Live data from Hacker News

Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

github.com

241–250 of 301 posts

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#241

Earlier quoted context omitted.

> Most people I know are not installing too many casks I did a wipe and install of Tahoe like 2–3 weeks ago and used a Brewfile [1] I've had for years to install ~30 casks via Homebrew, including from the App Store, not to mention 50-60 formulas. As of today, I have 44 casks. [1]: https://docs.brew.sh/Brew-Bundle-and-Brewfile

I do something similar. I bootstrap all my new installs with brew cask https://github.com/fastily/autobots/tree/master/macOS/setup

Same here.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#242
post #206
post #59

Earlier quoted context omitted.

> Most people I know are not installing too many casks Casks are the only things Homebrew does that some other package manager available on macOS doesn't reliably do better. Nix, Pkgsrc, MacPorts, and (and now Spack) all have better fundamental designs; sane, multi-user-friendly permissions; and enough isolation from the base system that they break neither each other nor manually-installed software. I use Homebrew ex…

Spack is a really unfortunate name for a project given that it's a slur derived from 'spastic' in the UK.

Can you just "pronounce" it (even in your head) S-pack, as in "source package"?

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#243

Earlier quoted context omitted.

Reading that discussion, I was very surprised at MikeMcQuaid’s reaction to xtqqczze’s concerns, which were calm, brief, and valid. In response, Mike was a dick. Maybe it’s totally understandable that being a maintainer for the biggest mac package manager conditions a knee-jerk asshole response in a person.

There's a misunderstanding here what the issue tracker is for in Homebrew. In some projects, it's for free-for-all discussion. That's great if those projects want to use it that way. In this issue's case, you have someone in leadership (p-linnane) communicating that work needs to be done, a maintainer (carlocab) communicating what needs to be done to make this change. xtqqczze's attempt to get us to move backwards on…

Thanks for the response. Yes, I think some clarity about the purpose of the issue tracker would help someone unfamiliar with the project's maintenance better understand the conduct of the maintainers. If it is only for coordination of work tasks and not discussion of whether the work should be done, it would seem natural to have somewhere else where the discussion of the merits occurs.

> drive-by negativity by non-code-contributor users is the biggest existential threat

I do believe this, and it's what I was getting at with my "conditions a knee-jerk asshole response" comment. From the outside, I saw someone who wasn't being negative, but just seemed to have unaddressed concerns about the impact of the change. You, however, have been conditioned by hostile users over your many years of work to interpret this as negativity, because other, ruder people pile on to the valid concern in unhelpful ways, or the person with the concern wasn't willing to listen at all and just used a veneer of calm rationality to be a stick in the mud.

The point is, I get why you would be this way, but also that it doesn't look very good from the outside looking in. I know that you are doing unpaid labor and so nothing is owed, but still, both can be true.

I know some people don't like it, but I've always found discussions that are locked to collaborators only to be totally understandable for this reason. If you find yourself making "I know more about x than you ever will" comments to a person, you should probably instead just disregard them and carry on. Likewise, you do know more about x than I ever will, so you should probably just disregard me and carry on.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#244

Earlier quoted context omitted.

Yeah, my nix-darwin config is pretty nice and perfectly hermetic and reproducible, save for a now-growing list of casks in my brew.nix that looks like this: > 1password # breaks in nix, must go in /Applications folder > softwareB # not available in nixpkgs > softwareC # available in nixpkgs, but because nixpkgs maintainers are hardline purists it takes 15 minutes to compile from source and ain't nobody got time for t…

> nixpkgs maintainers are hardline purists On the contrary, Nixpkgs is generally made by the most pragmatic people and takes a flexible approach to a lot of issues. For instance, very few package managers have packages for proprietary software like 1Password in their official repositories. Nixpkgs also doesn't insist on building everything from source when it's hard to do so. As a result, Nixpkgs contains many packag…

The Nixpkgs community is internally diverse, but broadly values both "purity" and pragmatism. You can see debates and compromises play out in PRs all the time, or read traces of such careful weighing in the source code of Nixpkgs itself.

For the record, the Nix community's largest public cache doesn't cache binaries of proprietary software because doing so would be illegal— the public doesn't generally have the rights to redistribute proprietary software.

The phenomenon of having to compile free software from source via Nix typically happens when free software depends on proprietary software (which is common on macOS). Maybe this could be ameliorated on a technical level, but I think it's mostly historical accident and ease of implementation that got us to the current situation, where the whole dependency tree has to have a free license for something to make it into the binary cache.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#245

Earlier quoted context omitted.

As someone who migrated from macports to Homebrew, I'd like to see a third option (or maybe re-investigate macports again to see what's changed recently). Homebrew's insistence on leaving OSes behind that they deem to be "too old" is becoming a problem as the years click by. One of the reasons to use third party software and a third party package manager is to avoid Apple's own insistence on abandoning old OSes. Home…

Nix is sort of that third option, though I really wish there was a well-documented way to use it on macOS as purely a binary/source package manager. A lot of stuff I read online goes into setting up nix-darwin to manage desktop settings and etc. and I just don't need or want that. That being said, if you haven't used MacPorts in years, I'd say it's worth the jump. I recall moving from MacPorts in the first place beca…

Thank you for this helpful information. It might be worth a try. I initially moved to brew because it was "new", because I liked the command line interface, and because it seemed more "segregated" from the rest of the OS's files (/usr/local/Cellar and so on). But it's increasingly aggressive messages reminding me I am a second-class (or third-class) citizen due to the age of my OS is really off-putting.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#246
post #167

Earlier quoted context omitted.

As someone who migrated from macports to Homebrew, I'd like to see a third option (or maybe re-investigate macports again to see what's changed recently). Homebrew's insistence on leaving OSes behind that they deem to be "too old" is becoming a problem as the years click by. One of the reasons to use third party software and a third party package manager is to avoid Apple's own insistence on abandoning old OSes. Home…

"Homebrew's insistence on leaving OSes behind that they deem to be "too old" is becoming a problem as the years click by" Indeed! I have a VERY usable Macbook Pro from 2015. Even with the newest version supported macOS version (11) Big Sur (which is still quite modern) it doesn't have any binaries for apps, which means it has to compile every single app and dependency. I managed to update to macOS 14 (with the help o…

It's too bad that homebrew adopted the "Apple Attitude" around dealing with legacy OS versions. I don't recall ever seeing a message while working in Linux saying "Oh, you're using an OLD version of Linux, that's unsupported! You're a Tier-3 Loser and we don't guarantee this is going to work!"

Even developer tools on Windows tend to be fairly graceful about you running Windows 7 or whatever.

Somehow Apple and their entire ecosystem has adopted this "Latest Version Or GTFO" attitude towards users and developers.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#247

Alacritty is seemingly affected by this, which sucks for people who install it from homebrew because there's no way the developers are going to shell out to Apple for the signature. https://github.com/alacritty/alacritty/issues/8749 Does anyone know if self-signed binaries will work?

Alacrity is one of my casks. I'm not tied to it. Alternatives? I guess I could just go back to terminal. Here's my other casks: cask "aerospace" cask "alacritty" cask "betterdisplay" cask "emacs" cask "espanso" cask "hammerspoon" cask "jordanbaird-ice" # ice cask "gimp" cask "inkscape" cask "maccy" cask "mactex" cask "macwhisper" cask "qmk-toolbox" cask "zoom"

You can either use the tap which is posted in another one of my replies, or install it from the releases and remove the quarantine flag yourself as describes in both the issue I linked and my blog post from 4 years ago. Or you can build it yourself with `make app`.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#248

Earlier quoted context omitted.

> This is to say that Apple used to represent a sort of freedom to escape what used to be Microsoft's walled garden. Now it's just another dead-end closed ecosystem So you haven’t had a Mac since 2017, but you believe all of us using Macs are stuck in some walled garden? These comments are so weird. Gatekeeper can be turned off easily if that’s what you want. Most of us leave it on because it’s not actually a problem…

I have to agree. Number of times it’s prevented me from running software I wanted to run: zero. Number of times it’s stopped me and said the equivalent of “are you really sure?”: a handful, maybe once a year on average. And it’s not like I don’t use a gazillion third party apps and commands.

Same. I can see how it would look like a major problem if your only perspective was through clickbait headlines and angry comments from people who don’t use Macs anyway, though.

It reminds me of the distant cousin who lives out the countryside and prides themselves on not living in the city because the news tells them it’s a dangerous hellhole where everyone is getting mugged or shot on every street corner. When you immerse yourself in clickbait journalism the other side, whatever that may be, starts to look much worse than reality.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#249

Earlier quoted context omitted.

> Gatekeeper will ever so slowly tighten so that people don't realise like a frog boiled in water is continuing to be true Gatekeeper can be disabled. Given Cupertino’s pivot to services and the Mac’s limited install base relative to iPhones (and high penetration among developers) I’m doubtful they’d remove that option in the foreseeable future.

It really bothers me that Apple removed any convenient shortcut to bypass Gatekeeper like the old Control-click [1] hotkey. Apple's relentless ratcheting of the difficulty/annoyance of Gatekeeper has just about pushed me over the edge to completely disable it, despite the risk. The ridiculous song and dance of "File is dangerous, delete it?"->No->Settings->Security->Open Anyway->"File is dangerous, delete it?"->No is…

> The ridiculous song and dance of "File is dangerous, delete it?"->No->Settings->Security->Open Anyway->"File is dangerous, delete it?"->No is getting ridiculously old after literally doing it a hundred times at this point. And soon enough Apple will inevitably come up with some additional hurdle like, idk, closing Settings three times in a row while reading a fingerprint during an odd numbered minute.

> So in the name of "increased security" they've needlessly turned it into a binary thing where it's completely unprotected or accept my own computer that I paid for will deliberately waste my time constantly.

Remember when Apple made fun of Microsoft for doing exactly this? https://www.youtube.com/watch?v=8CwoluNRSSc

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#250

Alacritty is seemingly affected by this, which sucks for people who install it from homebrew because there's no way the developers are going to shell out to Apple for the signature. https://github.com/alacritty/alacritty/issues/8749 Does anyone know if self-signed binaries will work?

Alacrity is one of my casks. I'm not tied to it. Alternatives? I guess I could just go back to terminal. Here's my other casks: cask "aerospace" cask "alacritty" cask "betterdisplay" cask "emacs" cask "espanso" cask "hammerspoon" cask "jordanbaird-ice" # ice cask "gimp" cask "inkscape" cask "maccy" cask "mactex" cask "macwhisper" cask "qmk-toolbox" cask "zoom"

ghostty with tmux has served me well
Post reply on HN