5 ms·

Xcode (the UI) is able to bypass GateKeeper checks for things it builds. The "Developer Tool" pane in System Prefs, Security, Privacy is the same power. Drag a

Xcode (the UI) is able to bypass GateKeeper checks for things it builds. The "Developer Tool" pane in System Prefs, Security, Privacy is the same power. Drag anything into that list you'd like to grant the same privilege (such as xcodebuild). This is inherited by child processes as well. The point of this is to avoid malware packing bits of Xcode with itself and silently compiling itself on the target machine, thus bypassing system security policy.

closeparen 6y ago
This is life-changing. Thank you!
- pindab0ter 6y ago
  What did you notice?
LeoPanthera 6y ago
Putting Terminal (and your favorite text editor) in this category and in "Full Disk Access" will change your life.
- sneak 6y ago
  Yes, falling victim to ransomware is definitely lifechanging if you don’t have good backups.
  - LeoPanthera 6y ago
    That is a non-sequitur.
    - mperham 6y ago
      It's not; they are stating that if you bypass these security checks, you open the machine up to ransomware.
      - justinmeiners 6y ago
        better not turn on it at all, to be extra safe
- MrBuddyCasino 6y ago
  How does "Full Disk Access" help?
  - lloeki 6y ago
    You can browse Time Machine backup directory trees from the CLI again.
grishka 6y ago
So since these permissions apply to process trees, what happens if you put launchd in there?
- aasasd 6y ago
  The computer will probably hang while it tries to solve the chicken-egg problem. Isn't launchd Mac's ‘init’? I.e. run before anything else.
  - grishka 6y ago
    Yes, and that's the point — everything you run will theoretically inherit the permission from it.
indemnity 6y ago
Reminds me of the AV exception folder our corporate IT created for developers. Soon absolutely everything developers needed or created was installed into that folder. Applications, IDEs, you name it.
- kunday 6y ago
  Guilty as accused. I try to keep to an absolute minimum. Like docker data-dir and IDE. With that i can atleast use my machine. otherwise this macos notarisation, along with a possibly of cpu heating issues with left thunderbolt usage and corporate av scanning, makes my machine, next to useless
wila 6y ago
GateKeeper only triggers the check for things downloaded from the internet. IOW, it checks if your binary has a quarantine flag attached via an extended attribute.
- xenadu02 6y ago
  That is not correct starting with Catalina.
acecilia 6y ago
Can you advise on how to make the "Developer Tool" panel in "System Prefs, Security, Privacy" appear if it is not present? Cant find a way: https://stackoverflow.com/questions/60176405/macos-catalina-developer-tools-tab-is-hidden https://stackoverflow.com/questions/60176405/macos-catalina-...
- saagarjha 6y ago
  https://news.ycombinator.com/item?id=23278629 https://news.ycombinator.com/item?id=23278629
  - acecilia 6y ago
    Thanks for the link. Tried it, but that did not work
make3 6y ago
How do I get a "Developer Tool" pane in System Prefs? Do I have to install X-Code? I would really rather not
- saagarjha 6y ago
  https://news.ycombinator.com/item?id=23278629 https://news.ycombinator.com/item?id=23278629

closeparen 6y ago

This is life-changing. Thank you!

pindab0ter 6y ago
What did you notice?

LeoPanthera 6y ago

Putting Terminal (and your favorite text editor) in this category and in "Full Disk Access" will change your life.

sneak 6y ago
Yes, falling victim to ransomware is definitely lifechanging if you don’t have good backups.
- LeoPanthera 6y ago
  That is a non-sequitur.
  - mperham 6y ago
    It's not; they are stating that if you bypass these security checks, you open the machine up to ransomware.
    - justinmeiners 6y ago
      better not turn on it at all, to be extra safe
MrBuddyCasino 6y ago
How does "Full Disk Access" help?
- lloeki 6y ago
  You can browse Time Machine backup directory trees from the CLI again.

grishka 6y ago

So since these permissions apply to process trees, what happens if you put launchd in there?

aasasd 6y ago
The computer will probably hang while it tries to solve the chicken-egg problem. Isn't launchd Mac's ‘init’? I.e. run before anything else.
- grishka 6y ago
  Yes, and that's the point — everything you run will theoretically inherit the permission from it.

indemnity 6y ago

Reminds me of the AV exception folder our corporate IT created for developers. Soon absolutely everything developers needed or created was installed into that folder. Applications, IDEs, you name it.

kunday 6y ago
Guilty as accused. I try to keep to an absolute minimum. Like docker data-dir and IDE. With that i can atleast use my machine. otherwise this macos notarisation, along with a possibly of cpu heating issues with left thunderbolt usage and corporate av scanning, makes my machine, next to useless

wila 6y ago

GateKeeper only triggers the check for things downloaded from the internet. IOW, it checks if your binary has a quarantine flag attached via an extended attribute.

xenadu02 6y ago
That is not correct starting with Catalina.

acecilia 6y ago

Can you advise on how to make the "Developer Tool" panel in "System Prefs, Security, Privacy" appear if it is not present? Cant find a way: https://stackoverflow.com/questions/60176405/macos-catalina-developer-tools-tab-is-hidden https://stackoverflow.com/questions/60176405/macos-catalina-...

saagarjha 6y ago
https://news.ycombinator.com/item?id=23278629 https://news.ycombinator.com/item?id=23278629
- acecilia 6y ago
  Thanks for the link. Tried it, but that did not work

make3 6y ago

How do I get a "Developer Tool" pane in System Prefs? Do I have to install X-Code? I would really rather not

saagarjha 6y ago
https://news.ycombinator.com/item?id=23278629 https://news.ycombinator.com/item?id=23278629