5 ms·

No, if your subscription lapses previously released software won't stop working. If you are offering free software you can sign with an ad-hoc certificate, and

No, if your subscription lapses previously released software won't stop working. If you are offering free software you can sign with an ad-hoc certificate, and instruct the user on how to bypass gatekeeper, which isn't great at all but it doesn't cost any $$.

Gorbzel 5y ago
Happy Friday everyone. Day ending in 'y', so it's time for that never ending HN Apple haters groupthink exercise: 1. Linux desktop advocate describes a supposed technical implementation from Apple that seems extremely walled garden and onerous if accurate. 2. Outrage ensues. 3. It's never true.
- lstamour 5y ago
  In this case I think it is accurate given forum post evidence, but possibly dated to 2019 given other dates on the page and the fact that Big Sur is not mentioned.
- Klonoar 5y ago
  This puts it well, albeit with (enjoyable) snark. So often these criticisms read like it’s expected that Apple conform to the Linux “model” of doing things, and anything else is like the plague.
anentropic 5y ago
Looks like this explains how: https://www.digicert.com/kb/code-signing/mac-os-codesign-tool.htm https://www.digicert.com/kb/code-signing/mac-os-codesign-too... but... "only Apple Developer code signing certificates are compatible with GateKeeper" Does code-signing with an ad hoc certificate and no notarization provide any better experience than just unsigned code? Do you get a friendlier message (c/f "malicious software: Move to Trash") when Gatekeeper blocks it?
- galad87 5y ago
  Unsigned (arm64) binaries don't run at all on M1 Macs, so yes, an ad-hoc certificate provides a better experience ;)
  - anentropic 5y ago
    I just tried an unsigned bin on M1 Big Sur and the experience is the same: it's initially blocked with a "Move to Trash" dialog but you can go to security prefs and click "allow anyway" Then try again, click "open" rather than "move to trash" on another warning dialog and the file does get run. I haven't tried a signed+un-notarized one but it sounds like it'd be similar?
    - saagarjha 5y ago
      I suspect that the code you're trying to run is ad-hoc signed.
      - anentropic 5y ago
        Not by me... and it's my own code build from src in a github action.
        comex 5y ago
        When targeting ARM macOS, the linker automatically ad-hoc signs everything it outputs. You can check this by running `codesign -dvv` on the binary. Alternately, if your binary is an Intel binary running under Rosetta, those can be unsigned.
        anentropic 5y ago
        Hmm, it was built on Intel though (GitHub Actions macos runners are only Intel) But maybe some other part of the toolchain (Gradle, GraalVM native-image) was implicitly ad-hoc signing it
sneak 5y ago
Instructing users on how to bypass gatekeeper is a nonstarter, as explained here: https://lapcatsoftware.com/articles/unsigned.html https://lapcatsoftware.com/articles/unsigned.html This simply is not a viable distribution method for the mass market. Apple has positioned apps from devs that pay Apple so far above apps from devs that don't that you cannot compete outside of their subscription revenue model.

Gorbzel 5y ago

Happy Friday everyone. Day ending in 'y', so it's time for that never ending HN Apple haters groupthink exercise: 1. Linux desktop advocate describes a supposed technical implementation from Apple that seems extremely walled garden and onerous if accurate. 2. Outrage ensues. 3. It's never true.

lstamour 5y ago
In this case I think it is accurate given forum post evidence, but possibly dated to 2019 given other dates on the page and the fact that Big Sur is not mentioned.
Klonoar 5y ago
This puts it well, albeit with (enjoyable) snark. So often these criticisms read like it’s expected that Apple conform to the Linux “model” of doing things, and anything else is like the plague.

anentropic 5y ago

Looks like this explains how: https://www.digicert.com/kb/code-signing/mac-os-codesign-tool.htm https://www.digicert.com/kb/code-signing/mac-os-codesign-too... but... "only Apple Developer code signing certificates are compatible with GateKeeper" Does code-signing with an ad hoc certificate and no notarization provide any better experience than just unsigned code? Do you get a friendlier message (c/f "malicious software: Move to Trash") when Gatekeeper blocks it?

galad87 5y ago
Unsigned (arm64) binaries don't run at all on M1 Macs, so yes, an ad-hoc certificate provides a better experience ;)
- anentropic 5y ago
  I just tried an unsigned bin on M1 Big Sur and the experience is the same: it's initially blocked with a "Move to Trash" dialog but you can go to security prefs and click "allow anyway" Then try again, click "open" rather than "move to trash" on another warning dialog and the file does get run. I haven't tried a signed+un-notarized one but it sounds like it'd be similar?
  - saagarjha 5y ago
    I suspect that the code you're trying to run is ad-hoc signed.
    - anentropic 5y ago
      Not by me... and it's my own code build from src in a github action.
      - comex 5y ago
        When targeting ARM macOS, the linker automatically ad-hoc signs everything it outputs. You can check this by running `codesign -dvv` on the binary. Alternately, if your binary is an Intel binary running under Rosetta, those can be unsigned.
        anentropic 5y ago
        Hmm, it was built on Intel though (GitHub Actions macos runners are only Intel) But maybe some other part of the toolchain (Gradle, GraalVM native-image) was implicitly ad-hoc signing it

sneak 5y ago

Instructing users on how to bypass gatekeeper is a nonstarter, as explained here: https://lapcatsoftware.com/articles/unsigned.html https://lapcatsoftware.com/articles/unsigned.html This simply is not a viable distribution method for the mass market. Apple has positioned apps from devs that pay Apple so far above apps from devs that don't that you cannot compete outside of their subscription revenue model.