Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

macOS gatekeeper and file quarantine bypass

objective-see.com

Post reply on HN
Print view View original

101–110 of 125 posts

Re: macOS gatekeeper and file quarantine bypass

#101

Post by kossTKR »

ghughes wrote: post #86
kossTKR wrote: post #7

Does anyone know how trustworthy this objective-see project is? I remember once installing several of his apps, but then coming to the conclusion that i don't know enough - even though he consistently seems to find and fix flaws in OSX. Why isn't Apple hiring this man? EDIT: Why are people downvoting this question? If i'm implying something then i'm unaware of it.

The tools are legit, and the bugs are real, but he has a distasteful habit of feeding sensationalist quotes to outlets like Forbes and Vice. This time, he told Forbes that "the hacks effectively take Mac security back a decade" [1], and Vice quotes him as saying "this is likely the worst or potentially the most impactful bug to everyday macOS users in recent memory". [2] Forbes ran the story with the headline "The ‘W…

Thanks for the insight! Seems like quite a talented dude but with the mandatory eccentricity that seemingly often comes with . Great to know that the tools are legit.

Re: macOS gatekeeper and file quarantine bypass

#102

Post by favorited »

Spivak wrote: post #74
pehtis wrote: post #30

Earlier quoted context omitted.

Yes it cares. If you rename a folder to folder.app then it will change to look and "behave" like an app. Or if you change the extension of a video file to mp3 you'll loose the icon preview. Finder does try to help with renaming and when you try to rename a file only the filename is selected and not the extension.

What you're describing is just Finder caring. Linux doesn't care at all about your file extensions but Nautilus sure does. In GNOME for example gio handles opening files in the "correct" application by way of the MIME database in /usr/share/application/mimeapps.list and ~/.local/share/applications/mimeapps.list.

LaunchServices definitely cares about extensions. The Mac OS has a strange history with extensions (classic Macs didn't really support them, but they were still a common convention), but file extensions are more than a browser-level construct.

Re: macOS gatekeeper and file quarantine bypass

#104

Post by doopy1 »

kossTKR wrote: post #101
ghughes wrote: post #86

Earlier quoted context omitted.

The tools are legit, and the bugs are real, but he has a distasteful habit of feeding sensationalist quotes to outlets like Forbes and Vice. This time, he told Forbes that "the hacks effectively take Mac security back a decade" [1], and Vice quotes him as saying "this is likely the worst or potentially the most impactful bug to everyday macOS users in recent memory". [2] Forbes ran the story with the headline "The ‘W…

Thanks for the insight! Seems like quite a talented dude but with the mandatory eccentricity that seemingly often comes with . Great to know that the tools are legit.

I just think this is how the PR/Media flow goes with these things.

Re: macOS gatekeeper and file quarantine bypass

#106

Post by HandstandMick »

crazygringo wrote: post #87
Isthatablackgsd wrote: post #5

Earlier quoted context omitted.

I'm assuming you don't use the package manager like Homebrew or MacPorts? this is where the gatekeeper will annoy the hell out of me. Apps installed via Homebrew often will encounter Gatekeeper alerts. Half of them will give the option to open it and the other half, the gatekeeper --demands-- gently ask me to put it in the Trash without the option to open it.

That's... unusual. I use Homebrew constantly and have never seen such a thing in my life, in any version of macOS/OSX over the past several years. Not in building from source, not in casks. Like another commenter the only security change I have is "Allow apps downloaded from" set to "App store and identified developers" -- which I'd assume virtually every Mac user on HN has also set. Perhaps you have some kind of unu…

What works for me is to ignore the trash message, in Finder, find the App, right click open, macOS displays a warning and open prompt, click Open, next time around do the same and post it seems to be fine.

Re: macOS gatekeeper and file quarantine bypass

#107

Post by healsjnr1 »

benatkin wrote: post #58
jdlshore wrote: post #43

Fascinating article. Short version: there was a bug in the part of Apple’s Gatekeeper code that checked whether a file was an application bundle. Bundles that only contained a script, and not a plist file, were considered “not a bundle,” and this bypasses the Gatekeeper checks. The issue is fixed in the latest version of Big Sur. Be sure to upgrade. It’s being exploited in the wild.

> Be sure to upgrade. This is a technical crowd, so some of us don't need to rush to download things like this. I'll upgrade when it's convenient, thank you very much.

Given the ease and severity of this I don't think being technical does anything for you.

I am grateful for the "upgrade now" message being pushed it. As a technical user I can't trust my skills and knowledge to truly keep me safe from this one.

Re: macOS gatekeeper and file quarantine bypass

#108

Post by trissylegs »

boomboomsubban wrote: post #26
pehtis wrote: post #17

I will never understand why "Show all filename extensions" is unchecked by default in Finder.

Genuine question, does MacOS actually care about file extensions? I would guess not, though there are probably some compatibility features that will do things if they are there.

Yes. Take a JPEG with extension. It opens fine. Get a file with .jfif macOS doesn't know what the hell it is. Same file format, weird extension. (For some reason twitter was saving files as .jfif for a while)

Re: macOS gatekeeper and file quarantine bypass

#109

Post by symlinkk »

Closi wrote: post #21
pehtis wrote: post #17

I will never understand why "Show all filename extensions" is unchecked by default in Finder.

It's also unchecked in Windows by default - I suspect that in reality the concept of extensions probably confuses some users, who end up changing the extension and then struggle to work out how to open their saved files. ( I always prefer to see the extensions too though :) )

This is an outdated mindset. Literally everyone knows the difference between .docx and .jpg in 2021.
Post reply on HN