Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Safely open apps on your Mac

support.apple.com

Post reply on HN
Print view View original

11–20 of 61 posts

Re: Safely open apps on your Mac

#11

Post by grishka »

latchkey wrote: post #6
grishka wrote: post #3

What Apple probably doesn't want you to know is that you can also run these two commands to disable the notarization requirement, effectively reverting your security level to non-paranoid pre-Catalina: sudo spctl --master-disable sudo defaults write /Library/Preferences/com.apple.security GKAutoRearm -bool false This reveal add and select a third option, "any source", under "allow applications downloaded from". The s…

> The setting will still occasionally reset after installing some system updates because it's 2023 and computers these days are extremely unreliable when it comes to remembering user preferences. The sudo touchid mod gets reset so often now that I've stopped bothering with it. Ok, you win apple!

I was just thinking that I should make a shell script with these commands and the touch ID one and add it as a login item. Sudo shouldn't be a big deal, just set the owner to root and set the SUID bit.

Re: Safely open apps on your Mac

#12

Post by MBCook »

latchkey wrote: post #9
MBCook wrote: post #7

Earlier quoted context omitted.

It may be official now! I just saw today that Sonoma contains an example pam config file with that line commented out. Uncomment, copy it over the default file, win. Far less hidden. https://mastodon.social/@StrangeNoises/110910261899874868

YES! Confirmed! Thank you!

Oh you posted that as a story. Heh. That’s a great idea. Why don’t I ever think of that?

Glad I could help. It ran through my feed today by chance.

Re: Safely open apps on your Mac

#13

Post by cod1r »

FYI, you can add whatever developer tool you use as an exception to privacy and security rules under "Developer Tools" in the "Privacy and Security" settings. I added my terminal emulator and it seems to let me run prebuilt, unsigned binaries without any annoyances.

Re: Safely open apps on your Mac

#14

Post by latchkey »

MBCook wrote: post #12
latchkey wrote: post #9

Earlier quoted context omitted.

YES! Confirmed! Thank you!

Oh you posted that as a story. Heh. That’s a great idea. Why don’t I ever think of that? Glad I could help. It ran through my feed today by chance.

My comments aren't entertaining enough to get enough upvotes for karma farming, so I post cool links that I find.

Re: Safely open apps on your Mac

#15

Post by MBCook »

latchkey wrote: post #14
MBCook wrote: post #12

Earlier quoted context omitted.

Oh you posted that as a story. Heh. That’s a great idea. Why don’t I ever think of that? Glad I could help. It ran through my feed today by chance.

My comments aren't entertaining enough to get enough upvotes for karma farming, so I post cool links that I find.

Trust me, I get it. The cool links are what drew me to HN, however they’re found.

Re: Safely open apps on your Mac

#16

Post by KennyBlanken »

grishka wrote: post #3

What Apple probably doesn't want you to know is that you can also run these two commands to disable the notarization requirement, effectively reverting your security level to non-paranoid pre-Catalina: sudo spctl --master-disable sudo defaults write /Library/Preferences/com.apple.security GKAutoRearm -bool false This reveal add and select a third option, "any source", under "allow applications downloaded from". The s…

I don't want to necessarily disable it. What I do want is to be able to click "yes yes, I don't care this time / ever for this binary, fuck off." I don't even mind if you make me fingerprint auth for it.

What drives me insane: the inconsistent/invisible functionality around this stuff. In Ventura, if you double-click an unsigned app, it won't run, with a big scary message that it cannot be verified.

...except if you right-click and select "open", you can now click on a button that lets you run the app anyway.

This is not remotely obvious or even indicated in any way. There's nothing that explains this to the user, nada. It just behaves differently if you select "open" instead of double-clicking.

How on earth that compliant with Apple's human interface guidelines?

Re: Safely open apps on your Mac

#17

Post by FpUser »

grishka wrote: post #10
balls187 wrote: post #4

Earlier quoted context omitted.

That’s helpful. Broadly speaking, as a developer you should expect that none of your users will have disabled those protections and your release plan should have notarizing as a step. Asking users to disable system protection, or at the very least fiddle with system settings is a non-starter.

> as a developer you should expect that none of your users will have disabled those protections and your release plan should have notarizing as a step. I don't want to spend $99/year for the rest of eternity for the privilege of having a slightly less scary warning when my users run my app for the first time. Thus, the readme for the one macOS app I made that has gained a bit of popularity instructs users to right-cl…

>"Otherwise it feels like straight up extortion."

Which it is

Re: Safely open apps on your Mac

#18

Post by JimDabell »

MBCook wrote: post #7
latchkey wrote: post #6

Earlier quoted context omitted.

> The setting will still occasionally reset after installing some system updates because it's 2023 and computers these days are extremely unreliable when it comes to remembering user preferences. The sudo touchid mod gets reset so often now that I've stopped bothering with it. Ok, you win apple!

It may be official now! I just saw today that Sonoma contains an example pam config file with that line commented out. Uncomment, copy it over the default file, win. Far less hidden. https://mastodon.social/@StrangeNoises/110910261899874868

I try this occasionally and always disable it again. For some reason I find the fingerprint sensor is far less reliable for this particular use case. When I try to authenticate, I have to try repeatedly to get it to recognise my fingerprint. I know it’s the same hardware and software doing the matching, so it doesn’t really make any sense to me.
Post reply on HN