4 ms·

> There’s no attempt by Apple to claim that the application is safe or does what it says on the tin. So that isn't part of the notarization process. It still w

> There’s no attempt by Apple to claim that the application is safe or does what it says on the tin. So that isn't part of the notarization process. It still was approved by Apple and thus was notarised. > It’s like claiming that the outcome of toasting a sandwich is approval or rejection, no the outcome of toasting a sandwich is you have a sandwich that is toasted, aka “toasted sandwich.” That's disingenuous. If I send a Sandwich to be toasted by Apple and get it back toasted that means the Sandwich was indeed approved by Apple since it has been toasted.

ziml77 6y ago
If I set up a toasting service and you sent me a ham and cheese sandwich spread with Nutella, you're going to get it back toasted. That doesn't mean that I approve of that nasty sandwich filling though.
- rowanG077 6y ago
  Then you should not toast it.
manicdee 6y ago
Notarising is only the act of a trusted third party verifying that the signature on a document is valid. Here's a grossly simplified version of what happens with Apple's notary service: 1. Developer writes program 2. Developer signs program to provide evidence to end-user that program has not been tampered with 3. Developer submits program and signature to Apple's notarising service 4. Apple signs program and developer's signature to tell macOS that this developer signature for this program has been seen by a trusted third party (the notary, in this case Apple) — the notary signature basically states that at this date and time the developer presented Apple with the program and the developer signature and that the developer signature is the correct one for that program 5. End user downloads program which includes signature by developer and signature by Apple 6. macOS compares program signature to developer signature 7. macOS compares checks that notary signature matches the program and developer signature 8. macOS now trusts that this program is what was published by the developer, and allows it to run At no point in this sequence has Apple provided any testimony or recommendation about this program. Notarising is only about ensuring that what you are trying to run is what the developer wrote for you. "Approval" on the other hand implies that Apple might "disapprove" something, which is not something that happens in the notarising service. A notarising request might be rejected if the applications contains known malware (because the presence of such is an exceptional circumstance which the developer needs to take urgent action to correct, not because Apple doesn't want to sign malware). It's like a Justice of the Peace recommending that you see a doctor if you turn up to ask for a witness to your signature while bleeding profusely from your ear. The JP is not refusing to witness your signature, they are simply suggesting that you have more urgent matters to attend to right now.
- _qulr 6y ago
  You're just making up stuff. You have no idea what you're talking about. You're clearly not a Mac developer. Nobody should be listening to this long-winded fable spun out of yarn. I mean, I could go through that whole thing and refute it line-by-line, but I'm just astonished that you think you get to invent all this stuff out of thin air. It's totally wrong, and you don't even have first-hand knowledge of it.
  - manicdee 6y ago
    You don't need to refute anything if you can describe the process yourself.
    - _qulr 6y ago
      > You don't need to refute anything if you can describe the process yourself. So you're admitting that you don't know what it is? Are you or are you not a Mac developer who notarizes and distributes Mac software?
      - _qulr 6y ago
        There are so many things I could say, but let's just start with the user experience on Catalina. If you try to open an unsigned app, you get a Gatekeeper alert that says "macOS cannot verify that this app is free from malware" and tells you to move the app to the Trash. (Of course we see from the linked article that the phrase "free from malware" has always been misleading.) Whereas for a notarized app, the Gatekeeper alert says "Apple checked it for malicious software and none was detected" and allows you to open the app. So to claim that this is not any kind of "approval" is just patently absurd.
      - manicdee 6y ago
        Do you even know what you're talking about? The process is described at a high level by Apple here: https://developer.apple.com/developer-id/ https://developer.apple.com/developer-id/ 1. Developer signs their app 2. Developer sends signed app to Apple for Notarisation 3. Apple provides notary signature 4. Developer distributes notarised app

ziml77 6y ago

If I set up a toasting service and you sent me a ham and cheese sandwich spread with Nutella, you're going to get it back toasted. That doesn't mean that I approve of that nasty sandwich filling though.

rowanG077 6y ago
Then you should not toast it.

manicdee 6y ago

Notarising is only the act of a trusted third party verifying that the signature on a document is valid. Here's a grossly simplified version of what happens with Apple's notary service: 1. Developer writes program 2. Developer signs program to provide evidence to end-user that program has not been tampered with 3. Developer submits program and signature to Apple's notarising service 4. Apple signs program and developer's signature to tell macOS that this developer signature for this program has been seen by a trusted third party (the notary, in this case Apple) — the notary signature basically states that at this date and time the developer presented Apple with the program and the developer signature and that the developer signature is the correct one for that program 5. End user downloads program which includes signature by developer and signature by Apple 6. macOS compares program signature to developer signature 7. macOS compares checks that notary signature matches the program and developer signature 8. macOS now trusts that this program is what was published by the developer, and allows it to run At no point in this sequence has Apple provided any testimony or recommendation about this program. Notarising is only about ensuring that what you are trying to run is what the developer wrote for you. "Approval" on the other hand implies that Apple might "disapprove" something, which is not something that happens in the notarising service. A notarising request might be rejected if the applications contains known malware (because the presence of such is an exceptional circumstance which the developer needs to take urgent action to correct, not because Apple doesn't want to sign malware). It's like a Justice of the Peace recommending that you see a doctor if you turn up to ask for a witness to your signature while bleeding profusely from your ear. The JP is not refusing to witness your signature, they are simply suggesting that you have more urgent matters to attend to right now.

_qulr 6y ago
You're just making up stuff. You have no idea what you're talking about. You're clearly not a Mac developer. Nobody should be listening to this long-winded fable spun out of yarn. I mean, I could go through that whole thing and refute it line-by-line, but I'm just astonished that you think you get to invent all this stuff out of thin air. It's totally wrong, and you don't even have first-hand knowledge of it.
- manicdee 6y ago
  You don't need to refute anything if you can describe the process yourself.
  - _qulr 6y ago
    > You don't need to refute anything if you can describe the process yourself. So you're admitting that you don't know what it is? Are you or are you not a Mac developer who notarizes and distributes Mac software?
    - _qulr 6y ago
      There are so many things I could say, but let's just start with the user experience on Catalina. If you try to open an unsigned app, you get a Gatekeeper alert that says "macOS cannot verify that this app is free from malware" and tells you to move the app to the Trash. (Of course we see from the linked article that the phrase "free from malware" has always been misleading.) Whereas for a notarized app, the Gatekeeper alert says "Apple checked it for malicious software and none was detected" and allows you to open the app. So to claim that this is not any kind of "approval" is just patently absurd.
    - manicdee 6y ago
      Do you even know what you're talking about? The process is described at a high level by Apple here: https://developer.apple.com/developer-id/ https://developer.apple.com/developer-id/ 1. Developer signs their app 2. Developer sends signed app to Apple for Notarisation 3. Apple provides notary signature 4. Developer distributes notarised app