4 ms·

It does say right there that Big Sur will be requiring signatures on all binaries, but it does actually specifically say that a self-signed certificate would be

It does say right there that Big Sur will be requiring signatures on all binaries, but it does actually specifically say that a self-signed certificate would be enough. If someone wants to distribute apps without notarizing them, it's just a matter of adding instructions on how to bypass the notarization check. And again — there's shouldn't be a party more trusted than the device owner. Otherwise I'd characterize such an OS as malware.

heavyset_go 6y ago
> If someone wants to distribute apps without notarizing them, it's just a matter of adding instructions on how to bypass the notarization check. In the future, that will require disabling SIP. Good luck explaining to a non-power users how to do that. Your analysis ignores the anticompetitive behavior Apple is engaging in. By making unapproved software second-class citizens on macOS, only apps that get Apple's approval through the Notarization or App Store process can be run easily by users.
- grishka 6y ago
  > In the future, that will require disabling SIP. Are you sure about that? Catalina has this "developer tools" permission that allows running unsigned/non-notarized binaries. Xcode grants that to itself, but you could as well grant it to things like Terminal and run your app from there. Bonus points for including a shell script with your app so the user doesn't have to run "scary" commands manually. Yes, there are going to be (one-time) UX compromises, but I think it's possible to make it feel more or less okay for the average user.
  - clusterfish 6y ago
    Jeez, have some empathy for regular people. The whole damn point of those measures on Apple's side is to introduce friction and make it excessively hard to install non-notarized apps. It's already bad and unusable by most average people, and that's exactly the goal.
    - grishka 6y ago
      > The whole damn point of those measures on Apple's side is to introduce friction and make it excessively hard to install non-notarized apps. I understand that. And that's why I'm trying to come up with a good enough, UX-wise, way to bypass this malicious, hostile behavior.
- pier25 6y ago
  > In the future, that will require disabling SIP. Good luck explaining to a non-power users how to do that. Indeed. Also good luck telling that to your customers.

heavyset_go 6y ago

> If someone wants to distribute apps without notarizing them, it's just a matter of adding instructions on how to bypass the notarization check. In the future, that will require disabling SIP. Good luck explaining to a non-power users how to do that. Your analysis ignores the anticompetitive behavior Apple is engaging in. By making unapproved software second-class citizens on macOS, only apps that get Apple's approval through the Notarization or App Store process can be run easily by users.

grishka 6y ago
> In the future, that will require disabling SIP. Are you sure about that? Catalina has this "developer tools" permission that allows running unsigned/non-notarized binaries. Xcode grants that to itself, but you could as well grant it to things like Terminal and run your app from there. Bonus points for including a shell script with your app so the user doesn't have to run "scary" commands manually. Yes, there are going to be (one-time) UX compromises, but I think it's possible to make it feel more or less okay for the average user.
- clusterfish 6y ago
  Jeez, have some empathy for regular people. The whole damn point of those measures on Apple's side is to introduce friction and make it excessively hard to install non-notarized apps. It's already bad and unusable by most average people, and that's exactly the goal.
  - grishka 6y ago
    > The whole damn point of those measures on Apple's side is to introduce friction and make it excessively hard to install non-notarized apps. I understand that. And that's why I'm trying to come up with a good enough, UX-wise, way to bypass this malicious, hostile behavior.
pier25 6y ago
> In the future, that will require disabling SIP. Good luck explaining to a non-power users how to do that. Indeed. Also good luck telling that to your customers.