Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

github.com

Post reply on HN
Print view View original

101–110 of 301 posts

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#101

Post by queenkjuul »

JohnTHaller wrote: post #15
foxandmouse wrote: post #7

Yeah, I’ve been noticing an alarming number of casks marked to be depreciated… at the same time gatekeeper has gotten so restrictive it won’t let me (easily) open a video files that I downloaded from the internet

Yeah, I noticed the same on my Macbook. I mainly use it for theater stuff (Qlab) and remoting into my main Windows desktop environment. I just stopped doing some of the workflows on Mac and do them on Windows because I didn't feel like trying to figure out why macOS wouldn't let GIMP open an image I downloaded from the internet. So dumb.

Most ridiculous one for me so far:

- downloaded json file from my own GitHub account

- double click to open in VSCode, Apple says no

- try the usual tricks (holding alt and right clicking, i guess), no

- drag and drop file into Code, no

- right click>get info, lo and behold: the entire file contents displayed in the Get Info preview pane for me to copy

I'm actually getting a Windows laptop to do some testing on and i might just abandon Mac for the most part after that. Eating up five minutes of my day to figure out how to edit a file i created myself is just too much sometimes

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#103

Post by queenkjuul »

0xbadcafebee wrote: post #42

Homebrew is famous for making life hard for users. It makes "design decisions" that often conflict with users' needs, all in order to live up to the personal preferences of the project leads. Personally I use asdf to manage my software on Macs. It too has also changed its design recently to become user-hostile (the command-line tool no longer prints the options for the commands, and it's full of bugs since a recent m…

Apple loves to change which tools they ship, too, it at least have for the last few years as system updates were routinely breaking our build scripts at work, mostly when Apple would replace a GNU tool with a BSD tool without warning i think.

I agree though, Finder is a joke, the macOS system preferences has gotten incredibly cluttered and hard to use, the ever stricter code signing and download-opening restrictions are frustrating, and i can't even just install and run the docker CLI--docker on Mac requires Desktop and commercial use of Desktop requires a license.

All 3 systems have things about them that annoy me, but I'm with you that Mac is my least favorite. And it kinda sucks because the global text shortcuts (command-arrow, command-delete etc) are really handy and hard to replicate on other systems, and at least traditionally it's been a very pretty and well integrated desktop, the system itself just drives me up a wall.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#104

Post by SOLAR_FIELDS »

pxc wrote: post #59
devkit1 wrote: post #24

If I understand the issue correctly, it appears that this change primarily impacts casks on macOS. In fact it looks like it may only impact casks. Casks are used to install binary packaged software, often in the form of a dmg or pkg file on macOS. Most people I know are not installing too many casks, and most of the ones I've seen install signed binaries anyway. The important thing for me with this is that it doesnt…

> Most people I know are not installing too many casks Casks are the only things Homebrew does that some other package manager available on macOS doesn't reliably do better. Nix, Pkgsrc, MacPorts, and (and now Spack) all have better fundamental designs; sane, multi-user-friendly permissions; and enough isolation from the base system that they break neither each other nor manually-installed software. I use Homebrew ex…

Yeah, my nix-darwin config is pretty nice and perfectly hermetic and reproducible, save for a now-growing list of casks in my brew.nix that looks like this:

> 1password # breaks in nix, must go in /Applications folder

> softwareB # not available in nixpkgs

> softwareC # available in nixpkgs, but because nixpkgs maintainers are hardline purists it takes 15 minutes to compile from source and ain't nobody got time for that

> softwareD # ostensibly available in nixpkgs, but the package is completely broken (more general case of 1password)

Why not wrap the binaries yourself in flake.nix you say? Well, sure, would love to, if it wasn't such a pain in the ass to do so for each one and keep them up to date.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#105

Post by [deleted] »

Onavo wrote: post #55

Anyone interested in forking homebrew? Seems like they need more competition when it comes to user friendly package managers (macports doesn't count). It's a pity the original author got lost in the crypto rabbit hole https://tea.xyz/ There's also Sps2 which is written in Rust but it's very early stage https://github.com/alexykn/sps2 Breaking the momentum and institutional adoption of homebrew is non-trivial but the…

[deleted]

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#106

Post by simonw »

knowitnone3 wrote: post #93
simonw wrote: post #37

Earlier quoted context omitted.

If you are a developer who needs a specific old version of PHP or Node or whatever and you're not using Docker then I have great news for you on how you can solve your problem.

so don't use brew at all? Great, what else should we not use?

I personally use and enjoy Homebrew for most of my development tasks. The thing I would not use it for is to exactly simulate a specific combination of tool versions.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#107

Post by dangus »

marcodiego wrote: post #77
cweagans wrote: post #64

Earlier quoted context omitted.

I'm not sure what you're talking about. Their bootloader explicitly supports other OSes. They make it easy to run Windows (even through a built-in app that helps you set it up). There are plenty of reasons to criticize Apple, but they literally don't do anything to prevent you from running another OS.

> they literally don't do anything to prevent you from running another OS. Like not documenting their hardware? Like making Asahi Linux becoming a multi-year reverse engineering project that may possibly never achieve perfect compatibility? > They make it easy to run Windows On apple silicon without virtualisation? Sorry, didn't know that.

The point is that Apple could have easily locked down the bootloader and made it not possible at all to install something else. In designing the M1 hardware they explicitly went out of their way to make sure other operating systems could be installed and they’ve said as much. They took their smartphone SoCs and bootloader that never allowed alternate operating systems and added that feature in actively.

Technically Asahi Linux isn’t facing a much different situation than standard Linux distributions as they relate to x86 hardware. There are thousands of PC components that don’t provide any sort of Linux driver where contributors reverse engineer those drivers.

Sure, in the PC world a lot more vendors do voluntarily provide Linux drivers, and Apple will never to that for its hardware, and that specific point is a valid criticism.

As far as assisting in running Windows, my understanding is that the company that makes Parallels and Apple have some kind of relationship. Microsoft officially endorses Parallels.

You can complain about it being virtualization but it’s perfectly fine for desktop apps or even some more intensive apps. And it’s not really a very valid complaint considering that Microsoft doesn’t distribute a general purpose ARM distribution of Windows.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#108

Post by rzzzt »

frizlab wrote: post #84
saghm wrote: post #45

Earlier quoted context omitted.

> The important thing for me with this is that it doesnt appear to impact homebrew's ability to download, compile, and install open source software. And that is the main thing I use homebrew for. I believe that is true for most people too FWIW I don't think brew has been compiling on installation even open source things by default for a while now[1]: > Homebrew provides pre-built binary packages for many formulae. Th…

> FWIW I don't think brew has been compiling on installation even open source things by default for a while now For built in formulas, no. For custom ones very much more so. I know I have a bunch I’ll never have bottles for and would thus always be compiled if used.

Also if you have an older version of macOS. It will try to take the compiled route for packages but also prints a stern warning that your setup is unsupported.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#109

Post by marcodiego »

dangus wrote: post #107
marcodiego wrote: post #77

Earlier quoted context omitted.

> they literally don't do anything to prevent you from running another OS. Like not documenting their hardware? Like making Asahi Linux becoming a multi-year reverse engineering project that may possibly never achieve perfect compatibility? > They make it easy to run Windows On apple silicon without virtualisation? Sorry, didn't know that.

The point is that Apple could have easily locked down the bootloader and made it not possible at all to install something else. In designing the M1 hardware they explicitly went out of their way to make sure other operating systems could be installed and they’ve said as much. They took their smartphone SoCs and bootloader that never allowed alternate operating systems and added that feature in actively. Technically A…

> Technically Asahi Linux isn’t facing a much different situation than standard Linux distributions as they relate to x86 hardware.

Very very different.

> There are thousands of PC components that don’t provide any sort of Linux driver where contributors reverse engineer those drivers.

Increasingly more rare. Maybe that only happens thèse d'ays on extremely specialized hardware.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#110

Post by bloppe »

devkit1 wrote: post #24

If I understand the issue correctly, it appears that this change primarily impacts casks on macOS. In fact it looks like it may only impact casks. Casks are used to install binary packaged software, often in the form of a dmg or pkg file on macOS. Most people I know are not installing too many casks, and most of the ones I've seen install signed binaries anyway. The important thing for me with this is that it doesnt…

This is a silly distinction. You can always include pre-built object files in your "source code" formula, then the build step is just linking it into an executable locally. That would bypass the quarantine attribute and effectively retain the ability to distribute pre-built binaries without gatekeeper getting involved.

Seems like only a matter of time before someone at Apple realizes this and takes the necessary measures to protect you from yourself.

Post reply on HN