macOS gatekeeper and file quarantine bypass • Hacker News Board

Re: macOS gatekeeper and file quarantine bypass

#91

Post by btilly » Mon, Apr 26, 2021, 10:54 PM UTC

Isthatablackgsd wrote: post #48

kstrauser wrote: post #36

Earlier quoted context omitted.

You're hugely misreading my intentions. I'm an engineer: I see something unexpected, I want to figure out what's happening. You and I are both using the same software and you're seeing problems that I didn't even know affected some people. I'm not saying "this works for me so I don't know what you're complaining about". I'm saying "huh, this works for me. I wonder what's different between our systems? Is this somethi…

Apologies for misreading you, I'm just frustrated and accepted the fact that it is by design. I been reading other comments and as someone (xrisk) pointed out that it is Homebrew Casks which it made sense since all of the gatekeeper alerts is coming from 'Cask-ed' apps. I could disable Gatekeeper but I rather not because MacOS is not my daily driver. I rather to keep Gatekeeper active to protect itself from moronic m…

Given how ubiquitous your problem is, I would be suspicious that security alerts are going off because you have a real security problem. I've seen similar problems when a piece of malware keeps trying to inject itself into various things, and Gatekeeper is catching it. The variety of places where you're getting alerts is a testament to the persistence of the malware, and not the fact that everything is actually broken.

Re: macOS gatekeeper and file quarantine bypass

#92

Post by hoka-one-one » Mon, Apr 26, 2021, 11:03 PM UTC

sildur wrote: post #84

benatkin wrote: post #58

Earlier quoted context omitted.

> Be sure to upgrade. This is a technical crowd, so some of us don't need to rush to download things like this. I'll upgrade when it's convenient, thank you very much.

Funny that when you started with "this is a technical crowd" I thought you will continue with "we don't need to be reminded to upgrade".

I usually hack the hackers first

Re: macOS gatekeeper and file quarantine bypass

#93

Post by ziml77 » Mon, Apr 26, 2021, 11:06 PM UTC

Closi wrote: post #21

pehtis wrote: post #17

I will never understand why "Show all filename extensions" is unchecked by default in Finder.

It's also unchecked in Windows by default - I suspect that in reality the concept of extensions probably confuses some users, who end up changing the extension and then struggle to work out how to open their saved files. ( I always prefer to see the extensions too though :) )

Isn't it also confusing for the average user when they end up with identical looking files? I didn't realize that macOS had per-file extension hiding until I synced some images over from my iPad. I ended up with files that I couldn't tell apart at a glance because they had the same name but were different image file types. I'm now torn if I actually want to force all extensions to show because I think showing applications as "Foo.app" is ugly (I know, it's a stupid reason to dislike the option...)

Re: macOS gatekeeper and file quarantine bypass

#94

Post by ziml77 » Mon, Apr 26, 2021, 11:14 PM UTC

spijdar wrote: post #45

boomboomsubban wrote: post #31

Earlier quoted context omitted.

Unix-based has almost always used internal metadata, and the "dot" is just another character. I thought Windows was unique in relying on the suffixes, but Wikipedia suggests MacOS inherited some form from NextSTEP.

"Unix" OSes in my experience simply don't (universally) have a way to "open this file in the correct application". It's a foreign concept. Files are just sequences of bytes, and file paths are just addresses to those bytes. The file extensions are, then, purely for the sake of the user, as there is no (standard) way to store file metadata. There are specific filesystems with these metadata extensions, but otherwise,…

I wonder if filesystems should be designed to store the MIME type alongside the file. Web browsers get MIME types alongside the data (and they do make use of that info).

Re: macOS gatekeeper and file quarantine bypass

#95

Post by herf » Mon, Apr 26, 2021, 11:24 PM UTC

Isthatablackgsd wrote: post #5

kstrauser wrote: post #4

Earlier quoted context omitted.

What frustrates you about it? I rarely bump into Gatekeeper and I'm doing the normal dev things.

I'm assuming you don't use the package manager like Homebrew or MacPorts? this is where the gatekeeper will annoy the hell out of me. Apps installed via Homebrew often will encounter Gatekeeper alerts. Half of them will give the option to open it and the other half, the gatekeeper --demands-- gently ask me to put it in the Trash without the option to open it.

Did you install homebrew via a Rosetta Terminal?

M1/ARM code is treated more strictly than Intel, so I guess all my command line stuff is Intel.

Re: macOS gatekeeper and file quarantine bypass

#96

Post by spurgu » Mon, Apr 26, 2021, 11:30 PM UTC

pehtis wrote: post #17

I will never understand why "Show all filename extensions" is unchecked by default in Finder.

Or how to navigate to /Users/. You have to manually add it to the sidebar from Preferences.

Re: macOS gatekeeper and file quarantine bypass

#97

Post by dimmke » Mon, Apr 26, 2021, 11:43 PM UTC

crazygringo wrote: post #87

Isthatablackgsd wrote: post #5

Earlier quoted context omitted.

I'm assuming you don't use the package manager like Homebrew or MacPorts? this is where the gatekeeper will annoy the hell out of me. Apps installed via Homebrew often will encounter Gatekeeper alerts. Half of them will give the option to open it and the other half, the gatekeeper --demands-- gently ask me to put it in the Trash without the option to open it.

That's... unusual. I use Homebrew constantly and have never seen such a thing in my life, in any version of macOS/OSX over the past several years. Not in building from source, not in casks. Like another commenter the only security change I have is "Allow apps downloaded from" set to "App store and identified developers" -- which I'd assume virtually every Mac user on HN has also set. Perhaps you have some kind of unu…

Same, I install almost all new software via Homebrew and I've never had this problem.

Re: macOS gatekeeper and file quarantine bypass

#98

Post by comex » Mon, Apr 26, 2021, 11:48 PM UTC

Wowfunhappy wrote: post #49

joshspankit wrote: post #47

Earlier quoted context omitted.

Does turning those off still leave the logs redacted? Or do you also have to install the profile after you tell it to get out of your way?

I don’t use Big Sur but I don’t think it has any affect on logs. Without SIP, you could patch the kernel or something and change whatever you want, but that would of course be nuts. I share your curiosity. If your computer isn't already managed, installing an MDM profile in order to view logs is ridiculous. I don’t even think there’s a way to do it without paying money.

That page is somewhat misleading. MDM is one way to install configuration profiles, but you can also install them by hand. No signing required, either. You can just stick that XML in a file with extension .mobileconfig, then double-click the file, and it will prompt you to install it.

Or download a signed version from here (not my site):

https://georgegarside.com/blog/macos/sierra-console-private/...

Re: macOS gatekeeper and file quarantine bypass

#99

Post by sharikone » Tue, Apr 27, 2021, 12:13 AM UTC

I feel that macOS has slowly become a mess. From Lion, more or less.

Overcomplicated and bloated security features, telemetry, iOSification of the UI, dumbed down settings, bugs..

Perhaps the time has come to shed some legacy and restart again from scratch (like Google Fuchsia) or to invest some of the hundreds of billions they have in refining the software so it actually works

Re: macOS gatekeeper and file quarantine bypass

#100

Post by gdavisson » Tue, Apr 27, 2021, 12:17 AM UTC

smoldesu wrote: post #2

Gatekeeper is one of the most frustrating things I have to fight whenever I try using MacOS. It feels like DRM for my applications, which in turn makes everything feel clunkier, and less integrated. I would genuinely pay Apple extra for a version of MacOS that just trusts me and lets me install what I want without the some esoteric mechanism stopping me at every step of the way...

It's not that macOS doesn't trust you, it's that macOS doesn't trust the programs you're running. Specifically, it doesn't trust the programs to do what you want them to, and only what you want them to.

And it's not just a matter of protecting you against out-and-out malware (although that's certainly part of it), it's a matter of protecting you against developers whose interests don't entirely align with yours. Developers who really want to spy on their users seem to be the biggest group (see, for example, the recent Apple vs. Facebook kerfuffle).

Unfortunately, distrusting software does add friction, especially if you add (/update-via-unsupported-mechanisms) new software frequently. "Are you sure you meant to run this program? It looks weird to me; I think you should get rid of it. Should it really have access to your contacts/camera/etc?" macOS is acting a little like an overprotective parent here, and it's certainly annoying. But the threats it's trying to protect you from are real. You can turn the protections off (with a certain amount of work), but then you're vulnerable to all the stuff it's there to protect you from.

P.s. I don't mean to completely defend Apple here. Their preferred solution is to have all software distribution go through their App store... where they get a cut of the price. Which means they're also on the list of developers whose interests don't entirely align with yours.