7 ms·

We are here, ladies and gentlemen. Users have three choices which type of apps can run on Mountain Lion: Only those from the App Store Only th

by dchest 15y ago

We are here, ladies and gentlemen. Users have three choices which type of apps can run on Mountain Lion: Only those from the App Store Only those from the App Store or which are signed by a developer ID Any app, whether signed or unsigned The default for this setting is, I say, exactly right: the one in the middle, disallowing only unsigned apps.

narkee 15y ago
Say I use my Macbook for development, and I compile a small toy C program using gcc. Does that mean now that I cannot run the produced binary by default? Forgive me for being naive, but what does "app" mean in this context? Is a shell script an app? What about a python script with GUI elements?
- tptacek 15y ago
  No, it does not mean that.
  - Craiggybear 15y ago
    Sources?
    - tptacek 15y ago
      The actual article you just read, for one. The way code signing is implemented today, for another.
- Craiggybear 15y ago
  Good question. I can't see this just yet, but it will happen. Probably by 10.9 which won't even have a command prompt -- or at least not one you can access easily without invalidating warranty or some such nonsense.
  - batista 15y ago
    Yeah, or 10.30, which will not even have a UI, just an OS-to-Mind interface. Can we please stop repeating BS? People like to make it sound like some kind of slippery slope, but including Mountain Lion, NOTHING has been taken away from users re: freedom, from OS X 10.0.1 to 10.8. In addition to running whatever from whatever, 10.7 gave you the option to use an App repository. You know, like the one, say, Debian had from decades, only not restricted to OSS. In addition to running whatever from whatever AND from the App Store, 10.8 adds the ability to only run signed apps. You, know, like the security solution that is considered one of most effective ones by security boffins.
    - daeken 15y ago
      > NOTHING has been taken away from users re: freedom, from OS X 10.0.1 to 10.8. Well, no, that's not quite true. See also: PTRACE_DENY_ATTACH in random binaries (e.g. iTunes) and the gimped DTrace implementation. Are these showstoppers or the end of freedom as we know it? Not be a long, long way. Are they (fairly small) limitations on the freedom of users? Yes.
      - wtallis 15y ago
        Introducing new features that aren't completely open is not the same as taking away existing freedoms.
  - k-mcgrady 15y ago
    Why do you feel the need to be so overdramatic? You don't seriously believe that do you? Many users regularly need access to the Terminal. Developers for one user it all the time. I use it for git. Many people (including non-developers) use vi. People run scripts from it and use it for automation.
- hazov 15y ago
  Even if this is the case I believe this would mean that the third setting will allow you to run anything just fine, but I believe this will only apply to .app folders that are the bundled applications.
- gkefalas 15y ago
  Nope, you'll be able to run it: "Finally, it’s important to note that because Gatekeeper uses the File Quarantine system, it only works the very first time you try to launch an app, and even then only when it’s been downloaded from an app on your Mac like a web browser or email program. And once an app has been launched once, it’s beyond the reach of Gatekeeper." (http://www.macworld.com/article/165408/2012/02/mountain_lion_hands_on_with_gatekeeper.html http://www.macworld.com/article/165408/2012/02/mountain_lion...)
- alanfalcon 15y ago
  C|Net reports you can override Gatekeeper on an app by app basis (even at the most restrictive setting), so as long as you trust yourself you're good: "It's also been designed to let you manually override the protection measures and install something that hasn't been signed, even if your settings are turned all the way up to App Store only."
tptacek 15y ago
This seems to me like a good feature, one that finds an actual good use for code signing on OS X. What's the issue?
- dchest 15y ago
  The issue is that Apple is the only certification authority.
  - tptacek 15y ago
    There is no other reasonable way to implement that feature that would scale across Apple's customer base. If you don't like it, they provided the third option ("Ignore all this code signing stuff").
    - dchest 15y ago
      There is a way. Allow at least one more certification authority. Let, say, Verisign sell code signing certificates for OS X. This will ensure that Apple is not the only party in control of which software runs on Macs. I have the third option, but I will also have to explain this option to the users of my software. Plus, the option is not granular -- it seems like you cannot disallow all unsigned software, but make exceptions.
      - tptacek 15y ago
        This feature would not be better if the sewer vampires that run the SSL CAs got to control it.
        dchest 15y ago
        1. Will it prevent Apple from controlling which software runs on Macs? Yes. 2. Will the code signing scheme be more vulnerable to malware because of the third-party CA? _____ (fill in)
        15y ago
keeran 15y ago
Some inline context - this appears to be about protecting against malicious software. Was always going to catch flak :) http://www.apple.com/macosx/mountain-lion/features.html#gatekeeper http://www.apple.com/macosx/mountain-lion/features.html#gate...
kibwen 15y ago
I came here just to post this exact snippet. Does this seem at all ominous to anyone else? Perhaps I'm overreacting.
- Craiggybear 15y ago
  Oh no, not ominous at all ... look for this list of three choices being reduced to the first two. Coming soon.
  - ChrisLTD 15y ago
    If Apple did that they'd kill the devotion from the development community. They may end up making App Store only the default option, but I have trouble seeing a day where you can only install Apple certified software on your Mac. Overnight they'd lose many thousands evangelists and unpaid tech support staff (ever help a family member with their Mac?).
    - orangecat 15y ago
      If Apple did that they'd kill the devotion from the development community. Like with iOS? Hackers will be annoyed, but Apple doesn't care about them when there are more than enough developers who are either in it for the money or who agree with Apple's position.
      - ChrisLTD 15y ago
        iOS started off as a closed environment unsuitable for development. As a web developer on the Mac I'm constantly using cross-platform command line programs, system utilities, and other development tools that would never make it through an Apple vetting process. If Apple killed the ability to install those programs in an update, I would absolutely have to abandon the Mac, and I'm sure I wouldn't be alone.
        fpgeek 15y ago
        I'm sure you wouldn't be alone. However, from Apple's perspective, if there are "enough" developers who can't or won't leave (because they develop Mac software or iOS software or both), Apple might not care if you do.
morisy 15y ago
Well, there were signals that something would change as soon as Apple launched the App Store for OS X. I think having signed developer ID's, with the option of allowing unsigned, is an OK step and might even bode for a more open iOS platform ... down the line. All in all, of the two ways it was likely to go (allowing only App Store apps by default, or allowing only signed Apps that meeting certain criteria), I think this is the much more palatable one.
deleted 15y ago
[deleted]
- deleted 15y ago
  [deleted]
dsr_ 15y ago
Look for new scripts for Apple support: Sir, please click on About this Mac: if there is an icon of a signed page, we are good, but if it has a circle-and-slash around it, well, your Mac is running some unsigned software. Your warranty is void. Please go to the application list in Finder to see which apps you must uninstall...
mmahemoff 15y ago
And we'll probably see that default move another level up the list by the time 11.0 comes round, before the other options disappear altogether on at least some devices (Macbook Air and Mac Mini perhaps). I know a lot of people won't like it, it's the equivalent of locking up the box with proprietary screwdrivers, but these restrictions do make life a lot easier for regular users and the people who have to support them. Also, it's nice to have a choice of operating systems. This kind of thing fits in with the siloed approach Apple takes across the board, so for dedicated Apple users it's not evil, it's just an improvement on what they're already used to.
- mike-cardwell 15y ago
  And then Apple will be able to start charging for developer IDs. To help prevent malware authors obtaining developer IDs of course.
  - rsynnott 15y ago
    And then, Apple will come to your house, and eat your cat.
  - mmahemoff 15y ago
    $99 apparently http://techcrunch.com/2012/02/16/os-x-mountain-lion/ http://techcrunch.com/2012/02/16/os-x-mountain-lion/ but revenue from developers is not the business model here.
  - Johngibb 15y ago
    They're letting developers use a free Apple ID to sign apps. You only need to pay if you're distributing through the Mac App Store.
    - mike-cardwell 15y ago
      Yes, but my point was in the future, once apps must be signed, it is not unreasonable to imagine them introducing a fee, with the excuse that they need to do this to introduce more barriers for malware authors.
rauljara 15y ago
This is a preference in system preferences that is pretty easy to change. I don't think it's entirely unreasonable to say that if you can't figure out how to change it, you probably would have trouble figuring out what's safe to install on your computer anyway. You'd also probably have trouble finding things to install on your computer that you didn't get at best buy (would be signed anyway), through the app store (would be signed anyway), or through a malicious site trying to get you to install some fake virus scan scam (wouldn't want). But it's not going to slow down developers, or even kids who like to explore.
- mistercow 15y ago
  Edit: Actually it looks like I may be mistaken about this. There is some confusion in the press currently about whether a paid developer program will be required for obtaining signing keys. If not, this is only a minor encroachment of control. > This is a preference in system preferences that is pretty easy to change. That doesn't matter. It means that if I want people to use my software, I will now have no choice but to join Apple's $99/year Mac Developer program. Time to port to Linux/Windows.
  - deleted 15y ago
    [deleted]
  - w01fe 15y ago
    FTA: "It’s a system whereby developers can sign up for free-of-charge Apple developer IDs which they can then use to cryptographically sign their applications."
    - mistercow 15y ago
      Yes, as I noted in my edit, there seems to be some confusion about this in the media. Some sources are saying that you will have to be a member of the Mac Developer Program (which costs $99/year), while others are saying the signing service is free of charge. Here's Apple's own page on the matter: http://www.apple.com/macosx/mountain-lion/security.html http://www.apple.com/macosx/mountain-lion/security.html > Apple wants to help you steer clear of malware even when you download applications from places other than the Mac App Store. That’s why Apple created the Developer ID. As part of the Mac Developer Program, Apple gives developers a unique Developer ID for signing their apps. This seems strongly to imply that a Mac Developer Program membership is required for code signing. I very much hope that their phrasing is merely imprecise, and if not, that they will change their minds and provide free signing. I love OS X as a development program, but I will leave it behind if they start down this path.
twoodfin 15y ago
Everyone's focusing on this switch, but the switch isn't the real issue. As many have pointed out, there's no reason Apple wouldn't want to leave it around indefinitely. If I were a Mac developer with a skepticism about Apple's increasingly tight grip on their platform, I'd be much more concerned about the widening circle of APIs that are unavailable to non-App Store apps.
- fpgeek 15y ago
  You're right that the rise of Mac App Store-only APIs is more troubling. This is a "boil the frog slowly" trick. Today, you can run all the unapproved software you want, but, someday, if Apple makes the APIs compelling enough, you won't want to. That being said, it isn't like the switch (and its parameters) and the development of Mac App Store-only APIs can't be trends that reinforce each other, of course.
- ezy 15y ago
  Is this just iCloud, or something else? Needing to be in the app store (or signed) to use iCloud makes perfect sense to me. If you don't want to do that, simply use Dropbox -- which works better anyway (at the moment).
mnutt 15y ago
Interesting. Let's say I'm a developer writing a Bittorrent client. Do I leave it unsigned and get lower adoption because people are afraid of malware, or do I sign it and hope that Apple doesn't someday revoke my key? Of course, Apple could have done this before. They could push out an OS update that wiped an app from everyone's computers. But that was a huge undertaking and now they have a process that is generally accepted from the App Store, and I wouldn't be surprised if we start to see it more regularly. Edit: Apple wouldn't even have to be against Bittorrent clients. They could just get sued by record labels and lose, and then a judge would say "You built the capability to remotely disable apps, so use it to disable this one."
- Zirro 15y ago
  Are you making the assumption that people would be afraid of your application because it could potentially be malware, or because they don't want to switch to the third mode? If it's the latter, I hope the control is on an individual applications basis so that I am alerted about other unsigned applications even after having allowed yours. If it's about the first, I think the users who can get a Bittorrent client up and running (and have an interest in it, in the first place) are also able to read reviews and ask friends who may have recommended them this application.
- jkubicek 15y ago
  Practically speaking, I don't see this being much of a problem. If Apple does disable your app, but your app is not malicious and users actually want it, they can just return to your site and download an unsigned version. This would be a minor annoyance to your users, but if you are having the kinds of troubles that cause Apple to disable your app, you probably have much bigger things to worry about than a few thousand customers downloading your app again.
bhousel 15y ago
We're not quite here yet. I think a better version of Gatekeeper would offer: Only those from Trusted Sources Only those from Trusted Sources or which are signed by a developer ID Any app, whether signed or unsigned Where "trusted sources" is something that future Gatekeeper would give you control over. Enterprises spend a ridiculous amount of effort in locking down and pushing out software to workstations, so allowing them to maintain their own code-signed internal "app store" could be game changing. Apple has almost no enterprise presence, and this could be an opportunity for them to steal market share from Microsoft, who lately appears directionless and out of touch.
- 286c8cb04bda 15y ago
  Apple has an enterprise version[1] of the iOS App Store available. I'd wager that an equivalent for the Mac App Store is pretty likely. [1] https://developer.apple.com/programs/ios/enterprise/ https://developer.apple.com/programs/ios/enterprise/

by dchest 15y ago

narkee 15y ago

Say I use my Macbook for development, and I compile a small toy C program using gcc. Does that mean now that I cannot run the produced binary by default? Forgive me for being naive, but what does "app" mean in this context? Is a shell script an app? What about a python script with GUI elements?

tptacek 15y ago
No, it does not mean that.
- Craiggybear 15y ago
  Sources?
  - tptacek 15y ago
    The actual article you just read, for one. The way code signing is implemented today, for another.
Craiggybear 15y ago
Good question. I can't see this just yet, but it will happen. Probably by 10.9 which won't even have a command prompt -- or at least not one you can access easily without invalidating warranty or some such nonsense.
- batista 15y ago
  Yeah, or 10.30, which will not even have a UI, just an OS-to-Mind interface. Can we please stop repeating BS? People like to make it sound like some kind of slippery slope, but including Mountain Lion, NOTHING has been taken away from users re: freedom, from OS X 10.0.1 to 10.8. In addition to running whatever from whatever, 10.7 gave you the option to use an App repository. You know, like the one, say, Debian had from decades, only not restricted to OSS. In addition to running whatever from whatever AND from the App Store, 10.8 adds the ability to only run signed apps. You, know, like the security solution that is considered one of most effective ones by security boffins.
  - daeken 15y ago
    > NOTHING has been taken away from users re: freedom, from OS X 10.0.1 to 10.8. Well, no, that's not quite true. See also: PTRACE_DENY_ATTACH in random binaries (e.g. iTunes) and the gimped DTrace implementation. Are these showstoppers or the end of freedom as we know it? Not be a long, long way. Are they (fairly small) limitations on the freedom of users? Yes.
    - wtallis 15y ago
      Introducing new features that aren't completely open is not the same as taking away existing freedoms.
- k-mcgrady 15y ago
  Why do you feel the need to be so overdramatic? You don't seriously believe that do you? Many users regularly need access to the Terminal. Developers for one user it all the time. I use it for git. Many people (including non-developers) use vi. People run scripts from it and use it for automation.
hazov 15y ago
Even if this is the case I believe this would mean that the third setting will allow you to run anything just fine, but I believe this will only apply to .app folders that are the bundled applications.
gkefalas 15y ago
Nope, you'll be able to run it: "Finally, it’s important to note that because Gatekeeper uses the File Quarantine system, it only works the very first time you try to launch an app, and even then only when it’s been downloaded from an app on your Mac like a web browser or email program. And once an app has been launched once, it’s beyond the reach of Gatekeeper." (http://www.macworld.com/article/165408/2012/02/mountain_lion_hands_on_with_gatekeeper.html http://www.macworld.com/article/165408/2012/02/mountain_lion...)
alanfalcon 15y ago
C|Net reports you can override Gatekeeper on an app by app basis (even at the most restrictive setting), so as long as you trust yourself you're good: "It's also been designed to let you manually override the protection measures and install something that hasn't been signed, even if your settings are turned all the way up to App Store only."

tptacek 15y ago

This seems to me like a good feature, one that finds an actual good use for code signing on OS X. What's the issue?

dchest 15y ago
The issue is that Apple is the only certification authority.
- tptacek 15y ago
  There is no other reasonable way to implement that feature that would scale across Apple's customer base. If you don't like it, they provided the third option ("Ignore all this code signing stuff").
  - dchest 15y ago
    There is a way. Allow at least one more certification authority. Let, say, Verisign sell code signing certificates for OS X. This will ensure that Apple is not the only party in control of which software runs on Macs. I have the third option, but I will also have to explain this option to the users of my software. Plus, the option is not granular -- it seems like you cannot disallow all unsigned software, but make exceptions.
    - tptacek 15y ago
      This feature would not be better if the sewer vampires that run the SSL CAs got to control it.
      - dchest 15y ago
        1. Will it prevent Apple from controlling which software runs on Macs? Yes. 2. Will the code signing scheme be more vulnerable to malware because of the third-party CA? _____ (fill in)
        15y ago

keeran 15y ago

Some inline context - this appears to be about protecting against malicious software. Was always going to catch flak :) http://www.apple.com/macosx/mountain-lion/features.html#gatekeeper http://www.apple.com/macosx/mountain-lion/features.html#gate...

kibwen 15y ago

I came here just to post this exact snippet. Does this seem at all ominous to anyone else? Perhaps I'm overreacting.

Craiggybear 15y ago
Oh no, not ominous at all ... look for this list of three choices being reduced to the first two. Coming soon.
- ChrisLTD 15y ago
  If Apple did that they'd kill the devotion from the development community. They may end up making App Store only the default option, but I have trouble seeing a day where you can only install Apple certified software on your Mac. Overnight they'd lose many thousands evangelists and unpaid tech support staff (ever help a family member with their Mac?).
  - orangecat 15y ago
    If Apple did that they'd kill the devotion from the development community. Like with iOS? Hackers will be annoyed, but Apple doesn't care about them when there are more than enough developers who are either in it for the money or who agree with Apple's position.
    - ChrisLTD 15y ago
      iOS started off as a closed environment unsuitable for development. As a web developer on the Mac I'm constantly using cross-platform command line programs, system utilities, and other development tools that would never make it through an Apple vetting process. If Apple killed the ability to install those programs in an update, I would absolutely have to abandon the Mac, and I'm sure I wouldn't be alone.
      - fpgeek 15y ago
        I'm sure you wouldn't be alone. However, from Apple's perspective, if there are "enough" developers who can't or won't leave (because they develop Mac software or iOS software or both), Apple might not care if you do.

morisy 15y ago

Well, there were signals that something would change as soon as Apple launched the App Store for OS X. I think having signed developer ID's, with the option of allowing unsigned, is an OK step and might even bode for a more open iOS platform ... down the line. All in all, of the two ways it was likely to go (allowing only App Store apps by default, or allowing only signed Apps that meeting certain criteria), I think this is the much more palatable one.

deleted 15y ago

[deleted]

deleted 15y ago
[deleted]

dsr_ 15y ago

Look for new scripts for Apple support: Sir, please click on About this Mac: if there is an icon of a signed page, we are good, but if it has a circle-and-slash around it, well, your Mac is running some unsigned software. Your warranty is void. Please go to the application list in Finder to see which apps you must uninstall...

mmahemoff 15y ago

And we'll probably see that default move another level up the list by the time 11.0 comes round, before the other options disappear altogether on at least some devices (Macbook Air and Mac Mini perhaps). I know a lot of people won't like it, it's the equivalent of locking up the box with proprietary screwdrivers, but these restrictions do make life a lot easier for regular users and the people who have to support them. Also, it's nice to have a choice of operating systems. This kind of thing fits in with the siloed approach Apple takes across the board, so for dedicated Apple users it's not evil, it's just an improvement on what they're already used to.

mike-cardwell 15y ago
And then Apple will be able to start charging for developer IDs. To help prevent malware authors obtaining developer IDs of course.
- rsynnott 15y ago
  And then, Apple will come to your house, and eat your cat.
- mmahemoff 15y ago
  $99 apparently http://techcrunch.com/2012/02/16/os-x-mountain-lion/ http://techcrunch.com/2012/02/16/os-x-mountain-lion/ but revenue from developers is not the business model here.
- Johngibb 15y ago
  They're letting developers use a free Apple ID to sign apps. You only need to pay if you're distributing through the Mac App Store.
  - mike-cardwell 15y ago
    Yes, but my point was in the future, once apps must be signed, it is not unreasonable to imagine them introducing a fee, with the excuse that they need to do this to introduce more barriers for malware authors.

rauljara 15y ago

This is a preference in system preferences that is pretty easy to change. I don't think it's entirely unreasonable to say that if you can't figure out how to change it, you probably would have trouble figuring out what's safe to install on your computer anyway. You'd also probably have trouble finding things to install on your computer that you didn't get at best buy (would be signed anyway), through the app store (would be signed anyway), or through a malicious site trying to get you to install some fake virus scan scam (wouldn't want). But it's not going to slow down developers, or even kids who like to explore.

mistercow 15y ago
Edit: Actually it looks like I may be mistaken about this. There is some confusion in the press currently about whether a paid developer program will be required for obtaining signing keys. If not, this is only a minor encroachment of control. > This is a preference in system preferences that is pretty easy to change. That doesn't matter. It means that if I want people to use my software, I will now have no choice but to join Apple's $99/year Mac Developer program. Time to port to Linux/Windows.
- deleted 15y ago
  [deleted]
- w01fe 15y ago
  FTA: "It’s a system whereby developers can sign up for free-of-charge Apple developer IDs which they can then use to cryptographically sign their applications."
  - mistercow 15y ago
    Yes, as I noted in my edit, there seems to be some confusion about this in the media. Some sources are saying that you will have to be a member of the Mac Developer Program (which costs $99/year), while others are saying the signing service is free of charge. Here's Apple's own page on the matter: http://www.apple.com/macosx/mountain-lion/security.html http://www.apple.com/macosx/mountain-lion/security.html > Apple wants to help you steer clear of malware even when you download applications from places other than the Mac App Store. That’s why Apple created the Developer ID. As part of the Mac Developer Program, Apple gives developers a unique Developer ID for signing their apps. This seems strongly to imply that a Mac Developer Program membership is required for code signing. I very much hope that their phrasing is merely imprecise, and if not, that they will change their minds and provide free signing. I love OS X as a development program, but I will leave it behind if they start down this path.

twoodfin 15y ago

Everyone's focusing on this switch, but the switch isn't the real issue. As many have pointed out, there's no reason Apple wouldn't want to leave it around indefinitely. If I were a Mac developer with a skepticism about Apple's increasingly tight grip on their platform, I'd be much more concerned about the widening circle of APIs that are unavailable to non-App Store apps.

fpgeek 15y ago
You're right that the rise of Mac App Store-only APIs is more troubling. This is a "boil the frog slowly" trick. Today, you can run all the unapproved software you want, but, someday, if Apple makes the APIs compelling enough, you won't want to. That being said, it isn't like the switch (and its parameters) and the development of Mac App Store-only APIs can't be trends that reinforce each other, of course.
ezy 15y ago
Is this just iCloud, or something else? Needing to be in the app store (or signed) to use iCloud makes perfect sense to me. If you don't want to do that, simply use Dropbox -- which works better anyway (at the moment).

mnutt 15y ago

Interesting. Let's say I'm a developer writing a Bittorrent client. Do I leave it unsigned and get lower adoption because people are afraid of malware, or do I sign it and hope that Apple doesn't someday revoke my key? Of course, Apple could have done this before. They could push out an OS update that wiped an app from everyone's computers. But that was a huge undertaking and now they have a process that is generally accepted from the App Store, and I wouldn't be surprised if we start to see it more regularly. Edit: Apple wouldn't even have to be against Bittorrent clients. They could just get sued by record labels and lose, and then a judge would say "You built the capability to remotely disable apps, so use it to disable this one."

Zirro 15y ago
Are you making the assumption that people would be afraid of your application because it could potentially be malware, or because they don't want to switch to the third mode? If it's the latter, I hope the control is on an individual applications basis so that I am alerted about other unsigned applications even after having allowed yours. If it's about the first, I think the users who can get a Bittorrent client up and running (and have an interest in it, in the first place) are also able to read reviews and ask friends who may have recommended them this application.
jkubicek 15y ago
Practically speaking, I don't see this being much of a problem. If Apple does disable your app, but your app is not malicious and users actually want it, they can just return to your site and download an unsigned version. This would be a minor annoyance to your users, but if you are having the kinds of troubles that cause Apple to disable your app, you probably have much bigger things to worry about than a few thousand customers downloading your app again.

bhousel 15y ago

We're not quite here yet. I think a better version of Gatekeeper would offer: Only those from Trusted Sources Only those from Trusted Sources or which are signed by a developer ID Any app, whether signed or unsigned Where "trusted sources" is something that future Gatekeeper would give you control over. Enterprises spend a ridiculous amount of effort in locking down and pushing out software to workstations, so allowing them to maintain their own code-signed internal "app store" could be game changing. Apple has almost no enterprise presence, and this could be an opportunity for them to steal market share from Microsoft, who lately appears directionless and out of touch.

286c8cb04bda 15y ago
Apple has an enterprise version[1] of the iOS App Store available. I'd wager that an equivalent for the Mac App Store is pretty likely. [1] https://developer.apple.com/programs/ios/enterprise/ https://developer.apple.com/programs/ios/enterprise/