Safely open apps on your Mac
support.apple.com
Safely open apps on your Mac
1–10 of 61 posts
Re: Safely open apps on your Mac
#2This page was updated yesterday to remove the following text from the final section, which was added in November 2020:
In addition, over the the next year we will introduce several changes to our security checks:
• A new encrypted protocol for Developer ID certificate revocation checks
• Strong protections against server failure
• A new preference for users to opt out of these security protectionsRe: Safely open apps on your Mac
#3What Apple probably doesn't want you to know is that you can also run these two commands to disable the notarization requirement, effectively reverting your security level to non-paranoid pre-Catalina:
sudo spctl --master-disable
sudo defaults write /Library/Preferences/com.apple.security GKAutoRearm -bool false
The setting will still occasionally reset after installing some system updates because it's 2023 and computers these days are extremely unreliable when it comes to remembering user preferences.
Re: Safely open apps on your Mac
#4What Apple probably doesn't want you to know is that you can also run these two commands to disable the notarization requirement, effectively reverting your security level to non-paranoid pre-Catalina: sudo spctl --master-disable sudo defaults write /Library/Preferences/com.apple.security GKAutoRearm -bool false This reveal add and select a third option, "any source", under "allow applications downloaded from". The s…
That’s helpful.
Broadly speaking, as a developer you should expect that none of your users will have disabled those protections and your release plan should have notarizing as a step.
Asking users to disable system protection, or at the very least fiddle with system settings is a non-starter.
Re: Safely open apps on your Mac
#5What Apple probably doesn't want you to know is that you can also run these two commands to disable the notarization requirement, effectively reverting your security level to non-paranoid pre-Catalina: sudo spctl --master-disable sudo defaults write /Library/Preferences/com.apple.security GKAutoRearm -bool false This reveal add and select a third option, "any source", under "allow applications downloaded from". The s…
That’s helpful. Broadly speaking, as a developer you should expect that none of your users will have disabled those protections and your release plan should have notarizing as a step. Asking users to disable system protection, or at the very least fiddle with system settings is a non-starter.
Even if a company wasn’t being purposefully malicious, shit happens.
https://support.google.com/chrome/thread/15235262/chrome-upd...
And Apple isn’t immune either. There was a bug in the iTunes installer where it would erase files if there was a space in the name of the hard drive.
Then some companies are just evil.
https://www.zdnet.com/article/zoom-defends-use-of-local-web-...
Re: Safely open apps on your Mac
#6What Apple probably doesn't want you to know is that you can also run these two commands to disable the notarization requirement, effectively reverting your security level to non-paranoid pre-Catalina: sudo spctl --master-disable sudo defaults write /Library/Preferences/com.apple.security GKAutoRearm -bool false This reveal add and select a third option, "any source", under "allow applications downloaded from". The s…
> The setting will still occasionally reset after installing some system updates because it's 2023 and computers these days are extremely unreliable when it comes to remembering user preferences.
The sudo touchid mod gets reset so often now that I've stopped bothering with it. Ok, you win apple!
Re: Safely open apps on your Mac
#7What Apple probably doesn't want you to know is that you can also run these two commands to disable the notarization requirement, effectively reverting your security level to non-paranoid pre-Catalina: sudo spctl --master-disable sudo defaults write /Library/Preferences/com.apple.security GKAutoRearm -bool false This reveal add and select a third option, "any source", under "allow applications downloaded from". The s…
> The setting will still occasionally reset after installing some system updates because it's 2023 and computers these days are extremely unreliable when it comes to remembering user preferences. The sudo touchid mod gets reset so often now that I've stopped bothering with it. Ok, you win apple!
It may be official now! I just saw today that Sonoma contains an example pam config file with that line commented out.
Uncomment, copy it over the default file, win.
Far less hidden.
Re: Safely open apps on your Mac
#8This page was updated yesterday to remove the following text from the final section, which was added in November 2020: In addition, over the the next year we will introduce several changes to our security checks: • A new encrypted protocol for Developer ID certificate revocation checks • Strong protections against server failure • A new preference for users to opt out of these security protections
> A new encrypted protocol for Developer ID certificate revocation checks
Done.
> Strong protections against server failure
Unknown, but presumably done.
> A new preference for users to opt out of these security protections
Never done. Apple lied.
Re: Safely open apps on your Mac
#9Earlier quoted context omitted.
> The setting will still occasionally reset after installing some system updates because it's 2023 and computers these days are extremely unreliable when it comes to remembering user preferences. The sudo touchid mod gets reset so often now that I've stopped bothering with it. Ok, you win apple!
It may be official now! I just saw today that Sonoma contains an example pam config file with that line commented out. Uncomment, copy it over the default file, win. Far less hidden. https://mastodon.social/@StrangeNoises/110910261899874868
YES! Confirmed! Thank you!
Re: Safely open apps on your Mac
#10What Apple probably doesn't want you to know is that you can also run these two commands to disable the notarization requirement, effectively reverting your security level to non-paranoid pre-Catalina: sudo spctl --master-disable sudo defaults write /Library/Preferences/com.apple.security GKAutoRearm -bool false This reveal add and select a third option, "any source", under "allow applications downloaded from". The s…
That’s helpful. Broadly speaking, as a developer you should expect that none of your users will have disabled those protections and your release plan should have notarizing as a step. Asking users to disable system protection, or at the very least fiddle with system settings is a non-starter.
> as a developer you should expect that none of your users will have disabled those protections and your release plan should have notarizing as a step.
I don't want to spend $99/year for the rest of eternity for the privilege of having a slightly less scary warning when my users run my app for the first time. Thus, the readme for the one macOS app I made that has gained a bit of popularity instructs users to right-click, then select "open". Works reasonably well so far.
I would absolutely have embraced notarization if it was offered for free. Otherwise it feels like straight up extortion.