41–50 of 61 posts
FYI, you can add whatever developer tool you use as an exception to privacy and security rules under "Developer Tools" in the "Privacy and Security" settings. I added my terminal emulator and it seems to let me run prebuilt, unsigned binaries without any annoyances.
Earlier quoted context omitted.
> as a developer you should expect that none of your users will have disabled those protections and your release plan should have notarizing as a step. I don't want to spend $99/year for the rest of eternity for the privilege of having a slightly less scary warning when my users run my app for the first time. Thus, the readme for the one macOS app I made that has gained a bit of popularity instructs users to right-cl…
Is it $99/year regardless of local cost of living? In that sense yes that is understandable. As an American developer, $99/year is something I can afford, can write off as a business expense, and hopefully make back with software proceeds. It should be noted, keeping the bar annoying but not prohibitive with a token fee does cut down on both junk submissions and malware.
> can write off as a business expense, and hopefully make back with software proceeds.
That's if your software involves money. Mine doesn't — it's all pure altruism. I just want to put my stuff out there for other people who might want it.
Earlier quoted context omitted.
That’s helpful. Broadly speaking, as a developer you should expect that none of your users will have disabled those protections and your release plan should have notarizing as a step. Asking users to disable system protection, or at the very least fiddle with system settings is a non-starter.
> as a developer you should expect that none of your users will have disabled those protections and your release plan should have notarizing as a step. I don't want to spend $99/year for the rest of eternity for the privilege of having a slightly less scary warning when my users run my app for the first time. Thus, the readme for the one macOS app I made that has gained a bit of popularity instructs users to right-cl…
That’s what you see. Users see it differently. I’m not running random exes on my computer. Even package managers are run in containers and VMs
This page was updated yesterday to remove the following text from the final section, which was added in November 2020: In addition, over the the next year we will introduce several changes to our security checks: • A new encrypted protocol for Developer ID certificate revocation checks • Strong protections against server failure • A new preference for users to opt out of these security protections
> A new encrypted protocol for Developer ID certificate revocation checks Done. > Strong protections against server failure Unknown, but presumably done. > A new preference for users to opt out of these security protections Never done. Apple lied. https://lapcatsoftware.com/articles/ocsp-privacy.html
The macOS appocalypse was a really shocking moment -- it was so disappointing to learn that despite the privacy marketing shtick, macOS engineers chose to have Macs phone home sensitive data in an seemingly aggressive way, with no opt out. Now in 2023 the fact that "a preference for users to opt out of these security protections" never materialized, and the copy just disappeared from the website, is quite disappointing. Great write up here [0] - thanks @lapcat!
Anecdata: Ever since that day I've blackholed ocsp.apple.com/ocsp2.apple.com at the DNS level, and all my Mac apps have launched just fine since.
If anyone at Apple reads this, I want to be given the choice. Warn me, stuff the setting into whatever plist -- whatever, but give me the choice.
Frankly for a company with Apple's resources, it's hard to believe the OCSP test suite somehow didn't consider half-open TCP connections. If a global catastrophe like that can happen once, it can happen again - which is why, in addition to the clearly negative privacy implications, Apple should give users who care a clear opt-out.
Wow, this is a big TIL! Until now I thought all cases of "damaged" had to do with something like bad/incomplete build or wrong architecture. Now it seems like any of them could've been attempts to deliver malware from possibly infected hosts.
Earlier quoted context omitted.
Apple is probably lucky that so few people use Macs, because the EU would have a field day with this notarization bullshit if they'd managed to get a 10% market share on computers.
Yet somehow, Windows 10 and 11 are dripping with contempt for the user, but the EU still hasn't acknowledged that as an antitrust problem worth investigating. Their insistence on pushing users into Edge alone should be enough IMO. Stuff like Edge "accidentally" opening on startup and some links "accidentally" opening in Edge instead of your default browser and your default browser setting getting "accidentally" reset…
At this point, I'm not sure it's worth investigating. This isn't the 90s when everyone was running application software directly on their PC; now everything is done in the cloud or through your web browser somehow. I honestly find it funny when Windows users have all kinds of agony because of that "contempt" you refer to; if they don't like it, they're free to switch to another OS. I've been watching this for over 25 years now but people just won't give up Windows, even when they only use it for web browsing, so I've lost all sympathy for them, even though the Windows user experience keeps getting worse.
Earlier quoted context omitted.
Is it $99/year regardless of local cost of living? In that sense yes that is understandable. As an American developer, $99/year is something I can afford, can write off as a business expense, and hopefully make back with software proceeds. It should be noted, keeping the bar annoying but not prohibitive with a token fee does cut down on both junk submissions and malware.
Play Store account cost me $25 as a one-time fee and that does the job of keeping the junk out just fine. There's no good reason why it has to be a recurring payment. > can write off as a business expense, and hopefully make back with software proceeds. That's if your software involves money. Mine doesn't — it's all pure altruism. I just want to put my stuff out there for other people who might want it.
Earlier quoted context omitted.
Yet somehow, Windows 10 and 11 are dripping with contempt for the user, but the EU still hasn't acknowledged that as an antitrust problem worth investigating. Their insistence on pushing users into Edge alone should be enough IMO. Stuff like Edge "accidentally" opening on startup and some links "accidentally" opening in Edge instead of your default browser and your default browser setting getting "accidentally" reset…
Since Edge is built ontop of Chromium and it is a distant 2nd to Google’s Chrome would that trigger EU compliance issues?