16 ms·

Notarizing Your Mac Software for macOS Catalina

221 points by draugadrotten 7y ago

mikece 7y ago
Officially this is being done in the name of security... is it really or is this a cash grab to coerce everyone making apps for macOS to pay the $99/year fee which is required for the signing/notarizing being mentioned?
- realusername 7y ago
  The "security" part is of course complete bullshit. They slowly want to turn macOS into a walled garden for more control and profit like they did in the mobile space.
  - mikece 7y ago
    I don't know about everyone else but the only reason I even have macOS computers is because I'm making apps for iOS. If it were possible to develop for iOS on Windows 10 or Linux I would do that in a heartbeat.
    - 72deluxe 7y ago
      I don't know much about it but I thought you could develop for iOS using C# using Visual Studio 2017/2019 and it remotely deploy to Mac? I read a bit about it because I wanted to do it myself but I haven't upgraded from Sierra yet due to no support/broken for my audio hardware in newer versions.
    - WilliamEdward 7y ago
      There's that, but I also just kind of like the operating system more than others ¯\_(ツ)_/¯
  - Angostura 7y ago
    Except of course it isn't complete bullshit. It's saved me a few times where naive family members (one greater than the age of 80, the other under 12) has inadvertently downloaded mal/annoyanceware and tried to install it. Crapware is a substantial cause of 'my machine's not working properly' among the less technically savvy
    - realusername 7y ago
      There's no relation between proper sandboxing (actual security) and a walled-garden like apple is building. You also can download malware on the App Store.
      - Spivak 7y ago
        Okay, your wish is granted. "Apps that want to escape an extremely minimal runtime sandbox need to be approved by Apple."
        realusername 7y ago
        I would prefer to leave that choice to the user.
        qtplatypus 7y ago
        And the user can choose to bypass that check by removing the quarantined flag.
        realusername 7y ago
        You have a point but that's exactly the same on an app store. They can just select "yes" to the permission dialog and we have exactly the same issue.
    - johnisgood 7y ago
      On the other hand, people who have been doing this for a living will have less work to do!
  - scarface74 7y ago
    People have been saying this for a decade.....
- duiker101 7y ago
  I think that is actually a smaller part of what's at play. The money is in Apple getting everything to be on the store, getting fees on the money spent on the store and the control over it. They will have the final say over everything.
  - scarface74 7y ago
    If that’s actually Apple’s goal, it’s taken them over a decade to get there. The Mac software market is so small and insignificant for Apple’s revenue that it wouldn’t be worth the trouble.
- deleted 7y ago
  [deleted]
- sjwright 7y ago
  The parent post is factually false. The $99/year developer account fee is not a prerequisite for notarizing macOS apps.
  - duiker101 7y ago
    While you are right, it is adding an extra hurdle that is obviously trying to stride dev toward the store. "Hey, you can have your software notirized (which we might not accept), people will be warned before opening the app and some other bs or you can pay us 99$ and stop worrying!"
    - sjwright 7y ago
      Please limit your criticism to what Apple is actually doing, not what your imagination speculates they might do in future.
      - duiker101 7y ago
        I am criticising what they are doing now. Which is making everything harder if you don't go through the App Store, and they have been doing it for a while now. It's the same they are doing with their hardware and everything (you can't repair it yourself because "quality") so I can't really see them doing anything different.
    - jtbayly 7y ago
      You are implying that notarized apps will still not just run normally after this change. I believe that is false.
- geerlingguy 7y ago
  Is the $99/year actually required? I thought there was a way to sign apps without it.
- michaelt 7y ago
  It's not a cash grab; it's a power grab. By introducing themselves as gatekeepers, they can analyse software and reject it. For example, if they decide to deprecate an API, they can decline to notarise any software that uses it. The thin end of the wedge is, of course, free notarisation with few limitations. Then once that is in place, they can increase their power to the level they enjoy in the iPhone app store.
orf 7y ago
So now you need a 100$ a year license to publish any software on MacOS?
- sjwright 7y ago
  No, Apple doesn't require a paid developer account for you to receive a notarizing certificate.
  - duiker101 7y ago
    *yet. This sort of things are always gradual to not scare people off. First it's a popup that you need to right click->open to bypass, then it's notarising, soon no software from outside the store will be allowed.
    - scarface74 7y ago
      So when? The Mac App Store was introduced over a decade ago and people have been making this prediction.
    - sjwright 7y ago
      Worry about the slippery slope when the slippery slope actually slips. For now there's good reasoning behind what Apple has done and I applaud their active concern for badware.
      - badsectoracula 7y ago
        > Worry about the slippery slope when the slippery slope actually slips. Wouldn't that be too late? After all we have "warning! slippery surface" signs to avoid slipping, we don't just let people slip and fall over to figure out the surface is indeed slippery.
        sjwright 7y ago
        Too late for what?
jordigh 7y ago
"Notarised", what a loaded, feel-good term.
- sjwright 7y ago
  I for one welcome our notarizing overlords. Running a terminal command to disable it is a very minor inconvenience for us nerds... in return we'll get fewer tedious house calls from family and friends asking why their computer is doing weird things.
  - johnisgood 7y ago
    I already posted it elsewhere but: on the other hand, people who have been doing this for a living will have less work to do! I know some people who live off those calls. :)
    - sjwright 7y ago
      Don't worry, endlessly escalating software complexity will keep us all busy. I love current MacOS but my perception it's never been quite as bug-free as it was in the Snow Leopard era. And I attribute that to increasing complexity. Part of me wishes that Apple would slow down the big innovation for a couple of years and get the entire development team working on bug-fixes and polish.
      - heavyset_go 7y ago
        > And I attribute that to increasing complexity. I attribute it to Apple focusing on iOS and letting their desktop products slide.
  - noxToken 7y ago
    I don't know the intimate details of Windows SmartScreen, but aren't these basically the same thing? This seems to be a welcomed change while SmartScreen seems largely hated.
    - 7y ago
fortran77 7y ago
You don't own your computers, folks!
- sjwright 7y ago
  Correct. And that's almost universally true for any software program and operating system you didn't personally write. You don't "own" any software on your computer, including your favourite Linux & GNU distribution. You agree to a license which almost always places certain restrictions on what you can do with the software.
  - ForHackernews 7y ago
    This is not necessarily the case: http://thedjbway.b0llix.net/license_free.html http://thedjbway.b0llix.net/license_free.html http://cr.yp.to/softwarelaw.html http://cr.yp.to/softwarelaw.html
    - sjwright 7y ago
      Sure, if you accept the feel-good corporatist double-speak that is "owning copies" of intellectual property.
      - dahart 7y ago
        There are restrictions on what you can do with almost all products, commercial and open source, e.g., see licenses, copyrights, moral right, trademarks, patents, trade secrets, etc. What do you want “own” to mean, exactly? What do you want to do with your software that you can’t do right now?
- Angostura 7y ago
  Unless, of course - you control click on first launch to bypass the check.
- aikah 7y ago
  > You don't own your computers, folks! You do, you just don't necessarily own the software running on it.
Tepix 7y ago
About notarizing: Give users even more confidence in your software by submitting it to Apple to be notarized. The service automatically scans your Developer ID-signed software and performs security checks. When it’s ready to export for distribution, a ticket is attached to your software to let Gatekeeper know it’s been notarized. So, on this page it reads: Mac software distributed outside the Mac App Store must be notarized by Apple in order to run on macOS Catalina What does this mean? Is this something that affects merely the default security setting?
awwaiid 7y ago
How does this work with Brew? (Dear lazyweb...)
- geocar 7y ago
  It shouldn't affect brew or software you build yourself.
  - swiley 7y ago
    How can it tell you've compiled it and haven't just signed it yourself? Or does it only check signatures when you're launching things from the GUI?
    - Angostura 7y ago
      Or does it only check signatures when you're launching things from the GUI? Yes. If you;re tinkering with Homebre, you are not the target demographic.
      - swiley 7y ago
        So you could easily install a graphical shell that doesn't check that. heh people probably need to chill out about all this. I got a mechanical engineering student (read: "doesn't understand computers") to play open arena with me the other month dispite all of this. It's just a couple buttons you have to press.
      - flohofwoe 7y ago
        ...which makes it all the more annoying for "power users" that there's no simple switch anymore to allow all apps to run without the scare/confirmation popups (there used to be a third option in "Security & Privacy" settings next to "App Store" and "App Store and identified developers" for this).
        my123 7y ago
        That third option is hidden in the GUI, but can be re-enabled via: sudo spctl --master-disable
tomlong 7y ago
Is software that isn't currently notarized going to stop working when we upgrade to Catalina?
- chadlavi 7y ago
  no
  - tomlong 7y ago
    That's good. I wish things were a little clearer.
- deleted 7y ago
  [deleted]
- tumult 7y ago
  The other person who replied to you is wrong (edit: assuming they meant in general, not for only software that you have specifically already downloaded and run on a single computer before upgrading it to Catalina.) Non-"notarized" software, when freshly downloaded to a computer running Catalina, will not run. A dialog will be displayed, telling the user that the developer needs to update their app for compatibility. There is no further indication telling the user what to do, and no "run anyway" button. The developer will need to "notarize" the software with Apple, and receive their approval. If that happens, then the "notarization" information for the app bundle will be available via Apple's servers when users attempt to run the program, and Gatekeeper will attempt to look it up from the Apple's servers if the "notarization" information is not "stapled" into the app bundle. Optionally, and probably preferably, the app developer can "staple" the notarization information directly into the app bundle, and Gatekeeper won't need to look anything up over the internet the first time the user attempts to run the program.
  - filleduchaos 7y ago
    They aren't "wrong" - sure there's no further indication telling the user what to do, but you can right-click and run the app from Finder all the same (requires admin permissions). It's basically an upgraded Gatekeeper. I'm not quite sure what the pearl-clutching is about.
elteto 7y ago
What is the extent of this? Dos it apply to every binary I could run on my computer?
- qtplatypus 7y ago
  Only binaries downloaded via a browser.
daffy 7y ago
One more reason to switch to Linux.
- sgt 7y ago
  Most apps you'd care about in those cases would be perfectly buildable via Homebrew.
  - diffeomorphism 7y ago
    Note that "buildable" is much more of a hassle than "installable". There is a reason not everybody is using gentoo.
    - delinka 7y ago
      homebrew removes that hassle. "brew install" doesn't make you download and build everything from source.
      - diffeomorphism 7y ago
        At present. The impression I got from the threads above is that will change with this requirement. > brew cask quarantines, but not regular brew. > ...which makes it all the more annoying for "power users" that there's no simple switch anymore to allow all apps to run without the scare/confirmation popups
m-p-3 7y ago
Is there some contingency for open-source softwares? Some really nice app out there are release by a single dev that does this as a hobby, and imposing a fee on them to release a software they make simply out of passion may make them leave the platform if that is the case.
- scarface74 7y ago
  There is no fee.
  - m-p-3 7y ago
    Thanks for the info!
  - vunie 7y ago
    For now.
tomp 7y ago
If we instead focused of containerization / sandboxes and/or capabilities-based security, life would be much better (not to mention more secure).
- AgloeDreams 7y ago
  MacOS has all of this, but none of this can protect against abuse of privileges or tricking customers into thinking their copy of an app is legitimate and entering third party information into it. This process, agree with it or not, is meant to stop things that cannot be stopped with just basic security technology.
  - tomp 7y ago
    So they're going to also vet all webpages before consumers can visit them? That's ridiculous.
    - AgloeDreams 7y ago
      The concept of HTTPS must sound crazy to you. Edit: Or this guy: https://www.intego.com/mac-security-blog/wp-content/uploads/2016/03/Browser-Fraudulent-Website-Protection.jpg https://www.intego.com/mac-security-blog/wp-content/uploads/...
      - tomp 7y ago
        Ah, I see what you're getting at. Well, there's better ways of achieving that, other than just banning non-compliant apps. Like, similar to HTTPS, we could add "ticks" into the app toolbar (or something similar) to indicate "verified" apps. Currently, there's nothing preventing websites from impersonating other websites, except consumer vigilance and green ticks in the adderss bar.
- deleted 7y ago
  [deleted]
deleted 7y ago
[deleted]
timrichard 7y ago
Scary looking submission, but from what I've read the right-click-menu-open trick to bypass Gatekeeper still works.
- sjwright 7y ago
  I can't speak to that particular method as I haven't personally played with Catalina, but you are correct. $ sudo spctl --master-disable definitely works.
  - duiker101 7y ago
    Problem is, the average user will never ever do that or even think it's possible.
    - matthewmacleod 7y ago
      This is exactly the opposite of a problem.
    - rimliu 7y ago
      How is that a problem?
    - maxaf 7y ago
      Apple’s position is that the average user isn’t supposed to be installing apps from outside the App Store anyway. Who is the average user, you ask? No one who posts to or reads HN, that’s for sure. Your parents, grandparents, and clueless neighbors are all average users. They will benefit from the decrease in malware and increase in assurance that the app won’t do something fishy. Everyone else will bypass protections and continue as before.
      - duiker101 7y ago
        But from the perspective of a dev it means you will need to either go through the App Store (and pay / let Apple have any list word on your app) or have your users drastically reduced because they can't even open the app.
bobx11 7y ago
What about python and node binaries? Assuming those don’t fall under the same group, can we also run electron from the cli if it’s not notarized?
- saagarjha 7y ago
  None of those involve GateKeeper at all, so they'll be fine.
chadlavi 7y ago
Apple doesn't require a paid developer account to do this, and it's also not actually required. A user can still click "Open" from the right-click menu on a newly downloaded app to open it for the first time, and then double click the app to open it subsequent times like normal. This is Apple's official line, but no one is going to actually have to do anything different if they don't want to. Some not-so-tech-savvy users might end up with apps they don't understand how to open after downloading them, but those are also the user most susceptible to falling for malicious downloads, so I'd call it a pretty good security feature. Anyway, were any of you who are complaining in this thread planning on actually publishing an app for macOS, or just here to beat a dead horse?
- rbanffy 7y ago
  > Anyway, were any of you who are complaining in this thread planning on actually publishing an app for macOS, or just here to beat a dead horse? I was concerned MacPorts would stop working on my computer. I don't plan on publishing apps for Mac, but I depend on apps others publish.
  - klodolph 7y ago
    No, from what I understand this only affects binaries through Gatekeeper. Gatekeeper is “opt-in”—sort of. The way it works is that your web browser has an option “LSFileQuarantineEnabled” set in the bundle, and this makes it so files it creates have the “com.apple.quarantine” extended attribute on them by default. This attribute is propagated when you extract archives. When you open a program with the quarantine bit, you get the Gatekeeper warning. All MacPorts has to do is either avoid setting the quarantine bit in the first place (easy enough) or remove it. The quarantine bit is nothing more than an xattr called “com.apple.quarantine” which you can inspect or remove with the xattr tool.
    - ceejayoz 7y ago
      The MacPorts .pkg installer is probably the only thing affected, and they should be able to get that signed. (Plus, anyone using MacPorts should be capable of the right-click+open workaround.)
atoav 7y ago
»Beautiful General Computation Device you got there. Would be a shame if it couldn’t generally compute anymore..«
- atoav 7y ago
  (this was just a joke, sorry if it annoyed you)
davidhyde 7y ago
If you want to develop apps for Windows you have to get around their smart screen which is particularly difficult to do if you are not well known. I don't think Apple should charge so much because it doesn't cost them that but it is a good thing that they have some sort of mechanism for connecting the original authors to the built software. Follow the money and you find the source.
- TruthSHIFT 7y ago
  Actually, Apple doesn't charge anything for a developer account to notarize Mac software.
  - davidhyde 7y ago
    Cheers, that's good to know
terracatta 7y ago
As far as I can tell, Notarization only impacts apps/executables that have the quarantine bit set in their extended attributes. This bit is typically added by web browsers and other programs when they download files directly from the internet. Before notarization, when this bit was set, the user would receive a simple warning that the software was downloaded from the internet and they should proceed with caution. All notarization does is add additional logic to this flow. If the notarization is "stapled" to the executable, then macOS can verify it offline, otherwise macOS will connect to Apple's servers to verify the notarization of an app/binary. This means that by notarizing an existing app, you do not need to re-distribute it. This quarantine bit behavior is why upgrading to Catalina does not impact previously installed apps (regardless of their notarization status) as they do not have this bit set.
- kjksf 7y ago
  Slow boiling frog. Given the history of what Apple did in the past, I think it's very naive that this is the last restriction Apple will add. First the user could run any app. Then you had to sign the app or the user would see a scary warning. Then you had to sign the app or, by default, the user could not open the app, unless he enables it via a UI that is very confusing (and I assume on purpose). Now you have to notorize the app. It's pretty clear that the end goal for Apple is to lock down Mac OS the same way they locked down iOS. Apple needs to protect the hostages, I mean users, from the likes of Mozilla which produces a dangerous app that duplicates built-in OS functionality, which is confusing. And it can deliver porn so think of the children! And they will in Mac OS 10.20, unless the government steps in.
  - vunie 7y ago
    >Slow boiling frog. I agree. All this infrastructure and support doesn't make sense if it is only used on executables that have some easily modifiable fs attribute set. I fully expect apple to try to expand this on all executables at some point in the future. It'll be interesting to see if they will be able to pull it off.
  - velcrovan 7y ago
    It's worth noting that frogs will in fact jump out of hot water no matter how slowly you bring it to a boil.
jakobegger 7y ago
If you are interested in how app notarisation is enforced in detail, I recommend watching the WWDC 2019 session "Advances in macOS Security" [1] Here's a quick summary: App Notarisation is enforced by Gatekeeper. Gatekeeper only checks software with the "quarantined" attribute [2]. The "quarantined" attribute is set by web browsers, email clients, messaging apps, etc. So this means that Gatekeeper does not check software installed with curl / brew / port. You can circumvent Gatekeeper by right-clicking the file in Finder, or by removing the quarantine attribute. A change from previous versions of macOS is that Gatekeeper now also checks programs you start from the command line (if they have the quarantine attribute set). [1]: https://developer.apple.com/videos/play/wwdc2019/701/ https://developer.apple.com/videos/play/wwdc2019/701/ (Transcript: https://asciiwwdc.com/2019/sessions/701 https://asciiwwdc.com/2019/sessions/701) [2]: Actually Gatekeeper now also checks programs that don't have the quarantine attribute set, but it only checks the signature against a known malware database, and doesn't require notarisation. Details are in the video linked above.
- FPGAhacker 7y ago
  Thank you for the summary and links.
- shoeffner 7y ago
  And to remove the quarantine attribute when you are sure you want to run something: xattr -d com.apple.quarantine FILE
- cprecioso 7y ago
  IIRC, brew cask does actually set the quarantine bit in the downloaded binaries
chj 7y ago
This does not require developer membership at least for the moment. That being said, it's worrying that Apple is becoming the single point of failure in Mac App Distribution. Windows allows your binary to be signed by third party CA.
runn1ng 7y ago
How to notarize a binary if one does not have macOS? I used to have a cross-platform build on Docker for macOS, I wonder how would I do it now.
- delinka 7y ago
  You do not notarize. Apple does. You submit the app to Apple for them to notarize. Pretty sure you don't need a Mac for that.
  - trothamel 7y ago
    The tool that's used to submit a binary to Apple only runs on macOS. Short of something like a hackintosh (which is against the macOS license) or maybe Darling, it's not clear how one would do the submission without a mac. This is a real issue for me, as my open source project is a cross-platform game development tool. It used to be that it was possible for someone to click a button and get Linux, Windows, and Mac distributions - but now the Mac side is proving more and more difficult.
  - icebraining 7y ago
    > Pretty sure you don't need a Mac for that. Maybe you do, I can't find any way besides using Xcode, either on the GUI or using "altool", which comes with it.
    - delinka 7y ago
      Indeed the only instructions rely on Xcode tools. That sucks.
  - runn1ng 7y ago
    I’m pretty sure you do.
Communitivity 7y ago
I've used a Mac since the IIGS. This year I bought my first non-Mac (a desktop) in a long time. Now I am looking at a laptop. I don't think I'll ever own a Mac again because of this, plus all the other semi-recent things (I need to have a developer license to write software for an OS built on BSD, what I perceive as deteriorating quality, low-value features such as the touch bar, Mac OS becoming more and more IOS like, and more). My new go-to for dev laptops is a System 76 machine [1]. I am unaffiliated with System 76 in any way. [1] https://system76.com/ https://system76.com/
- mrunkel 7y ago
  You don't need a developer license to write software on OS X.
  - heavyset_go 7y ago
    You do if you want to release it and have your users be able to use it without being warned that your product is insecure.
- Crinus 7y ago
  Considering they have their own hardware and software (well, not exactly their own, but they customize both and work on both before release), is System 76 as problem-free and solid as Mac OS X was during the Snow Leopard times?
- pram 7y ago
  I see this trotted out every time someones mad with Apple. JFYI System 76 are just rebadged Clevo/Sager. Save yourself some money lol https://www.sagernotebook.com/Notebook-NP8454.html https://www.sagernotebook.com/Notebook-NP8454.html
arthurfm 7y ago
The blog post below contains a useful flowchart showing how to open a non-Mac App Store app on Catalina. https://eclecticlight.co/2019/10/04/will-gatekeeper-let-me-run-that-app-in-catalina/ https://eclecticlight.co/2019/10/04/will-gatekeeper-let-me-r... A follow-up post mentions that standard users will not see an Open button at all. https://eclecticlight.co/2019/10/05/what-to-do-when-a-newly-installed-app-cant-be-opened/ https://eclecticlight.co/2019/10/05/what-to-do-when-a-newly-...
apple_losing_us 7y ago
I hope Apple is prepared for a massive exodus of developers / ISVs and a class action or three if they try to force all software through the App Store. I owned a business focused on iOS and shut it down because of the dumpster fire the App Store has become. My livelihood will not depend on some halfwit middle manager. The day they force Mac software through that dumpster fire is the day 100% of my Apple products go in the trash. Enough with the fucking greed already.
ur-whale 7y ago
Phone vendors (iOS + Android) invented the whole "t'is your phone, but actually, it isn't, we'll decide what you're allowed to run on it" trend. It was just a matter of time until the disease spread to the desktop. I am no fan of RMS for many reasons, but one thing can no one can take away from him: he totally foresaw the curtailing of freedoms decades before anyone else did. It's fully here now. I expect the next step to be: if you use an unrestricted platform (Linux, OpenBSD, etc...), you won't be granted access to major chunks of the internet. And then next: if you want to use Linux, you'll need the IT equivalent of a carry permit from the govt.
- vunie 7y ago
  > I expect the next step to be: if you use an unrestricted platform (Linux, OpenBSD, etc...), you won't be granted access to major chunks of the internet. We already have this in the form of browser drm modules. It's not hard to imagine similar modules being implemented for network stacks. ISPs and internet exchanges can be required by law to drop any unencrypted traffic. Lock down is an inevitability for any technology. General computing, Machine learning, Encryption, and other technology will inevitably get locked behind a sea of regulation. The only way to combat this is to keep governments playing catch up by innovating faster than they can legislate (e.g. mesh networks as a response to telecom overregulation).

221 points by draugadrotten 7y ago

Officially this is being done in the name of security... is it really or is this a cash grab to coerce everyone making apps for macOS to pay the $99/year fee which is required for the signing/notarizing being mentioned?

realusername 7y ago
The "security" part is of course complete bullshit. They slowly want to turn macOS into a walled garden for more control and profit like they did in the mobile space.
- mikece 7y ago
  I don't know about everyone else but the only reason I even have macOS computers is because I'm making apps for iOS. If it were possible to develop for iOS on Windows 10 or Linux I would do that in a heartbeat.
  - 72deluxe 7y ago
    I don't know much about it but I thought you could develop for iOS using C# using Visual Studio 2017/2019 and it remotely deploy to Mac? I read a bit about it because I wanted to do it myself but I haven't upgraded from Sierra yet due to no support/broken for my audio hardware in newer versions.
  - WilliamEdward 7y ago
    There's that, but I also just kind of like the operating system more than others ¯\_(ツ)_/¯
- Angostura 7y ago
  Except of course it isn't complete bullshit. It's saved me a few times where naive family members (one greater than the age of 80, the other under 12) has inadvertently downloaded mal/annoyanceware and tried to install it. Crapware is a substantial cause of 'my machine's not working properly' among the less technically savvy
  - realusername 7y ago
    There's no relation between proper sandboxing (actual security) and a walled-garden like apple is building. You also can download malware on the App Store.
    - Spivak 7y ago
      Okay, your wish is granted. "Apps that want to escape an extremely minimal runtime sandbox need to be approved by Apple."
      - realusername 7y ago
        I would prefer to leave that choice to the user.
        qtplatypus 7y ago
        And the user can choose to bypass that check by removing the quarantined flag.
        realusername 7y ago
        You have a point but that's exactly the same on an app store. They can just select "yes" to the permission dialog and we have exactly the same issue.
  - johnisgood 7y ago
    On the other hand, people who have been doing this for a living will have less work to do!
- scarface74 7y ago
  People have been saying this for a decade.....
duiker101 7y ago
I think that is actually a smaller part of what's at play. The money is in Apple getting everything to be on the store, getting fees on the money spent on the store and the control over it. They will have the final say over everything.
- scarface74 7y ago
  If that’s actually Apple’s goal, it’s taken them over a decade to get there. The Mac software market is so small and insignificant for Apple’s revenue that it wouldn’t be worth the trouble.
deleted 7y ago
[deleted]
sjwright 7y ago
The parent post is factually false. The $99/year developer account fee is not a prerequisite for notarizing macOS apps.
- duiker101 7y ago
  While you are right, it is adding an extra hurdle that is obviously trying to stride dev toward the store. "Hey, you can have your software notirized (which we might not accept), people will be warned before opening the app and some other bs or you can pay us 99$ and stop worrying!"
  - sjwright 7y ago
    Please limit your criticism to what Apple is actually doing, not what your imagination speculates they might do in future.
    - duiker101 7y ago
      I am criticising what they are doing now. Which is making everything harder if you don't go through the App Store, and they have been doing it for a while now. It's the same they are doing with their hardware and everything (you can't repair it yourself because "quality") so I can't really see them doing anything different.
  - jtbayly 7y ago
    You are implying that notarized apps will still not just run normally after this change. I believe that is false.
geerlingguy 7y ago
Is the $99/year actually required? I thought there was a way to sign apps without it.
michaelt 7y ago
It's not a cash grab; it's a power grab. By introducing themselves as gatekeepers, they can analyse software and reject it. For example, if they decide to deprecate an API, they can decline to notarise any software that uses it. The thin end of the wedge is, of course, free notarisation with few limitations. Then once that is in place, they can increase their power to the level they enjoy in the iPhone app store.

orf 7y ago

So now you need a 100$ a year license to publish any software on MacOS?

sjwright 7y ago
No, Apple doesn't require a paid developer account for you to receive a notarizing certificate.
- duiker101 7y ago
  *yet. This sort of things are always gradual to not scare people off. First it's a popup that you need to right click->open to bypass, then it's notarising, soon no software from outside the store will be allowed.
  - scarface74 7y ago
    So when? The Mac App Store was introduced over a decade ago and people have been making this prediction.
  - sjwright 7y ago
    Worry about the slippery slope when the slippery slope actually slips. For now there's good reasoning behind what Apple has done and I applaud their active concern for badware.
    - badsectoracula 7y ago
      > Worry about the slippery slope when the slippery slope actually slips. Wouldn't that be too late? After all we have "warning! slippery surface" signs to avoid slipping, we don't just let people slip and fall over to figure out the surface is indeed slippery.
      - sjwright 7y ago
        Too late for what?

jordigh 7y ago

"Notarised", what a loaded, feel-good term.

sjwright 7y ago
I for one welcome our notarizing overlords. Running a terminal command to disable it is a very minor inconvenience for us nerds... in return we'll get fewer tedious house calls from family and friends asking why their computer is doing weird things.
- johnisgood 7y ago
  I already posted it elsewhere but: on the other hand, people who have been doing this for a living will have less work to do! I know some people who live off those calls. :)
  - sjwright 7y ago
    Don't worry, endlessly escalating software complexity will keep us all busy. I love current MacOS but my perception it's never been quite as bug-free as it was in the Snow Leopard era. And I attribute that to increasing complexity. Part of me wishes that Apple would slow down the big innovation for a couple of years and get the entire development team working on bug-fixes and polish.
    - heavyset_go 7y ago
      > And I attribute that to increasing complexity. I attribute it to Apple focusing on iOS and letting their desktop products slide.
- noxToken 7y ago
  I don't know the intimate details of Windows SmartScreen, but aren't these basically the same thing? This seems to be a welcomed change while SmartScreen seems largely hated.
  - 7y ago

fortran77 7y ago

You don't own your computers, folks!

sjwright 7y ago
Correct. And that's almost universally true for any software program and operating system you didn't personally write. You don't "own" any software on your computer, including your favourite Linux & GNU distribution. You agree to a license which almost always places certain restrictions on what you can do with the software.
- ForHackernews 7y ago
  This is not necessarily the case: http://thedjbway.b0llix.net/license_free.html http://thedjbway.b0llix.net/license_free.html http://cr.yp.to/softwarelaw.html http://cr.yp.to/softwarelaw.html
  - sjwright 7y ago
    Sure, if you accept the feel-good corporatist double-speak that is "owning copies" of intellectual property.
    - dahart 7y ago
      There are restrictions on what you can do with almost all products, commercial and open source, e.g., see licenses, copyrights, moral right, trademarks, patents, trade secrets, etc. What do you want “own” to mean, exactly? What do you want to do with your software that you can’t do right now?
Angostura 7y ago
Unless, of course - you control click on first launch to bypass the check.
aikah 7y ago
> You don't own your computers, folks! You do, you just don't necessarily own the software running on it.

Tepix 7y ago

About notarizing: Give users even more confidence in your software by submitting it to Apple to be notarized. The service automatically scans your Developer ID-signed software and performs security checks. When it’s ready to export for distribution, a ticket is attached to your software to let Gatekeeper know it’s been notarized. So, on this page it reads: Mac software distributed outside the Mac App Store must be notarized by Apple in order to run on macOS Catalina What does this mean? Is this something that affects merely the default security setting?

awwaiid 7y ago

How does this work with Brew? (Dear lazyweb...)

geocar 7y ago
It shouldn't affect brew or software you build yourself.
- swiley 7y ago
  How can it tell you've compiled it and haven't just signed it yourself? Or does it only check signatures when you're launching things from the GUI?
  - Angostura 7y ago
    Or does it only check signatures when you're launching things from the GUI? Yes. If you;re tinkering with Homebre, you are not the target demographic.
    - swiley 7y ago
      So you could easily install a graphical shell that doesn't check that. heh people probably need to chill out about all this. I got a mechanical engineering student (read: "doesn't understand computers") to play open arena with me the other month dispite all of this. It's just a couple buttons you have to press.
    - flohofwoe 7y ago
      ...which makes it all the more annoying for "power users" that there's no simple switch anymore to allow all apps to run without the scare/confirmation popups (there used to be a third option in "Security & Privacy" settings next to "App Store" and "App Store and identified developers" for this).
      - my123 7y ago
        That third option is hidden in the GUI, but can be re-enabled via: sudo spctl --master-disable

tomlong 7y ago

Is software that isn't currently notarized going to stop working when we upgrade to Catalina?

chadlavi 7y ago
no
- tomlong 7y ago
  That's good. I wish things were a little clearer.
deleted 7y ago
[deleted]
tumult 7y ago
The other person who replied to you is wrong (edit: assuming they meant in general, not for only software that you have specifically already downloaded and run on a single computer before upgrading it to Catalina.) Non-"notarized" software, when freshly downloaded to a computer running Catalina, will not run. A dialog will be displayed, telling the user that the developer needs to update their app for compatibility. There is no further indication telling the user what to do, and no "run anyway" button. The developer will need to "notarize" the software with Apple, and receive their approval. If that happens, then the "notarization" information for the app bundle will be available via Apple's servers when users attempt to run the program, and Gatekeeper will attempt to look it up from the Apple's servers if the "notarization" information is not "stapled" into the app bundle. Optionally, and probably preferably, the app developer can "staple" the notarization information directly into the app bundle, and Gatekeeper won't need to look anything up over the internet the first time the user attempts to run the program.
- filleduchaos 7y ago
  They aren't "wrong" - sure there's no further indication telling the user what to do, but you can right-click and run the app from Finder all the same (requires admin permissions). It's basically an upgraded Gatekeeper. I'm not quite sure what the pearl-clutching is about.

elteto 7y ago

What is the extent of this? Dos it apply to every binary I could run on my computer?

qtplatypus 7y ago
Only binaries downloaded via a browser.

daffy 7y ago

One more reason to switch to Linux.

sgt 7y ago
Most apps you'd care about in those cases would be perfectly buildable via Homebrew.
- diffeomorphism 7y ago
  Note that "buildable" is much more of a hassle than "installable". There is a reason not everybody is using gentoo.
  - delinka 7y ago
    homebrew removes that hassle. "brew install" doesn't make you download and build everything from source.
    - diffeomorphism 7y ago
      At present. The impression I got from the threads above is that will change with this requirement. > brew cask quarantines, but not regular brew. > ...which makes it all the more annoying for "power users" that there's no simple switch anymore to allow all apps to run without the scare/confirmation popups

m-p-3 7y ago

Is there some contingency for open-source softwares? Some really nice app out there are release by a single dev that does this as a hobby, and imposing a fee on them to release a software they make simply out of passion may make them leave the platform if that is the case.

scarface74 7y ago
There is no fee.
- m-p-3 7y ago
  Thanks for the info!
- vunie 7y ago
  For now.

tomp 7y ago

If we instead focused of containerization / sandboxes and/or capabilities-based security, life would be much better (not to mention more secure).

AgloeDreams 7y ago
MacOS has all of this, but none of this can protect against abuse of privileges or tricking customers into thinking their copy of an app is legitimate and entering third party information into it. This process, agree with it or not, is meant to stop things that cannot be stopped with just basic security technology.
- tomp 7y ago
  So they're going to also vet all webpages before consumers can visit them? That's ridiculous.
  - AgloeDreams 7y ago
    The concept of HTTPS must sound crazy to you. Edit: Or this guy: https://www.intego.com/mac-security-blog/wp-content/uploads/2016/03/Browser-Fraudulent-Website-Protection.jpg https://www.intego.com/mac-security-blog/wp-content/uploads/...
    - tomp 7y ago
      Ah, I see what you're getting at. Well, there's better ways of achieving that, other than just banning non-compliant apps. Like, similar to HTTPS, we could add "ticks" into the app toolbar (or something similar) to indicate "verified" apps. Currently, there's nothing preventing websites from impersonating other websites, except consumer vigilance and green ticks in the adderss bar.
deleted 7y ago
[deleted]

deleted 7y ago

[deleted]

timrichard 7y ago

Scary looking submission, but from what I've read the right-click-menu-open trick to bypass Gatekeeper still works.

sjwright 7y ago
I can't speak to that particular method as I haven't personally played with Catalina, but you are correct. $ sudo spctl --master-disable definitely works.
- duiker101 7y ago
  Problem is, the average user will never ever do that or even think it's possible.
  - matthewmacleod 7y ago
    This is exactly the opposite of a problem.
  - rimliu 7y ago
    How is that a problem?
  - maxaf 7y ago
    Apple’s position is that the average user isn’t supposed to be installing apps from outside the App Store anyway. Who is the average user, you ask? No one who posts to or reads HN, that’s for sure. Your parents, grandparents, and clueless neighbors are all average users. They will benefit from the decrease in malware and increase in assurance that the app won’t do something fishy. Everyone else will bypass protections and continue as before.
    - duiker101 7y ago
      But from the perspective of a dev it means you will need to either go through the App Store (and pay / let Apple have any list word on your app) or have your users drastically reduced because they can't even open the app.

bobx11 7y ago

What about python and node binaries? Assuming those don’t fall under the same group, can we also run electron from the cli if it’s not notarized?

saagarjha 7y ago
None of those involve GateKeeper at all, so they'll be fine.

chadlavi 7y ago

Apple doesn't require a paid developer account to do this, and it's also not actually required. A user can still click "Open" from the right-click menu on a newly downloaded app to open it for the first time, and then double click the app to open it subsequent times like normal. This is Apple's official line, but no one is going to actually have to do anything different if they don't want to. Some not-so-tech-savvy users might end up with apps they don't understand how to open after downloading them, but those are also the user most susceptible to falling for malicious downloads, so I'd call it a pretty good security feature. Anyway, were any of you who are complaining in this thread planning on actually publishing an app for macOS, or just here to beat a dead horse?

rbanffy 7y ago
> Anyway, were any of you who are complaining in this thread planning on actually publishing an app for macOS, or just here to beat a dead horse? I was concerned MacPorts would stop working on my computer. I don't plan on publishing apps for Mac, but I depend on apps others publish.
- klodolph 7y ago
  No, from what I understand this only affects binaries through Gatekeeper. Gatekeeper is “opt-in”—sort of. The way it works is that your web browser has an option “LSFileQuarantineEnabled” set in the bundle, and this makes it so files it creates have the “com.apple.quarantine” extended attribute on them by default. This attribute is propagated when you extract archives. When you open a program with the quarantine bit, you get the Gatekeeper warning. All MacPorts has to do is either avoid setting the quarantine bit in the first place (easy enough) or remove it. The quarantine bit is nothing more than an xattr called “com.apple.quarantine” which you can inspect or remove with the xattr tool.
  - ceejayoz 7y ago
    The MacPorts .pkg installer is probably the only thing affected, and they should be able to get that signed. (Plus, anyone using MacPorts should be capable of the right-click+open workaround.)

atoav 7y ago

»Beautiful General Computation Device you got there. Would be a shame if it couldn’t generally compute anymore..«

atoav 7y ago
(this was just a joke, sorry if it annoyed you)

davidhyde 7y ago

If you want to develop apps for Windows you have to get around their smart screen which is particularly difficult to do if you are not well known. I don't think Apple should charge so much because it doesn't cost them that but it is a good thing that they have some sort of mechanism for connecting the original authors to the built software. Follow the money and you find the source.

TruthSHIFT 7y ago
Actually, Apple doesn't charge anything for a developer account to notarize Mac software.
- davidhyde 7y ago
  Cheers, that's good to know

terracatta 7y ago

As far as I can tell, Notarization only impacts apps/executables that have the quarantine bit set in their extended attributes. This bit is typically added by web browsers and other programs when they download files directly from the internet. Before notarization, when this bit was set, the user would receive a simple warning that the software was downloaded from the internet and they should proceed with caution. All notarization does is add additional logic to this flow. If the notarization is "stapled" to the executable, then macOS can verify it offline, otherwise macOS will connect to Apple's servers to verify the notarization of an app/binary. This means that by notarizing an existing app, you do not need to re-distribute it. This quarantine bit behavior is why upgrading to Catalina does not impact previously installed apps (regardless of their notarization status) as they do not have this bit set.

kjksf 7y ago
Slow boiling frog. Given the history of what Apple did in the past, I think it's very naive that this is the last restriction Apple will add. First the user could run any app. Then you had to sign the app or the user would see a scary warning. Then you had to sign the app or, by default, the user could not open the app, unless he enables it via a UI that is very confusing (and I assume on purpose). Now you have to notorize the app. It's pretty clear that the end goal for Apple is to lock down Mac OS the same way they locked down iOS. Apple needs to protect the hostages, I mean users, from the likes of Mozilla which produces a dangerous app that duplicates built-in OS functionality, which is confusing. And it can deliver porn so think of the children! And they will in Mac OS 10.20, unless the government steps in.
- vunie 7y ago
  >Slow boiling frog. I agree. All this infrastructure and support doesn't make sense if it is only used on executables that have some easily modifiable fs attribute set. I fully expect apple to try to expand this on all executables at some point in the future. It'll be interesting to see if they will be able to pull it off.
- velcrovan 7y ago
  It's worth noting that frogs will in fact jump out of hot water no matter how slowly you bring it to a boil.

jakobegger 7y ago

If you are interested in how app notarisation is enforced in detail, I recommend watching the WWDC 2019 session "Advances in macOS Security" [1] Here's a quick summary: App Notarisation is enforced by Gatekeeper. Gatekeeper only checks software with the "quarantined" attribute [2]. The "quarantined" attribute is set by web browsers, email clients, messaging apps, etc. So this means that Gatekeeper does not check software installed with curl / brew / port. You can circumvent Gatekeeper by right-clicking the file in Finder, or by removing the quarantine attribute. A change from previous versions of macOS is that Gatekeeper now also checks programs you start from the command line (if they have the quarantine attribute set). [1]: https://developer.apple.com/videos/play/wwdc2019/701/ https://developer.apple.com/videos/play/wwdc2019/701/ (Transcript: https://asciiwwdc.com/2019/sessions/701 https://asciiwwdc.com/2019/sessions/701) [2]: Actually Gatekeeper now also checks programs that don't have the quarantine attribute set, but it only checks the signature against a known malware database, and doesn't require notarisation. Details are in the video linked above.

FPGAhacker 7y ago
Thank you for the summary and links.
shoeffner 7y ago
And to remove the quarantine attribute when you are sure you want to run something: xattr -d com.apple.quarantine FILE
cprecioso 7y ago
IIRC, brew cask does actually set the quarantine bit in the downloaded binaries

chj 7y ago

This does not require developer membership at least for the moment. That being said, it's worrying that Apple is becoming the single point of failure in Mac App Distribution. Windows allows your binary to be signed by third party CA.

runn1ng 7y ago

How to notarize a binary if one does not have macOS? I used to have a cross-platform build on Docker for macOS, I wonder how would I do it now.

delinka 7y ago
You do not notarize. Apple does. You submit the app to Apple for them to notarize. Pretty sure you don't need a Mac for that.
- trothamel 7y ago
  The tool that's used to submit a binary to Apple only runs on macOS. Short of something like a hackintosh (which is against the macOS license) or maybe Darling, it's not clear how one would do the submission without a mac. This is a real issue for me, as my open source project is a cross-platform game development tool. It used to be that it was possible for someone to click a button and get Linux, Windows, and Mac distributions - but now the Mac side is proving more and more difficult.
- icebraining 7y ago
  > Pretty sure you don't need a Mac for that. Maybe you do, I can't find any way besides using Xcode, either on the GUI or using "altool", which comes with it.
  - delinka 7y ago
    Indeed the only instructions rely on Xcode tools. That sucks.
- runn1ng 7y ago
  I’m pretty sure you do.

Communitivity 7y ago

I've used a Mac since the IIGS. This year I bought my first non-Mac (a desktop) in a long time. Now I am looking at a laptop. I don't think I'll ever own a Mac again because of this, plus all the other semi-recent things (I need to have a developer license to write software for an OS built on BSD, what I perceive as deteriorating quality, low-value features such as the touch bar, Mac OS becoming more and more IOS like, and more). My new go-to for dev laptops is a System 76 machine [1]. I am unaffiliated with System 76 in any way. [1] https://system76.com/ https://system76.com/

mrunkel 7y ago
You don't need a developer license to write software on OS X.
- heavyset_go 7y ago
  You do if you want to release it and have your users be able to use it without being warned that your product is insecure.
Crinus 7y ago
Considering they have their own hardware and software (well, not exactly their own, but they customize both and work on both before release), is System 76 as problem-free and solid as Mac OS X was during the Snow Leopard times?
pram 7y ago
I see this trotted out every time someones mad with Apple. JFYI System 76 are just rebadged Clevo/Sager. Save yourself some money lol https://www.sagernotebook.com/Notebook-NP8454.html https://www.sagernotebook.com/Notebook-NP8454.html

arthurfm 7y ago

The blog post below contains a useful flowchart showing how to open a non-Mac App Store app on Catalina. https://eclecticlight.co/2019/10/04/will-gatekeeper-let-me-run-that-app-in-catalina/ https://eclecticlight.co/2019/10/04/will-gatekeeper-let-me-r... A follow-up post mentions that standard users will not see an Open button at all. https://eclecticlight.co/2019/10/05/what-to-do-when-a-newly-installed-app-cant-be-opened/ https://eclecticlight.co/2019/10/05/what-to-do-when-a-newly-...

apple_losing_us 7y ago

I hope Apple is prepared for a massive exodus of developers / ISVs and a class action or three if they try to force all software through the App Store. I owned a business focused on iOS and shut it down because of the dumpster fire the App Store has become. My livelihood will not depend on some halfwit middle manager. The day they force Mac software through that dumpster fire is the day 100% of my Apple products go in the trash. Enough with the fucking greed already.

ur-whale 7y ago

Phone vendors (iOS + Android) invented the whole "t'is your phone, but actually, it isn't, we'll decide what you're allowed to run on it" trend. It was just a matter of time until the disease spread to the desktop. I am no fan of RMS for many reasons, but one thing can no one can take away from him: he totally foresaw the curtailing of freedoms decades before anyone else did. It's fully here now. I expect the next step to be: if you use an unrestricted platform (Linux, OpenBSD, etc...), you won't be granted access to major chunks of the internet. And then next: if you want to use Linux, you'll need the IT equivalent of a carry permit from the govt.

vunie 7y ago
> I expect the next step to be: if you use an unrestricted platform (Linux, OpenBSD, etc...), you won't be granted access to major chunks of the internet. We already have this in the form of browser drm modules. It's not hard to imagine similar modules being implemented for network stacks. ISPs and internet exchanges can be required by law to drop any unencrypted traffic. Lock down is an inevitability for any technology. General computing, Machine learning, Encryption, and other technology will inevitably get locked behind a sea of regulation. The only way to combat this is to keep governments playing catch up by innovating faster than they can legislate (e.g. mesh networks as a response to telecom overregulation).