4 ms·

From what I understand, access to official Apple websites from within China is very slow, so people host mirrors of Apple software (like XCode) for developers w

From what I understand, access to official Apple websites from within China is very slow, so people host mirrors of Apple software (like XCode) for developers within China to download. One of these mirrors had a altered version of XCode that Chinese developers were downloading. One of these developers noticed strange behavior with one of his apps. It was connecting to strange servers on the Internet when he hadn't written the code to do so. This lead to the discovery of malware in some copies of XCode floating around the Chinese portion of the Internet. I imagine Apple will add some sort of tool verification step to help fix this issue. Another way to help prevent this problem would be to host an official mirror inside China, obviating the need to get Apple tools from unofficial sources.

klodolph 11y ago
Of course, it happens only with developers who turn Gatekeeper off. As frustrated as some people are with Gatekeeper, this is exactly the kind of thing that it is designed to protect against. I've never turned Gatekeeper off on my macs (nor UAC off on Windows).
- mikeash 11y ago
  I think this illustrates the balance you have to strike to have an effective security system. If you make it too annoying for legitimate use, you'll get people to disable it so that it no longer protects them. I don't know what the best answer is, but Gatekeeper could stand to be a little less obstructive when the user legitimately trusts something that the system doesn't know about. Apple's answer will, sadly, probably be to make it impossible to disable.
  - klodolph 11y ago
    Right click -> open. If you open an app this way, the gatekeeper dialog box will allow you to launch the app if you want (but the warning will still be shown). Once you open the app for the first time, you won't be prompted again.
  - rsy96 11y ago
    Shameless plug for my blog post on how the UX of Gatekeeper should be improved https://rsy96.github.io/blogs/2015/09/20/gatekeeper-should-be-overhauled.html https://rsy96.github.io/blogs/2015/09/20/gatekeeper-should-b...

klodolph 11y ago

Of course, it happens only with developers who turn Gatekeeper off. As frustrated as some people are with Gatekeeper, this is exactly the kind of thing that it is designed to protect against. I've never turned Gatekeeper off on my macs (nor UAC off on Windows).

mikeash 11y ago
I think this illustrates the balance you have to strike to have an effective security system. If you make it too annoying for legitimate use, you'll get people to disable it so that it no longer protects them. I don't know what the best answer is, but Gatekeeper could stand to be a little less obstructive when the user legitimately trusts something that the system doesn't know about. Apple's answer will, sadly, probably be to make it impossible to disable.
- klodolph 11y ago
  Right click -> open. If you open an app this way, the gatekeeper dialog box will allow you to launch the app if you want (but the warning will still be shown). Once you open the app for the first time, you won't be prompted again.
- rsy96 11y ago
  Shameless plug for my blog post on how the UX of Gatekeeper should be improved https://rsy96.github.io/blogs/2015/09/20/gatekeeper-should-be-overhauled.html https://rsy96.github.io/blogs/2015/09/20/gatekeeper-should-b...