3 ms·
I don't want to be asked about moving apps somewhere else especially for testing them. It is kind of hostile. And it's a burden for the dev to include yet more
by zZorgz 10y ago
I don't want to be asked about moving apps somewhere else especially for testing them. It is kind of hostile. And it's a burden for the dev to include yet more code for this. IMO, Apple should have a way to solve the issue for out-of-store apps.
(I really don't know if that many apps do this btw, I think most apps I download today are packaged in zip..)
Other users are just baffled and run apps from disk images or Downloads just because.
The authors point is that at least before 10.12 zip was a decent approach.
Too bad they aren't offering signed zip or something similar that takes same advantages that a signed dmg does..
- eridius 10y agoA signed zip is still dangerous. If the attacker can convince the user to download two files instead of just one, the attacker controls the names of the folders that contains the extracted zip contents (i.e. the name of the zip), so any app that looks at ../foo/bar would still be vulnerable. The Info.plist approach (where the app declares that it has no such relative path dependencies and so should skip gatekeeper path randomization) seems like the best approach for fixing this "issue".