3 ms·

You're just making up stuff. You have no idea what you're talking about. You're clearly not a Mac developer. Nobody should be listening to this long-winded fab

by _qulr 6y ago

You're just making up stuff. You have no idea what you're talking about. You're clearly not a Mac developer. Nobody should be listening to this long-winded fable spun out of yarn. I mean, I could go through that whole thing and refute it line-by-line, but I'm just astonished that you think you get to invent all this stuff out of thin air. It's totally wrong, and you don't even have first-hand knowledge of it.

manicdee 6y ago
You don't need to refute anything if you can describe the process yourself.
- _qulr 6y ago
  > You don't need to refute anything if you can describe the process yourself. So you're admitting that you don't know what it is? Are you or are you not a Mac developer who notarizes and distributes Mac software?
  - _qulr 6y ago
    There are so many things I could say, but let's just start with the user experience on Catalina. If you try to open an unsigned app, you get a Gatekeeper alert that says "macOS cannot verify that this app is free from malware" and tells you to move the app to the Trash. (Of course we see from the linked article that the phrase "free from malware" has always been misleading.) Whereas for a notarized app, the Gatekeeper alert says "Apple checked it for malicious software and none was detected" and allows you to open the app. So to claim that this is not any kind of "approval" is just patently absurd.
  - manicdee 6y ago
    Do you even know what you're talking about? The process is described at a high level by Apple here: https://developer.apple.com/developer-id/ https://developer.apple.com/developer-id/ 1. Developer signs their app 2. Developer sends signed app to Apple for Notarisation 3. Apple provides notary signature 4. Developer distributes notarised app
    - _qulr 6y ago
      Yes, those are the basic steps. The fundamental problem was with your technical understanding and interpretation of each of the steps. Also, you didn't answer my question as to whether you're a Mac developer. I've already explained how the Gatekeeper dialogs prove that your conclusion is false. Moreover, the very page you just linked shows that your claims are false. You say, "At no point in this sequence has Apple provided any testimony or recommendation about this program. Notarising is only about ensuring that what you are trying to run is what the developer wrote for you." Whereas Apple says, "Gatekeeper on macOS helps protect users from downloading and installing malicious software", "Give users even more confidence in your software by submitting it to Apple to be notarized. The service automatically scans your Developer ID-signed software and performs security checks", etc. This story has now dropped way down in the HN rankings, and it's likely that few people are reading these comments anymore except us, so I have no desire to write a long, point-by-point treatise on how you misunderstand Developer ID and notarization.
coldtea 6y ago
>You're just making up stuff. You have no idea what you're talking about. You're clearly not a Mac developer. What are you talking about? That's basically the process. >I mean, I could go through that whole thing and refute it line-by-line But you'd only have some inconsequential pedantic details to change.
- _qulr 6y ago
  > What are you talking about? That's basically the process. How do you know? > But you'd only have some inconsequential pedantic details to change. No, the writer completely misunderstands the entire purpose of the process, and consequently just makes up details about what the writer thinks ought to be happening. It sounds like more of a hypothetical than actual knowledge.

by _qulr 6y ago

manicdee 6y ago

You don't need to refute anything if you can describe the process yourself.

_qulr 6y ago
> You don't need to refute anything if you can describe the process yourself. So you're admitting that you don't know what it is? Are you or are you not a Mac developer who notarizes and distributes Mac software?
- _qulr 6y ago
  There are so many things I could say, but let's just start with the user experience on Catalina. If you try to open an unsigned app, you get a Gatekeeper alert that says "macOS cannot verify that this app is free from malware" and tells you to move the app to the Trash. (Of course we see from the linked article that the phrase "free from malware" has always been misleading.) Whereas for a notarized app, the Gatekeeper alert says "Apple checked it for malicious software and none was detected" and allows you to open the app. So to claim that this is not any kind of "approval" is just patently absurd.
- manicdee 6y ago
  Do you even know what you're talking about? The process is described at a high level by Apple here: https://developer.apple.com/developer-id/ https://developer.apple.com/developer-id/ 1. Developer signs their app 2. Developer sends signed app to Apple for Notarisation 3. Apple provides notary signature 4. Developer distributes notarised app
  - _qulr 6y ago
    Yes, those are the basic steps. The fundamental problem was with your technical understanding and interpretation of each of the steps. Also, you didn't answer my question as to whether you're a Mac developer. I've already explained how the Gatekeeper dialogs prove that your conclusion is false. Moreover, the very page you just linked shows that your claims are false. You say, "At no point in this sequence has Apple provided any testimony or recommendation about this program. Notarising is only about ensuring that what you are trying to run is what the developer wrote for you." Whereas Apple says, "Gatekeeper on macOS helps protect users from downloading and installing malicious software", "Give users even more confidence in your software by submitting it to Apple to be notarized. The service automatically scans your Developer ID-signed software and performs security checks", etc. This story has now dropped way down in the HN rankings, and it's likely that few people are reading these comments anymore except us, so I have no desire to write a long, point-by-point treatise on how you misunderstand Developer ID and notarization.

coldtea 6y ago

>You're just making up stuff. You have no idea what you're talking about. You're clearly not a Mac developer. What are you talking about? That's basically the process. >I mean, I could go through that whole thing and refute it line-by-line But you'd only have some inconsequential pedantic details to change.

_qulr 6y ago
> What are you talking about? That's basically the process. How do you know? > But you'd only have some inconsequential pedantic details to change. No, the writer completely misunderstands the entire purpose of the process, and consequently just makes up details about what the writer thinks ought to be happening. It sounds like more of a hypothetical than actual knowledge.