Validating Your Version of Xcode • Hacker News Board

Re: Validating Your Version of Xcode

#31

Post by ghshephard » Tue, Sep 22, 2015, 4:14 PM UTC

Presuming, of course, that whatever process may have corrupted your version of Xcode didn't also corrupt spctl.

Heh.

Re: Validating Your Version of Xcode

#32

Post by cjensen » Tue, Sep 22, 2015, 4:15 PM UTC

untog wrote: post #26

cjensen wrote: post #8

Am I understanding this correctly: the devs who downloaded Xcode from an unknown source disabled gatekeeper to get it to run? That's unbelievably stupid dev behavior, if true.

disabled gatekeeper to get it to run Not necessarily - they might have disabled GateKeeper a long time ago and never re-enabled it. I have the same complain with Android's "allow software from third parties" checkbox - it's a little useless because you uncheck it for one specific app you downloaded, but probably leave it unchecked forever more.

If you run an app that gatekeeper forbids, when you go into settings to fix that there is a button to approve that single app. There's no need to let everything through.

Re: Validating Your Version of Xcode

#33

Post by urda » Tue, Sep 22, 2015, 4:15 PM UTC

simonvc wrote: post #28

What output is expected when you run the command? I get: $ spctl --assess --verbose /Applications/Xcode.app /Applications/Xcode.app: rejected source=obsolete resource envelope I downloaded XCode via the app store, but have disabled gatekeeper (re-enabled it before running this command).

  /Applications/Xcode.app: accepted
  source=Mac App Store

  /Applications/Xcode.app: accepted
  source=Apple

  /Applications/Xcode.app: accepted
  source=Apple System

Are the only valid options. You should remove XCode and reinstall it from Apple.

Re: Validating Your Version of Xcode

#34

Post by brobinson » Tue, Sep 22, 2015, 4:17 PM UTC

simonvc wrote: post #28

What output is expected when you run the command? I get: $ spctl --assess --verbose /Applications/Xcode.app /Applications/Xcode.app: rejected source=obsolete resource envelope I downloaded XCode via the app store, but have disabled gatekeeper (re-enabled it before running this command).

I get this with latest XCode from the App Store:

    $ spctl --assess --verbose /Applications/Xcode.app
    /Applications/Xcode.app: accepted
    source=Mac App Store

Re: Validating Your Version of Xcode

#35

Post by cjensen » Tue, Sep 22, 2015, 4:19 PM UTC

stephenr wrote: post #11

cjensen wrote: post #8

Am I understanding this correctly: the devs who downloaded Xcode from an unknown source disabled gatekeeper to get it to run? That's unbelievably stupid dev behavior, if true.

They downloaded Xcode from somewhere besides Apple. How much more clue do you need about their stupidity.

Gatekeeper makes that a lot safer than you might think. The only downside is that it's not obvious how to check who signed it. If you could easily verify it's signed by Apple, that would be 100% safe.

Re: Validating Your Version of Xcode

#36

Post by soccerdave » Tue, Sep 22, 2015, 4:20 PM UTC

klausa wrote: post #24

cjensen wrote: post #8

Am I understanding this correctly: the devs who downloaded Xcode from an unknown source disabled gatekeeper to get it to run? That's unbelievably stupid dev behavior, if true.

I see a lot of people saying they disable Gatekeeper on purpose. Is the "right-click and open" trick that disables Gatekeeper for that app generally unknown? Or do people value not being assed to do it more than (potential) security upsides?

I wasn't aware of this shortcut until now. I've been going the long route through Settings. Thanks for the tip!

Re: Validating Your Version of Xcode

#37

Post by Laaw » Tue, Sep 22, 2015, 4:21 PM UTC

simonvc wrote: post #28

What output is expected when you run the command? I get: $ spctl --assess --verbose /Applications/Xcode.app /Applications/Xcode.app: rejected source=obsolete resource envelope I downloaded XCode via the app store, but have disabled gatekeeper (re-enabled it before running this command).

I got:

    /Applications/Xcode.app: accepted
    source=Mac App Store
    override=security disabled

Which I think means I have Gatekeeper disabled, but it still gave me the 'accepted' response.

Re: Validating Your Version of Xcode

#38

Post by Sephiroth87 » Tue, Sep 22, 2015, 4:21 PM UTC

e28eta wrote: post #21

X-Istence wrote: post #12

Earlier quoted context omitted.

On machines with Gatekeeper enabled you won't be able to open the application without it verifying the signature. Devs would have to on purpose remove that protection to run this bad version of Xcode, and after that it is practically game over.

How about an "install" script, written in your scripting language of choice? Sufficiently obscure language, obfuscate the code, leave misleading comments and copyright statements to look like its from Apple...

It might work, but an "experienced" developer might know that there no install script for Xcode (also, an experienced developer will probably not download from a random server, so i guess that's something...)

Re: Validating Your Version of Xcode

#39

Post by chrisdroukas » Tue, Sep 22, 2015, 4:23 PM UTC

0x0 wrote: post #30

Some news sources said Angry Birds 2 was trojanized, but "only" for the Chinese version. Anyone have any more info on that? Because I didn't think you could have separate binaries per location? Unless it is actually two entirely separate apps? And why would they even have a separate binary for the Chinese market (and why would they use a different build environment?)

It appears that a Chinese company named Kunlun licensed IP from Rovio and is developing Angry Birds apps specifically for the Chinese market. Perhaps they're also distributing the app themselves.

http://www.rovio.com/en/news/press-releases/621/rovio-gets-w...

Re: Validating Your Version of Xcode

#40

Post by justinzollars » Tue, Sep 22, 2015, 4:25 PM UTC

Laaw wrote: post #37

simonvc wrote: post #28

What output is expected when you run the command? I get: $ spctl --assess --verbose /Applications/Xcode.app /Applications/Xcode.app: rejected source=obsolete resource envelope I downloaded XCode via the app store, but have disabled gatekeeper (re-enabled it before running this command).

I got: /Applications/Xcode.app: accepted source=Mac App Store override=security disabled Which I think means I have Gatekeeper disabled, but it still gave me the 'accepted' response.

I also have this. I'm curious if I have a hacked version.