical, but we are beholden to products we use as well. Being technical can also mean we are more aware of the dangers of upgrading too soon.

Re: macOS gatekeeper and file quarantine bypass

#117

Post by gempir »

spurgu wrote: post #96
pehtis wrote: post #17

I will never understand why "Show all filename extensions" is unchecked by default in Finder.

Or how to navigate to /Users/ . You have to manually add it to the sidebar from Preferences.

That part is so perplexing. Apple wants you to use that folder! Multiple useful things are stored in it, but you have to jump through hoops to go do it. It should be added as a favourite by default.

Re: macOS gatekeeper and file quarantine bypass

#118

Post by therealmarv »

submeta wrote: post #50
jdlshore wrote: post #43

Fascinating article. Short version: there was a bug in the part of Apple’s Gatekeeper code that checked whether a file was an application bundle. Bundles that only contained a script, and not a plist file, were considered “not a bundle,” and this bypasses the Gatekeeper checks. The issue is fixed in the latest version of Big Sur. Be sure to upgrade. It’s being exploited in the wild.

What about macOS Catalina users? Any updates / fixes for them? Do you happen to know?

The bad thing is: They patched Catalina less than Big Sur with the new update :(

Compare "Gatekeeper" fixed issues here:

https://support.apple.com/en-us/HT212326 Catalina

https://support.apple.com/en-us/HT212325 Big Sur

Feels for me that they only patched one part of it on Catalina but gates are more open on the older macOS. Really don't like that.

Re: macOS gatekeeper and file quarantine bypass

#119

Post by saagarjha »

lilyball wrote: post #111
Isthatablackgsd wrote: post #5

Earlier quoted context omitted.

I'm assuming you don't use the package manager like Homebrew or MacPorts? this is where the gatekeeper will annoy the hell out of me. Apps installed via Homebrew often will encounter Gatekeeper alerts. Half of them will give the option to open it and the other half, the gatekeeper --demands-- gently ask me to put it in the Trash without the option to open it.

Homebrew and MacPorts don't add the quarantine flag to the software they're installing. If you're getting Gatekeeper alerts for software installed this way, then something else must be going on.

Homebrew Cask does.
Post reply on HN