Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

github.com

Post reply on HN
Print view View original

231–240 of 301 posts

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#231

Post by amake »

tacker2000 wrote: post #228
richwater wrote: post #220

Earlier quoted context omitted.

I seriously can't accept this as valid criticism. Homebrew not allowing users to install EOL versions of software with no security patches or updates is a _good_ idea. Just because a fraction of a tiny minority needs some ancient version of PHP doesn't make it a good idea.

yea, that's why it's not "pro" grade, and that's my point. "pro" users need EOL version support because sometimes some client still didn't want to update his age old web app the newest node or python or whatever. sometimes it's not up to the dev himself, and he needs to make money either way. so in the end brew makes decisions for the most common denominator, and that will be the user that uses it to install youtube-…

“Pro” users are using containers, venvs, version managers (nvm, rvm, etc.). They definitely aren’t installing project-specific stuff directly to the system.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#232

Post by Aurornis »

spaceribs wrote: post #67
bbkane wrote: post #33

Earlier quoted context omitted.

Fortunately, Linux laptops are getting better and better. I'm hopeful that by the time my M1 macBook Air gets slow enough to annoy me (maybe a year or two from now?), I'll be able to smoothly transition to Linux. I've already done it on the desktop!

My family have bought macs and been apple fanboys since the "Pizzabox" 6100 PowerPC. My dad handed me down a DuoDock when I was in middle school. We bought a G4 Cube, I had an iBook and Powerbook throughout college and throughout the 2010s. In 2017 I built my first desktop PC from the ground up and got it running Windows/Linux. I just removed Windows after the 11 upgrade required TPM, and I bought a brand new Framewo…

> This is to say that Apple used to represent a sort of freedom to escape what used to be Microsoft's walled garden. Now it's just another dead-end closed ecosystem

So you haven’t had a Mac since 2017, but you believe all of us using Macs are stuck in some walled garden?

These comments are so weird. Gatekeeper can be turned off easily if that’s what you want. Most of us leave it on because it’s not actually a problem in practice. The homebrew change doesn’t even impact non-cask formulas.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#233

Post by Aurornis »

marcodiego wrote: post #43
seanparsons wrote: post #4

My longstanding prediction that Gatekeeper will ever so slowly tighten so that people don't realise like a frog boiled in water is continuing to be true.

Apple does not support running other OS's on their hardware. This is bad in many senses but it is specially bad since it weakens competition and reduces incentives for Apple to improve their own OS, meaning it is bad even for their users in the long run. If you choose to buy hardware from apple, you must consider that you're encouraging a behaviour that is bad for everyone, including yourself.

> Apple does not support running other OS's on their hardware.

The bootloader was intentionally left open to other OSes. You should look into Asahi Linux.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#234

Post by pbronez »

CGamesPlay wrote: post #111
bloppe wrote: post #110

Earlier quoted context omitted.

This is a silly distinction. You can always include pre-built object files in your "source code" formula, then the build step is just linking it into an executable locally. That would bypass the quarantine attribute and effectively retain the ability to distribute pre-built binaries without gatekeeper getting involved. Seems like only a matter of time before someone at Apple realizes this and takes the necessary meas…

The linking step isn't even required. You can download any existing binary and codesign it yourself with your local developer certificate. You can even overwrite the existing signature. I assume brew could even automate this, but are choosing not to for whatever reason.

If Homebrew auto-signed third-party code, that puts them on the line for the security of that code. The whole point of MacOS developer certificates is to increase the trustworthiness of the software you run on your machine. The trust comes from the formal relationship between Apple and the software developer, which includes a traceable financial transaction. If signed software proves to be malicious, attribution is trivial.

If the homebrew team signed everything, they would immediately become a target for bad actors. The bad actors would flood homebrew with malicious binaries, which homebrew would auto-sign, users would download & run, and the bad actors would laugh all the way to the bank.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#235

Post by Mystery-Machine »

mikemcquaid wrote: post #223
usernamed7 wrote: post #216

Earlier quoted context omitted.

> As to me being a dick: I've been maintaining Homebrew for 16 years. It's used by millions of people. My full-time job has never been doing so and I've never been paid a market rate for my work on it (not that I expect or perhaps even deserve so). My primary concern with Homebrew is keeping the project actually running. This primarily requires the time, energy and work of maintainers doing so in their free time. It…

I don't think I am a dick, I guess that went without saying. I'll take critique from other maintainers who have done as much or more open source work for similar returns over similar time periods. Funnily enough, I'm friends with many, and they are supportive the vast majority of the time instead of critical. Maybe that's because they can relate and you cannot.

No one thinks they are a dick. But you are. At least in many instances as many of the comments here and elsewhere point out. I had similar experience trying to start a discussion about something in one of the Homebrew repositories.

The fact that you have many friends who confirm your bias of not being a dick...means exactly nothing. You have people telling you your words made them perceive your comment as being arrogant/blunt and your reply is: I'm successful open-source maintainer and have many friends who think I'm not arrogant and I only take critique from them. Have it your way. But in my eyes, you're being a dick. (Don't misinterpret this as my judgement of your engineering skills. I love Homebrew and it's an incredible feat. Congrats.)

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#236

Post by nixpulvis »

swiftcoder wrote: post #209
nixpulvis wrote: post #53

Alacritty is seemingly affected by this, which sucks for people who install it from homebrew because there's no way the developers are going to shell out to Apple for the signature. https://github.com/alacritty/alacritty/issues/8749 Does anyone know if self-signed binaries will work?

It seems like all they have to do is add a post install script that clears the quarantine attribute?

There's a third party tap now: https://github.com/m99coder/homebrew-tap

Time will tell if it's kept up to date.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#237

Post by nothrabannosir »

SOLAR_FIELDS wrote: post #104
pxc wrote: post #59

Earlier quoted context omitted.

> Most people I know are not installing too many casks Casks are the only things Homebrew does that some other package manager available on macOS doesn't reliably do better. Nix, Pkgsrc, MacPorts, and (and now Spack) all have better fundamental designs; sane, multi-user-friendly permissions; and enough isolation from the base system that they break neither each other nor manually-installed software. I use Homebrew ex…

Yeah, my nix-darwin config is pretty nice and perfectly hermetic and reproducible, save for a now-growing list of casks in my brew.nix that looks like this: > 1password # breaks in nix, must go in /Applications folder > softwareB # not available in nixpkgs > softwareC # available in nixpkgs, but because nixpkgs maintainers are hardline purists it takes 15 minutes to compile from source and ain't nobody got time for t…

> softwareC # available in nixpkgs, but because nixpkgs maintainers are hardline purists it takes 15 minutes to compile from source and ain't nobody got time for that

Which package is that? Is it proprietary but source available? Any free software which is built from source is built by hydra and available from the binary cache to downstream users.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#238

Post by kstrauser »

Aurornis wrote: post #232
spaceribs wrote: post #67

Earlier quoted context omitted.

My family have bought macs and been apple fanboys since the "Pizzabox" 6100 PowerPC. My dad handed me down a DuoDock when I was in middle school. We bought a G4 Cube, I had an iBook and Powerbook throughout college and throughout the 2010s. In 2017 I built my first desktop PC from the ground up and got it running Windows/Linux. I just removed Windows after the 11 upgrade required TPM, and I bought a brand new Framewo…

> This is to say that Apple used to represent a sort of freedom to escape what used to be Microsoft's walled garden. Now it's just another dead-end closed ecosystem So you haven’t had a Mac since 2017, but you believe all of us using Macs are stuck in some walled garden? These comments are so weird. Gatekeeper can be turned off easily if that’s what you want. Most of us leave it on because it’s not actually a problem…

I have to agree. Number of times it’s prevented me from running software I wanted to run: zero. Number of times it’s stopped me and said the equivalent of “are you really sure?”: a handful, maybe once a year on average.

And it’s not like I don’t use a gazillion third party apps and commands.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#239

Post by [deleted] »

yaris wrote: post #197
saagarjha wrote: post #120

Earlier quoted context omitted.

You can’t run unsigned software on Apple silicon. Note that when you build your software if you use Apple’s tools it will inject an ad-hoc signature into the product.

You very much _can_ run unsigned software on Apple silicon. At work my department has a bit less than 50 engineers with Macs (M1 to M4) and nobody complained that they can't build and run our product (using GCC from Homebrew, not Clang from Apple). But it involves some jumping through hoops, yes.

[deleted]

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#240

Post by __mharrison__ »

nixpulvis wrote: post #53

Alacritty is seemingly affected by this, which sucks for people who install it from homebrew because there's no way the developers are going to shell out to Apple for the signature. https://github.com/alacritty/alacritty/issues/8749 Does anyone know if self-signed binaries will work?

Alacrity is one of my casks. I'm not tied to it. Alternatives? I guess I could just go back to terminal.

Here's my other casks:

    cask "aerospace"
    cask "alacritty"
    cask "betterdisplay"
    cask "emacs"
    cask "espanso"
    cask "hammerspoon"
    cask "jordanbaird-ice"  # ice
    cask "gimp"
    cask "inkscape"
    cask "maccy"
    cask "mactex"
    cask "macwhisper"
    cask "qmk-toolbox"
    cask "zoom"
Post reply on HN