7 ms·

Apple blocks all unsigned binaries on new Macs

nikivi 6y ago
Any workarounds for this? I thought Apple said they wanted to keep mac a computer and not an iPad..
- deleted 6y ago
  [deleted]
neximo64 6y ago
If this is true I wont be using the Mac, if there is no Parallels then it is better to just get an iPad with a mouse/kb and use another device for more serious work.
coldtea 6y ago
It's about unsigned (not notarized) binaries. Not about using only apps from the app store. You can use homebrew, third party apps from the web, apps you've built yourself, etc, just fine. They just need a signature. Kind of like Chrome, Safari, FF, blocking non https websites (with Apple being the CA tho). This has been announced years ago, and was extended last year, and is now enforced.
- therealmarv 6y ago
  Was homebrew binaries signed before?
- deanishe 6y ago
  > They just need a signature. And you need to pay Apple for the certificate to sign them. And never piss them off lest they revoke it.
  - vr46 6y ago
    That isn't true. You can use ad-hoc signatures generated during the build. The point is to detect tampering and damage.
    - onion2k 6y ago
      ad-hoc signed apps expire after a week, then you need to rebuild. It's not a viable solution for distributing apps. If you want other people to use something you wrote you have to pay Apple.
- neximo64 6y ago
  It was announced and there has always been a way to disable it. There is also a way to disable it on the intel macs. And no it has not been announced before that you will be forced into notarization.
- chrisfinazzo 6y ago
  Reminds me of the session at WWDC 2012 where Peter Kiehtreiber (aka Perry the Cynic) introduced Gatekeeper and Developer ID. Even back then, Apple was not kidding about forcing as much code as possible through some identity system before it could run. To quote the distinguished gentleman, with a touch of sarcasm: "If you're currently shipping unsigned code, what the hell is wrong with you!?"
binarycodedhex 6y ago
Pretty soon, Apple will tell you what the name of your app will be and what it should be about. Oh and nothing older than X years will be allowed to run. Tighten the screws until users repurchase hardware. Take that, hackintoshes and virtualized desktops. Verboten!
7373737373 6y ago
https://en.wikipedia.org/wiki/Economic_rent https://en.wikipedia.org/wiki/Economic_rent https://boingboing.net/2012/01/10/lockdown.html https://boingboing.net/2012/01/10/lockdown.html
alpineidyll3 6y ago
The remarkable thing is just how many people will bend over backwards to accommodate this blatantly monopolistic crap. HN will be full of threads asserting it's no big hassle to recert binaries every few weeks and helps security. A world without linux would be a nightmare.
dcchambers 6y ago
So I can't just write some C, Rust, or Go code on my mac, compile it myself, and run the executable file because it's not signed? There's got to be a way (developer mode?) to disable this, right? Edit: Found some more info - only binaries that are compiled to run natively on ARM are affected (for now). Still seems like this will introduce some major inconvenience for developers/power-users. https://eclecticlight.co/2020/08/22/apple-silicon-macs-will-require-signed-code/ https://eclecticlight.co/2020/08/22/apple-silicon-macs-will-...

Any workarounds for this? I thought Apple said they wanted to keep mac a computer and not an iPad..

deleted 6y ago
[deleted]

If this is true I wont be using the Mac, if there is no Parallels then it is better to just get an iPad with a mouse/kb and use another device for more serious work.

coldtea 6y ago

It's about unsigned (not notarized) binaries. Not about using only apps from the app store. You can use homebrew, third party apps from the web, apps you've built yourself, etc, just fine. They just need a signature. Kind of like Chrome, Safari, FF, blocking non https websites (with Apple being the CA tho). This has been announced years ago, and was extended last year, and is now enforced.

therealmarv 6y ago
Was homebrew binaries signed before?
deanishe 6y ago
> They just need a signature. And you need to pay Apple for the certificate to sign them. And never piss them off lest they revoke it.
- vr46 6y ago
  That isn't true. You can use ad-hoc signatures generated during the build. The point is to detect tampering and damage.
  - onion2k 6y ago
    ad-hoc signed apps expire after a week, then you need to rebuild. It's not a viable solution for distributing apps. If you want other people to use something you wrote you have to pay Apple.
neximo64 6y ago
It was announced and there has always been a way to disable it. There is also a way to disable it on the intel macs. And no it has not been announced before that you will be forced into notarization.
chrisfinazzo 6y ago
Reminds me of the session at WWDC 2012 where Peter Kiehtreiber (aka Perry the Cynic) introduced Gatekeeper and Developer ID. Even back then, Apple was not kidding about forcing as much code as possible through some identity system before it could run. To quote the distinguished gentleman, with a touch of sarcasm: "If you're currently shipping unsigned code, what the hell is wrong with you!?"

binarycodedhex 6y ago

Pretty soon, Apple will tell you what the name of your app will be and what it should be about. Oh and nothing older than X years will be allowed to run. Tighten the screws until users repurchase hardware. Take that, hackintoshes and virtualized desktops. Verboten!

7373737373 6y ago

https://en.wikipedia.org/wiki/Economic_rent https://en.wikipedia.org/wiki/Economic_rent https://boingboing.net/2012/01/10/lockdown.html https://boingboing.net/2012/01/10/lockdown.html

alpineidyll3 6y ago

The remarkable thing is just how many people will bend over backwards to accommodate this blatantly monopolistic crap. HN will be full of threads asserting it's no big hassle to recert binaries every few weeks and helps security. A world without linux would be a nightmare.

dcchambers 6y ago

So I can't just write some C, Rust, or Go code on my mac, compile it myself, and run the executable file because it's not signed? There's got to be a way (developer mode?) to disable this, right? Edit: Found some more info - only binaries that are compiled to run natively on ARM are affected (for now). Still seems like this will introduce some major inconvenience for developers/power-users. https://eclecticlight.co/2020/08/22/apple-silicon-macs-will-require-signed-code/ https://eclecticlight.co/2020/08/22/apple-silicon-macs-will-...