Safely open apps on your Mac

Post by jeroenhd » Thu, Sep 28, 2023, 3:36 AM UTC

grishka wrote: post #10

balls187 wrote: post #4

Earlier quoted context omitted.

That’s helpful. Broadly speaking, as a developer you should expect that none of your users will have disabled those protections and your release plan should have notarizing as a step. Asking users to disable system protection, or at the very least fiddle with system settings is a non-starter.

> as a developer you should expect that none of your users will have disabled those protections and your release plan should have notarizing as a step. I don't want to spend $99/year for the rest of eternity for the privilege of having a slightly less scary warning when my users run my app for the first time. Thus, the readme for the one macOS app I made that has gained a bit of popularity instructs users to right-cl…

Post by userbinator » Thu, Sep 28, 2023, 3:39 AM UTC

KennyBlanken wrote: post #16

grishka wrote: post #3

What Apple probably doesn't want you to know is that you can also run these two commands to disable the notarization requirement, effectively reverting your security level to non-paranoid pre-Catalina: sudo spctl --master-disable sudo defaults write /Library/Preferences/com.apple.security GKAutoRearm -bool false This reveal add and select a third option, "any source", under "allow applications downloaded from". The s…

I don't want to necessarily disable it. What I do want is to be able to click "yes yes, I don't care this time / ever for this binary, fuck off." I don't even mind if you make me fingerprint auth for it. What drives me insane: the inconsistent/invisible functionality around this stuff. In Ventura, if you double-click an unsigned app, it won't run, with a big scary message that it cannot be verified. ...except if you…

Post by fiddlerwoaroof » Thu, Sep 28, 2023, 3:52 AM UTC

fiddlerwoaroof wrote: post #24

userbinator wrote: post #23

Earlier quoted context omitted.

This is not remotely obvious Apple stopped emphasising discoverability a long time ago.

Making the option that bypasses the security measures less obvious is a feature. This is a case of assuming that developers are Apple’s model user when it’s non-developers who are likely to install “Macsweeper” because a popup ad told them they had a virus.

Post by MBCook » Thu, Sep 28, 2023, 3:55 AM UTC

JimDabell wrote: post #18

MBCook wrote: post #7

Earlier quoted context omitted.

It may be official now! I just saw today that Sonoma contains an example pam config file with that line commented out. Uncomment, copy it over the default file, win. Far less hidden. https://mastodon.social/@StrangeNoises/110910261899874868

I try this occasionally and always disable it again. For some reason I find the fingerprint sensor is far less reliable for this particular use case. When I try to authenticate, I have to try repeatedly to get it to recognise my fingerprint. I know it’s the same hardware and software doing the matching, so it doesn’t really make any sense to me.

Post by grishka » Thu, Sep 28, 2023, 3:58 AM UTC

jeroenhd wrote: post #21

grishka wrote: post #10

Earlier quoted context omitted.

> as a developer you should expect that none of your users will have disabled those protections and your release plan should have notarizing as a step. I don't want to spend $99/year for the rest of eternity for the privilege of having a slightly less scary warning when my users run my app for the first time. Thus, the readme for the one macOS app I made that has gained a bit of popularity instructs users to right-cl…

Apple is probably lucky that so few people use Macs, because the EU would have a field day with this notarization bullshit if they'd managed to get a 10% market share on computers.