Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Validating Your Version of Xcode

developer.apple.com

Post reply on HN
Print view View original

81–90 of 101 posts

Re: Validating Your Version of Xcode

#81

Post by Osmium »

perrycynic wrote: post #77
Osmium wrote: post #67

Earlier quoted context omitted.

> Am I understanding this correctly: the devs who downloaded Xcode from an unknown source disabled gatekeeper to get it to run? This is generally known as hubris. We think we're smart and that the rules don't apply to us, because we know better than the other people. Turns out they can protect us too. Who knew? In this instance, I'd give the Chinese developers the benefit of the doubt, having recently had first hand…

The whole point of Gatekeeper is that you can download your software from anywhere and it'll integrity-check it for you. "The downloads were too slow" has no bearing on "and then I saved three minutes by skipping the security check on the software I got from an untrusted site." :-(

Absolutely, but one might just suspect that the download was corrupted, no? Especially in these circumstances. I think as developers we have a responsibility not to assume that, and to be diligent, but I can understand how it happened.

Re: Validating Your Version of Xcode

#82

Post by jonknee »

jlarocco wrote: post #13
cjensen wrote: post #8

Am I understanding this correctly: the devs who downloaded Xcode from an unknown source disabled gatekeeper to get it to run? That's unbelievably stupid dev behavior, if true.

I don't think having Gatekeeper disabled is a very big deal. It's one of the first things I disable on a new Mac. I've never had it stop an actual piece of malware, and it triggers false positives on practically everything. That said, I have no idea why anybody would download XCode from a third party...

> I've never had it stop an actual piece of malware, and it triggers false positives on practically everything.

Well it would have stopped this actual piece of malware! How often are you installing unsigned applications that a single right click to add to a whitelist is too much effort?

Re: Validating Your Version of Xcode

#83

Post by gress »

galad87 wrote: post #59
klausa wrote: post #24

Earlier quoted context omitted.

I see a lot of people saying they disable Gatekeeper on purpose. Is the "right-click and open" trick that disables Gatekeeper for that app generally unknown? Or do people value not being assed to do it more than (potential) security upsides?

The right click trick works only if the app is not signed. If the app signature is invalid it won't work. You have to disable gatekeeper completely to open the invalid Xcode version.

Why would you do that?

Re: Validating Your Version of Xcode

#84

Post by jonknee »

galad87 wrote: post #59
klausa wrote: post #24

Earlier quoted context omitted.

I see a lot of people saying they disable Gatekeeper on purpose. Is the "right-click and open" trick that disables Gatekeeper for that app generally unknown? Or do people value not being assed to do it more than (potential) security upsides?

The right click trick works only if the app is not signed. If the app signature is invalid it won't work. You have to disable gatekeeper completely to open the invalid Xcode version.

> The right click trick works only if the app is not signed. If the app signature is invalid it won't work.

Is it possible that the malware version of Xcode had its signature removed?

Re: Validating Your Version of Xcode

#85

Post by perrycynic »

hjuutilainen wrote: post #71

The problem with "spctl" is that it also evaluates trust which depends on your system settings and you have to pay attention to the output (as pointed out in the article). If you only want to verify the code signature _and_ provide your own requirement string, you could use something like (long options for legibility): $ codesign --verify --verbose --deep --test-requirement "=anchor apple" /Applications/Xcode.app/ Th…

Note that "anchor apple" means "signed by Apple's build system". It will not cover the Xcode you get from the Mac App Store (it uses a different kind of signature). This incantation is good enough to check for "an Xcode I legitimately got from a web page download."

Re: Validating Your Version of Xcode

#86

Post by perrycynic »

Laaw wrote: post #37
simonvc wrote: post #28

What output is expected when you run the command? I get: $ spctl --assess --verbose /Applications/Xcode.app /Applications/Xcode.app: rejected source=obsolete resource envelope I downloaded XCode via the app store, but have disabled gatekeeper (re-enabled it before running this command).

I got: /Applications/Xcode.app: accepted source=Mac App Store override=security disabled Which I think means I have Gatekeeper disabled, but it still gave me the 'accepted' response.

Spctl(1) gives you Gatekeeper's acceptance status. If you disabled it, it will (almost) always say "accepted", but in this case it may be "accepted because you turned me off, you XXX." Check the spctl(1) manpage for more options. A recent version will support the --enforce-assessment option to tell you what the real answer is. And turn the dang thing back on while you're at it. :-)

Re: Validating Your Version of Xcode

#87

Post by gress »

The responses on this thread seem to prove that Apple knows what it is doing with its security strategy. The fact that people blindly disable protections and end up causing massive malware outbreaks is exactly the reason they are introducing things like Gatekeeper and Rootless. Arguably, this incident is evidence in favor of them locking down Gatekeeper further.

Re: Validating Your Version of Xcode

#88

Post by perrycynic »

hamstergene wrote: post #42

I've just run the recommended check on freshly downloaded older versions (5.1.1 and 4.6.3), and their both appear rejected (source=matched cdhash).

These are explicit overrides programmed into Gatekeeper to deal with weak Xcode signatures during the transition time to stronger signatures. They're not a danger. Of course, Apple will tell you that you should use newer devtools than that. :-)

Re: Validating Your Version of Xcode

#89

Post by mnem »

cheshire137 wrote: post #65
epmatsw wrote: post #50

Earlier quoted context omitted.

How often do you install new software that's unsigned? I've only done it a couple of times, and once you override Gatekeeper for a specific app it never asks you for that one again.

I rarely find apps on the Mac app store, they're usually always from the app's creator's website. Recent ones I can think of include Bowtie and Sublime Text 3.

Sublime Text 3 is signed:

    $ spctl --assess --verbose /Applications/Sublime\ Text.app
    /Applications/Sublime Text.app: accepted
    source=Developer ID
Or have you downloaded a special version from a Chinese file sharing website? :)

Re: Validating Your Version of Xcode

#90

Post by dang »

gpvos wrote: post #23
nadams wrote: post #15

Earlier quoted context omitted.

> That said, I have no idea why anybody would download XCode from a third party... Easily explainable really. Went to [their favorite search engine], searched for "Xcode download" and clicked the first result which may not be from Apple (or an advertising).

If you do that, you're too stupid to be a developer, really.

Personal attacks are not allowed on Hacker News.
Post reply on HN