Live data from Hacker News

Apple Accidentally Approved Malware to Run on macOS

wired.com

101–110 of 134 posts

Re: Apple Accidentally Approved Malware to Run on macOS

#101
post #22
post #11

Earlier quoted context omitted.

What makes you thing that open source developers are fine with that? What are their other choices? Apple doesn’t care.

The choice is don't build for MacOS. In the long run Apple won't be happy with that and maybe they'll waive the fee.

They do waive it for non-profits, if they have the right paperwork. I'm sure Mozilla/Apache/WordPress/Free Software Foundations could get a $0 key if they wanted.

Re: Apple Accidentally Approved Malware to Run on macOS

#102
post #98

Earlier quoted context omitted.

> Can you point to straightforward apple instructions for doing so? Take a look at how other apps do it, such as: • MacDown https://macdown.uranusjr.com (also on GitHub) Download → Right/Control-click → Open → Confirm There are several such apps and open-source tools that are not notarized, some quite popular. Some of them provide those instructions next to their download links.

See the below discussion on why this is not a realistic or user-friendly option. https://news.ycombinator.com/item?id=24217116

Exactly which part of “Download → Right-click → Open → Confirm” is user-unfriendly?

Those steps are literally all it takes. It’s barely 40 keystrokes to list them.

As a user and the resident tech support for people young and old, I am glad that there’s such a barrier against the execution of arbitrary software and it’s easily skippable if one so explicitly chooses.

In any case, how is it any worse than the Windows nag prompts that people accepted more than a decade ago?

Re: Apple Accidentally Approved Malware to Run on macOS

#103
post #99

Earlier quoted context omitted.

You are overestimating how many power users use Apple products. If you are technology literate, you've seen the evils of Apple for decades. A power user fixes their own problem, not waits years for Apple to fix it.

This is clearly anecdotal, but nearly every dev/engineer from every company I have ever worked for has had an MBP as their work laptop.

I'm the other way, I've never seen a Macbook in an (Engineering) office setting, four fortune 500, two small businesses.

I've seen them at University and some non STEM students homes.

That said, I see iPhones at work, but probably because they are not critical to doing anything other than email.

Re: Apple Accidentally Approved Malware to Run on macOS

#104
post #87
post #67

Earlier quoted context omitted.

I think open source licenses are ripe for an update with the following clauses to deal with FAANG companies: This software shall not be used on platforms that hinder users in their free choice of software. This software shall not be used to create or in conjunction with adware, spyware, or other malicious software. (Perhaps after a lawyer has reworded it properly so people can't pretend to not understand what is mean…

“This software shall not be used on platforms that hinder users in their free choice of software” That’s the GPL, isn’t it? Version 3 was specifically created to close loopholes w.r.t. to that ( https://en.wikipedia.org/wiki/Tivoization : “Tivoization is the creation of a system that incorporates software under the terms of a copyleft software license (like the GPL), but uses hardware restrictions or digital rights m…

No that line is different from the GPL. For example, you could still sell the software without distributing the source or without allowing users to link against your code.

Re: Apple Accidentally Approved Malware to Run on macOS

#105
post #98

Earlier quoted context omitted.

See the below discussion on why this is not a realistic or user-friendly option. https://news.ycombinator.com/item?id=24217116

Exactly which part of “Download → Right-click → Open → Confirm” is user-unfriendly? Those steps are literally all it takes. It’s barely 40 keystrokes to list them. As a user and the resident tech support for people young and old, I am glad that there’s such a barrier against the execution of arbitrary software and it’s easily skippable if one so explicitly chooses. In any case, how is it any worse than the Windows na…

The linked article clearly demonstrates that running apps without notarization on macOS is much more complicated than you describe it to be, to the point of it feeling insurmountable for less technical users.

Perhaps you've configured your device in a way that gives you an easier execution path, or the app is employing a workaround to bypass Gatekeeper.

It seems MacDown uses such a temporary workaround to make the process less painful for macOS users: https://github.com/MacDownApp/macdown/issues/1106#issuecomme...

Re: Apple Accidentally Approved Malware to Run on macOS

#106
post #92

Earlier quoted context omitted.

> You may still be using developer resources like documentation. That's not any different. If I write a POSIX-compliant program then it should run on macOS without having used any of Apple's documentation. And if they charged for documentation (which is dumb) it would create a market for third party macOS documentation that I could use instead. > But yeah, a flat fee for a wide variety of services risks edge cases wh…

If you write a program strictly to POSIX, your program doesn't have a GUI and is run from the terminal, which already bypasses Gatekeeper by default.

It doesn't have to be strictly to POSIX to not use anything Apple-specific, e.g. you can get a GUI using Qt or Gtk, or Java. For that matter, there are X.org implementations for macOS.

Re: Apple Accidentally Approved Malware to Run on macOS

#107
post #89

Earlier quoted context omitted.

> You may still be using developer resources like documentation. That's not any different. If I write a POSIX-compliant program then it should run on macOS without having used any of Apple's documentation. And if they charged for documentation (which is dumb) it would create a market for third party macOS documentation that I could use instead. > But yeah, a flat fee for a wide variety of services risks edge cases wh…

> I don't want to use anything they make, I just want to have access to my customers who use macOS. These are conflicting statements. You will have a very difficult time supporting your Apple-using customers without using any Apple stuff yourself.

If I write an application in Java, it should run on macOS the same as it does anywhere else, and if it doesn't then I submit a bug report to the maintainers of the JRE. What do I need from Apple?

Re: Apple Accidentally Approved Malware to Run on macOS

#108
post #95

Earlier quoted context omitted.

It’s pretty impressive that Ubuntu and Arch (Power User-only experiences in my mind) are considered an alternative to macOS by anyone at all. It shows the Linux desktop is actually delivering something very valuable despite the numbers. Although that the numbers don’t tell the whole story isn’t really saying much. What if it turned out that ease of use and OS-wide app consistency was the easy part all along? That bui…

The thing to remember is that, under all the chrome and Apple styling, macOS is rooted in BSD. So the power users who enjoy the *nix-y bits of macOS and are looking for a replacement will look for something that gives them more of that.

Is this a real thing? Like there are people that don't VM/SSH into Linux but use shell?

What demographic is this? College kids and Apple employees?

It seems like minor benefit in an otherwise atrocious platform.

Re: Apple Accidentally Approved Malware to Run on macOS

#109

Earlier quoted context omitted.

If I'm not mistaken you can create as many code signing certificates as you want, so it makes sense to sign each application with its own certificate. Of course this wouldn't help when Apple "kills" the entire developer account I guess.

Nope, you can only generate 5 Developer ID Application certificates for the lifetime of your Developer account. It's a real pain to get another one, I had lost all of mine (didn't have a real Mac, so was using various temporary Hackintosh and KVM installs) and it took 2 months of emails to both Developer support and the Security team to get another one issued [and backed up].

It took you five times before you learned to make backups? Woah.

Re: Apple Accidentally Approved Malware to Run on macOS

#110
post #56

Earlier quoted context omitted.

You're taking the current Apple developer program as an eternal truth, when in fact it has changed significantly over time. Before the App Store, you could develop for the Mac completely free. There was a developer program, which was much more expensive than $99 per year, but it was mainly concerned with WWDC and pre-release builds. There was even a hardware discount for developers, which was very popular, and effect…

It’s hilarious that according to Apple fans, Apple as a $2 tn dollar company cannot afford the program it was giving away for free as a $10bn company.

You know why rich people are rich?

They don't spend all their money!

Yup, a bit glib but it gets to the essence...

Post reply on HN