Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

github.com

Post reply on HN
Print view View original

81–90 of 301 posts

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#81

Post by danudey »

seanparsons wrote: post #69
armchairhacker wrote: post #40

Earlier quoted context omitted.

People did realize when the actual Gatekeeper change happened a year ago [1]. But your prediction still holds because frogs do realize when they're boiled in water [2]. [1] https://arstechnica.com/gadgets/2024/08/macos-15-sequoia-mak... , https://www.macrumors.com/2024/08/06/macos-sequoia-gatekeepe... , https://daringfireball.net/linked/2024/08/07/mac-os-15-sequo... . Top HN comment on Sequoia's announcement mentions…

The point is that by the time Gatekeeper closes tight enough that everything must run through Apple and it can't be disabled, most people wont notice and will be stuck with it.

Your assertion seems to imply that there will be a point of no return where users are no longer able to stop buying apple hardware to run the software they want, and that therefore people should do so now.

If that's not what you're saying then your point is effectively moot, because if indeed Apple's platform control gets too egregious for some individuals then those people will switch at that point so there's no point in panic-switching now just in case.

In other words, users will switch when what Apple is offering does not meet what those users require. Some users will literally never care because all the software they use is signed and gatekept and so on; some users have jumped ship already because they want to be able to change whatever they want whenever they want. If things continue to "slippery slope" then more people will hit their own tipping point but asserting that it's going to happen all at once and apply to everyone is nonsense.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#83

Post by pxc »

cweagans wrote: post #66
ryandrake wrote: post #44

Earlier quoted context omitted.

As someone who migrated from macports to Homebrew, I'd like to see a third option (or maybe re-investigate macports again to see what's changed recently). Homebrew's insistence on leaving OSes behind that they deem to be "too old" is becoming a problem as the years click by. One of the reasons to use third party software and a third party package manager is to avoid Apple's own insistence on abandoning old OSes. Home…

> I'd like to see a third option Nix, perhaps?

Also Pkgsrc

if you're good with tools that don't support global installs there are also Spack, Mise, and pkgx

none of those are quite suitable for managing macOS app bundles, though.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#84

Post by frizlab »

saghm wrote: post #45
devkit1 wrote: post #24

If I understand the issue correctly, it appears that this change primarily impacts casks on macOS. In fact it looks like it may only impact casks. Casks are used to install binary packaged software, often in the form of a dmg or pkg file on macOS. Most people I know are not installing too many casks, and most of the ones I've seen install signed binaries anyway. The important thing for me with this is that it doesnt…

> The important thing for me with this is that it doesnt appear to impact homebrew's ability to download, compile, and install open source software. And that is the main thing I use homebrew for. I believe that is true for most people too FWIW I don't think brew has been compiling on installation even open source things by default for a while now[1]: > Homebrew provides pre-built binary packages for many formulae. Th…

> FWIW I don't think brew has been compiling on installation even open source things by default for a while now

For built in formulas, no. For custom ones very much more so. I know I have a bunch I’ll never have bottles for and would thus always be compiled if used.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#85

Post by dylan604 »

saghm wrote: post #45
devkit1 wrote: post #24

If I understand the issue correctly, it appears that this change primarily impacts casks on macOS. In fact it looks like it may only impact casks. Casks are used to install binary packaged software, often in the form of a dmg or pkg file on macOS. Most people I know are not installing too many casks, and most of the ones I've seen install signed binaries anyway. The important thing for me with this is that it doesnt…

> The important thing for me with this is that it doesnt appear to impact homebrew's ability to download, compile, and install open source software. And that is the main thing I use homebrew for. I believe that is true for most people too FWIW I don't think brew has been compiling on installation even open source things by default for a while now[1]: > Homebrew provides pre-built binary packages for many formulae. Th…

You can tell this in how fast things "pour". There's no way things are compiling from source that fast.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#86

Post by nbobko »

Hehe, the classic rude and mean behavior from homebrew maintainers.

I get their motivation to remove the flag. In fact, it has always been better to run xattr in postinstall, this way the binary is free from quarantine even after updates.

But the way they communicate with people is unacceptable and just unnecessary.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#87

Post by shantara »

devkit1 wrote: post #24

If I understand the issue correctly, it appears that this change primarily impacts casks on macOS. In fact it looks like it may only impact casks. Casks are used to install binary packaged software, often in the form of a dmg or pkg file on macOS. Most people I know are not installing too many casks, and most of the ones I've seen install signed binaries anyway. The important thing for me with this is that it doesnt…

Two popular apps mentioned in the earlier discussion in Homebrew repo are Librewolf and Freetube.

https://github.com/orgs/Homebrew/discussions/6334

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#88

Post by lilyball »

pxc wrote: post #59
devkit1 wrote: post #24

If I understand the issue correctly, it appears that this change primarily impacts casks on macOS. In fact it looks like it may only impact casks. Casks are used to install binary packaged software, often in the form of a dmg or pkg file on macOS. Most people I know are not installing too many casks, and most of the ones I've seen install signed binaries anyway. The important thing for me with this is that it doesnt…

> Most people I know are not installing too many casks Casks are the only things Homebrew does that some other package manager available on macOS doesn't reliably do better. Nix, Pkgsrc, MacPorts, and (and now Spack) all have better fundamental designs; sane, multi-user-friendly permissions; and enough isolation from the base system that they break neither each other nor manually-installed software. I use Homebrew ex…

I haven't used Homebrew in a long time, but if I ever did it would be in the way that you describe (so far I've always found reasonable alternatives for the software I want). What I'm wondering is if this is entirely to support unsigned casks, why does Homebrew not simply resign the software itself at install time with an adhoc signature as though it had just built it?

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#89

Post by zbentley »

pxc wrote: post #59
devkit1 wrote: post #24

If I understand the issue correctly, it appears that this change primarily impacts casks on macOS. In fact it looks like it may only impact casks. Casks are used to install binary packaged software, often in the form of a dmg or pkg file on macOS. Most people I know are not installing too many casks, and most of the ones I've seen install signed binaries anyway. The important thing for me with this is that it doesnt…

> Most people I know are not installing too many casks Casks are the only things Homebrew does that some other package manager available on macOS doesn't reliably do better. Nix, Pkgsrc, MacPorts, and (and now Spack) all have better fundamental designs; sane, multi-user-friendly permissions; and enough isolation from the base system that they break neither each other nor manually-installed software. I use Homebrew ex…

> If I have to give my consent anew for each app update, I might as well install the apps manually and live in the usual auto-update pop-up hell.

Really? That's a whole lot of UI actions/clicks (and a variable number per .app) versus ... I think two always-the-same UI actions at most. Not like, a huge hassle either way, but I have trouble seeing how Homebrew's not still the winner here even without quarantine bypassing.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#90

Post by knowitnone3 »

nbobko wrote: post #86

Hehe, the classic rude and mean behavior from homebrew maintainers. I get their motivation to remove the flag. In fact, it has always been better to run xattr in postinstall, this way the binary is free from quarantine even after updates. But the way they communicate with people is unacceptable and just unnecessary.

they pretended to have a discussion so they look good.
Post reply on HN