3 ms·

If it checks with Apple servers every time you execute a new binary, what happens if you don't have an Internet connection? Are you just unable to run new code?

cpncrunch 6y ago
The article says "One way to solve the delays is to disable your internet connection" so I assume it just doesn't bother with notarization when you do that.
- zmmmmm 6y ago
  Which makes a mockery of the whole security angle - how can this be utterly essential for security while connected and then just tossed aside as optional as soon as you exit Wifi range? It can't be both.
nromiun 6y ago
> One way to solve the delays is to disable your internet connection. I think it just skips the checks if internet isn't available. But doesn't that kind of defeats the point of notarization?
- lallysingh 6y ago
  Hopefully you're also less likely to get new unsafe binaries when disconnected. But it's all still awful.
OskarS 6y ago
The linked website isn't loading, so I don't know what it says, but: if we're talking about notarization, you can "staple" the notarization to a .app or a .pkg, which means you don't have to do the internet lookup at all, and you can run the apps without having access to the internet. I'm not sure about the technical details, but I would assume you add some sort of signature that's like "This .app with hash X has been notarized and it's fine" signed by Apple's secret key. EDIT: how to staple: https://developer.apple.com/documentation/xcode/notarizing_macos_software_before_distribution/customizing_the_notarization_workflow#3087720 https://developer.apple.com/documentation/xcode/notarizing_m...
- skykooler 6y ago
  That doesn't help with self-written code, however, since you can't notarize without internet either.
enriquto 6y ago
> If it checks with Apple servers every time you execute a new binary, what happens if you don't have an Internet connection? Are you just unable to run new code? It waits 5 seconds while trying to connect, and then it gives up and caches the program as un-notarized, allowing it to run faster on later executions. Notice that notarization seems to be disabled if the network is disabled from within the OS. To observe the 5 second delay you need to cut the connection outside (e.g., on your router), while the mac still thinks it is connected. I observed it by running catalina inside a virtualbox, and disabling its network.

cpncrunch 6y ago

The article says "One way to solve the delays is to disable your internet connection" so I assume it just doesn't bother with notarization when you do that.

zmmmmm 6y ago
Which makes a mockery of the whole security angle - how can this be utterly essential for security while connected and then just tossed aside as optional as soon as you exit Wifi range? It can't be both.

nromiun 6y ago

> One way to solve the delays is to disable your internet connection. I think it just skips the checks if internet isn't available. But doesn't that kind of defeats the point of notarization?

lallysingh 6y ago
Hopefully you're also less likely to get new unsafe binaries when disconnected. But it's all still awful.

OskarS 6y ago

The linked website isn't loading, so I don't know what it says, but: if we're talking about notarization, you can "staple" the notarization to a .app or a .pkg, which means you don't have to do the internet lookup at all, and you can run the apps without having access to the internet. I'm not sure about the technical details, but I would assume you add some sort of signature that's like "This .app with hash X has been notarized and it's fine" signed by Apple's secret key. EDIT: how to staple: https://developer.apple.com/documentation/xcode/notarizing_macos_software_before_distribution/customizing_the_notarization_workflow#3087720 https://developer.apple.com/documentation/xcode/notarizing_m...

skykooler 6y ago
That doesn't help with self-written code, however, since you can't notarize without internet either.

enriquto 6y ago

> If it checks with Apple servers every time you execute a new binary, what happens if you don't have an Internet connection? Are you just unable to run new code? It waits 5 seconds while trying to connect, and then it gives up and caches the program as un-notarized, allowing it to run faster on later executions. Notice that notarization seems to be disabled if the network is disabled from within the OS. To observe the 5 second delay you need to cut the connection outside (e.g., on your router), while the mac still thinks it is connected. I observed it by running catalina inside a virtualbox, and disabling its network.