45 ms·
This makes me wonder how open source is supposed to work on macOS. People seem to become more and more aware of it and even enterprises that insisted on support
by lucb1e 6y ago
This makes me wonder how open source is supposed to work on macOS. People seem to become more and more aware of it and even enterprises that insisted on support contracts can see that they can't get around open source completely anymore. Meanwhile Apple is removing the ability for me to have a pet project without paying an Apple tax.
If the message were completely transparent, something like "The developer didn't pay $99 for us to do a cursory check on them (or whatever it is that Apple does with that money), are you sure you want to run their software? [Move to trash] [No] [?]", then that would give the user the relevant information to make this decision, but as it is, virtually no mac user will understand what is really going on.
I also can't imagine $100 is easy to come up with in countries below level 4[1]. The OpenStreetMap Foundation recently introduced a way to waive the yearly £15 fee for OSMF membership if you have a certain number of map edits or otherwise contributed to the project. The OSM community seems to be quite diverse, but I can't imagine that Apple computers are less widespread than OpenStreetMap.
[1] https://www.gatesnotes.com/Books/Factfulness#incomegroups https://www.gatesnotes.com/Books/Factfulness#incomegroups
- saagarjha 6y agoMany (often cross-platform) apps are no longer signed, so they throw up this warning–I assume that users of these have long since learned that the warning is just something they need to bypass. macOS-native apps have largely adopted notarization and the fee that comes with it. Open source command line tools do not need to be notarized. Interestingly enough, it seems to be possible to notarize someone else's app, so perhaps it might be a worthwhile use of my developer ID to provide this service to people I trust but don't want to shell out money…
- lucb1e 6y ago> learned that the warning is just something they need to bypass Note that I'm not necessarily arguing that training people to click "yes, yes, continue..." is a good idea. Digital security is my day job and I totally see why Apple wants digital signatures for software. However, the message is opaque about what is really going on and just tries to scare people into buying "trusted" software rather than using free software: that developer fee doesn't pay itself. > perhaps it might be a worthwhile use of my developer ID to provide this service to people I trust I was thinking the same, we could pool the money, but figured Apple almost certainly prohibits that "for security".
- saagarjha 6y agoNot only is the message opaque, but it is intentionally misleading. I know the security team at Apple occasionally has trouble coming up with good explanations of what is going on, but this message really can't be looked at in any way other than being misleading, sorry. And you are absolutely right that misleading messages like these train users to click through warnings.
- deleted 6y ago[deleted]
- FabHK 6y agoHow is it "intentionally misleading"?
- saagarjha 6y agoBecause it says the binary is damaged/malware/sketchy and that is not correct.
- FabHK 6y agoIt doesn't say that. It says that it can't verify the developer, and can't verify that the software is free of malware. It's just some arbitrary piece of software, could be written by anyone, and/or could be software that purports to be Word or Photoshop or whatever, but has been modified. Granted, you could quibble with the details (does pointing out that you can't verify that it's free from malware imply that you could verify that it's free from malware if there were a certificate?). But calling the message "intentionally" (!) misleading?
- saagarjha 6y agoOne of the possible warnings you can get literally has "[App name] will damage your computer. You should move it to the trash" in the dialog that shows up. There's a bunch of these, all of them pop up for various GateKeeper/Notarization shortcomings, and none of them actually seem to ever really tell you what the problem was.
- _qulr 6y agoIt's important to distinguish between Developer ID and notarization. Signing an app is done by the developer. Notarizing the app is done by Apple. If you check the code signature of a Developer ID signed app, you'll see the developer's name and Team ID from the signing certificate. This guarantees the app was signed by that developer, as long as the developer has kept their private key secure. First you sign the app, then you upload it to App Store Connect for notarization. It's an "open secret" that Apple has allowed any Apple Developer Program member to submit any app for notarization, even if the app wasn't signed by them. Apple really wanted all apps notarized. Whether Apple will crack down on this practice in the future, who knows. The notarization "ticket" is signed by Apple, not by the developer. I've heard of developers who discovered that someone else notarized their app. But nobody else can put their "name" on the app except the owner of the Developer ID certificate. If you Developer ID sign someone else's unsigned binary, you're presenting it to the world as your own. But that's not the case with notarization. Nobody except Apple knows who submitted an app for notarization.
- stefan_ 6y agoIt mostly doesn't. That is 20% because of bullshit like this and 80% because Apple deprecates, removes, changes and otherwise encumbers their operating system so much that keeping track of it all is a full-time job.
- oneplane 6y agoOpen source projects sign their Apps like anyone else. Works fine. They do the same on Windows of course and on Linux package managers.
- oauea 6y agoWho pays the apple tax?
- gowld 6y agoAnyone who volunteers. Same answer as "who writes the software" or "who buys the development hardware".
- nextaccountic 6y agoIs there any Linux distribution charging an yearly fee for package signing?
- recursive 6y agoIn my experience, open source installers for windows are mostly not signed. But windows has a button to let you run them though.
- ryandrake 6y agoIt seems like the right balance. As the author says: > As a Mac developer, it's nearly impossible to run a viable software business when this is the first-run experience of new customers. You'll never get any new customers! This is why every Mac developer I know signs up for Developer ID and ships only signed, notarized apps. It would be financial suicide to do otherwise. If you have hung your shingle out to make a profit, then the developer account, signing, notarizing, etc. is a cost of doing business, and you can easily justify it. The more customers you get, the more money you get, so you are motivated to reduce the first-run friction. If you are not in it for profit, you probably have a lot more tolerance for a little first-run friction, and having users drop out of the funnel. Fewer users does not affect you financially. As a hobbyist programmer, I wouldn't care. I'm just releasing a program--not looking to dominate a market.
- lucb1e 6y ago> the developer account, signing, notarizing, etc. is a cost of doing business, and you can easily justify it. But what if I'm not doing this for profit? Can Nirsoft or Mozilla apply for a waiver? Can I? We may not be looking to dominate the market, but it would be a shame if our work just went to waste because people would rather pay for something crappier that is closed source rather than our free (as in freedom & beer) software. (Yes, Mozilla is a huge project where it isn't worth employee's time to apply for a waiver, I just needed at least one name that people know is a non-profit software developer as an example.)
- KeepFlying 6y agoI appreciate this view except for the last point. As a hobbyist programmer, I am not "just releasing a program". I am usually "helping solve user's problems". And if my solution requires users to go through even more problems before they can use my tools, that's problematic. I don't need to many money on my side projects. I do, however, want to help people. If I can't help people on a Mac because of the install friction, then it isn't worth my effort to create a MacOS port of my software at all.
- saagarjha 6y agoI would generally like my open-source software not not be marked as malware.
- dddddaviddddd 6y agoThere's a segment of open source users who understand these messages and aren't necessarily dissuaded by them. I make an open source app for merging audio files in iTunes/the Music app. The userbase are people who are technical enough to install Homebrew, (generally) use iTunes scripts, and manage Gatekeeper warnings, but not so determined as to replicate the app's functionality with their own set of shell scripts. https://www.davidschlachter.com/misc/trackconcat https://www.davidschlachter.com/misc/trackconcat
- xenadu02 6y agoPlease note that Apple's linker will automatically ad-hoc sign binaries if you aren't using a signing certificate so there is no impact to package managers or any other forms of building software to run locally. Xcode already automatically opts such software out of GateKeeper checks when built from the UI. Similarly adding Terminal to the Developer Tool category in System Preferences will do the same for anything you run or build there. I should also note directly launching the binary inside the App bundle from Terminal bypasses the UI dialog. The assumption is you know what you are doing in that case.
- wila 6y agoYou can run your own binaries locally because they do not have quarantine flags, not because they are locally signed. You can also remove quarantine flags from anything you download and after that you don't have the right click option either. For example: xattr -dr com.apple.quarantine ~/Downloads/Absolutely-Not-Malware.dmg
- saagarjha 6y agoThe comment you're replying to is confusing because it's been copied out of context from where it was originally posted, which as a discussion of a mandatory signing requirement on Apple silicon.
- wila 6y agoThanks for the correction. Yes I see now what you mean and with that background Xenadu02's reply does make a lot more sense. Don't have access to a Apple Developer Transition Kit, so was not aware of the new requirements.
- coldtea 6y ago>I also can't imagine $100 is easy to come up with in countries below level 4[1]. While money for a Mac is?
- saagarjha 6y agoYou don't need a Mac to develop software for macOS.
- jordigh 6y agoDon't you? A few years ago I wanted to figure out how to cross-compile into macOS without ever actually using macOS. Is that possible now?
- Kaze404 6y agoI know Rust specifically supports compiling for Mac from Linux.
- efreak 6y agoDoesn't rust support cross compiling to/from any supported platform?
- steveklabnik 6y agoYes but details can get in the way. While every compiler is a cross compiler to any platform, that doesn’t mean that the platform libraries are available or that there’s a linker. For example, the MSVC target uses link.exe, and that only runs on Windows, so cross compiling to the MSCV target doesn’t work in practice even if it could in theory. You can cross compile to the GNU target for Windows though.
- saagarjha 6y agoMany POSIX-y applications will mostly work on macOS, to the point where you might ship in a package manager or something and can probably help with a segfault or two but have never touched a Mac.
- jmull 6y agoI've got to say, I think your proposed message is considerably less clear than the actual one. E.g., a reader would have to understand the perspective of the developer to even start to guess what that might mean. (Why would a developer pay or not pay $99 to Apple for verification? How do the implications of that affect my decision to run this program?) It would be pretty much meaningless to the average non-developer user. I agree the price of notarization should be a nominal incremental cost. I don't know if there are many level 3 people doing MacOS development, but if so, there needs to be a cheaper price for them. (The numbers of level 1 and 2 MacOS developers must be practically nothing.)
- usrusr 6y agoCould that be turned into a little funding opportunity? "Here are the sources, here are the binaries, here you subscribe to get access to signed binaries that run without the scare quotes"
- _qulr 6y agoThe developer who signs the software is thereby taking legal responsibility for the software, and taking the blame if anything is wrong with it. That's not a good risk unless you're signing for someone you trust completely.
- usrusr 6y agoHow much does that actually change liability vs building and distributing unsigned? Signing has no legal implication other than lowering deniability. What's added is the contract with Apple. Is that such a minefield?
- moduspol 6y agoIt also might be tough to run as a business because it's quite possible the first time you sign someone else's malware, Apple's going to revoke the notarization of all the apps you've signed (which would be for other paying customers). Not to mention it undermines the purpose of notarization, so if it became popular enough they'd probably just squash it.
- usrusr 6y agoThat would be true for rubberstamping-as-a-service, a weaker version of running a rogue CA. But project maintainers getting themselves an Apple ID and recouping that cost + x (hopefully) via non-gratis signed binaries wouldn't have that problem at all. Or of they did (malware sneaking into their artifacts), a lost Apple ID should be the least of their concerns. There'd even be a conceivable but unlikely scenario where some automated scan deep inside the Apple publishing pipeline would detect an otherwise undetected malware intrusion in some upstream dependency or badly vetted commit and thereby indirectly protecting the users of the unsigned copy, by acting as a canary.
- m463 6y agoI remember RMS saying that the GPL was updated because one "obvious" freedom was not so obvious -- you could meet all the requirements of the GPL, without giving the right to RUN the software. GPL3 allows that. And looking backwards, apple shipped software that was GPL2, but would not ship software that was GPL3. As one example, bash and make all quietly stopped getting updates from apple when the GPL3 versions came out. (although apple sort of broke GPL with bash as it never shipped all the source for it -- missing the header file rootless.h) One other point about these dialogs + the help message. You are required to contact apple to even see this online help. Apple deals itself into the equation no matter what.
- Something1234 6y agoWhat's in rootless.h?
- m463 6y agoI don't know they don't ship it but bash is compiled with it.
- solarkraft 6y agoSo they're shipping a proprietary version of bash?
- merijnv 6y agoOf course not, that'd be a violation of the GPL. They ship their own fork/patched version of bash, whose source is on their open source page: https://opensource.apple.com/source/bash/bash-118.11.1/ https://opensource.apple.com/source/bash/bash-118.11.1/
- solarkraft 6y agoSo ... rootless.h does nothing? I can compile a bash without it that does exactly the same thing? That seems like it would contradict previous comments. What am I not getting?
- _qulr 6y agoIn addition to paying the Apple Developer Program fee, you as an open source or hobbyist developer are required to sign a legal contract with Apple in order to be able to code sign your software. This can be even more problematic than the fee.
- jyrkesh 6y agoIn my day job, I work on a relatively large open-source non-GUI application macOS is becoming an increasingly difficult platform on which to release software. We're going down the notarization rabbit hole (which is a nightmare), but given that we don't fit on the App Store, it's very obvious that Apple doesn't want us on the platform. My suspicion is that they will eventually charge $$$ for a "developer unlock" on Apple Silicon, a move that I think will make both Windows and Linux look increasingly attractive to developers.
- baq 6y agoMicrosoft with WSL2 is pretty much ready to go for the jugular IMHO.
- ChuckNorris89 6y agoWindows Update 2004 made the experience even smoother on my XPS 15.
- efreak 6y agoUnfortunately, it hasn't fixed the problem with running VirtualBox using the hypervisor platform/virtual machine platform (I forget which) while hyper-v is enabled: sha sums (and other hashes like whirlpool, md5, etc) don't work properly. Meaning I can't use wsl2 and VirtualBox. Or use the Android emulator and VirtualBox. And yes, this seems to be a obscure issue that's hard to research (`Intel SHA extension` and `/etc/gcrypt/hwf.deny` may help); I've had to look this up three times now because I keep doing it in private browsing mode or on another device/browser. Don't mind me, I'm just annoyed that Microsoft won't add support for ssh-copy-id.
- H1Supreme 6y agoSame here. My terminal/neovim setup feels very close to what I run on a native Linux machine. A huge step up from WSL1, imo.
- dasKrokodil 6y agoIf developers move from Apple to Windows because of this, they haven't learned from their mistakes.
- Abishek_Muthian 6y agoApple is an aspiration selling company. >>I also can't imagine $100 is easy to come up with in countries below level 4[1] Someone who is developing for Apple platform in specific, has already spent ~$1000 in devices. Say they couldn't afford to build explicitly for Apple[1], they instead develop for web using a Raspberry Pi and try to leverage smartphone capabilities using PWAs; Alas Apple throws in hurdles there as well so that your PWA doesn't function properly on Apple devices[2]. I get it, perhaps this is part of Apple's aspiration i.e. 'You should deserve to be part of the Apple ecosystem' which is enticing to its customers. But what's overwhelming to me is, Apple's blatant hypocrisy. Exihibit -1: Data Apple calls Google by name, questioning its business model around data and proudly calims 'they chose not to do business with data'. Then why does Apple advertise its products using Google Ads? So, it's like 'I will call out dirty work, but I will use the results of that dirty work for my own advantage'. Exihibit -2 : Values Apple claims itself to be the beacon of human rights. a. We know Apple was included among list of other companies supplying user data for snooping in the documents highly regarded to be genuine. b. We know Apple actively cooperates with an autocratic regime and its highly publicised 'Privacy features' isn't applicable there. But, Apple never includes 'USA only' when it advertises it's 'Privacy'. More over when confronted with proof of Apple's platform being actively used for exploitation of minorities, it outright downplayed/dismissed the impact of it. [2]https://ionicframework.com/blog/is-apple-trying-to-kill-pwas/ https://ionicframework.com/blog/is-apple-trying-to-kill-pwas...
- Gorbzel 6y agoPWAs are terrible, but that debate has nothing on the real gem here: > ...Then why does Apple advertise its products using Google Ads? Congratulations, this cracks top 5 oddest Apple hater argument ever posted in this land of many of 'em.
- Abishek_Muthian 6y agoHate is a very strong word, something which I wouldn't give a private business luxury of buying from me. If you could give a justifiable answer to what you've quoted from me, I'm all ears.
- thinkloop 6y ago> or whatever it is that Apple does with that money What they primarily "do" is have an identity to sue or pursue in case of issues. That keeps everyone in line.
- teekert 6y agoAren't the new ARM macs going to support Docker in a nice way? Wouldn't that solve it? You can have what you want in your Docker, Apple can do whatever it wants (short of blocking the Dockers essential capabilities of course) to isolate said Docker.
- saagarjha 6y agoBut then you have to use Docker. It’s be nice to have something like that on iOS where it’d be an improvement, but on macOS, it’s a step down in a sense.
- Cthulhu_ 6y agoLike all other legitimate software on MacOS; they get a developer account and distribute it via the app store. For years, Windows got laughed at by EVERYONE because there was so much malware on it - in part because of its laissez-faire approach to letting the user install anything from anywhere. Mac went for the closed garden approach and there's hardly any malware, adware, scareware or whatever -ware you can think of on the platform, which is one of the reasons why Mac is safer and considered to have a better user experience. Curation is not a bad thing. And if an open source application wants to become popular for the masses - not the HN power user crowd, which represents only a small percentage of potential customers - they have to conform to its rules. Likewise, they will want to be available through the Windows store as well. Using the tools and platforms offered by the OS developers is the lowest friction option for installing software. As for poorer people and countries, isn't this where the open source charities come in? Isn't this where the big FAANGs - including Apple - and the investors and everyone that earned billions off of software should come in? I mean come on, it's only $99.
- classics2 6y agoAnd yet people would vomit blood being asked to pay $99 for an app.
- bromuro 6y agoAs you say it already worked great for preventing malware. No reason to make changes like they are doing.
- mih 6y ago> ... in part because of its laissez-faire approach to letting the user install anything from anywhere. This comment makes it seem like installing software outside of a curated store is responsible for security issues, but this is exactly what Linux and other like OSes do. You can install apps from anywhere and I'll wager you'll find less malware, adware etc. for them in the wild, than the Mac. Granted usage of these platforms as a Desktop is way lower making it a less attractive target for bad actors, but much of it owes to inherent OS design. > And if an open source application wants to become popular for the masses - not the HN power user crowd, which represents only a small percentage of potential customers - they have to conform to its rules. Open source applications have been popular with the masses way before the curated store app store model came into place. Publishing on an app store has a good chance for increasing outreach, but it should not make distribution and installation of applications in the classical way more cumbersome, should the user so desire.
- stereo 6y agoOpenStreetMap treasurer here to jump on the tangent. Hi! Apple's focus is on maximising profit, and ours is on maximising mapping and the width of our membership, especially after the entryism attempt last year ( https://news.ycombinator.com/item?id=19008792 https://news.ycombinator.com/item?id=19008792 ).- We've also recently received a non-profit signing certificate from Apple through our German local chapter, and two of us are working on getting JOSM automatically signed and notarized. Our workflow is at https://github.com/thomersch/josm/blob/master/.github/workflows/ant.yml https://github.com/thomersch/josm/blob/master/.github/workfl... and a JOSM.app built yesterday can be downloaded at https://github.com/thomersch/josm/actions/runs/214334897 https://github.com/thomersch/josm/actions/runs/214334897 .
- nanna 6y agoI'm happy for OSM, that's great for you and in turn the community. But what about small open source projects? One-person projects where the idea of having several people working on securing legal non-profit status and then acquiring non-profit signing certificates from Apple is for all intents and purposes impossible? And certainly not worth just coughing up the annual $99 fee (+tax) to Apple? $99+ every year is a lot of money to an independent open source developer who's in most cases losing money for their work. The fact that a company worth $2 trillion is demanding it - it's really beyond outrageous.
- pjmlp 6y agoOutrageous is the entitlement of the current generations for not paying for their tools. Many of us used to pay for every single piece of software that we had to run on top of our already expensive computer around 2000 euros on today's money.
- AriaMinaei 6y agoThis isn’t about not wanting to pay. It’s about being forced to use a tool in spite of much better possible alternatives. If apple allowed SSL-style certification, I’m sure cheaper and better alternatives (similar to LetsEncrypt) would prop up.
- zelly 6y ago> I also can't imagine $100 is easy to come up with in countries below level 4[1]. Apple has as low as 0% penetration in those countries. The market has solved this problem. They still use technology; there are alternative platforms. Android, Windows, ChromeOS, KaiOS, and desktop Linux (which has as high as 5% market share in India) are cheap to use and develop for. It was always going to end up this way. There's the brand for the haves and the brand for the have-nots. Although even people on welfare in the United States have iPhones, consider that they're still the elite in global terms.
- wjdp 6y agoI publish a CLI app for many platforms, including osx, on GitHub. Using the cross-compile feature of Go it just spits out a binary that Macs can run from a Linux build host. I don't own a Mac so don't see what my users do. Does this change affect running unsigned binaries from the terminal?
- tombell 6y agoI've never had an issue running binaries written in Go I've compiled myself. From what I've experienced, only appears to affect .app binaries.
- pjmlp 6y agoJust like it worked on any commercial UNIX, FCC's rise to fame was thanks to Sun no longer offering Solaris SDK as free beer.
- indigochill 6y ago>This makes me wonder how open source is supposed to work on macOS. It isn't. Apple's view of the world is that computer users are non-technical consumers who need to be protected from others and themselves, and that Apple are the ones to offer that protection. Open source is antithetical to this view because it puts the responsibility on the user, which is the last thing Apple wants. I can sympathize to some extent with this view. There's obviously a large (perhaps majority) share of computer users who it describes - just not small/independent developers/hackers. Those users are better served elsewhere.
- mlindner 6y agoYou can still disable Gatekeeper with: sudo spctl --master-disable This removes all of these dialog boxes entirely.