5 ms·

The Gatekeeper behavior is specific to running things from Finder (not Terminal), and only if you downloaded it via a browser that sets the com.apple.quarantine

The Gatekeeper behavior is specific to running things from Finder (not Terminal), and only if you downloaded it via a browser that sets the com.apple.quarantine xattr. Two posts from Apple dev support (Cmd+F "eskimo") describe this in more detail. https://forums.developer.apple.com/thread/127709 https://forums.developer.apple.com/thread/127709 https://forums.developer.apple.com/thread/127694 https://forums.developer.apple.com/thread/127694

nemosaltat 6y ago
I recently learned that `xattr -cr path/to/my.app` solves the “this App is damaged would you like to move it to the trash” you get when you copy an app from one Mac to another.
- rhizome 6y ago
  That might be the Windows-iest feature of OSX I've ever heard of.
  - cosmojg 6y ago
    It seems macOS is going downhill fast these days.
    - withinboredom 6y ago
      No, it’s just that they’re becoming more popular. When you become a popular desktop OS, governments and militaries want to start using it which comes with some strange requirements. It also means that you can’t rely on “obscurity” to provide any sort of security, where before you could overlook some things.
      - catalogia 6y ago
        Can you cite any sources for your claim that these things are being implemented to satisfy government/military requirements?
        o-__-o 6y ago
        DISA? I don’t know why grand op is downvoted. DoD requirements literally require a timeout setting for screensavers to begin locking. This has caught systems which have a race condition where you can move your mouse quickly and gain desktop access before it locks. The long term effects come from the required changes to the development security model to remain productive and profitable (took MSFT a few OOB hotfixes and service packs to fix that example above, look when gnome kde xscreensaver etc introduced that feature etc)
        saagarjha 6y ago
        > This has caught systems which have a race condition where you can move your mouse quickly and gain desktop access before it locks. I fail to see how this is a race condition rather than how a screensaver is supposed to work?
        o-__-o 6y ago
        Because it’s not, that’s why I pointed to xscreensaver feature implementation. Lock time is separate from screensaver activation time which is separate from energy saving activation time. What defines when a locking screen saver is “locked”? 10m? Or 10m1s? You are making assumptions and that is what DISA spells out. Which forces the OS design to change in subtle ways. Like xattrs on files as great grand op was alluding to. Does that provide clarity into how development security models evolve over the lifetime of an application?
  - noisem4ker 6y ago
    What would that mean?
    - bobbylarrybobby 6y ago
      It would appear to mean it's a hacky, over-technical solution to a problem that shouldn't exist in the first place, as copying things from one computer to another should just work™. This is one place where macOS used to shine and seems to be increasingly falling behind in.
JadeNB 6y ago
> The Gatekeeper behavior is specific to running things from Finder (not Terminal), and only if you downloaded it via a browser that sets the com.apple.quarantine xattr. The article says the described problem isn't limited in this way: > This is not just for files downloaded from the internet, nor is it only when you launch them via Finder, this is everything. So even if you write a one line shell script and run it in a terminal, you will get a delay!
- deleted 6y ago
  [deleted]
- staticfloat 6y ago
  If you read the comments of the article and do your own testing, you will find that reality appears to be more complicated than the article suggests. Users have shown using both timing and wireshark that the shell scripts do not appear to be triggering notarization checks.
reuben_scratton 6y ago
Quinn The Eskimo at Apple's forums is a 10x support engineer, his posts have helped me fix dozens of problems.
- saagarjha 6y ago
  He needs to be, because Apple Developer Technical Support is chronically understaffed.
- Someone 6y ago
  Unless somebody took over his name he’s been at Apple for almost 25 years, and was already being interviewed as such 20 years ago (http://preserve.mactech.com/articles/mactech/Vol.16/16.06/Jun00FactoryFloor/index.html http://preserve.mactech.com/articles/mactech/Vol.16/16.06/Ju...) His site (http://www.quinn.echidna.id.au/Quinn/WWW/ http://www.quinn.echidna.id.au/Quinn/WWW/) supports its claim “I'm not a great believer in web” :-)
  - saagarjha 6y ago
    It's interesting to see a time when Apple seemed to allow employees to have side projects…
xenadu02 6y ago
This is the way things worked prior to Catalina but is no longer the case.

nemosaltat 6y ago

I recently learned that `xattr -cr path/to/my.app` solves the “this App is damaged would you like to move it to the trash” you get when you copy an app from one Mac to another.

rhizome 6y ago
That might be the Windows-iest feature of OSX I've ever heard of.
- cosmojg 6y ago
  It seems macOS is going downhill fast these days.
  - withinboredom 6y ago
    No, it’s just that they’re becoming more popular. When you become a popular desktop OS, governments and militaries want to start using it which comes with some strange requirements. It also means that you can’t rely on “obscurity” to provide any sort of security, where before you could overlook some things.
    - catalogia 6y ago
      Can you cite any sources for your claim that these things are being implemented to satisfy government/military requirements?
      - o-__-o 6y ago
        DISA? I don’t know why grand op is downvoted. DoD requirements literally require a timeout setting for screensavers to begin locking. This has caught systems which have a race condition where you can move your mouse quickly and gain desktop access before it locks. The long term effects come from the required changes to the development security model to remain productive and profitable (took MSFT a few OOB hotfixes and service packs to fix that example above, look when gnome kde xscreensaver etc introduced that feature etc)
        saagarjha 6y ago
        > This has caught systems which have a race condition where you can move your mouse quickly and gain desktop access before it locks. I fail to see how this is a race condition rather than how a screensaver is supposed to work?
        o-__-o 6y ago
        Because it’s not, that’s why I pointed to xscreensaver feature implementation. Lock time is separate from screensaver activation time which is separate from energy saving activation time. What defines when a locking screen saver is “locked”? 10m? Or 10m1s? You are making assumptions and that is what DISA spells out. Which forces the OS design to change in subtle ways. Like xattrs on files as great grand op was alluding to. Does that provide clarity into how development security models evolve over the lifetime of an application?
- noisem4ker 6y ago
  What would that mean?
  - bobbylarrybobby 6y ago
    It would appear to mean it's a hacky, over-technical solution to a problem that shouldn't exist in the first place, as copying things from one computer to another should just work™. This is one place where macOS used to shine and seems to be increasingly falling behind in.

JadeNB 6y ago

> The Gatekeeper behavior is specific to running things from Finder (not Terminal), and only if you downloaded it via a browser that sets the com.apple.quarantine xattr. The article says the described problem isn't limited in this way: > This is not just for files downloaded from the internet, nor is it only when you launch them via Finder, this is everything. So even if you write a one line shell script and run it in a terminal, you will get a delay!

deleted 6y ago
[deleted]
staticfloat 6y ago
If you read the comments of the article and do your own testing, you will find that reality appears to be more complicated than the article suggests. Users have shown using both timing and wireshark that the shell scripts do not appear to be triggering notarization checks.

reuben_scratton 6y ago

Quinn The Eskimo at Apple's forums is a 10x support engineer, his posts have helped me fix dozens of problems.

saagarjha 6y ago
He needs to be, because Apple Developer Technical Support is chronically understaffed.
Someone 6y ago
Unless somebody took over his name he’s been at Apple for almost 25 years, and was already being interviewed as such 20 years ago (http://preserve.mactech.com/articles/mactech/Vol.16/16.06/Jun00FactoryFloor/index.html http://preserve.mactech.com/articles/mactech/Vol.16/16.06/Ju...) His site (http://www.quinn.echidna.id.au/Quinn/WWW/ http://www.quinn.echidna.id.au/Quinn/WWW/) supports its claim “I'm not a great believer in web” :-)
- saagarjha 6y ago
  It's interesting to see a time when Apple seemed to allow employees to have side projects…

xenadu02 6y ago

This is the way things worked prior to Catalina but is no longer the case.