Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Distributing Mac software is increasing my cortisol levels

blog.kronis.dev

Post reply on HN
Print view View original

171–180 of 299 posts

Re: Distributing Mac software is increasing my cortisol levels

#171

Post by a_t48 »

mixologic wrote: post #164
a_t48 wrote: post #41

Maybe I'm too dumb, but I haven't figured out a good way to sign just a binary (or a tar/zip containing a few binaries). I zipped up the binaries, sent them off to Apple, Apple comes back and says "yup, notarized!", and they still trigger the popup. I'm probably missing a step. I guess I'm not currently stapling the ticket to the binary, but supposedly you don't have to if you are running with a network connection.

Theres two different steps, there is signing and there is notarization . You sign with the developer certificate using productsign/codesign, and then there is notarization, which you use notarytool to submit your signed binaray to apple to notarize. finally you then take their response and staple it to your binary. Its a lot of steps.

Yup I do the first two - https://github.com/zig-for/snfm/blob/main/.github/workflows/...

The documentation implies the last step is optional https://developer.apple.com/documentation/security/customizi... but it might be inaccurate

Re: Distributing Mac software is increasing my cortisol levels

#172

Post by solrlow »

aggregator-ios wrote: post #168

If I am understanding this correctly, the $99/year Apple Developer Program allows you to notarize applications for macOS so users do not receive the warning/damaged binary dialog. I simply had AI generate the signing code, and you can run that script on any CICD or on your machine and push the artifacts to a CDN. Works wonderfully for macOS, and users of my app have had no issues with it. Let me know by replying here…

I'm totally interested in hearing more about this, please share more details about how you get this working.

Re: Distributing Mac software is increasing my cortisol levels

#173

Post by tdeck »

mixologic wrote: post #166
tdeck wrote: post #120

Is there no open source collective one can join which will share signing keys and handle signing?

https://signpath.org/ is about as close as you can get.

That's actually awesome. I'm working on a project right now that could use this!

Re: Distributing Mac software is increasing my cortisol levels

#174

Post by theonemind »

dangus wrote: post #169
F7F7F7 wrote: post #152

Earlier quoted context omitted.

Sounds like you should pick something other than MacOS.

I decided to get into this subject in my comment before I edited it out because I thought it would be too much of a tangent/ruffle too many feathers. But, yeah, macOS power users these days seem to spend a lot of time criticizing the OS and the company and never seem to just switch to something else. Apple is the 4th most popular PC manufacturer on the market. You can use something else. It's not a monopoly, nor a du…

I can charitably believe this comment is not disingenuous, however, there are effectively two options, which are Windows and macOS, regardless of three manufacturers making more Windows machines than Apple at number four with Mac. I would call it an effective duopoly

Re: Distributing Mac software is increasing my cortisol levels

#175

Post by jaredklewis »

kqp wrote: post #92
Wowfunhappy wrote: post #5

Any user who does not like Gatekeeper can turn it off on their machine in ten seconds by running this in a Terminal: sudo spctl —-master-disable People will say, no, that’s too big a hammer, it’s not safe… but then, like, what do you actually want? Either you keep Gatekeeper because you like the friction it introduces, or you don’t like that friction and you should go turn it off. Pick one, you obviously can’t have b…

> what do you actually want? Give me the ability to choose what I trust. “You can either trust Apple and nobody else, even yourself, or you can trust literally everybody” is obviously not a good faith implementation of this. Apple excels at steering the narrative with false conflation and false dichotomy, I’d also remind you of the came-and-went secure boot debate, which Apple successfully steered into Apple owns the…

I don’t disagree with your post but I’m still unclear on how you envision gatekeeper should work.

You want the ability to choose a different “authorities” that verify and sign binaries? That makes sense to me but is unlikely to relieve any of the issues in the post.

Also what do you mean by “even yourself?” What would that option look like?

Re: Distributing Mac software is increasing my cortisol levels

#176

Post by mh- »

tdeck wrote: post #118
aiisahik wrote: post #110

1 year ago i would have agreed with you. Today, I'm going to take the other side on this. The amount of malicious code embedded in software now is going up exponentially. Yes this is a painful tax imposed on all software, malicious or not, but until they figure out a better system, this system actually will disuade a certain percentage of malicious actors to give up - ESPECIALLY having to pay a fee. As a mac user, i…

Malicious actors can easily pay a fee - they're either running a business or they work for a state actor.

The $100 isn't the deterrent. It's the having to pay (+ use a new identity/entity) every time you have to sign up for a new Developer account because Apple revoked your cert when it caught you distributing malware.

Re: Distributing Mac software is increasing my cortisol levels

#177

Post by mh- »

jedberg wrote: post #64

As a user I actually like Gatekeeper. 95% of the time it's not a problem. the other 5% of the time I have to click a button in my settings to allow unsigned code. But at least it gives me pause to think about the source and if I really trust it (which is mostly offloaded to Apple the other 95% of the time). Free business idea: get an Apple developer account and then agree to sign code for other people in exchange for…

The risk is that eventually you sign someone's malware and all of your customers have the certs that signed their apps revoked.

Re: Distributing Mac software is increasing my cortisol levels

#178

Post by Barbing »

suzzer99 wrote: post #151
Barbing wrote: post #44

Earlier quoted context omitted.

Posit it saves a decent number of folks who are unable to follow the scammer’s necessary instructions: “Press command space, no no hold down the command key - gosh it’s in the bottom left - okay, now type “privacy”, now scroll, no you scrolled too far …”

Lol I would love to see a scammer try to get my mom or dad to do anything other than press the power button. He's in for a world of hurt. The other day my mom got a text saying she had a $399 charge on Apple, and to call the number if it wasn't her. So she called, because of course, why wouldn't you? Apparently the scammer finally got frustrated and hung up on her because she couldn't understand his accent.

:D

Does your mother by chance happen to bear a striking resemblance to Kitboga?

Re: Distributing Mac software is increasing my cortisol levels

#179

Post by eviks »

Wowfunhappy wrote: post #5

Any user who does not like Gatekeeper can turn it off on their machine in ten seconds by running this in a Terminal: sudo spctl —-master-disable People will say, no, that’s too big a hammer, it’s not safe… but then, like, what do you actually want? Either you keep Gatekeeper because you like the friction it introduces, or you don’t like that friction and you should go turn it off. Pick one, you obviously can’t have b…

> Pick one, you obviously can’t have both!

Obviously you can, and you actually could earlier where you could click a bypass button for a specific app without any of this terminal nonsense

> turn it off on their machine in ten seconds

You forgot to add the time to learn that it's possible and to find the right command

> So maybe it takes 30 seconds instead of ten seconds. That’s mildly more annoying, but still doesn’t really seem like a big deal to me.

That's because you keep ignoring the actual effort/cost even after you've learned your first simplistic estimate was a mistake

Re: Distributing Mac software is increasing my cortisol levels

#180

Post by electroly »

seam_carver wrote: post #39
ryandrake wrote: post #28

Earlier quoted context omitted.

10 seconds or 30 seconds, it's just too much friction to ask end users to do. I actually develop on a Mac, but I've written off Apple as a target system for hobby/open source projects. Between quarantine, code signing, and notarizing (which requires $99 a year), it's just not worth it. Good for Apple users if they like this shit--I'm just not going to bother with distributing to the platform anymore. macOS is slowly…

Isn't code signing even harder/more expensive on Windows?

It's expensive. I don't agree that it's harder, in the sense of TFA's technical struggles getting it to work. If you've got the money for the certificate, passing OV and signing the binary is easy. The difficulty of signing isn't the big problem we face on Windows. The main issue is that signing barely does anything: you still get hit with SmartScreen blocks even though it's signed. The return on your investment of time and money is just showing your name as the publisher in the SmartScreen prompt. The only way to avoid the SmartScreen prompt is by building reputation with lots of installs.

I still prefer this over having a Microsoft developer account and publishing in the store--I hate having to put my software through arbitrary store review processes--but it's not a good situation. SmartScreen is just about the worst thing ever to happen to indie developers on Windows. We're right there in the thick of it with macOS developers: different details, same struggle. Both of our corporate overlords want you to distribute software in their store, and you get the sense that they would end self-distribution entirely if they thought they could get away with it.

I note that TFA's author edited the post after-the-fact, changing the line about Windows. It originally claimed that Windows worked fine and they got "just an EXE" and that was that. I assume they finally tried it for real on a civilian computer and saw the SmartScreen block.

Post reply on HN