9 ms·

Shell scripts are affected by quarantine just like any other executable. The easiest solition is, as kybernetyk says, to right-click the app. If you do that, y

Shell scripts are affected by quarantine just like any other executable. The easiest solition is, as kybernetyk says, to right-click the app. If you do that, you can bypass most the warnings. Another possibility would be to install the app in a way that doesn't set the quarantine attribute, eg. with curl, rsync or brew cask. But Apple has been tightening seccurity year after year, so it's questionable how long all the workarounds will continue working. My recommendation would be to just notarize the app - Mac users expect notarized software, and if you tell users they need to bypass the security checks, then a lot of people will think you are sketchy.

grishka 4y ago
> My recommendation would be to just notarize the app The problem is that this involves having a developer ID, which costs $100/year — which is the one thing I'd like to avoid. Hence my question. The apps I'm contemplating about would be free and open-source so I won't be making any money on them.
- jagged-chisel 4y ago
  Rhetorical questions: how much salary do you make on other work? How much have you spent on your hardware? Real question: why is $100/yr such an egregious amount of money? If it’s a matter of principle, perhaps targeting macOS also lies outside those principles.
  - zeta0134 4y ago
    This would have been a completely unattainable amount of money as a high school student. In college, that money was better spent on school supplies and food, and spending cash was short. After college it took me the better part of a decade to get to the point where $100/year felt like something I could feasibly consider spending and not risk missing rent in January. $100/year is a lot of money to people in a wide variety of life situations. Being unable to afford this does not make them any less of a programmer.
    - pjmlp 4y ago
      I bought Turbo Pascal and Turbo C++ versions for Windows 3.1 as high-school student. Each of them were between 150 and 200 euros on today's money. High school student allowance in early 1990's Portugal after decades of dictatorship wasn't that great either.
      - smoldesu 4y ago
        Was it a subscription service, though? That doesn't seem like a terrible deal if you get a perpetual license - meanwhile forking over $99/year for some basic functionality wrapped in Service Credit seems like a racket to me.
        pjmlp 4y ago
        No it wasn't, nor are Apple devices given for free to students. Anyone that can afford Apple hardware as an high school student surely can afford the dev subscription.
        smoldesu 4y ago
        Anyone that can afford a Lexus can also pay for a heated seat subscription. Does that make it right for them to sell it?
        pjmlp 4y ago
        Yes, a company has the right to do whatever they want with their products. It is up for the customers to validate their business decisions.
        smoldesu 4y ago
        Customers can only validate it if they have a choice. How does an iPhone developer validate or invalidate Apple's behavior? They're basically a hostage on Apple's platform, and the only thing keeping them there is the fact that they get paid. Apple shouldn't have the negotiating power they wield, and regulators are taking action to stop them from abusing it.
  - 0ct4via 4y ago
    It can be an "egregious" amount to those in a variety of circumstances -- developing countries, students, those without employment, or living paycheck-to-paycheck as is... not everyone who is or wants to be a dev is making tens/hundreds of thousands of bucks per year. GP says they're "Ex VKontakte, Telegram" in their profile though, which would imply they've made some money at least... and their comments read as more of an unwillingness to pay the $99, not an inability to do so ¯\_(ツ)_/¯
  - guilherme-puida 4y ago
    As a developer from a developing country, $100/yr is really expensive.
  - realusername 4y ago
    > How much have you spent on your hardware? The hardware itself has some value though
    - scarface74 4y ago
      And giving people enough confidence in you that paying $100 a year isn’t? Does your app have value? It’s not hardware.
      - dividedbyzero 4y ago
        Sucks for non-commercial work though. Not every app is intended to make money, but as I understand it all have to pay. 100 USD a year is quite an expensive hobby.
        scarface74 4y ago
        Then let the end user jump through a hoop and describe how to bypass GateKeeper.
        sbuk 4y ago
        Is it? In the grand scheme of things, I would argue not. My partner, for instance, knits. Cheap hobby, right? Nope. Specialist needles, yarn, etc. all adds up. She certainly spends more than $100 per year on it. How about photography? Or fishing? Most arts and craft type hobbies? You get the picture...
      - realusername 4y ago
        > And giving people enough confidence in you that paying $100 a year isn’t? Why stop at Apple then? Why not paying the antivirus companies as well?
        scarface74 4y ago
        Do you pay for SSL certs for your websites to help give customers confidence that you are who you say you are?
  - grishka 4y ago
    It's not that I can't afford $100/year. I simply don't like Apple's security model where they consider themselves an unquestionably trusted party. I also don't want these kinds of dependencies. It's more like an act of protest. I'm targeting macOS because that's the OS I use. I use it because the two alternatives suck a lot more. Modern Mac hardware is also really nice and a joy to use. The integration of software and hardware is unmatched by any competition.
    - lwkl 4y ago
      If you think Apple sucks look at signing binaries on Windows. If you don‘t use the Microsoft App Store it‘s much more expensive and annoying. It basically requires you to be incorporated and hire a notary so you‘re probably spending $ 1000 or more for the first year. Renewal is cheaper but you will still be paying at least $ 100 a year. Also if you know a good affordable way for a code signing certificate on Windows answer to this comment. I gave up the last time I tried.
      - dave78 4y ago
        I've been using: https://www.ksoftware.net/code-signing-certificates/ https://www.ksoftware.net/code-signing-certificates/ Last time I looked they had the best pricing I could find at about $70/year. However, you still have to jump through the antiquated hoops for them to validate your business. One of the hoops was something like "have a business address and phone number listed in a commercial directory" which was particularly tricky to do for us since we don't have a company office anywhere and don't have a company phone number. In 2022, it should be reasonable for a software company to exist without a published phone number. I think we got around that by setting up a Twilio or Google Voice number and then adding a business listing in Google to one of our owner's residential addresses. Totally useless but apparently good enough to pass validation.
      - oleks637 4y ago
        You can get an OV code signing certificate for 84$ per year - https://www.ksoftware.net/code-signing-certificates/ https://www.ksoftware.net/code-signing-certificates/ I'm using it for my app, and I never had any issues. You don't need to incorporate a company to get this certificate ( https://support.sectigo.com/PS_KnowledgeDetailPageFaq?Id=kA01N000000brb0 https://support.sectigo.com/PS_KnowledgeDetailPageFaq?Id=kA0... scroll down to the Individual Validation Requirements). If your ID has your address printed on it, then you are lucky and can just take a photo of the ID and yourself holding the ID. If you don't, then you need to go to a notary and sign a special form provided by Sectigo. Sectigo doesn't even need to call you anymore, as it was about 5-10 years ago. The downside of the OV certificate is that Windows Defender will show a blue pop-up saying that your app might put the user's PC at risk. Good thing is that it will eventually go away after some time. For my app it took about a year.
  - superkuh 4y ago
    $100 a year means that no one makes applications for Mac OS on a whim, etc and it ensures that all the applications come from a purely profit-motive driven persons. It commercializes the entire OS and prevents software for people, instead of software for profit, from even existing in the ecosystem.
  - jzb 4y ago
    Real question: Why defend Apple charging developers $100 a year for the service of developing for their OS? Do we think it costs Apple $100 a year to grant this? The burden should be on Apple to justify this.
    - jagged-chisel 4y ago
      You’ll notice I made no argument in defense of Apple. You can definitely develop for their desktop OS without paying that $100 fee. If you don’t want to use all the free languages out there that will run on many platforms (macOS included), and you’d rather use Apple’s tools to build natively, well now you have to spend money on Apple hardware. If you need an argument in defense of paying $100/yr for a signing certificate: it’s definitely a barrier to entry. It makes high volume scams based on obtaining signing keys too expensive. If it were free for all, it would be a free-for-all for scammers … until the world asked Apple to “do something about it” and that something would be charging for access to those certs.
- 0ct4via 4y ago
  If you want to distribute FLOSS apps without cost, do so on platforms that support it, or look at how jailbroken iDevices can have apps side loaded. If you want to distribute Mac apps you don't need a Developer ID. You can literally control-click (or right-click) the app and click Open, and you'll be given a warning asking if you're sure, as it's from an unidentified developer -- simple. It's not a "problem" -- it's a choice. If you want to distribute Mac apps without having to have an FAQ about Gatekeeper, suck it up and pay the $99.
- GeekyBear 4y ago
  $100 is cheap. Getting an Extended Validation code signing certificate to accomplish the equivalent goal on Windows (having no scary security dialog box when users download and open your program) costs even more.
  - eduction 4y ago
    $100 is cheap to an American working as a software developer. That’s not most people, most Americans, or most software developers.
    - GeekyBear 4y ago
      We're comparing what you get for the money. A $100 developer account from Apple allows you to sign software so that there will be no scary dialog boxes when a user downloads your software off the internet and opens it. An ~$100 code signing certificate for use on Windows will allow you to digitally sign your Windows application, but users will still see a scary dialog box from Windows SmartScreen when they download your software unless you spend a good bit more to step up to an Extended Validation certificate. If you don't want to pay, you'll just have to accept that users are going to see a scary dialog box, and take care to warn them that it will happen on your website.
- spfzero 4y ago
  If they are free and open source can you use the github distribution feature the OA mentioned?
- dqh 4y ago
  I’m in this situation too, having to pay to be able to distribute macOS binaries of VICE. Quite annoying. I wish they’d make exceptions for open source.

grishka 4y ago

> My recommendation would be to just notarize the app The problem is that this involves having a developer ID, which costs $100/year — which is the one thing I'd like to avoid. Hence my question. The apps I'm contemplating about would be free and open-source so I won't be making any money on them.

jagged-chisel 4y ago
Rhetorical questions: how much salary do you make on other work? How much have you spent on your hardware? Real question: why is $100/yr such an egregious amount of money? If it’s a matter of principle, perhaps targeting macOS also lies outside those principles.
- zeta0134 4y ago
  This would have been a completely unattainable amount of money as a high school student. In college, that money was better spent on school supplies and food, and spending cash was short. After college it took me the better part of a decade to get to the point where $100/year felt like something I could feasibly consider spending and not risk missing rent in January. $100/year is a lot of money to people in a wide variety of life situations. Being unable to afford this does not make them any less of a programmer.
  - pjmlp 4y ago
    I bought Turbo Pascal and Turbo C++ versions for Windows 3.1 as high-school student. Each of them were between 150 and 200 euros on today's money. High school student allowance in early 1990's Portugal after decades of dictatorship wasn't that great either.
    - smoldesu 4y ago
      Was it a subscription service, though? That doesn't seem like a terrible deal if you get a perpetual license - meanwhile forking over $99/year for some basic functionality wrapped in Service Credit seems like a racket to me.
      - pjmlp 4y ago
        No it wasn't, nor are Apple devices given for free to students. Anyone that can afford Apple hardware as an high school student surely can afford the dev subscription.
        smoldesu 4y ago
        Anyone that can afford a Lexus can also pay for a heated seat subscription. Does that make it right for them to sell it?
        pjmlp 4y ago
        Yes, a company has the right to do whatever they want with their products. It is up for the customers to validate their business decisions.
        smoldesu 4y ago
        Customers can only validate it if they have a choice. How does an iPhone developer validate or invalidate Apple's behavior? They're basically a hostage on Apple's platform, and the only thing keeping them there is the fact that they get paid. Apple shouldn't have the negotiating power they wield, and regulators are taking action to stop them from abusing it.
- 0ct4via 4y ago
  It can be an "egregious" amount to those in a variety of circumstances -- developing countries, students, those without employment, or living paycheck-to-paycheck as is... not everyone who is or wants to be a dev is making tens/hundreds of thousands of bucks per year. GP says they're "Ex VKontakte, Telegram" in their profile though, which would imply they've made some money at least... and their comments read as more of an unwillingness to pay the $99, not an inability to do so ¯\_(ツ)_/¯
- guilherme-puida 4y ago
  As a developer from a developing country, $100/yr is really expensive.
- realusername 4y ago
  > How much have you spent on your hardware? The hardware itself has some value though
  - scarface74 4y ago
    And giving people enough confidence in you that paying $100 a year isn’t? Does your app have value? It’s not hardware.
    - dividedbyzero 4y ago
      Sucks for non-commercial work though. Not every app is intended to make money, but as I understand it all have to pay. 100 USD a year is quite an expensive hobby.
      - scarface74 4y ago
        Then let the end user jump through a hoop and describe how to bypass GateKeeper.
      - sbuk 4y ago
        Is it? In the grand scheme of things, I would argue not. My partner, for instance, knits. Cheap hobby, right? Nope. Specialist needles, yarn, etc. all adds up. She certainly spends more than $100 per year on it. How about photography? Or fishing? Most arts and craft type hobbies? You get the picture...
    - realusername 4y ago
      > And giving people enough confidence in you that paying $100 a year isn’t? Why stop at Apple then? Why not paying the antivirus companies as well?
      - scarface74 4y ago
        Do you pay for SSL certs for your websites to help give customers confidence that you are who you say you are?
- grishka 4y ago
  It's not that I can't afford $100/year. I simply don't like Apple's security model where they consider themselves an unquestionably trusted party. I also don't want these kinds of dependencies. It's more like an act of protest. I'm targeting macOS because that's the OS I use. I use it because the two alternatives suck a lot more. Modern Mac hardware is also really nice and a joy to use. The integration of software and hardware is unmatched by any competition.
  - lwkl 4y ago
    If you think Apple sucks look at signing binaries on Windows. If you don‘t use the Microsoft App Store it‘s much more expensive and annoying. It basically requires you to be incorporated and hire a notary so you‘re probably spending $ 1000 or more for the first year. Renewal is cheaper but you will still be paying at least $ 100 a year. Also if you know a good affordable way for a code signing certificate on Windows answer to this comment. I gave up the last time I tried.
    - dave78 4y ago
      I've been using: https://www.ksoftware.net/code-signing-certificates/ https://www.ksoftware.net/code-signing-certificates/ Last time I looked they had the best pricing I could find at about $70/year. However, you still have to jump through the antiquated hoops for them to validate your business. One of the hoops was something like "have a business address and phone number listed in a commercial directory" which was particularly tricky to do for us since we don't have a company office anywhere and don't have a company phone number. In 2022, it should be reasonable for a software company to exist without a published phone number. I think we got around that by setting up a Twilio or Google Voice number and then adding a business listing in Google to one of our owner's residential addresses. Totally useless but apparently good enough to pass validation.
    - oleks637 4y ago
      You can get an OV code signing certificate for 84$ per year - https://www.ksoftware.net/code-signing-certificates/ https://www.ksoftware.net/code-signing-certificates/ I'm using it for my app, and I never had any issues. You don't need to incorporate a company to get this certificate ( https://support.sectigo.com/PS_KnowledgeDetailPageFaq?Id=kA01N000000brb0 https://support.sectigo.com/PS_KnowledgeDetailPageFaq?Id=kA0... scroll down to the Individual Validation Requirements). If your ID has your address printed on it, then you are lucky and can just take a photo of the ID and yourself holding the ID. If you don't, then you need to go to a notary and sign a special form provided by Sectigo. Sectigo doesn't even need to call you anymore, as it was about 5-10 years ago. The downside of the OV certificate is that Windows Defender will show a blue pop-up saying that your app might put the user's PC at risk. Good thing is that it will eventually go away after some time. For my app it took about a year.
- superkuh 4y ago
  $100 a year means that no one makes applications for Mac OS on a whim, etc and it ensures that all the applications come from a purely profit-motive driven persons. It commercializes the entire OS and prevents software for people, instead of software for profit, from even existing in the ecosystem.
- jzb 4y ago
  Real question: Why defend Apple charging developers $100 a year for the service of developing for their OS? Do we think it costs Apple $100 a year to grant this? The burden should be on Apple to justify this.
  - jagged-chisel 4y ago
    You’ll notice I made no argument in defense of Apple. You can definitely develop for their desktop OS without paying that $100 fee. If you don’t want to use all the free languages out there that will run on many platforms (macOS included), and you’d rather use Apple’s tools to build natively, well now you have to spend money on Apple hardware. If you need an argument in defense of paying $100/yr for a signing certificate: it’s definitely a barrier to entry. It makes high volume scams based on obtaining signing keys too expensive. If it were free for all, it would be a free-for-all for scammers … until the world asked Apple to “do something about it” and that something would be charging for access to those certs.
0ct4via 4y ago
If you want to distribute FLOSS apps without cost, do so on platforms that support it, or look at how jailbroken iDevices can have apps side loaded. If you want to distribute Mac apps you don't need a Developer ID. You can literally control-click (or right-click) the app and click Open, and you'll be given a warning asking if you're sure, as it's from an unidentified developer -- simple. It's not a "problem" -- it's a choice. If you want to distribute Mac apps without having to have an FAQ about Gatekeeper, suck it up and pay the $99.
GeekyBear 4y ago
$100 is cheap. Getting an Extended Validation code signing certificate to accomplish the equivalent goal on Windows (having no scary security dialog box when users download and open your program) costs even more.
- eduction 4y ago
  $100 is cheap to an American working as a software developer. That’s not most people, most Americans, or most software developers.
  - GeekyBear 4y ago
    We're comparing what you get for the money. A $100 developer account from Apple allows you to sign software so that there will be no scary dialog boxes when a user downloads your software off the internet and opens it. An ~$100 code signing certificate for use on Windows will allow you to digitally sign your Windows application, but users will still see a scary dialog box from Windows SmartScreen when they download your software unless you spend a good bit more to step up to an Extended Validation certificate. If you don't want to pay, you'll just have to accept that users are going to see a scary dialog box, and take care to warn them that it will happen on your website.
spfzero 4y ago
If they are free and open source can you use the github distribution feature the OA mentioned?
dqh 4y ago
I’m in this situation too, having to pay to be able to distribute macOS binaries of VICE. Quite annoying. I wish they’d make exceptions for open source.