Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

github.com

Post reply on HN
Print view View original

261–270 of 301 posts

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#261

Post by setopt »

fastily wrote: post #143
alwillis wrote: post #91

Earlier quoted context omitted.

> Most people I know are not installing too many casks I did a wipe and install of Tahoe like 2–3 weeks ago and used a Brewfile [1] I've had for years to install ~30 casks via Homebrew, including from the App Store, not to mention 50-60 formulas. As of today, I have 44 casks. [1]: https://docs.brew.sh/Brew-Bundle-and-Brewfile

I do something similar. I bootstrap all my new installs with brew cask https://github.com/fastily/autobots/tree/master/macOS/setup

I bootstrap it using Brewfile (plaintext file read by Homebrew), which supports Casks too.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#262

Post by setopt »

devkit1 wrote: post #24

If I understand the issue correctly, it appears that this change primarily impacts casks on macOS. In fact it looks like it may only impact casks. Casks are used to install binary packaged software, often in the form of a dmg or pkg file on macOS. Most people I know are not installing too many casks, and most of the ones I've seen install signed binaries anyway. The important thing for me with this is that it doesnt…

> Most people I know are not installing too many casks, and most of the ones I've seen install signed binaries anyway.

I install any GUI program I can via Homebrew, there’s at least 30 casks installed currently. Don’t know how many were signed though.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#263

Post by salawat »

torginus wrote: post #222
whywhywhywhy wrote: post #211

Protecting the user from things they don’t realize are apps or new apps on general is important. But the amount of overreach in gatekeeper to try and make the failed Mac App Store profitable and milk $90 a year at the expense of apps users want to run is egregious.

I personally think $90 per year is reasonable and not 'milking' - I don't think it's large enough to suspect Apple making bank on this, but does represent a certain level of commitment from a dev and prevents users from spamming developer accounts. The only scenario in which I think it's excessive is broke student devs, not sure if there's a scheme to waive the fee for them. Not allowing regular folks to run unsigned…

>Not allowing regular folks to run unsigned apps is something I also agree with -though I would love if Apple allowed us to trust third-party root certs so that apps would be both signed and free of Apple's control.

Rolling up the ladder much? Most who can program nowadays in one form or another owe the learning experience to the fact we could write and run unsigned apps without nannery measures like Gatekeeper.

I flat out refuse henceforth the do anything that encourages mind share on fundamentally anti-user, gatekept platforms.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#264

Post by verdverm »

Does this mean if I publish my own cask for pre built binaries, people will no longer be able to use it unless I do something with Homebrew's Gatekeeper?

If yes, this sounds a lot like the android side loading the Google just reversed

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#265

Post by PeaceTed »

Aurornis wrote: post #232
spaceribs wrote: post #67

Earlier quoted context omitted.

My family have bought macs and been apple fanboys since the "Pizzabox" 6100 PowerPC. My dad handed me down a DuoDock when I was in middle school. We bought a G4 Cube, I had an iBook and Powerbook throughout college and throughout the 2010s. In 2017 I built my first desktop PC from the ground up and got it running Windows/Linux. I just removed Windows after the 11 upgrade required TPM, and I bought a brand new Framewo…

> This is to say that Apple used to represent a sort of freedom to escape what used to be Microsoft's walled garden. Now it's just another dead-end closed ecosystem So you haven’t had a Mac since 2017, but you believe all of us using Macs are stuck in some walled garden? These comments are so weird. Gatekeeper can be turned off easily if that’s what you want. Most of us leave it on because it’s not actually a problem…

It is said you only realise you are in jail once you feel the chains. And this is something Apple has tried to walk the line on, be locked down but in a fashion that causes the least push back on users.

Personally I never felt Mac OS was that locked down, but it has been over a decade since I last used it.

The only time I felt it was trying to delete 'Chess' only it to be listed as a vital system application. I know this isn't true but I would love it if Chess turned out to be a load bearing application for the entire OS. Like folks at Apple don't know why but if you remove it, everything stops.At least MS managed to remove the load bearing Space cadet pinball. Replaced it with a One drive popup that handles all memory management in the kernel ;)

Back to the original point, by comparison on iOS I definetly did feel the chains. One could fear Mac OS will turn into that but they haven't conditioned people yet.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#266

Post by jajuuka »

mikemcquaid wrote: post #253
Mystery-Machine wrote: post #235

Earlier quoted context omitted.

No one thinks they are a dick. But you are. At least in many instances as many of the comments here and elsewhere point out. I had similar experience trying to start a discussion about something in one of the Homebrew repositories. The fact that you have many friends who confirm your bias of not being a dick...means exactly nothing. You have people telling you your words made them perceive your comment as being arrog…

If you love Homebrew, maybe you might want to consider if repeatedly calling me a dick or arrogant/blunt is a particularly nice way to treat someone who spends their spare time building software you rely on.

This, this is being a dick. Holding your project hostage because you want to flex your power over someone. It's entitled behavior. Glad I moved to MacPorts years ago.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#267

Post by Onavo »

wl wrote: post #210
Onavo wrote: post #55

Anyone interested in forking homebrew? Seems like they need more competition when it comes to user friendly package managers (macports doesn't count). It's a pity the original author got lost in the crypto rabbit hole https://tea.xyz/ There's also Sps2 which is written in Rust but it's very early stage https://github.com/alexykn/sps2 Breaking the momentum and institutional adoption of homebrew is non-trivial but the…

Mike McQuaid has been doing this a long time and there are more egregious examples in the past. I got off the Homebrew train when Little Snitch caught Homebrew phoning home without my consent and the response from him was, the developers have already decided to implement telemetry in an opt-out fashion and any pushback to that already made decision is "abusive" to the maintainers. The Homebrew maintainers are not tru…

I think mise has a real chance of being a homebrew replacement, if the author chooses do take up the mantle.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#268

Post by torginus »

salawat wrote: post #263
torginus wrote: post #222

Earlier quoted context omitted.

I personally think $90 per year is reasonable and not 'milking' - I don't think it's large enough to suspect Apple making bank on this, but does represent a certain level of commitment from a dev and prevents users from spamming developer accounts. The only scenario in which I think it's excessive is broke student devs, not sure if there's a scheme to waive the fee for them. Not allowing regular folks to run unsigned…

>Not allowing regular folks to run unsigned apps is something I also agree with -though I would love if Apple allowed us to trust third-party root certs so that apps would be both signed and free of Apple's control. Rolling up the ladder much? Most who can program nowadays in one form or another owe the learning experience to the fact we could write and run unsigned apps without nannery measures like Gatekeeper. I fl…

The reason you can go anywhere on the internet and trust at least that the website you're viewing is in the form the creator intended is that HTTPS exists - which requires that a trusted entity has issued a cert that proves the domain is indeed held by the person and what goes on in that domain hasn't been tampered with externally.

That is the default on the internet, and even enforced. I'm merely saying that for average users (or power users even, who understand the risks) the default should be that the same guarantees apply to desktop apps as well (especially considering those usually have far more access).

HTTPS shows that such a world where people live with this restriction is possible and practical, and far from the jackbooted tyranny you describe.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#269

Post by paradox460 »

nixpulvis wrote: post #117
valicord wrote: post #115

Earlier quoted context omitted.

if it's an open source project, why is it using a cask anyway? it should be a formula that builds from source directly

I don't know much about macOS these days, but I was under the impression that Casks were for applications, and normal formula were for things installed in your PATH as standalone binaries. The .app needs a few extra things bundled up. EDIT: I looked it up, the issue is that homebrew explicitly doesn't want .app formulas: https://docs.brew.sh/Acceptable-Formulae#stuff-that-builds-a... IDK what they expect. Every open…

Mise can install things directly from GitHub

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#270

Post by noname120 »

mikemcquaid wrote: post #185
devkit1 wrote: post #24

If I understand the issue correctly, it appears that this change primarily impacts casks on macOS. In fact it looks like it may only impact casks. Casks are used to install binary packaged software, often in the form of a dmg or pkg file on macOS. Most people I know are not installing too many casks, and most of the ones I've seen install signed binaries anyway. The important thing for me with this is that it doesnt…

Homebrew Project Leader here. Yes, this only affects casks, not formulae, whether formulae are built from source or use Homebrew's bottles (binary packages) or bottles from taps.

As an open-source developer, is there a way to have my apps pass Gatekeeper without paying the $100/year Apple ransom and notarizing them? I think it’s the crux of the problem.

As I’m writing these lines, Homebrew has 7656 casks in the official cask tap[1]. I’m not sure exactly how many of those are unsigned but if we assume 4000 then signing them all would be an additional $400,000/year extorted by Apple from the open-source community.

Defining HOMEBREW_CASK_OPTS=--no-quarantine in my shell configuration was a good way to avoid this issue without having to manually run dozens of xattr -d every time I run brew upgrade.

Now my only option left is to pull the trigger and make my system globally less secure: sudo spctl --master-disable

Unfortunately, disabling Gatekeeper doesn’t just allow unsigned apps to run: it also completely disable all verifications for signed apps: notarization checks, revocation checks, trust evaluation checks.

[1] curl https://formulae.brew.sh/api/cask.json | jq 'length'

Post reply on HN