Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Building and shipping Mac and iOS apps without opening Xcode

scottwillsey.com

Post reply on HN
Print view View original

231–240 of 248 posts

Re: Building and shipping Mac and iOS apps without opening Xcode

#231

Post by brookst »

Someone wrote: post #183
pmontra wrote: post #171

Earlier quoted context omitted.

RYO is the best way to learn, if you have the time to learn. After building one own solution one is able to assess the strengths and weaknesses of what other more experienced people built. Without the learning phase those other solutions are incomprehensible black boxes. The trick is not to skip the phase in which one researches available solutions.

> RYO is the best way to learn, if you have the time to learn The problem is that nowadays, people roll their own solution, don’t take the time to learn (somewhat understandably, given the complexity of today’s stuff. You simply cannot learn all details about your hardware, OS, and third-party libraries anymore) but immediately deploy things in production. Eating your own dog food can be good, but for security relate…

Honest question: is there anyone truly good at security who never made a potentially-disastrous dogfooding mistake while learning?

Not to decent mistakes or amateur brain surgery, but there has to be some level of risk tolerance among tinkerers.

Re: Building and shipping Mac and iOS apps without opening Xcode

#232

Post by MetaWhirledPeas »

justincormack wrote: post #211
codazoda wrote: post #78

One down-side to this is that it does require you to run the agent on your Mac instead of in a Sandbox. I do this too and there are lots of problems I can't solve in a sandbox. I know a lot of you are throwing your hands up at the years of security practices we're throwing out the window when we do that. The fact that xAI uploaded someone's home directory, including their SSH keys, is giving me serious pause at my ch…

Use Secretive so your ssh keys are stored in the secure enclave. Keeping private keys in files is the 1990s security…

Genuine question: if the LLM possesses the ability to use Secretive to retrieve secrets are you not back to square 1? I'm not familiar with Secretive but if it's just another way to store secrets that's not enough. For proper security the LLM needs a black box intermediary to do anything privileged. I don't know what that looks like in terms of software.

Or better yet it needs dead-end privileges with a system and data that doesn't matter.

Re: Building and shipping Mac and iOS apps without opening Xcode

#233

Post by mark_l_watson »

codazoda wrote: post #78

One down-side to this is that it does require you to run the agent on your Mac instead of in a Sandbox. I do this too and there are lots of problems I can't solve in a sandbox. I know a lot of you are throwing your hands up at the years of security practices we're throwing out the window when we do that. The fact that xAI uploaded someone's home directory, including their SSH keys, is giving me serious pause at my ch…

Well you can use Apple Containers - more convenient than Docker. Alternatively: I am not enthusiastic about Anthropic as a company but I use Claude Code with the three best open coding models (for low cost and speed) and opus when I need it: if you configure Claude Code correctly you protect !/.ssh, etc. I would rather use OpenCode but I am more comfortable with CC (and of course turn off telemetry).

re: this article: excellent! I always do about 90% of my Swift dev on the command line and I learned new tricks from the article. Bookmarked.

Re: Building and shipping Mac and iOS apps without opening Xcode

#234

Post by DrewADesign »

999_cirno wrote: post #152
DrewADesign wrote: post #150

Earlier quoted context omitted.

Generally, assuming an RYO solution is a reasonable first approach is is a trap beginners fall into.

Strong StackOverflow "don't do anything new, god forbid you may actually learn something" vibes On "Hacker" News of all places :)

Strong “I’ve never had to deal with serious security problems stemming from a weird edge case, so this all seems silly to me” vibes.

Re: Building and shipping Mac and iOS apps without opening Xcode

#235

Post by DrewADesign »

pmontra wrote: post #171
DrewADesign wrote: post #150

Earlier quoted context omitted.

Generally, assuming an RYO solution is a reasonable first approach is is a trap beginners fall into.

RYO is the best way to learn, if you have the time to learn. After building one own solution one is able to assess the strengths and weaknesses of what other more experienced people built. Without the learning phase those other solutions are incomprehensible black boxes. The trick is not to skip the phase in which one researches available solutions.

Learning as you go is great if you’re not basing your core development workflow or data integrity on it.

Re: Building and shipping Mac and iOS apps without opening Xcode

#236

Post by DrewADesign »

brookst wrote: post #231
Someone wrote: post #183

Earlier quoted context omitted.

> RYO is the best way to learn, if you have the time to learn The problem is that nowadays, people roll their own solution, don’t take the time to learn (somewhat understandably, given the complexity of today’s stuff. You simply cannot learn all details about your hardware, OS, and third-party libraries anymore) but immediately deploy things in production. Eating your own dog food can be good, but for security relate…

Honest question: is there anyone truly good at security who never made a potentially-disastrous dogfooding mistake while learning? Not to decent mistakes or amateur brain surgery, but there has to be some level of risk tolerance among tinkerers.

Developing software that has the sole purpose of preventing something dangerous from happening is exactly when people should strive to be engineers, not tinkerers. Beginners often don’t know the difference.

Re: Building and shipping Mac and iOS apps without opening Xcode

#237

Post by DrewADesign »

iririririr wrote: post #156
DrewADesign wrote: post #142

Earlier quoted context omitted.

>> I feel like we're back to 1990's security here. > vibe code your own wrapper around the OS API Maybe stick with one of the existing projects? Throwing out all of the edge cases and hardening that went into a security-related project just to burn a bunch of resources to generate a worse one you have to maintain yourself is 90s-level security with 2026-level inefficiency, IMO.

all community projects (specially the ones maintained or opensourced by model owners) will certainly have the security-convenience trade offs set all the way to convenience while advertising all the (off by default) security features

Setting the convenience knob to very convenient in a system that has a lot more eyeballs on it will always be better than having something that one person who, let’s be real, probably doesn’t even have journeyman-level coding skills, estimates to be very secure based on what the model told them and a quick-skim code review.

It’s also a hell of an indictment of this community. FreeBSD is a community project. Qubes is a community project. SELinux is a community project. And people wonder why developers don’t take vibe coders seriously.

Re: Building and shipping Mac and iOS apps without opening Xcode

#238

Post by 1vuio0pswjnm7 »

ChrisMarshallNY wrote: post #128
quasarj wrote: post #92

Earlier quoted context omitted.

That's good to hear. I never even tried to make anything for macOS because I opened Xcode and.. well, you know.

Nah. I usually use Xcode GUI, but there's been a lot of discussion about using a CLI workflow, for many years. Should be easy to find. Hope you like long argument lists. xcodebuild has a crazy long parameter list. https://developer.apple.com/documentation/xcode/xcode-comman...

Text-only, no Javascript

https://developer.apple.com/tutorials/data/documentation/xco...

2011: https://manpagez.com/man/1/xcodebuild/

2016: https://keith.github.io/xcode-man-pages/xcodebuild.1.html

Source code for xcodebuild not public

?

Re: Building and shipping Mac and iOS apps without opening Xcode

#239

Post by nedt »

MetaWhirledPeas wrote: post #232
justincormack wrote: post #211

Earlier quoted context omitted.

Use Secretive so your ssh keys are stored in the secure enclave. Keeping private keys in files is the 1990s security…

Genuine question: if the LLM possesses the ability to use Secretive to retrieve secrets are you not back to square 1? I'm not familiar with Secretive but if it's just another way to store secrets that's not enough. For proper security the LLM needs a black box intermediary to do anything privileged. I don't know what that looks like in terms of software. Or better yet it needs dead-end privileges with a system and da…

They keys are stored in the secure enclave. You can't get them out. You can only let the secure enclave make calculations with it. And it needs your fingerprint to unlock.

Akamai akr should be able to do something similar, but would store the private key on your phone. It's the successor of krypton, which was bought by Akamai, and I liked that even more as you really need a second device.

Re: Building and shipping Mac and iOS apps without opening Xcode

#240

Post by overgard »

pclowes wrote: post #84
overgard wrote: post #30

Oh god, the app store does not need more slop. If you can't be bothered to open XCode (which I agree is a dumpster fire, but), you shouldn't be bothered to submit an app that a person has to review and another person has to filter out of their search results.

Counterpoint: XCode is such slop that an app made by a developer with the taste to avoid it has a higher probability of being less "sloppy" than average.

I don't know if that's really practical unless you're full-on-vibe coding or you avoid all the native frameworks. You kinda need XCode for a lot of things. I personally really dislike XCode after having to use it for like a decade and having it crash six times a day, so I feel people's pain in wanting to avoid it, but I also think slopping up the app store with vibe code monstrosities is not something that should be encouraged. Bad ideas are better made inconvenient..
Post reply on HN