6 ms·

I never knew this was so much to write about. Whatever happened to the days of having an apache web server, having it in a zip, and just hosting it? If it's sma

I never knew this was so much to write about. Whatever happened to the days of having an apache web server, having it in a zip, and just hosting it? If it's small enough, personal S3 bucket? If paranoid, post the SHA1/MD5 hash. I guess signing the app too.

gh123man 6y ago
Agreed. I worked for (very large company) distributing a mac app outside the app store. Other than the distribution + update benefits (and a couple entitlements) you get from the app store, the freedom you get by living outside the sandbox outweighs it IMO.
jolux 6y ago
It's not much more complicated than just sticking it in an S3 bucket. This article seems to be more about the broader implications for your business about choosing one route vs the other. Guilherme mentions that GitHub Releases work fine for open source apps.
jws 6y ago
“Transmission”, a popular Mac bit torrent client did it the simple way. They ended up distributing a disk destroying malware to their users. If you only distribute your Mac software outside the store, and aren’t inherently ineligible for the store (like a full disk space measuring program) I just assume you are up to no good or don’t care enough about my security and pass on your product. If you aren’t willing to fork over $100/year to at least minimally tie an identity to your actions and go through all the signing nuisance then you don’t get control of my computer. Now that we are living in a notarized application world I may have to rethink this and loosen up, so the nuisance you go through notarizing your app is in some sense the entry fee to sell to some security conscious customers.
- deleted 6y ago
  [deleted]
- kranner 6y ago
  The $100 fee is not the issue. You also give up 15% or 30% of revenue to Apple; have to go through app review on every update facing arbitrary rejection; have no direct relationship with your users; can't offer upgrade pricing on significant new releases (existing users either get the new release for free or you make it a new SKU thus forcing everyone to pay full price, including existing users).
  - ogre_codes 6y ago
    Well Gumroad, the storefront he's using charges 5% or 3.5% + $10/ month so unless you are earning more than $1m/ year you are only saving 10-11.5%. Plus you have to host your own code which is another (very small) fee. You also lose access to some of Apple's cloud service like Sign in With Apple which some customers prefer (self included). There are also some additional sales just due to being in the App Store. Which is to say, the getting rid of that 15% fee isn't a slam dunk. Even before the Apple Tax cut, many developers chose to use the App Store even when the fee was 30% for good reason. I suspect if you are earning $900k in the App Store and launching a new product the math gets quite weird.
    - foepys 6y ago
      > unless you are earning more than $1m/ year you are only saving 10-11.5% 10% is a lot.
      - ogre_codes 6y ago
        If you sell 50 copies independently for $100 you save $10 or $500. If listing it in the App Store means you would sell 150 copies instead, how much is that savings worth? I didn't suggest it was cheap, I said many people find it's worth spending the money.
  - webmobdev 6y ago
    For me, $100 annual fees is also an issue. It's just an unnecessary and useless burden for not just open source softwares, but commercial wares too. Moreover, why should Apple get a monopoly on this - non-profits like EFF or the FSF should be allowed to do something similar, or even other corporates. Isn't that what we do currently with browsers and certificates?
- webmobdev 6y ago
  > "Transmission", a popular Mac bit torrent client did it the simple way. They ended up distributing a disk destroying malware to their users. APPLE APP STORE, a popular app store also distributed a malware / spyware bundled within a messenger app - https://www.bbc.com/news/technology-50890846 https://www.bbc.com/news/technology-50890846 > If you aren’t willing to fork over $100/year to at least minimally tie an identity to your actions and go through all the signing nuisance then you don’t get control of my computer. You don't need to pay $100 to a corporate to verify your identity and gain the trust of your users. Open source users have been doing it without paying a single penny to any corporates so far.
- jws 6y ago
  Just a little more info and a meta-HN fact: I don't ordinarily use bit torrent, but I was downloading a couple OS images and the provider requested I use bit torrent so I went and got Transmission during the period while the malware was up, but before Transmission discovered it. I got lucky and saw a news article, perhaps on HN, about the infection the next day or two, verified I had it, removed it, and ran a set of offline backups. Had I not caught it, after a several day waiting period the malware would have encrypted my drives for ransomware. So I got ridiculously unlucky to get the infection, and then ridiculously lucky to see an article suggesting I might have it before it went off. About HN, the parent comment is getting a disappointing amount of up and down voting relative to its total score.
- hda2 6y ago
  > If you aren’t willing to fork over $100/year to at least minimally tie an identity to your actions and go through all the signing nuisance then you don’t get control of my computer. I think what people who think like you are missing is that developers also don't want to control your computer if they have to go though all this hassle. It's a two way street.
ogre_codes 6y ago
You can do that. The only extra step is you need to have your app signed by Apple. Not App Store review, it just scans for malware and signs it.
- PurpleFoxy 6y ago
  And charges you $100/year for that scan.
  - smnrchrds 6y ago
    Is it at least available in all countries?
  - GeekyBear 6y ago
    The extended validation code signing certificate you need for your software installer to get around Windows 10's SmartScreen isn't free either.
  - nicky0 6y ago
    That's really not a lot of money if you are selling software as a business.
    - fsflover 6y ago
      And what if you are a non-profit?
      - CandyFace 6y ago
        I can speak for the cross platform open source project I work on; we don't pay the license fee. That means regularly bumping into new users that need help with opening the mac application, so we've written a "How to" guide as a workaround . It's an annoyance we'll live with, probably until we hit v1.0 and then i'll probably take it upon me to pay that fee.
        deleted 6y ago
sneak 6y ago
https://lapcatsoftware.com/articles/unsigned.html https://lapcatsoftware.com/articles/unsigned.html

gh123man 6y ago

Agreed. I worked for (very large company) distributing a mac app outside the app store. Other than the distribution + update benefits (and a couple entitlements) you get from the app store, the freedom you get by living outside the sandbox outweighs it IMO.

jolux 6y ago

It's not much more complicated than just sticking it in an S3 bucket. This article seems to be more about the broader implications for your business about choosing one route vs the other. Guilherme mentions that GitHub Releases work fine for open source apps.

jws 6y ago

“Transmission”, a popular Mac bit torrent client did it the simple way. They ended up distributing a disk destroying malware to their users. If you only distribute your Mac software outside the store, and aren’t inherently ineligible for the store (like a full disk space measuring program) I just assume you are up to no good or don’t care enough about my security and pass on your product. If you aren’t willing to fork over $100/year to at least minimally tie an identity to your actions and go through all the signing nuisance then you don’t get control of my computer. Now that we are living in a notarized application world I may have to rethink this and loosen up, so the nuisance you go through notarizing your app is in some sense the entry fee to sell to some security conscious customers.

deleted 6y ago
[deleted]
kranner 6y ago
The $100 fee is not the issue. You also give up 15% or 30% of revenue to Apple; have to go through app review on every update facing arbitrary rejection; have no direct relationship with your users; can't offer upgrade pricing on significant new releases (existing users either get the new release for free or you make it a new SKU thus forcing everyone to pay full price, including existing users).
- ogre_codes 6y ago
  Well Gumroad, the storefront he's using charges 5% or 3.5% + $10/ month so unless you are earning more than $1m/ year you are only saving 10-11.5%. Plus you have to host your own code which is another (very small) fee. You also lose access to some of Apple's cloud service like Sign in With Apple which some customers prefer (self included). There are also some additional sales just due to being in the App Store. Which is to say, the getting rid of that 15% fee isn't a slam dunk. Even before the Apple Tax cut, many developers chose to use the App Store even when the fee was 30% for good reason. I suspect if you are earning $900k in the App Store and launching a new product the math gets quite weird.
  - foepys 6y ago
    > unless you are earning more than $1m/ year you are only saving 10-11.5% 10% is a lot.
    - ogre_codes 6y ago
      If you sell 50 copies independently for $100 you save $10 or $500. If listing it in the App Store means you would sell 150 copies instead, how much is that savings worth? I didn't suggest it was cheap, I said many people find it's worth spending the money.
- webmobdev 6y ago
  For me, $100 annual fees is also an issue. It's just an unnecessary and useless burden for not just open source softwares, but commercial wares too. Moreover, why should Apple get a monopoly on this - non-profits like EFF or the FSF should be allowed to do something similar, or even other corporates. Isn't that what we do currently with browsers and certificates?
webmobdev 6y ago
> "Transmission", a popular Mac bit torrent client did it the simple way. They ended up distributing a disk destroying malware to their users. APPLE APP STORE, a popular app store also distributed a malware / spyware bundled within a messenger app - https://www.bbc.com/news/technology-50890846 https://www.bbc.com/news/technology-50890846 > If you aren’t willing to fork over $100/year to at least minimally tie an identity to your actions and go through all the signing nuisance then you don’t get control of my computer. You don't need to pay $100 to a corporate to verify your identity and gain the trust of your users. Open source users have been doing it without paying a single penny to any corporates so far.
jws 6y ago
Just a little more info and a meta-HN fact: I don't ordinarily use bit torrent, but I was downloading a couple OS images and the provider requested I use bit torrent so I went and got Transmission during the period while the malware was up, but before Transmission discovered it. I got lucky and saw a news article, perhaps on HN, about the infection the next day or two, verified I had it, removed it, and ran a set of offline backups. Had I not caught it, after a several day waiting period the malware would have encrypted my drives for ransomware. So I got ridiculously unlucky to get the infection, and then ridiculously lucky to see an article suggesting I might have it before it went off. About HN, the parent comment is getting a disappointing amount of up and down voting relative to its total score.
hda2 6y ago
> If you aren’t willing to fork over $100/year to at least minimally tie an identity to your actions and go through all the signing nuisance then you don’t get control of my computer. I think what people who think like you are missing is that developers also don't want to control your computer if they have to go though all this hassle. It's a two way street.

ogre_codes 6y ago

You can do that. The only extra step is you need to have your app signed by Apple. Not App Store review, it just scans for malware and signs it.

PurpleFoxy 6y ago
And charges you $100/year for that scan.
- smnrchrds 6y ago
  Is it at least available in all countries?
- GeekyBear 6y ago
  The extended validation code signing certificate you need for your software installer to get around Windows 10's SmartScreen isn't free either.
- nicky0 6y ago
  That's really not a lot of money if you are selling software as a business.
  - fsflover 6y ago
    And what if you are a non-profit?
    - CandyFace 6y ago
      I can speak for the cross platform open source project I work on; we don't pay the license fee. That means regularly bumping into new users that need help with opening the mac application, so we've written a "How to" guide as a workaround . It's an annoyance we'll live with, probably until we hit v1.0 and then i'll probably take it upon me to pay that fee.
      - deleted 6y ago

sneak 6y ago

https://lapcatsoftware.com/articles/unsigned.html https://lapcatsoftware.com/articles/unsigned.html