The Gates to Hell: Apple’s Notarizing • Hacker News Board

Re: The Gates to Hell: Apple’s Notarizing

#101

Post by maxwell » Fri, Apr 30, 2021, 5:08 PM UTC

eitland wrote: post #92

fsflover wrote: post #74

Earlier quoted context omitted.

> That doesn't prevent it from becoming so mainstream at work I would say that it does. If your boss is not aware of this system, they will not allow to use it or consider secure. At work, I am typically not allowed to freely choose my OS.

You misunderstood me. The point is it is already happening: Linux is already so mainstream at work that I've seen a sales guy(!) using Ubuntu. And I see people sharing screen on Teams and it is Linux!

Yeah, the majority of phones and servers run Linux. It's "mainstream infrastructure" instead of a consumer brand, but not out of the ordinary for consumers or businesses.

Re: The Gates to Hell: Apple’s Notarizing

#102

Post by lunixbochs » Fri, Apr 30, 2021, 5:10 PM UTC

anonymouse008 wrote: post #45

Ha! Even though Notarizing was released in 2018, it's still too soon to discuss for me.... Try packaging a python interpreter with a ton of .so's and .dylibs with your .app and see how much hair you have left!

I ship my app as universal2 with latest Python (including modules and complex shared objects preinstalled to site packages such as Pytorch, numpy, opencv), xpc services, a launch daemon, a handful of frameworks, and ~137 shared objects in deeply nested subfolders. Fully notarized + stapled + hardened runtime + library validation. I don't build in Xcode, as this is a cross platform app. It's caused little stress. AMA.

(I also ship the same app to Windows with EV signing and I think that is more of a pain, due to the physical HSM requirement)

Re: The Gates to Hell: Apple’s Notarizing

#103

Post by karmelapple » Fri, Apr 30, 2021, 5:13 PM UTC

Could we get a year added to the headline?

The blog post talks about waiting to upgrade to macOS 10.15, but the current macOS is version 11, so I'm thinking this is fairly old. Because at first I thought this might have been related to a recent info.plist vulnerability. [0]

[0] https://www.wired.com/story/macos-malware-shlayer-gatekeeper...

Re: The Gates to Hell: Apple’s Notarizing

#104

Post by lunixbochs » Fri, Apr 30, 2021, 5:15 PM UTC

Klonoar wrote: post #76

anonymouse008 wrote: post #45

Ha! Even though Notarizing was released in 2018, it's still too soon to discuss for me.... Try packaging a python interpreter with a ton of .so's and .dylibs with your .app and see how much hair you have left!

I’ve packaged and signed/notarized a Dolphin (fork) build and it was relatively painless all things considered. Dylibs have no real impact on this process so I’m curious what you ran into.

In python there are a handful of .so files in subdirectories you need to sign. You can basically `find . -name \*.dylib -o -name \*.so` and codesign those.

Re: The Gates to Hell: Apple’s Notarizing

#105

Post by jhatemyjob » Fri, Apr 30, 2021, 5:18 PM UTC

maxwell wrote: post #57

jhatemyjob wrote: post #33

Earlier quoted context omitted.

LOL you know who coined the term "app" right?

Coined? We talked about web apps, desktop apps, mobile apps back in the early '00s, before Jobs unveiled the iPhone, which initially supported only web apps, if you missed those days.

okay so you don't know who coined the term "app", got it

Re: The Gates to Hell: Apple’s Notarizing

#106

Post by kalleboo » Fri, Apr 30, 2021, 5:21 PM UTC

nicky0 wrote: post #93

kalleboo wrote: post #87

Earlier quoted context omitted.

For macOS (which is what we're talking about in a topic about notarization), you can sell your software any way you want outside of the App Store, without the 30% cut. There's still a $100/year developer account fee to be able to notarize new builds of your app. This is not iOS where the App Store is the only way to install an app. This comment is not an endorsement of any aspect of Apple's business model, I'm just c…

Just FWIW it's a 15% cut nowadays. (Unless you are doing >$1million a year of sales, which anyone quibbling over a $100 annual fee isn't.)

That is correct, but that is a special discount program you have to apply for, wait for judgement, and get approved for in advance. It's not the default.

It was a great step forward, but I don't understand why they made it so complicated with an approval process, when Google did the same thing afterwards and could just say "the first million dollars a year is 15%, after that it's 30%".

The total revenue difference for the different companies is probably negligible.

(or... outside of the App Store you can sign up for a PayPal account and accept payments at a 3% rate instantly)

Re: The Gates to Hell: Apple’s Notarizing

#107

Post by lunixbochs » Fri, Apr 30, 2021, 5:26 PM UTC

galad87 wrote: post #13

I wrote a little sh script to notarize HandBrake two (or maybe three) years ago, and that's was it. It's not rocket science. But like every new thing, it required a bit of time to read the documentation and to understand what's going on. The plugin issue described in the article is probably related to the hardened runtime, so it's unrelated to the actual notarisation process.

This is my notary script for a DMG: https://gist.github.com/lunixbochs/0ceeb23be5c3d5c6748165e61...

   ./notary.sh notarize app.dmg
   ./notary.sh staple app.dmg

I store a password as a keychain entry named AC_PASSWORD. If you're running this in headless CI you should run a notarize command once interactively so you can tell keychain to always allow altool to access the password.

Re: The Gates to Hell: Apple’s Notarizing

#108

Post by r00fus » Fri, Apr 30, 2021, 5:27 PM UTC

maxwell wrote: post #78

r00fus wrote: post #34

Earlier quoted context omitted.

> Why do users choose a platform? Apps. They also choose brands. Apple has one of the biggest ones, and the fact that people bought MacBooks during the butterfly keyboard years should tell you just how powerful that brand is.

Yeah, grandparents and computer labs kept their old Apple computers around through the '90s when Apple wasn't cool. Before getting a Mac became at first ironically cool in the early '00s (because they looked funny but couldn't run any good games). Apple is clearly just a default and not a preference with kids nowadays in my experience, like they were for kids in schools in the '90s. They have good games now though. B…

> Brands don't seem particularly defensible, and Apple doesn't seem to have any network effects outside iMessages/FaceTime and their accessory ecosystem.

Perhaps that's why Apple advertises so much with product placements in movies. On a lot of movies the main characters have iPhones - it's not overt, just a jingle or them looking at a call (which looks like iOS incoming call UI). Same with Macs or AirPods. I honestly wonder what their placement spend is like.

They aren't the most valuable brand for no reason [1]. That placement is earned, but reinforced with lots of spend.

[1] https://www.businessinsider.com/apple-surpasses-amazon-as-wo...

Re: The Gates to Hell: Apple’s Notarizing

#109

Post by Klonoar » Fri, Apr 30, 2021, 5:28 PM UTC

mvanaltvorst wrote: post #81

Klonoar wrote: post #69

Earlier quoted context omitted.

$100/yr is fairly cheap all things considered, and it takes thirty minutes Max to set up a bash script to handle it. And that’s just non-Xcode. If you use Xcode it’s often automatic.

Cheap considering what? Considering the 30% margins they take on any further sale? Considering the 25$ one-time fee the Play Store takes?

Cheap considering buying a proper certificate for signing and releasing on Windows will often cost you the same. ;P

If your bar to hit is Linux, you'll never be happy with anything.

Re: The Gates to Hell: Apple’s Notarizing

#110

Post by Klonoar » Fri, Apr 30, 2021, 5:29 PM UTC

lunixbochs wrote: post #104

Klonoar wrote: post #76

Earlier quoted context omitted.

I’ve packaged and signed/notarized a Dolphin (fork) build and it was relatively painless all things considered. Dylibs have no real impact on this process so I’m curious what you ran into.

In python there are a handful of .so files in subdirectories you need to sign. You can basically `find . -name \*.dylib -o -name \*.so` and codesign those.

I'm fairly certain that you just need to codesign --deep here, as that's all I've ever done.