23 ms·

Notarizing Your App Before Distribution

252 points by tambourine_man 8y ago

floatingatoll 8y ago
TLDR highlights: Beginning in macOS 10.14.5, all new or updated kernel extensions and all software from developers new to distributing with Developer ID must be notarized in order to run. In a future version of macOS, notarization will be required by default for all software. — Apple recommends that you notarize all of the software that you’ve distributed, including older releases, and even software that doesn’t meet all of these requirements or that is unsigned.
- crooked-v 8y ago
  So the actual title should be "In a future version of macOS, apps signed with Developer ID will require notarization by default".
  - tambourine_man 8y ago
    “…for all software.” It’s very vague as usual. I guess the current work arounds will still apply (right click open, for instance) But we'll probably have to wait for WWDC for a definitive answer
    - sjwright 8y ago
      I wonder, will that include random terminal apps like gnu grep, and if so, how will the notary be attached?
      - saagarjha 8y ago
        They can be distributed without a signature.
        tylerhou 8y ago
        But the post says "all software." Surely that implies that macOS won't let unnotarized software run?
        saagarjha 8y ago
        That software will not have the quarantine bit set, so I don't think these restrictions will apply.
    - dwaite 8y ago
      We had a pretty definitive answer last WWDC during the session on notarizing. https://developer.apple.com/videos/play/wwdc2018/702/ https://developer.apple.com/videos/play/wwdc2018/702/ Developer ID signing will eventually be replaced with notarized Developer ID signing, on some suitably long roadmap that can be assumed to first involve a change in new app signing, then developer warnings of impending change of default on new OS version, that new OS version having user visible warnings, finally having the old developer id signatures ignored (making apps behave as unsigned, requiring the same right-click opening/exempting as today) For those who are looking for my entry into the pool - the OS changeover for user-visible warnings will be this time next year, with it made obvious (at WWDC 2020) that the September 2020 macOS major release will make the final change to ignore old non-notarized signatures.
  - pvg 8y ago
    The actual title should be the title of the article, which is neither misleading, nor clickbait. The made-up title is both of these things.
    - floatingatoll 8y ago
      The linked document, as of when I wrote that anyways, was not a news article at all. It was a developer support document that someone was linking as the primary - and, at that time, only - source of an Apple policy change. Using the original KB link’s title would have pointlessly obscured the relevance of the link to HN readers.
      - deleted 8y ago
        [deleted]
currymj 8y ago
I hope a well-informed person will clarify what exactly this means in practice. I have to assume that it will still be possible to compile some code and run the executable without first passing it through Apple’s servers.
- crooked-v 8y ago
  This only applies to apps signed using Developer ID.
- lunixbochs 8y ago
  This is my understanding: To notarize an app, you upload it to Apple. They'll run malware scans on it and such. This only applies to people distributing apps outside the app store with the $100/year Developer ID certificate. If you're not signing your apps, I believe the behavior will be unchanged, because your app would already be blocked from running by default. When you download an app from the internet using a browser or other quarantine-aware tool, it receives a "quarantine" bit and metadata recording the download URL. When you try to run the app for the first time, a window pops up saying "You got this app from shadywebsite.com, are you sure you want to open it?". Right now, the app's code signature is checked, and you get a message saying "this app can't be trusted" if the code signature check fails or the app isn't signed. Once notarization is required, signed apps that are not notarized will be prevented from launching in the same way as unsigned apps. 1. This will probably be a setting under "Allow apps downloaded from:" in System Preferences -> Security & Privacy you can revert if it breaks your workflow. 2. If the notarization check reuses the current mechanism, it will only apply to quarantined apps. If you're compiling something yourself, the compiler won't put a quarantine bit on it and it will execute fine. Same with homebrew/friends.
  - currymj 8y ago
    wonderful explanation, thank you!
  - Wowfunhappy 8y ago
    > 1. This will probably be a setting under "Allow apps downloaded from:" in System Preferences -> Security & Privacy you can revert if it breaks your workflow. There's no longer a GUI option to allow unsigned apps by default. It was removed from System Preferences some versions ago. But, you can do it via a one-line terminal command: sudo spctl --master-disable
nutjob2 8y ago
Just another reason to build and use a Hackintosh, if you want to be free to choose your own software. Apple is slowly moving towards an iPhone model with macOS.
- tinus_hn 8y ago
  ..will be required by default.. Just change the setting if the default doesn’t suit you.
  - ndnxhs 8y ago
    This change mainly affects developers who will now have to pay apples ransom if they want anyone to be able to run their app.
    - tinus_hn 8y ago
      I’m not sure how the developer running a hackintosh fixes that.
  - nutjob2 8y ago
    On a Hackintosh you have that choice, on Apple hardware you'll eventually have that choice taken away from you. That is my point.
    - User23 8y ago
      For a user of your sophistication, why bother with a Hackintosh at all? You could use a truly free Linux based OS and not have to deal with any of this. Is there some killer app that you can only get in Mac OS? Xcode I guess for iPhone dev? And if you have a moral objection to Apple making MacOS like iOS, why would you want to do iOS dev?
      - nutjob2 8y ago
        Firstly, macOS is a far and away superior experience, given the alternatives, secondly it has better applications, or the Mac versions are better than for other platforms and thirdly it allows development on all platforms with a minimum of fuss. Overall it's just more productive and pleasant. If there were a practical alternative I'd jump in a second. Developing for all platforms is a commercial reality, regardless of what I think, but wanting freedom to develop software for any platform without a corporate's approval is not unreasonable. The complaint applies to Google and Microsoft to some degree as well.
kbenson 8y ago
You know, I really don't mind the idea of something like this (which is really one of the added benefits of an app store), but I really wish there was a way to add different trusted parties that could sign apps. Sort of like Android where you can add third party apps, but actually go the full distance and allow separate app signing authorities, and while it should be covered in numerous warnings about not adding another signing authority without complete trust and nobody should be walking you through it, it shouldn't be terribly hard to do. If I want to install Amazon App Store apps instead of Android apps (or vice versa), that shouldn't require me disabling security mechanisms on my phone and installing a separate program to manage everything. I guess I basically want the web certificate system but much more selective, and don't ship a bunch of trusted ones by default. Of course there's basically zero chance of Apple or Android doing this without outside pressure since it's essentially them giving up the monopoly they have over their ecosystems.
- lern_too_spel 8y ago
  What you described is essentially how Android works today. You whitelist specific apps, like the Amazon App Store or F-Droid, as allowed to install other apps.
  - kbenson 8y ago
    That's interesting. The Android on my phone mus be old enough that it isn't using that, or it's changed since I last bothered with it. Last time I did anything with it was a couple years back with the Humble Bundle app, and I believe you still had to toggle in the settings to allow untrusted sources for that to function. Good to know there's been some progress on this.
  - coffexx 8y ago
    The play store and samsung store are able to install and update in the background without the user doing anything. The same is not true of any 3rd party app store you whitelist. Explicit consent is required for every apk install or update. Which is a bummer if you want to compete with the baked in store apps that "just work" and keep things up to date.
timeimp 8y ago
How would this affect things like Steam?
- ravenstine 8y ago
  Or Homebrew?
  - saagarjha 8y ago
    Homebrew doesn't sign software, so it would be unaffected.
- djsumdog 8y ago
  Steam is its own client. Only Steam would need to be signed/verified. It doesn't have to set the gatekeeper bit for the software it downloads (like your web browser does), although it could and just allow the same GK process to occur with each game.
Nextgrid 8y ago
I am concerned about the UI for this that says "Apple has checked it for malicious software and none was found". How does Apple check against malicious software? What is even considered "malicious" software? Software that someone might consider benign might be considered malicious by someone else - it isn't a black and white thing. The UI just provides a false sense of security. I assume they check it for known malware, but it wouldn't do anything against a targeted attack where the malware is custom made and only ever used once. In fact, it would facilitate the attack by giving the user a false sense of security that everything is OK.
- saagarjha 8y ago
  > How does Apple check against malicious software? What is even considered "malicious" software? It's an automated check that Apple has not disclosed.
  - applecrazy 8y ago
    I see how this can help protect against outright malware. However, what if there's a flaw in the heuristics, and some malware slips through the cracks? Sure, they can fix their malware scanner, but will they take the time to retroactively scan all software with their new and improved scanner? Will they even store every single notarized app on their servers for this to be feasible? Or will they mandate re-notarization every now and then? So many questions, hopefully Apple answers these soon. Edit: phrasing
    - saagarjha 8y ago
      They can revoke certificates and add the software to XProtect's blacklist.
- angott 8y ago
  > How does Apple check against malicious software? KB page says "[...] The Apple notary service is an automated system that scans your software for malicious content, checks for code-signing issues [...]"
- 8y ago
mikenew 8y ago
Here's how I'm understanding this: Currently, you have three options to distribute software on macOS. 1) You register as an Apple Developer (which costs $100 a year) and distribute through the Mac App Store, where Apple will do their review/automated scans/whatever, resign the app with their certificate, and then distribute it. 2) You register as an Apple Developer but don't distribute through the app store, and instead sign your software with the certificate you get through the developer program. It looks like, starting in macOS 10.14.5, you'll have to upload your software to Apple to be "notarized" if you want to distribute this way. It sounds like it's only for new software at first, but eventually old software will stop working unless it's notarized. 3) You don't register as an Apple Developer, and you just build and distribute software however you like. Currently, if a user tries to run your software it simply won't run, and the user has to know to go into system settings and manually give it permission. What isn't clear (at least to me) is weather this option will remain unchanged. This sentence: > In a future version of macOS, notarization will be required by default for all software. kind of makes it sound like like all software will have to be notarized, which implies that you have to be an Apple Developer to distribute at all. But saying "by default" makes it seem like there's some kind of option given to the user, so maybe it just means that software that's distributed by a registered Apple Developer but isn't notarized just moves down into the third tier of software that has to be explicitly allowed to run by the user. It seems like Apple's ideal model is that if a user wants to run software of any kind, it has to go through them (like iOS). I don't think that's what they're announcing for macOS, but it's a little hard to say for sure.
- Wevah 8y ago
  My understanding is that if you’ve released Developer ID-signed software in the past, you won’t have to notarize just yet.
- RHSeeger 8y ago
  How does it work if you want to write your own software and run it locally on your machine?
  - opportune 8y ago
writepub 8y ago
This is Apple moving one step closer to completely shutting down execution of apps that haven't been signed - a virtual app store so to speak. Because there's no longer a GUI option to allow unsigned apps by default. It was removed from System Preferences some versions ago. Apple knows and relies on the fact that a regular Mac user would be intimidated by requiring a terminal command: `sudo spctl --master-disable` to enable un-trusted apps! EU, FTC, et. al. need to look into this monopolistic behavior, where Apple constantly cock blocks anything it hasn't blessed, the fee for the blessing - a cool $100/year, assuming they don't start arbitrarily rejecting the said blessing, as is the case with their iOS app store.
- overgard 8y ago
  I personally dislike it, but I don't think it's monopolistic behavior. macOS's market share is comparatively pretty low and you can install windows or linux on your mac if you choose to.
  - writepub 8y ago
    "Install another OS" is not an acceptable solution, it smacks of technophile arrogance. Try giving that advice to any senior owning a Mac, wondering why their favorite (unsigned) app doesn't launch after updating their Mac OS. Apple's entire marketing strategy revolves around customer empathy, but their actions don't
    - scarface74 8y ago
      But you’re okay with giving that same “senior owning Mac” the responsibility of choosing which apps to trust? How has this worked out for the last 30+ years?
      - lostmyoldone 8y ago
        It has worked mostly fine for OS X during that period, not so much for Windows though. The blame for thelatter is squarely on Microsoft for having had terrible security defaults and a confusing UI.
jimmy1 8y ago
Seems like we need to relearn the concept of liberty, but again in the digital world. Yes, liberty is sometimes difficult, and it allows people to make bad choices. Liberty is hard. We've seen this story play out enough times to know that it isn't a slippery slope. It starts of as a play to "protect the users" or "avoid the bad guys", or as we have seen in the security theater of other domains, namely the aviation industry, "for your safety and security"
- airstrike 8y ago
  > but again in the digital world. You can always buy a different platform. Seems like that's plenty of liberty.
  - jimmy1 8y ago
    It seems like a false choice. Can I go start my own oil refinery because I don't like Exxon, Chevron, BP, or Shell?
- eridius 8y ago
  We have liberty. You have the liberty to use a platform that tries to protect your security at the cost of adding some restrictions. You have the liberty of choosing a different platform (using the same hardware even!) that has no restrictions and is fully open to be modified, at the cost of requiring a lot of technical expertise and putting yourself at risk of malware. You have the liberty of choosing yet another platform (still on the same hardware!) that's not open to modification but less restricted, at the cost of serving you ads on the lock screen and having a history of the worst malware infestation of any computing platform in history. And you have the freedom to write your own platform from scratch if you don't like any of these.
quotemstr 8y ago
The death of general-purpose computing is well underway. Just imagine the world in a decade or two: it'll be one of mandatory secure boot, remote attestation, and centralized app store distribution. Regular people just installing software? That's unthinkable. It'll put themselves and others at risk. Even browser extensions will be tightly restricted. If you want to write software, you'll have to get a developer's license and accreditation from an industry-wide professional association, who can remove your accreditation (and ability to get a run-your-own-code certificate) for any reason. Sure, you can find some 2019 laptop and run Linux on it, but your ISP won't forward your packets if they're not signed by a trusted kernel. Good luck running some tin-pot mesh network in whatever tiny sliver of unlicensed spectrum remains. Think this scenario is unlikely? I wouldn't be so sure. All the bits of technical infrastructure we need for this dystopia already exist in one form or another. There's also significant social and political pressure to rein in the internet --- pick your favorite pretext --- and it's inevitable that platform vendors will respond to this pressure. I've heard a disturbing amount of talk lately of the need for centralized control in order to combat "disinformation", for example. Already, we've lost an amazing amount of ground on software freedom relative to what we had ten or fifteen years ago. Most people already use a primary computer that they can neither control nor inspect --- and they like it. Mark my words: in ten or twenty years, policymakers and very serious establishment types will regard letting regular people just make their own software and connecting it to the public internet as unnecessary, dangerous, and suggestive of some kind of moral fault. It's starting already.
- PorterDuff 8y ago
  That's an interesting point and I'll mull over it. It isn't like the big software houses would fight against the idea.
- djsumdog 8y ago
  You can disable secure boot on most modern machines, install Linux, create a cert and sign Grub or your EFI stub kernel, add that cert to your UEFI (delete the stock ones) and then you have a machine that can boot Linux and not Windows. Of course the major distros like Ubuntu can boot with the default secure boot keys. I have a feeling x86 manufactures would face considerable backlash if they tried to lock down SecureBoot in a manner where it's impossible to disable. (and yes, I do know there are some Microsoft devices that are already setup this way, but the majority of manufactures do allow control over SecureBoot). Then again we have Intel ME on all our machines and that's somehow still okay, so maybe you're right.
makecheck 8y ago
This model needs to evolve from “you must sign with Apple” to “you must sign with one of $TRUSTED_LIST”. There should be a (non-trivial) way to set this, and if I decide all software signed by my best friend is OK then I should have that option. Grandmas should be able to trust software from their IT-expert grandsons and so forth. There is value in requiring all software to be validated by somebody but it’s a slippery slope to have ONE. The main reason is, even if I trust “Apple” now, what is “Apple” in 10 years? (Heck I thought I “trusted” them to always make desirable hardware, got burned on that one.) Things change. I want another signatory.
- _wmd 8y ago
  This is literally how code signing worked for Windows. Unsurprisingly signed malware has been far from uncommon
  - 6nf 8y ago
    There's been issues with code signing but you can't say it's been pointless. It's a significant hoop to jump for malware writers and out of reach for basic script kiddies.
  - jake_the_third 8y ago
    This is literally also how cert signing works for tls. Unsurprisingly miss-issued certs have been far from common. This model can work. It's just that microsoft is being sloppy.
    - deleted 8y ago
      [deleted]
    - swiftcoder 8y ago
      Mis-issued certs are common enough that Google et al had to force Symantec out of the cert issuing business. It's a model that only works with a monopolistic cartel gatekeeping the ability to issue certs (which is basically Apple's role in this scenario).
  - 8y ago
Schnitz 8y ago
This isn't a big surprise, you should expect the tightening of the screws to continue and the pace of it to accelerate. The real issue here is general purpose computing. General purpose computing makes it possible to block ads, to rip your CDs instead of the industry forcing you to buy the same music again, etc. and as a result it is THE major obstacle to unlimited rent seeking and squeezing the last penny out of every user. Expect the industry to keep working in this direction until everything is as locked down as an iPhone. See also: https://www.youtube.com/watch?v=HUEvRyemKSg https://www.youtube.com/watch?v=HUEvRyemKSg
- azinman2 8y ago
  Except you can always turn this off, so you can still run the “features” you want. So while you’re assuming evil intensions, occam’s razor would suggest that instead this is actually about preventing ever increasing malware even for software that don’t originate from the App Store. It’s about creating a record that traces executables back to their authors.
  - Schnitz 8y ago
    Assuming you are right then shouldn't there a switch on my iPad that allows me to run my own fully privileged code?
    - ronsor 8y ago
      Apple's security model believes the user is untrusted and a security risk.
      - xattt 8y ago
        A security risk to their business model.
        saagarjha 8y ago
        Their business model being making devices that are easy to use and hard for the user to mess up.
delfinom 8y ago
All I'm reading is Apple is working really hard to avoid calling it an anti-malware/anti-virus scanner and even centralizing it to cover it up (that's one of the notarization process main action).
pier25 8y ago
To play the devil's advocate here... From what I see around me, the vast majority of Mac users spend the vast majority of their time in mainstream apps (Chrome, Adobe, Office, Safari, Xcode, Final Cut, Logic, Ableton Live, etc). I don't think this will impact the majority of mac users negatively. This will only really impact macOS developers without an Apple Developer account, which I guess are a minority. Probably in that minority most are compiling to macOS from Windows or Linux.
- oscargrouch 8y ago
  > To play the devil's advocate here... You are not being the devil's advocate here. Whatever MS, Google or Facebook do its the end of the world (as it should), but apparently for the HN crowd, Apple can do whatever they want. This monopoly over our digital life will have severe consequences in the future. People here are so smart, but when its about Apple, their sentimental reasoning start triggering. Actions like this one, as many others, are some of the reasons why i never use anything from Apple. Its like a car factory being able to decide where you cannot go with "their" car (Its yours). Or the clothing company choosing the places i can use "their" clothes. The hacker spirit here ends when is anything related to Apple, when in doubt just read the top comments here in this thread. Its not a 'benevolent ditactor hacker' sort of social contract.. its a company which need to raise their profits so their shares keep being valuable to the stock market. If consumers and developers let them, they will own our digital life, and lock us with them. We have no legal framework, and no State to intervene in our interests as it should be.. States and democracies are a dying species, and we are the ones to blame.. we, as in the general population, just want the next shiny gadget. But i bet we will miss the things we have, but dont give much value now. Lets not forget the share of our lives that are constantly being transfered to the digital dimension, and how important they are now.
  - pier25 8y ago
    On one hand I see your point and agree somewhat, but OTOH the wild unregulated west has had its issues. Look at NPM for example. > But i bet we will miss the things we have, but dont give much value now. For a minority. A vast portion of users are happy with the iOS model. I don't think the majority of Mac users share your ideology.
dgellow 8y ago
Slightly related: I’m a mac user since almost forever but I’m becoming more and more frustrated by Apple’s decisions concerning their laptops and macOS in general. Recently I’ve been looking at Microsoft Surface Book as a potential alternative if I decide to jump the ship, I also started to move away from Apple applications as I want to be able to switch to an other platform without too much hassle. I still have to find an alternative to Pixelmator and iTerm2 (this one is really more difficult to replace if I consider moving to windows). Do you have experience to share concerning the Surface Book or moving from macOS to Windows?
moreorless 8y ago
When I found out that Mojave doesn't work on my Macbook, I moved on to https://www.bunsenlabs.org https://www.bunsenlabs.org which has its roots from #!. Good lord it is snappy.
bobwaycott 8y ago
If notarization is going to be required by default, and Apple wants users to depend on this as a signal of trust, they really need to use something other than light gray text on a gray dialog to inform users that the software they’re opening for the first time is checked and notarized. That dialog that you’re trying to open software from the internet feels like a BE CAREFUL warning—which feels odd when the light gray text says they’ve checked it and found nothing malicious. Not that I think users shouldn’t be encouraged to be aware ... but it feels rather odd.
calimac 8y ago
that’s overly controlling and intrusive.
r_singh 8y ago
It’s slightly surprising to see people here support this. I own my Mac, I’m responsible enough to decide what app to use and not to, I don’t need apple’s help. This transition of OSX to be more like iOS is definitely gonna result in me switching to Linux for good. This, plus things like advertising on the App Store are really gonna make me switch all my devices. Thanks Apple, but no thanks.
- Wowfunhappy 8y ago
  I don't mind as long as it's optional. I as a user still have the ability to run unsigned/un-notarized apps, and there's no indication that's changing. I can also turn off SIP and load unsigned drivers if I want (and I do). iOS, by contrast, doesn't give you any choice in the matter. That's a big difference.
  - r_singh 8y ago
    You're right, we have a choice. It's just that when my mom or dad download an app from the browser and it says, app is from an unidentified developer, they're just not gonna no how to turn it off and Apple knows that about a lot of its user base too well.
gardaani 8y ago
Currently, apps distributed in Mac App Store must be sandboxed. Notarized apps distributed outside Mac App Store must have hardened runtime enabled. It's interesting that Apple has created two similar protecting technologies. Here's a good article explaining the similarity / differences: https://lapcatsoftware.com/articles/hardened-runtime-sandboxing.html https://lapcatsoftware.com/articles/hardened-runtime-sandbox...
egorfine 8y ago
Does this mean that Apple gets notified every time a user runs an executable?
maxehmookau 8y ago
Thanks Apple. Like code signing wasn't already a massive pain in the ass!
mapcars 8y ago
Why on earth would anyone use apple?
supernes 8y ago
With regards to the bit about plugins, will Apple make exceptions for their own software like Logic Pro X? I'm not entirely sure what the hosting/execution model is for AudioUnits and VSTs, what I do know is that many of them will never be updated to meet any new security requirements. I bet we're in for a few more years of terrible advice like "run this command that disables security in the Terminal, then reboot in order to use the product you bought."

TLDR highlights: Beginning in macOS 10.14.5, all new or updated kernel extensions and all software from developers new to distributing with Developer ID must be notarized in order to run. In a future version of macOS, notarization will be required by default for all software. — Apple recommends that you notarize all of the software that you’ve distributed, including older releases, and even software that doesn’t meet all of these requirements or that is unsigned.

crooked-v 8y ago
So the actual title should be "In a future version of macOS, apps signed with Developer ID will require notarization by default".
- tambourine_man 8y ago
  “…for all software.” It’s very vague as usual. I guess the current work arounds will still apply (right click open, for instance) But we'll probably have to wait for WWDC for a definitive answer
  - sjwright 8y ago
    I wonder, will that include random terminal apps like gnu grep, and if so, how will the notary be attached?
    - saagarjha 8y ago
      They can be distributed without a signature.
      - tylerhou 8y ago
        But the post says "all software." Surely that implies that macOS won't let unnotarized software run?
        saagarjha 8y ago
        That software will not have the quarantine bit set, so I don't think these restrictions will apply.
  - dwaite 8y ago
    We had a pretty definitive answer last WWDC during the session on notarizing. https://developer.apple.com/videos/play/wwdc2018/702/ https://developer.apple.com/videos/play/wwdc2018/702/ Developer ID signing will eventually be replaced with notarized Developer ID signing, on some suitably long roadmap that can be assumed to first involve a change in new app signing, then developer warnings of impending change of default on new OS version, that new OS version having user visible warnings, finally having the old developer id signatures ignored (making apps behave as unsigned, requiring the same right-click opening/exempting as today) For those who are looking for my entry into the pool - the OS changeover for user-visible warnings will be this time next year, with it made obvious (at WWDC 2020) that the September 2020 macOS major release will make the final change to ignore old non-notarized signatures.
- pvg 8y ago
  The actual title should be the title of the article, which is neither misleading, nor clickbait. The made-up title is both of these things.
  - floatingatoll 8y ago
    The linked document, as of when I wrote that anyways, was not a news article at all. It was a developer support document that someone was linking as the primary - and, at that time, only - source of an Apple policy change. Using the original KB link’s title would have pointlessly obscured the relevance of the link to HN readers.
    - deleted 8y ago
      [deleted]

currymj 8y ago

I hope a well-informed person will clarify what exactly this means in practice. I have to assume that it will still be possible to compile some code and run the executable without first passing it through Apple’s servers.

crooked-v 8y ago
This only applies to apps signed using Developer ID.
lunixbochs 8y ago
This is my understanding: To notarize an app, you upload it to Apple. They'll run malware scans on it and such. This only applies to people distributing apps outside the app store with the $100/year Developer ID certificate. If you're not signing your apps, I believe the behavior will be unchanged, because your app would already be blocked from running by default. When you download an app from the internet using a browser or other quarantine-aware tool, it receives a "quarantine" bit and metadata recording the download URL. When you try to run the app for the first time, a window pops up saying "You got this app from shadywebsite.com, are you sure you want to open it?". Right now, the app's code signature is checked, and you get a message saying "this app can't be trusted" if the code signature check fails or the app isn't signed. Once notarization is required, signed apps that are not notarized will be prevented from launching in the same way as unsigned apps. 1. This will probably be a setting under "Allow apps downloaded from:" in System Preferences -> Security & Privacy you can revert if it breaks your workflow. 2. If the notarization check reuses the current mechanism, it will only apply to quarantined apps. If you're compiling something yourself, the compiler won't put a quarantine bit on it and it will execute fine. Same with homebrew/friends.
- currymj 8y ago
  wonderful explanation, thank you!
- Wowfunhappy 8y ago
  > 1. This will probably be a setting under "Allow apps downloaded from:" in System Preferences -> Security & Privacy you can revert if it breaks your workflow. There's no longer a GUI option to allow unsigned apps by default. It was removed from System Preferences some versions ago. But, you can do it via a one-line terminal command: sudo spctl --master-disable

nutjob2 8y ago

Just another reason to build and use a Hackintosh, if you want to be free to choose your own software. Apple is slowly moving towards an iPhone model with macOS.

tinus_hn 8y ago
..will be required by default.. Just change the setting if the default doesn’t suit you.
- ndnxhs 8y ago
  This change mainly affects developers who will now have to pay apples ransom if they want anyone to be able to run their app.
  - tinus_hn 8y ago
    I’m not sure how the developer running a hackintosh fixes that.
- nutjob2 8y ago
  On a Hackintosh you have that choice, on Apple hardware you'll eventually have that choice taken away from you. That is my point.
  - User23 8y ago
    For a user of your sophistication, why bother with a Hackintosh at all? You could use a truly free Linux based OS and not have to deal with any of this. Is there some killer app that you can only get in Mac OS? Xcode I guess for iPhone dev? And if you have a moral objection to Apple making MacOS like iOS, why would you want to do iOS dev?
    - nutjob2 8y ago
      Firstly, macOS is a far and away superior experience, given the alternatives, secondly it has better applications, or the Mac versions are better than for other platforms and thirdly it allows development on all platforms with a minimum of fuss. Overall it's just more productive and pleasant. If there were a practical alternative I'd jump in a second. Developing for all platforms is a commercial reality, regardless of what I think, but wanting freedom to develop software for any platform without a corporate's approval is not unreasonable. The complaint applies to Google and Microsoft to some degree as well.

kbenson 8y ago

You know, I really don't mind the idea of something like this (which is really one of the added benefits of an app store), but I really wish there was a way to add different trusted parties that could sign apps. Sort of like Android where you can add third party apps, but actually go the full distance and allow separate app signing authorities, and while it should be covered in numerous warnings about not adding another signing authority without complete trust and nobody should be walking you through it, it shouldn't be terribly hard to do. If I want to install Amazon App Store apps instead of Android apps (or vice versa), that shouldn't require me disabling security mechanisms on my phone and installing a separate program to manage everything. I guess I basically want the web certificate system but much more selective, and don't ship a bunch of trusted ones by default. Of course there's basically zero chance of Apple or Android doing this without outside pressure since it's essentially them giving up the monopoly they have over their ecosystems.

lern_too_spel 8y ago
What you described is essentially how Android works today. You whitelist specific apps, like the Amazon App Store or F-Droid, as allowed to install other apps.
- kbenson 8y ago
  That's interesting. The Android on my phone mus be old enough that it isn't using that, or it's changed since I last bothered with it. Last time I did anything with it was a couple years back with the Humble Bundle app, and I believe you still had to toggle in the settings to allow untrusted sources for that to function. Good to know there's been some progress on this.
- coffexx 8y ago
  The play store and samsung store are able to install and update in the background without the user doing anything. The same is not true of any 3rd party app store you whitelist. Explicit consent is required for every apk install or update. Which is a bummer if you want to compete with the baked in store apps that "just work" and keep things up to date.

timeimp 8y ago

How would this affect things like Steam?

ravenstine 8y ago
Or Homebrew?
- saagarjha 8y ago
  Homebrew doesn't sign software, so it would be unaffected.
djsumdog 8y ago
Steam is its own client. Only Steam would need to be signed/verified. It doesn't have to set the gatekeeper bit for the software it downloads (like your web browser does), although it could and just allow the same GK process to occur with each game.

Nextgrid 8y ago

I am concerned about the UI for this that says "Apple has checked it for malicious software and none was found". How does Apple check against malicious software? What is even considered "malicious" software? Software that someone might consider benign might be considered malicious by someone else - it isn't a black and white thing. The UI just provides a false sense of security. I assume they check it for known malware, but it wouldn't do anything against a targeted attack where the malware is custom made and only ever used once. In fact, it would facilitate the attack by giving the user a false sense of security that everything is OK.

saagarjha 8y ago
> How does Apple check against malicious software? What is even considered "malicious" software? It's an automated check that Apple has not disclosed.
- applecrazy 8y ago
  I see how this can help protect against outright malware. However, what if there's a flaw in the heuristics, and some malware slips through the cracks? Sure, they can fix their malware scanner, but will they take the time to retroactively scan all software with their new and improved scanner? Will they even store every single notarized app on their servers for this to be feasible? Or will they mandate re-notarization every now and then? So many questions, hopefully Apple answers these soon. Edit: phrasing
  - saagarjha 8y ago
    They can revoke certificates and add the software to XProtect's blacklist.
angott 8y ago
> How does Apple check against malicious software? KB page says "[...] The Apple notary service is an automated system that scans your software for malicious content, checks for code-signing issues [...]"
8y ago

mikenew 8y ago

Here's how I'm understanding this: Currently, you have three options to distribute software on macOS. 1) You register as an Apple Developer (which costs $100 a year) and distribute through the Mac App Store, where Apple will do their review/automated scans/whatever, resign the app with their certificate, and then distribute it. 2) You register as an Apple Developer but don't distribute through the app store, and instead sign your software with the certificate you get through the developer program. It looks like, starting in macOS 10.14.5, you'll have to upload your software to Apple to be "notarized" if you want to distribute this way. It sounds like it's only for new software at first, but eventually old software will stop working unless it's notarized. 3) You don't register as an Apple Developer, and you just build and distribute software however you like. Currently, if a user tries to run your software it simply won't run, and the user has to know to go into system settings and manually give it permission. What isn't clear (at least to me) is weather this option will remain unchanged. This sentence: > In a future version of macOS, notarization will be required by default for all software. kind of makes it sound like like all software will have to be notarized, which implies that you have to be an Apple Developer to distribute at all. But saying "by default" makes it seem like there's some kind of option given to the user, so maybe it just means that software that's distributed by a registered Apple Developer but isn't notarized just moves down into the third tier of software that has to be explicitly allowed to run by the user. It seems like Apple's ideal model is that if a user wants to run software of any kind, it has to go through them (like iOS). I don't think that's what they're announcing for macOS, but it's a little hard to say for sure.

Wevah 8y ago
My understanding is that if you’ve released Developer ID-signed software in the past, you won’t have to notarize just yet.
RHSeeger 8y ago
How does it work if you want to write your own software and run it locally on your machine?
- opportune 8y ago

writepub 8y ago

This is Apple moving one step closer to completely shutting down execution of apps that haven't been signed - a virtual app store so to speak. Because there's no longer a GUI option to allow unsigned apps by default. It was removed from System Preferences some versions ago. Apple knows and relies on the fact that a regular Mac user would be intimidated by requiring a terminal command: `sudo spctl --master-disable` to enable un-trusted apps! EU, FTC, et. al. need to look into this monopolistic behavior, where Apple constantly cock blocks anything it hasn't blessed, the fee for the blessing - a cool $100/year, assuming they don't start arbitrarily rejecting the said blessing, as is the case with their iOS app store.

overgard 8y ago
I personally dislike it, but I don't think it's monopolistic behavior. macOS's market share is comparatively pretty low and you can install windows or linux on your mac if you choose to.
- writepub 8y ago
  "Install another OS" is not an acceptable solution, it smacks of technophile arrogance. Try giving that advice to any senior owning a Mac, wondering why their favorite (unsigned) app doesn't launch after updating their Mac OS. Apple's entire marketing strategy revolves around customer empathy, but their actions don't
  - scarface74 8y ago
    But you’re okay with giving that same “senior owning Mac” the responsibility of choosing which apps to trust? How has this worked out for the last 30+ years?
    - lostmyoldone 8y ago
      It has worked mostly fine for OS X during that period, not so much for Windows though. The blame for thelatter is squarely on Microsoft for having had terrible security defaults and a confusing UI.

jimmy1 8y ago

Seems like we need to relearn the concept of liberty, but again in the digital world. Yes, liberty is sometimes difficult, and it allows people to make bad choices. Liberty is hard. We've seen this story play out enough times to know that it isn't a slippery slope. It starts of as a play to "protect the users" or "avoid the bad guys", or as we have seen in the security theater of other domains, namely the aviation industry, "for your safety and security"

airstrike 8y ago
> but again in the digital world. You can always buy a different platform. Seems like that's plenty of liberty.
- jimmy1 8y ago
  It seems like a false choice. Can I go start my own oil refinery because I don't like Exxon, Chevron, BP, or Shell?
eridius 8y ago
We have liberty. You have the liberty to use a platform that tries to protect your security at the cost of adding some restrictions. You have the liberty of choosing a different platform (using the same hardware even!) that has no restrictions and is fully open to be modified, at the cost of requiring a lot of technical expertise and putting yourself at risk of malware. You have the liberty of choosing yet another platform (still on the same hardware!) that's not open to modification but less restricted, at the cost of serving you ads on the lock screen and having a history of the worst malware infestation of any computing platform in history. And you have the freedom to write your own platform from scratch if you don't like any of these.

quotemstr 8y ago

The death of general-purpose computing is well underway. Just imagine the world in a decade or two: it'll be one of mandatory secure boot, remote attestation, and centralized app store distribution. Regular people just installing software? That's unthinkable. It'll put themselves and others at risk. Even browser extensions will be tightly restricted. If you want to write software, you'll have to get a developer's license and accreditation from an industry-wide professional association, who can remove your accreditation (and ability to get a run-your-own-code certificate) for any reason. Sure, you can find some 2019 laptop and run Linux on it, but your ISP won't forward your packets if they're not signed by a trusted kernel. Good luck running some tin-pot mesh network in whatever tiny sliver of unlicensed spectrum remains. Think this scenario is unlikely? I wouldn't be so sure. All the bits of technical infrastructure we need for this dystopia already exist in one form or another. There's also significant social and political pressure to rein in the internet --- pick your favorite pretext --- and it's inevitable that platform vendors will respond to this pressure. I've heard a disturbing amount of talk lately of the need for centralized control in order to combat "disinformation", for example. Already, we've lost an amazing amount of ground on software freedom relative to what we had ten or fifteen years ago. Most people already use a primary computer that they can neither control nor inspect --- and they like it. Mark my words: in ten or twenty years, policymakers and very serious establishment types will regard letting regular people just make their own software and connecting it to the public internet as unnecessary, dangerous, and suggestive of some kind of moral fault. It's starting already.

PorterDuff 8y ago
That's an interesting point and I'll mull over it. It isn't like the big software houses would fight against the idea.
djsumdog 8y ago
You can disable secure boot on most modern machines, install Linux, create a cert and sign Grub or your EFI stub kernel, add that cert to your UEFI (delete the stock ones) and then you have a machine that can boot Linux and not Windows. Of course the major distros like Ubuntu can boot with the default secure boot keys. I have a feeling x86 manufactures would face considerable backlash if they tried to lock down SecureBoot in a manner where it's impossible to disable. (and yes, I do know there are some Microsoft devices that are already setup this way, but the majority of manufactures do allow control over SecureBoot). Then again we have Intel ME on all our machines and that's somehow still okay, so maybe you're right.

makecheck 8y ago

This model needs to evolve from “you must sign with Apple” to “you must sign with one of $TRUSTED_LIST”. There should be a (non-trivial) way to set this, and if I decide all software signed by my best friend is OK then I should have that option. Grandmas should be able to trust software from their IT-expert grandsons and so forth. There is value in requiring all software to be validated by somebody but it’s a slippery slope to have ONE. The main reason is, even if I trust “Apple” now, what is “Apple” in 10 years? (Heck I thought I “trusted” them to always make desirable hardware, got burned on that one.) Things change. I want another signatory.

_wmd 8y ago
This is literally how code signing worked for Windows. Unsurprisingly signed malware has been far from uncommon
- 6nf 8y ago
  There's been issues with code signing but you can't say it's been pointless. It's a significant hoop to jump for malware writers and out of reach for basic script kiddies.
- jake_the_third 8y ago
  This is literally also how cert signing works for tls. Unsurprisingly miss-issued certs have been far from common. This model can work. It's just that microsoft is being sloppy.
  - deleted 8y ago
    [deleted]
  - swiftcoder 8y ago
    Mis-issued certs are common enough that Google et al had to force Symantec out of the cert issuing business. It's a model that only works with a monopolistic cartel gatekeeping the ability to issue certs (which is basically Apple's role in this scenario).
- 8y ago

Schnitz 8y ago

This isn't a big surprise, you should expect the tightening of the screws to continue and the pace of it to accelerate. The real issue here is general purpose computing. General purpose computing makes it possible to block ads, to rip your CDs instead of the industry forcing you to buy the same music again, etc. and as a result it is THE major obstacle to unlimited rent seeking and squeezing the last penny out of every user. Expect the industry to keep working in this direction until everything is as locked down as an iPhone. See also: https://www.youtube.com/watch?v=HUEvRyemKSg https://www.youtube.com/watch?v=HUEvRyemKSg

azinman2 8y ago
Except you can always turn this off, so you can still run the “features” you want. So while you’re assuming evil intensions, occam’s razor would suggest that instead this is actually about preventing ever increasing malware even for software that don’t originate from the App Store. It’s about creating a record that traces executables back to their authors.
- Schnitz 8y ago
  Assuming you are right then shouldn't there a switch on my iPad that allows me to run my own fully privileged code?
  - ronsor 8y ago
    Apple's security model believes the user is untrusted and a security risk.
    - xattt 8y ago
      A security risk to their business model.
      - saagarjha 8y ago
        Their business model being making devices that are easy to use and hard for the user to mess up.

delfinom 8y ago

All I'm reading is Apple is working really hard to avoid calling it an anti-malware/anti-virus scanner and even centralizing it to cover it up (that's one of the notarization process main action).

pier25 8y ago

To play the devil's advocate here... From what I see around me, the vast majority of Mac users spend the vast majority of their time in mainstream apps (Chrome, Adobe, Office, Safari, Xcode, Final Cut, Logic, Ableton Live, etc). I don't think this will impact the majority of mac users negatively. This will only really impact macOS developers without an Apple Developer account, which I guess are a minority. Probably in that minority most are compiling to macOS from Windows or Linux.

oscargrouch 8y ago
> To play the devil's advocate here... You are not being the devil's advocate here. Whatever MS, Google or Facebook do its the end of the world (as it should), but apparently for the HN crowd, Apple can do whatever they want. This monopoly over our digital life will have severe consequences in the future. People here are so smart, but when its about Apple, their sentimental reasoning start triggering. Actions like this one, as many others, are some of the reasons why i never use anything from Apple. Its like a car factory being able to decide where you cannot go with "their" car (Its yours). Or the clothing company choosing the places i can use "their" clothes. The hacker spirit here ends when is anything related to Apple, when in doubt just read the top comments here in this thread. Its not a 'benevolent ditactor hacker' sort of social contract.. its a company which need to raise their profits so their shares keep being valuable to the stock market. If consumers and developers let them, they will own our digital life, and lock us with them. We have no legal framework, and no State to intervene in our interests as it should be.. States and democracies are a dying species, and we are the ones to blame.. we, as in the general population, just want the next shiny gadget. But i bet we will miss the things we have, but dont give much value now. Lets not forget the share of our lives that are constantly being transfered to the digital dimension, and how important they are now.
- pier25 8y ago
  On one hand I see your point and agree somewhat, but OTOH the wild unregulated west has had its issues. Look at NPM for example. > But i bet we will miss the things we have, but dont give much value now. For a minority. A vast portion of users are happy with the iOS model. I don't think the majority of Mac users share your ideology.

dgellow 8y ago

Slightly related: I’m a mac user since almost forever but I’m becoming more and more frustrated by Apple’s decisions concerning their laptops and macOS in general. Recently I’ve been looking at Microsoft Surface Book as a potential alternative if I decide to jump the ship, I also started to move away from Apple applications as I want to be able to switch to an other platform without too much hassle. I still have to find an alternative to Pixelmator and iTerm2 (this one is really more difficult to replace if I consider moving to windows). Do you have experience to share concerning the Surface Book or moving from macOS to Windows?

moreorless 8y ago

When I found out that Mojave doesn't work on my Macbook, I moved on to https://www.bunsenlabs.org https://www.bunsenlabs.org which has its roots from #!. Good lord it is snappy.

bobwaycott 8y ago

If notarization is going to be required by default, and Apple wants users to depend on this as a signal of trust, they really need to use something other than light gray text on a gray dialog to inform users that the software they’re opening for the first time is checked and notarized. That dialog that you’re trying to open software from the internet feels like a BE CAREFUL warning—which feels odd when the light gray text says they’ve checked it and found nothing malicious. Not that I think users shouldn’t be encouraged to be aware ... but it feels rather odd.

calimac 8y ago

that’s overly controlling and intrusive.

r_singh 8y ago

It’s slightly surprising to see people here support this. I own my Mac, I’m responsible enough to decide what app to use and not to, I don’t need apple’s help. This transition of OSX to be more like iOS is definitely gonna result in me switching to Linux for good. This, plus things like advertising on the App Store are really gonna make me switch all my devices. Thanks Apple, but no thanks.

Wowfunhappy 8y ago
I don't mind as long as it's optional. I as a user still have the ability to run unsigned/un-notarized apps, and there's no indication that's changing. I can also turn off SIP and load unsigned drivers if I want (and I do). iOS, by contrast, doesn't give you any choice in the matter. That's a big difference.
- r_singh 8y ago
  You're right, we have a choice. It's just that when my mom or dad download an app from the browser and it says, app is from an unidentified developer, they're just not gonna no how to turn it off and Apple knows that about a lot of its user base too well.

gardaani 8y ago

Currently, apps distributed in Mac App Store must be sandboxed. Notarized apps distributed outside Mac App Store must have hardened runtime enabled. It's interesting that Apple has created two similar protecting technologies. Here's a good article explaining the similarity / differences: https://lapcatsoftware.com/articles/hardened-runtime-sandboxing.html https://lapcatsoftware.com/articles/hardened-runtime-sandbox...

egorfine 8y ago

Does this mean that Apple gets notified every time a user runs an executable?

maxehmookau 8y ago

Thanks Apple. Like code signing wasn't already a massive pain in the ass!

mapcars 8y ago

Why on earth would anyone use apple?

supernes 8y ago

With regards to the bit about plugins, will Apple make exceptions for their own software like Logic Pro X? I'm not entirely sure what the hosting/execution model is for AudioUnits and VSTs, what I do know is that many of them will never be updated to meet any new security requirements. I bet we're in for a few more years of terrible advice like "run this command that disables security in the Terminal, then reboot in order to use the product you bought."