5 ms·

Ventura has changed app quarantine with a new xattr

87 points by rcarmo 4y ago

Ruq 4y ago
Apple's security measures feel like they're designed to protect Apple, with users as an accidental side effect.
- lockhouse 4y ago
  I think Apple struck an excellent balance with Gate Keeper. Your average user can’t run random software they accidentally download from shady sources, but yet it’s easy enough for power users to get around if they’re willing to accept the risks. If Apple ever takes away the option to run software that hasn’t been notarized then I’ll feel differently.
  - m463 4y ago
    they did it with ios. my opinion of apple would change drastically if they let me run my own software on ios. Heck, I can't even access my full filesystem on ios. (EDIT: without asking permission, let alone paying or renewing a cert)
    - kitsunesoba 4y ago
      Apple has been pretty clear in that they consider Macs to be in a wholly different category of devices than iPhones, iPads, Apple Watches, and Apple TVs. It's why they bothered to make booting arbitrary operating systems a publicly accessible feature on M-series Macs, which they absolutely didn't have to do, with the iPhone/iPad having served as the basis of M-series Macs.
      - deleted 4y ago
        [deleted]
      - smoldesu 4y ago
        > which they absolutely didn't have to do Strictly speaking, Apple doesn't have to do anything. They're judged against the quality of their prior products though, and prior Macs have worked well with an unlocked bootloader. If Apple threw that feature away (like the headphone jack or 32-bit software), then it would have been noteworthy, but it's not. You're ascribing goodwill to something as simple as a non-removed feature. Whatever the case is with Macs, regulators at-large don't seem to agree with Apple's product segmentation. If they want to distinguish iPhones from Macs, they'll have to find a way that doesn't undermine user authority.
    - renewiltord 4y ago
      You have to pay Apple for the developer program membership but after that you can write your own code and run it on the iPhone.
      - lockhouse 4y ago
        You don’t even have to pay them. With some admittedly major limitations, you can do that with a free Apple developer account.
      - m463 4y ago
        you shouldn't have to ask permission, let alone pay
    - lilyball 4y ago
      They didn't take it away on iOS, it was never a feature of iOS to begin with.
  - lapcat 4y ago
    There are many known instances where malware from shady sources has been notarized. Anyone in the world with $99 can join the Apple Developer Program, and Apple's automated malware checker is not that great. Moreover, any innocent appearing app can download another app and run it without having to go through Developer ID or notarization, so the whole thing is security theater.
    - oneplane 4y ago
      What it mostly provides is a revocation mechanism, which in itself is relatively powerful. On top of that, there is the notary mechanism which further strengthens the option of creating a digital immunity system. The main issue is the balance between security and usability, which is not something that is perfectly solved within a single decade.
  - whartung 4y ago
    It's certainly an improvement, but in the end it ends up like the "type in your password to continue installation". If an app is not notarized, you can right click and open it. Do either of these enough, and it becomes automatic. Back in the day, on Windows, pretty much everything out of the box had to be installed "as admin". Even the most mundane apps required admin. Folks just routinely simply logged in as "admin", giving every random app privilege, make the limitation effectively pointless. Many apps on the Mac require an admin to install them. It's not universal, like it seemed to be on Windows, but many apps require admin. It's not a leap to blindly right click on a new downloaded installer, and type in your password to install it. Or "<App> wants to access removable media" "OK!" We're conditioned to just click through these warnings because, honestly, we just want the software, and we just want it to work. We don't want to interview everything as a hostile party.
    - nyanpasu64 4y ago
      Just the other day I tried installing a custom Webcord build to fix "select all" on macOS (https://github.com/SpacingBat3/WebCord/issues/319 https://github.com/SpacingBat3/WebCord/issues/319). Surprisingly this time, right-click and open didn't make the "app corrupted" message go away, and I had to disable Gatekeeper entirely to install the package.
      - cobbal 4y ago
        I find the command `xattr -r -d com.apple.quarantine SomeApp.app` goes a long way toward fixing many gatekeeper problems. For some reason, the right click often fails for me.
        mrguyorama 4y ago
        Supposedly the right click method only works if you have already attempted to open the app a normal way, and gotten the "error" message. Only then can you right click to open anyway.
erulabs 4y ago
Ventura is a 150 year old city where 100k people live. I know this is HN, but can we not let mega-companies capture names like this? "macOS Ventura" is far clearer. </grouch-with-a-friend-named-Alexa>
- wilg 4y ago
  I'm similarly mad whenever I go to the store to buy an apple.
  - tomcam 4y ago
    How do you think I feel? I’m a farmer with a dell.
- wahnfrieden 4y ago
  macOS Ventura is the official name. The linked site is a Mac blog so they omitted the prefix. Your anger should be directed at hn policy for requiring original headlines at the cost of clarity, not Apple or the Mac blog
  - erulabs 4y ago
    Fair point. I’m not angry, I’m just getting old :P
    - prpl 4y ago
      Don’t worry, there is at least a lifetime on the usage.
  - detrites 4y ago
    Actually... > please use the original title, unless it is misleading The policy appears to invite the adding of clarity. Ie, disambiguation in this case.
    - dylan604 4y ago
      Yes, because on a tech related forum, the disambiguation of city name vs the name of an OS is front of mind on almost all readers
newaccount74 4y ago
I wish these internal behaviors of macOS were documented somewhere. A lot of these security features are pretty neat, but developers have to use trial and error to figure out how they work. If something doesn't work, we have to wonder if it is by design or by accident, and the only way to know is to use a tech support incident, hope it gets escalated to the right person, and see if you get an answer. Every year I worry if Apple breaks something in one of my apps, and when they do I have to scramble to find a workaround that hopefully doesn't impact my users.
- oneplane 4y ago
  If I'm not mistaken, the point of internal (private) elements and public parts is exactly that: the vendor doesn't need to maintain a public interface for the parts you're not supposed to touch. So as long as you don't use them, you should be safe. There are of course different problems in the realm of changing public APIs and that just sucks. On the other hand, it sucks less than having 3 decades of baggage that nobody really asks for.
  - newaccount74 4y ago
    The problem is when those internal changes break existing apps that never intended to depend on Apple internals. When it happens it's really frustrating to try to figure out why the app suddenly doesn't work as expected any more and what to change to make it work again.
    - rektide 4y ago
      And as a user trying to know how your computer works, you are totally hosed until a year latter someone deep-dives & writes it up. This article shows clear cases where this crude idea just doesn't work. And it seemingly serves no clear purpose at all right now. This idea that the vendor's OS is their to do whatever they want with, that they have all rights reserved & anything not announced is 100% caveat emptor, good luck, is a really really shitty & corporate-egoistic way of dealing with the world. There should be a greater than 0 try here, to make things make sense.
cobertos 4y ago
I didn't know about extended attributes before this, but also I grew up with Windows and now Linux and just haven't run into them. Do people other than the OS tend to use these? Are they well-trodden and portable between OS's? I've seen Unity's .meta files and kind of haten them but assumed they were sort of the "the way"
- loeg 4y ago
  > I didn't know about extended attributes before this, but also I grew up with Windows and now Linux and just haven't run into them. The somewhat similar mechanism on Windows is Alternative Data Streams. ADS are like named subfiles below your main file. If you squint pretty hard, unix xattrs look kind of similar -- they're also named binary objects attached to files. But xattrs are typically limited to much smaller amounts of data due to implementation details, and are also namespaced with some sort of integer enum (on Linux, "user" and "system" are common). I would not really assume they're a portable construct, although commonly used unix-likes (Mac and Linux) both support them in their most popular filesystems.
  - ciupicri 4y ago
    One of the most popular ADS is probably the Zone.Identifier [1][2] which is how Windows knows if the program you're trying to run was downloaded from the Internet. [1]: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/6e3f7352-d11c-4d76-8c39-2516a9df36e8 https://learn.microsoft.com/en-us/openspecs/windows_protocol... [2]: https://devblogs.microsoft.com/scripting/powertip-use-powershell-3-0-to-identify-zone-information-of-files/ https://devblogs.microsoft.com/scripting/powertip-use-powers...
- kccqzy 4y ago
  I pretty much treat them as macOS only. Useful for things like Spotlight comments, Finder tags, and other macOS-exclusive features. They were originally introduced in Tiger, by the way. https://arstechnica.com/gadgets/2005/04/macosx-10-4/7/ https://arstechnica.com/gadgets/2005/04/macosx-10-4/7/
- PeterWhittaker 4y ago

87 points by rcarmo 4y ago

Ruq 4y ago

Apple's security measures feel like they're designed to protect Apple, with users as an accidental side effect.

lockhouse 4y ago
I think Apple struck an excellent balance with Gate Keeper. Your average user can’t run random software they accidentally download from shady sources, but yet it’s easy enough for power users to get around if they’re willing to accept the risks. If Apple ever takes away the option to run software that hasn’t been notarized then I’ll feel differently.
- m463 4y ago
  they did it with ios. my opinion of apple would change drastically if they let me run my own software on ios. Heck, I can't even access my full filesystem on ios. (EDIT: without asking permission, let alone paying or renewing a cert)
  - kitsunesoba 4y ago
    Apple has been pretty clear in that they consider Macs to be in a wholly different category of devices than iPhones, iPads, Apple Watches, and Apple TVs. It's why they bothered to make booting arbitrary operating systems a publicly accessible feature on M-series Macs, which they absolutely didn't have to do, with the iPhone/iPad having served as the basis of M-series Macs.
    - deleted 4y ago
      [deleted]
    - smoldesu 4y ago
      > which they absolutely didn't have to do Strictly speaking, Apple doesn't have to do anything. They're judged against the quality of their prior products though, and prior Macs have worked well with an unlocked bootloader. If Apple threw that feature away (like the headphone jack or 32-bit software), then it would have been noteworthy, but it's not. You're ascribing goodwill to something as simple as a non-removed feature. Whatever the case is with Macs, regulators at-large don't seem to agree with Apple's product segmentation. If they want to distinguish iPhones from Macs, they'll have to find a way that doesn't undermine user authority.
  - renewiltord 4y ago
    You have to pay Apple for the developer program membership but after that you can write your own code and run it on the iPhone.
    - lockhouse 4y ago
      You don’t even have to pay them. With some admittedly major limitations, you can do that with a free Apple developer account.
    - m463 4y ago
      you shouldn't have to ask permission, let alone pay
  - lilyball 4y ago
    They didn't take it away on iOS, it was never a feature of iOS to begin with.
- lapcat 4y ago
  There are many known instances where malware from shady sources has been notarized. Anyone in the world with $99 can join the Apple Developer Program, and Apple's automated malware checker is not that great. Moreover, any innocent appearing app can download another app and run it without having to go through Developer ID or notarization, so the whole thing is security theater.
  - oneplane 4y ago
    What it mostly provides is a revocation mechanism, which in itself is relatively powerful. On top of that, there is the notary mechanism which further strengthens the option of creating a digital immunity system. The main issue is the balance between security and usability, which is not something that is perfectly solved within a single decade.
- whartung 4y ago
  It's certainly an improvement, but in the end it ends up like the "type in your password to continue installation". If an app is not notarized, you can right click and open it. Do either of these enough, and it becomes automatic. Back in the day, on Windows, pretty much everything out of the box had to be installed "as admin". Even the most mundane apps required admin. Folks just routinely simply logged in as "admin", giving every random app privilege, make the limitation effectively pointless. Many apps on the Mac require an admin to install them. It's not universal, like it seemed to be on Windows, but many apps require admin. It's not a leap to blindly right click on a new downloaded installer, and type in your password to install it. Or "<App> wants to access removable media" "OK!" We're conditioned to just click through these warnings because, honestly, we just want the software, and we just want it to work. We don't want to interview everything as a hostile party.
  - nyanpasu64 4y ago
    Just the other day I tried installing a custom Webcord build to fix "select all" on macOS (https://github.com/SpacingBat3/WebCord/issues/319 https://github.com/SpacingBat3/WebCord/issues/319). Surprisingly this time, right-click and open didn't make the "app corrupted" message go away, and I had to disable Gatekeeper entirely to install the package.
    - cobbal 4y ago
      I find the command `xattr -r -d com.apple.quarantine SomeApp.app` goes a long way toward fixing many gatekeeper problems. For some reason, the right click often fails for me.
      - mrguyorama 4y ago
        Supposedly the right click method only works if you have already attempted to open the app a normal way, and gotten the "error" message. Only then can you right click to open anyway.

erulabs 4y ago

Ventura is a 150 year old city where 100k people live. I know this is HN, but can we not let mega-companies capture names like this? "macOS Ventura" is far clearer. </grouch-with-a-friend-named-Alexa>

wilg 4y ago
I'm similarly mad whenever I go to the store to buy an apple.
- tomcam 4y ago
  How do you think I feel? I’m a farmer with a dell.
wahnfrieden 4y ago
macOS Ventura is the official name. The linked site is a Mac blog so they omitted the prefix. Your anger should be directed at hn policy for requiring original headlines at the cost of clarity, not Apple or the Mac blog
- erulabs 4y ago
  Fair point. I’m not angry, I’m just getting old :P
  - prpl 4y ago
    Don’t worry, there is at least a lifetime on the usage.
- detrites 4y ago
  Actually... > please use the original title, unless it is misleading The policy appears to invite the adding of clarity. Ie, disambiguation in this case.
  - dylan604 4y ago
    Yes, because on a tech related forum, the disambiguation of city name vs the name of an OS is front of mind on almost all readers

newaccount74 4y ago

I wish these internal behaviors of macOS were documented somewhere. A lot of these security features are pretty neat, but developers have to use trial and error to figure out how they work. If something doesn't work, we have to wonder if it is by design or by accident, and the only way to know is to use a tech support incident, hope it gets escalated to the right person, and see if you get an answer. Every year I worry if Apple breaks something in one of my apps, and when they do I have to scramble to find a workaround that hopefully doesn't impact my users.

oneplane 4y ago
If I'm not mistaken, the point of internal (private) elements and public parts is exactly that: the vendor doesn't need to maintain a public interface for the parts you're not supposed to touch. So as long as you don't use them, you should be safe. There are of course different problems in the realm of changing public APIs and that just sucks. On the other hand, it sucks less than having 3 decades of baggage that nobody really asks for.
- newaccount74 4y ago
  The problem is when those internal changes break existing apps that never intended to depend on Apple internals. When it happens it's really frustrating to try to figure out why the app suddenly doesn't work as expected any more and what to change to make it work again.
  - rektide 4y ago
    And as a user trying to know how your computer works, you are totally hosed until a year latter someone deep-dives & writes it up. This article shows clear cases where this crude idea just doesn't work. And it seemingly serves no clear purpose at all right now. This idea that the vendor's OS is their to do whatever they want with, that they have all rights reserved & anything not announced is 100% caveat emptor, good luck, is a really really shitty & corporate-egoistic way of dealing with the world. There should be a greater than 0 try here, to make things make sense.

cobertos 4y ago

I didn't know about extended attributes before this, but also I grew up with Windows and now Linux and just haven't run into them. Do people other than the OS tend to use these? Are they well-trodden and portable between OS's? I've seen Unity's .meta files and kind of haten them but assumed they were sort of the "the way"

loeg 4y ago
> I didn't know about extended attributes before this, but also I grew up with Windows and now Linux and just haven't run into them. The somewhat similar mechanism on Windows is Alternative Data Streams. ADS are like named subfiles below your main file. If you squint pretty hard, unix xattrs look kind of similar -- they're also named binary objects attached to files. But xattrs are typically limited to much smaller amounts of data due to implementation details, and are also namespaced with some sort of integer enum (on Linux, "user" and "system" are common). I would not really assume they're a portable construct, although commonly used unix-likes (Mac and Linux) both support them in their most popular filesystems.
- ciupicri 4y ago
  One of the most popular ADS is probably the Zone.Identifier [1][2] which is how Windows knows if the program you're trying to run was downloaded from the Internet. [1]: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/6e3f7352-d11c-4d76-8c39-2516a9df36e8 https://learn.microsoft.com/en-us/openspecs/windows_protocol... [2]: https://devblogs.microsoft.com/scripting/powertip-use-powershell-3-0-to-identify-zone-information-of-files/ https://devblogs.microsoft.com/scripting/powertip-use-powers...
kccqzy 4y ago
I pretty much treat them as macOS only. Useful for things like Spotlight comments, Finder tags, and other macOS-exclusive features. They were originally introduced in Tiger, by the way. https://arstechnica.com/gadgets/2005/04/macosx-10-4/7/ https://arstechnica.com/gadgets/2005/04/macosx-10-4/7/
PeterWhittaker 4y ago