4 ms·

Usually package managers on linux distros, to use an example for comparison, tend to check checksums of downloads for security purposes during any installation.

Usually package managers on linux distros, to use an example for comparison, tend to check checksums of downloads for security purposes during any installation. For MacOS users, I guess I understand they want to use software not blessed by Apple, then isn't homebrew or whatever supposed to do the same thing?

mikeash 10y ago
Most Mac users don't use anything like Homebrew. Typically you just download the software as a .zip file or equivalent, unpack it, and run it. Apple does support code signatures for apps downloaded this way through their Developer ID program, but you have to pay $99/year to be a member of their developer program in order to do so. In theory, you could still sign downloads using a code signing certificate you got elsewhere, but system wouldn't check it for you, and few people would bother to do it manually.
- zalmoxes 10y ago
  If you have Gatekeeper enabled(which it is by default), the system prevents the user from running random unsigned apps.
  - mikeash 10y ago
    You can't turn Gatekeeper off anymore, at least not without using the command line. You can bypass it on an app-by-app basis by just right-clicking an app and selecting "Open" there, which is what you'd have to do if you're downloading apps like Handbrake.
- noobermin 10y ago
  >In theory, you could still sign downloads using a code signing certificate you got elsewhere, but system wouldn't check it for you, and few people would bother to do it manually. Hence, we have occurrences like the OP. The point is checking checksums or (better) signatures is the most common way to mitigate it. Otherwise, this will continue to happen. Dare I say that is the entire reason repo managers of all stripes do this in the first place.
- fishywang 10y ago
  Even for homebrew users, installing GUI apps via homebrew usually means you'll need full Xcode installed. I, for one, only have Xcode command line tools installed and never use homebrew to install GUI apps.
  - soraminazuki 10y ago
    Actually, Homebrew discourages building GUI apps. It's in the process of moving all GUI apps to Homebrew Cask, which doesn't support building from source. The exception is for GUI apps targeted for Linux, which can't be converted to a macOS-style appliation bundle.
fulafel 10y ago
Handbrake for Ubuntu is distributed through the official Handbrake PPA, and this means there is still more transparency: there is a public record of the source code that went in the build process, and the binaries were automatically built from that on the Launchpad build servers. There's a potential downside too: If a trojan gets into the PPA sources, it will be automatically downloaded and installed by users.
- noobermin 10y ago
  Of course, if the source is compromised, then all bets are off. It's all about degrees / probabilities when talking about security.
  - fulafel 10y ago
    Yep, but it's not just the official source, it's also the guy's computer who uploads the source to the PPA. Just something to keep in mind when adding a PPA: you're tying your machine's integrity to the integrity of the PPA and its keyholder(s), and this trust is tested each time you update your packages.
skybrian 10y ago
Downloadable Mac apps should be signed [1]. Unfortunately not all developers do this. [1] https://developer.apple.com/library/content/documentation/IDEs/Conceptual/AppDistributionGuide/DistributingApplicationsOutside/DistributingApplicationsOutside.html https://developer.apple.com/library/content/documentation/ID...

mikeash 10y ago

Most Mac users don't use anything like Homebrew. Typically you just download the software as a .zip file or equivalent, unpack it, and run it. Apple does support code signatures for apps downloaded this way through their Developer ID program, but you have to pay $99/year to be a member of their developer program in order to do so. In theory, you could still sign downloads using a code signing certificate you got elsewhere, but system wouldn't check it for you, and few people would bother to do it manually.

zalmoxes 10y ago
If you have Gatekeeper enabled(which it is by default), the system prevents the user from running random unsigned apps.
- mikeash 10y ago
  You can't turn Gatekeeper off anymore, at least not without using the command line. You can bypass it on an app-by-app basis by just right-clicking an app and selecting "Open" there, which is what you'd have to do if you're downloading apps like Handbrake.
noobermin 10y ago
>In theory, you could still sign downloads using a code signing certificate you got elsewhere, but system wouldn't check it for you, and few people would bother to do it manually. Hence, we have occurrences like the OP. The point is checking checksums or (better) signatures is the most common way to mitigate it. Otherwise, this will continue to happen. Dare I say that is the entire reason repo managers of all stripes do this in the first place.
fishywang 10y ago
Even for homebrew users, installing GUI apps via homebrew usually means you'll need full Xcode installed. I, for one, only have Xcode command line tools installed and never use homebrew to install GUI apps.
- soraminazuki 10y ago
  Actually, Homebrew discourages building GUI apps. It's in the process of moving all GUI apps to Homebrew Cask, which doesn't support building from source. The exception is for GUI apps targeted for Linux, which can't be converted to a macOS-style appliation bundle.

fulafel 10y ago

Handbrake for Ubuntu is distributed through the official Handbrake PPA, and this means there is still more transparency: there is a public record of the source code that went in the build process, and the binaries were automatically built from that on the Launchpad build servers. There's a potential downside too: If a trojan gets into the PPA sources, it will be automatically downloaded and installed by users.

noobermin 10y ago
Of course, if the source is compromised, then all bets are off. It's all about degrees / probabilities when talking about security.
- fulafel 10y ago
  Yep, but it's not just the official source, it's also the guy's computer who uploads the source to the PPA. Just something to keep in mind when adding a PPA: you're tying your machine's integrity to the integrity of the PPA and its keyholder(s), and this trust is tested each time you update your packages.

skybrian 10y ago

Downloadable Mac apps should be signed [1]. Unfortunately not all developers do this. [1] https://developer.apple.com/library/content/documentation/IDEs/Conceptual/AppDistributionGuide/DistributingApplicationsOutside/DistributingApplicationsOutside.html https://developer.apple.com/library/content/documentation/ID...