12 ms·

Many around these parts will make glib insinuations about the "Gatekeeper" feature heralding Apple's clawing away the freedoms of it's users, one-by-one, until

Many around these parts will make glib insinuations about the "Gatekeeper" feature heralding Apple's clawing away the freedoms of it's users, one-by-one, until we are all prisoners of "the computer as a jail made cool". However, it seems to me that Gatekeeper's presence embodies a rather more embarrassing admission that, yes, Mac OS is on the verge of needing some kind of malware protection; in the wake of the Mac Defender malware surfacing last year, it was really only a matter of time.

nirvana 15y ago
You're right, but Gatekeeper does something else: It marks the line in the sand. So long as that choice is there as an option in settings for me to make, Apple is in the right. If they ever take that choice away, and they start dictating what I can run or not run, they will have crossed that line, and lost me as a customer forever. I think a lot of people think that Apple taking away that choice is inevitable. I don't think so- I think it would be completely out of character. But if I'm wrong, I'm gone.
- deleted 15y ago
  [deleted]
  - Tyrannosaurs 15y ago
    Apple's pattern with iOS has actually been one of slowly opening up. Just web apps, then native apps with massive restrictions on what you can do and how you can build them, then native apps with a few less restrictions on what you can do and how you can build them (for instance compiled from non-objective C sources). I get that people don't like where they are now but the pattern isn't one of closing down, it's slow but in the other direction. I don't think it's a jump to assume it might keep moving if Apple see the benefit of allowing it. Gatekeeper might, just might, be them seeing how such a model might work.
    - fpgeek 15y ago
      > Apple's pattern with iOS has actually been one of slowly opening up. Tell that to Amazon or Barnes & Noble or Netflix or Hulu or anyone else burned by the In-App Purchase mess. I'd bet none of them would say Apple's pattern has been to open up iOS.
      - Tyrannosaurs 15y ago
        I should possibly have been clearer - from the perspective of software development. Even with those three it's not closed. I read Kindle books on my iPhone (and use iBooks as nothing more the a PDF reader as it goes), just the purchasing model isn't as streamlined as Amazon would like.
    - dchest 15y ago
      then native apps with massive restrictions on what you can do and how you can build them No. They originally allowed any programming language, then played a bit with disallowing anything other than C/C++/Objective-C.
- ugh 15y ago
  I think it’s right to make very clear that Apple overstepping that line would be inexcusable and evil, or else they might think people would be ok with that. So a bit of outrage isn’t altogether a bad thing, really. (Although it’s pretty obvious that acting like Apple already overstepped that line or will certainly overstep that line in the future is very childish.)
- tptacek 15y ago
  It's a sensible feature, and there's no reasonable way to implement it without that settings option, and the options they've chosen make total sense. I agree with you: not having the option would be very bad... but it's very unlikely they'll ever take the option away. Why would they? The overwhelming majority of their users will never touch it.
  - yequalsx 15y ago
    Right now there is no need to take the option away. You are certainly correct about that. Microsoft is going to soon start pushing its users to buy from its app store. I can see a future in which only 'trusted' programs can be run on new computers. Trusted here means programs approved by Apple/Microsoft and the national government of the country in which your computer resides. I don't know how likely this would be but China seems to like to have a lot of control over the computing its citizens do.
    - tptacek 15y ago
      Sure is handy for China how easy it is to get a keylogger installed on someone's computer, isn't it?
      - yequalsx 15y ago
        Yes. Unfortunately control of citizens' computing is one area that China leads in. Other national government appear to be envious of this control seek to emulate it.
        mbateman 15y ago
        I think you may be missing tptacek's point. Things like code signing make it harder for bad things to run without the user's permission.
        yequalsx 15y ago
        If option 3 is removed then how is this so? It's not in Apple's interest right now to do this. In five years? Maybe China decides that in order to get access to its market Option 3 must not be available. Maybe Gatekeeper gets enhanced in the future. Obviously this is hypothetical but given the trend toward national surveillance is it hard to imagine that this can happen?
- MatthewPhillips 15y ago
  What I'm curious about is how they'll present this to users who try to install an unsigned application the first time. Will they educate the user, and provide a way to get to the Settings and change it if they want? Or will they present it in such a way that 90% of users give up and assume the installer is broken.
  - Maxious 15y ago
    Just as long as they don't present it the way Windows does - pretty much the same dialog boxes but one has a blue banner (signed) and one has a yellow banner (unsigned).
  - wtallis 15y ago
    Remember that most Mac apps don't have an installer - they're self-contained, and installing consists of extracting the DMG and putting the app on your hard drive. The notification will probably take the same form as the error message you get upon trying to launch a PowerPC app on 10.6 without Rosetta installed.
    - dedward 15y ago
      TO be fair, even apps without an installer will open a warning dialogue the first time it's actually run letting the user know this is an application that's "new" and hasn't been run before. Also - as long as Apple makes it easy for developers to get signing keys, which seems to be their direction as far as OS X goes, there's no reason for developers to complain about it too much. Just sign your builds, and you probably avoid any warning message.
- rryan 15y ago
  But will you be able to leave with your data? Or will it be locked in to iCloud?
  - k-mcgrady 15y ago
    iCloud is not a drive you store your data on. iCloud syncs data and changes between your devices. So you have local copies of a document on your iPhone and Mac. Make a change on your Mac and it will show up on the iPhone. Both devices have local copies. In other words you will always have your data. The only things stored on iCloud are device backups and iTunes purchases.
    - jrockway 15y ago
      In other words you will always have your data. In what format? If addresses and mail are stored like Apple stores my iTunes metadata, I'll never get them back if I stop using Apple products.
      - k-mcgrady 15y ago
        I'm not sure about mail because I don't use it but you can export your contacts as a Vcard.
      - microtherion 15y ago
        Addresses exportable as vcards, as noted above. Mail has export options for mail boxes and individual mails, plus icloud is using IMAP, so you should be able to export both from the server and the client.
      - glhaynes 15y ago
        iTunes metadata can be exported as an XML file.
- tomjen3 15y ago
  To me it depends on what happens when you attempt to run the binary. If there is an override button which remembers that setting, fine. If not, to hell with Apple.
- mikeash 15y ago
  I'm curious, what makes you say that taking away that choice is completely out of character when they've already done so on a different, more popular platform?
  - evan_ 15y ago
    they never gave you that choice on iOS, so they never took it away, did they?
    - mikeash 15y ago
      Never giving the choice in the first place is stronger, not weaker, than giving it and then taking it away.
      - kemiller 15y ago
        I disagree. Pulling access to something you've come to depend on (especially, derive your livelihood from) is worse than never fostering that dependence in the first place.
        mikeash 15y ago
        I was aiming more at the idea that it would be out of character for Apple to completely restrict access to just certain sources of apps. If we're talking about whether Apple would take something away that people had come to rely upon, well, there's a whole long list of technologies I could list off to support the idea that they have no problem doing that....
        kemiller 15y ago
        Not arguing that they won't do it. Just that it's worse than never allowing something.
        mikeash 15y ago
- nextparadigms 15y ago
  Shouldn't it work the same way for iOS, too? It seems Android is the only one who's allowing you you to make that choice. Neither iOS nor WP7 allow it.
- courtewing 15y ago
  I don't necessarily think Gatekeeper is a bad thing, but I worry about the impact if Apple were to make the default setting for Gatekeeper be Mac-store-only. Having the option to install other software would be great, but such a move would further marginalize non-Apple-approved software in a huge way. Assuming a large portion of Mac users are not the type to lower default security settings, then that could have a severe impact on the way people think about software in the "wild".
- bishnu 15y ago
  Agreed on all points. I think it's far likelier that this form of tiered app access will make its way over to iOS eventually.
tptacek 15y ago
I don't want to disagree with your core point, because you're right; to a certain extent, OS X has always needed more defenses against malware than it has owned up to. But you can't find a large-scale Windows deployment anywhere that hasn't had to deal with an actual in-the-wild malware outbreak. Security people in corporate America do malware cleanups for Windows several times a week. At the same time, you'll have a hard time finding anyone in the real world that got hit by "Mac Defender".
- nikcub 15y ago
  but that is because the target plane for OS X is so small and not worthwhile. If OS X was 95% of the corporate market and made up large networks it would be targeted just as regularly as Windows is. there is nothing technically superior in OS X that prevents it from being a malware target (prob inferior to win7)
batista 15y ago
What Mac Defender malware? The one that affected 0.1% of OS X users? Not to mention: Mac Defender was a TROJAN. You HAD to install it yourself for it to work. From Wikipedia: "Mac Defender (also known as Mac Protector, Mac Security,[1]Mac Guard,[2] and Mac Shield)[3] is an internet rogue security program that can be installed by unwitting users of computers running the Mac OS X operating system". The exact same thing can happen to any operating system. You can install malware YOURSELF even in OpenBSD.
- gkefalas 15y ago
  Right, which would be rendered pretty ineffective by Gatekeeper, now, at least for people that don't know about the launch-from-disk trick or other workarounds (basically, the same people that would potentially be vulnerable). Gatekeeper's a small, small step that doesn't add much inconvenience to developers, but it does help a bit and I'm surprised at how long it's taken to arrive at something so basic & logical.
  - nkassis 15y ago
    I'd be surprised that people would just turn that feature off pretty quickly after getting a new Mac. There are tons of application out there that aren't sign and aren't malware. People will come to view this feature like the annoying warning about bad SSL certs.
    - glassx 15y ago
      ...or UAC on Windows Vista/Seven.
    - gkefalas 15y ago
      Hm, that's a good point: "warning fatigue" that users get. I hadn't thought about it from that point of view; I guess how fatiguing it is will really depend on how quickly developers in general get aboard the "sign your application" train, so I'd be curious to see the response from the legions of independent Mac software developers that aren't using the App Store for delivery.
    - 15y ago
ByronFortescue 15y ago
There has been malware protection since Snow Leopard and Lion in the form of Xprotect. However, it can't hurt to offer an extra layer of protection with signing apps.
mcantelon 15y ago
Just like meatspace states use child pornography to justify Internet monitoring and control, Apple will use malware to justify locking down software. Not distributing software via the App Store will now remove a segment of Apple's user base from a software vendor's market so vendors will likely do whatever they can to get in the App Store. Apple now gets the ability to censor software on their non-iOS hardware.
- danudey 15y ago
  Well you could hypothesize that that's where it's going, but at the moment, they're going to allow signed, non-app-store apps by default as well. All a dev needs to do now is to sign their binary when they build it and problem solved. I can't see why anyone actively maintaining an app wouldn't make the small change required.
  - mcantelon 15y ago
    Even if you sign the binary, you are still getting shut out of the market for the segment of users that select App Store only. You pay Apple the App Store cut or you limit your market... not a great choice to have to make.
brown9-2 15y ago
I agree with this; but at the same time, what is the reason for tying the iCloud and Notification Center features to App Store installs only?
- riobard 15y ago
  Easy. iCloud syncing and storage costs money. Notifications go through Apple's servers, which also costs money to run. Apple wants its 30% share of the price to cover these costs. Make sense?
- jonhendry 15y ago
  That means iCloud won't be accessed except by applications that have been scrutinized by Apple, which cuts down on an avenue of attack by malware, and makes it less likely that an application bug will cause problems with iCloud. The first thing that comes to mind with Notification Center is that perhaps it could be used for phishing-type attacks, by presenting a notification that appears to be from something else.
Duff 15y ago
Apple is ahead of the curve -- this is coming to Windows as well, although perhaps through 3rd parties. About 2 years ago, my then employer was considered a "strategic" customer to one of the big security/AV vendors. They came in to give us their dog and pony show about the future of security, etc... which basically said that the current strategy of using AV to "blacklist" bad stuff is ineffective. (I asked the awkward question "So WTF am I paying for your ineffective AV product?") The only thing that makes me nervous about "Gatekeeper" is that it is Apple-controlled, and Apple is a mercurial vendor whom I don't really trust to do things that are in my interest. I'd be happier if I could trust other certifying authorities, which would mitigate the impact of Apple cutting of the oxygen to unsigned applications in the future.
brudgers 15y ago
I think it has less to do with a concern over malware than it does with an opportunity to further control development for the platform. I suspect Apple will retain the right to pull applications from user's computers for any TOS violation, not just those involving malware. Even when those TOS violations are due to a change in the TOS.

nirvana 15y ago

You're right, but Gatekeeper does something else: It marks the line in the sand. So long as that choice is there as an option in settings for me to make, Apple is in the right. If they ever take that choice away, and they start dictating what I can run or not run, they will have crossed that line, and lost me as a customer forever. I think a lot of people think that Apple taking away that choice is inevitable. I don't think so- I think it would be completely out of character. But if I'm wrong, I'm gone.

deleted 15y ago
[deleted]
- Tyrannosaurs 15y ago
  Apple's pattern with iOS has actually been one of slowly opening up. Just web apps, then native apps with massive restrictions on what you can do and how you can build them, then native apps with a few less restrictions on what you can do and how you can build them (for instance compiled from non-objective C sources). I get that people don't like where they are now but the pattern isn't one of closing down, it's slow but in the other direction. I don't think it's a jump to assume it might keep moving if Apple see the benefit of allowing it. Gatekeeper might, just might, be them seeing how such a model might work.
  - fpgeek 15y ago
    > Apple's pattern with iOS has actually been one of slowly opening up. Tell that to Amazon or Barnes & Noble or Netflix or Hulu or anyone else burned by the In-App Purchase mess. I'd bet none of them would say Apple's pattern has been to open up iOS.
    - Tyrannosaurs 15y ago
      I should possibly have been clearer - from the perspective of software development. Even with those three it's not closed. I read Kindle books on my iPhone (and use iBooks as nothing more the a PDF reader as it goes), just the purchasing model isn't as streamlined as Amazon would like.
  - dchest 15y ago
    then native apps with massive restrictions on what you can do and how you can build them No. They originally allowed any programming language, then played a bit with disallowing anything other than C/C++/Objective-C.
ugh 15y ago
I think it’s right to make very clear that Apple overstepping that line would be inexcusable and evil, or else they might think people would be ok with that. So a bit of outrage isn’t altogether a bad thing, really. (Although it’s pretty obvious that acting like Apple already overstepped that line or will certainly overstep that line in the future is very childish.)
tptacek 15y ago
It's a sensible feature, and there's no reasonable way to implement it without that settings option, and the options they've chosen make total sense. I agree with you: not having the option would be very bad... but it's very unlikely they'll ever take the option away. Why would they? The overwhelming majority of their users will never touch it.
- yequalsx 15y ago
  Right now there is no need to take the option away. You are certainly correct about that. Microsoft is going to soon start pushing its users to buy from its app store. I can see a future in which only 'trusted' programs can be run on new computers. Trusted here means programs approved by Apple/Microsoft and the national government of the country in which your computer resides. I don't know how likely this would be but China seems to like to have a lot of control over the computing its citizens do.
  - tptacek 15y ago
    Sure is handy for China how easy it is to get a keylogger installed on someone's computer, isn't it?
    - yequalsx 15y ago
      Yes. Unfortunately control of citizens' computing is one area that China leads in. Other national government appear to be envious of this control seek to emulate it.
      - mbateman 15y ago
        I think you may be missing tptacek's point. Things like code signing make it harder for bad things to run without the user's permission.
        yequalsx 15y ago
        If option 3 is removed then how is this so? It's not in Apple's interest right now to do this. In five years? Maybe China decides that in order to get access to its market Option 3 must not be available. Maybe Gatekeeper gets enhanced in the future. Obviously this is hypothetical but given the trend toward national surveillance is it hard to imagine that this can happen?
MatthewPhillips 15y ago
What I'm curious about is how they'll present this to users who try to install an unsigned application the first time. Will they educate the user, and provide a way to get to the Settings and change it if they want? Or will they present it in such a way that 90% of users give up and assume the installer is broken.
- Maxious 15y ago
  Just as long as they don't present it the way Windows does - pretty much the same dialog boxes but one has a blue banner (signed) and one has a yellow banner (unsigned).
- wtallis 15y ago
  Remember that most Mac apps don't have an installer - they're self-contained, and installing consists of extracting the DMG and putting the app on your hard drive. The notification will probably take the same form as the error message you get upon trying to launch a PowerPC app on 10.6 without Rosetta installed.
  - dedward 15y ago
    TO be fair, even apps without an installer will open a warning dialogue the first time it's actually run letting the user know this is an application that's "new" and hasn't been run before. Also - as long as Apple makes it easy for developers to get signing keys, which seems to be their direction as far as OS X goes, there's no reason for developers to complain about it too much. Just sign your builds, and you probably avoid any warning message.
rryan 15y ago
But will you be able to leave with your data? Or will it be locked in to iCloud?
- k-mcgrady 15y ago
  iCloud is not a drive you store your data on. iCloud syncs data and changes between your devices. So you have local copies of a document on your iPhone and Mac. Make a change on your Mac and it will show up on the iPhone. Both devices have local copies. In other words you will always have your data. The only things stored on iCloud are device backups and iTunes purchases.
  - jrockway 15y ago
    In other words you will always have your data. In what format? If addresses and mail are stored like Apple stores my iTunes metadata, I'll never get them back if I stop using Apple products.
    - k-mcgrady 15y ago
      I'm not sure about mail because I don't use it but you can export your contacts as a Vcard.
    - microtherion 15y ago
      Addresses exportable as vcards, as noted above. Mail has export options for mail boxes and individual mails, plus icloud is using IMAP, so you should be able to export both from the server and the client.
    - glhaynes 15y ago
      iTunes metadata can be exported as an XML file.
tomjen3 15y ago
To me it depends on what happens when you attempt to run the binary. If there is an override button which remembers that setting, fine. If not, to hell with Apple.
mikeash 15y ago
I'm curious, what makes you say that taking away that choice is completely out of character when they've already done so on a different, more popular platform?
- evan_ 15y ago
  they never gave you that choice on iOS, so they never took it away, did they?
  - mikeash 15y ago
    Never giving the choice in the first place is stronger, not weaker, than giving it and then taking it away.
    - kemiller 15y ago
      I disagree. Pulling access to something you've come to depend on (especially, derive your livelihood from) is worse than never fostering that dependence in the first place.
      - mikeash 15y ago
        I was aiming more at the idea that it would be out of character for Apple to completely restrict access to just certain sources of apps. If we're talking about whether Apple would take something away that people had come to rely upon, well, there's a whole long list of technologies I could list off to support the idea that they have no problem doing that....
        kemiller 15y ago
        Not arguing that they won't do it. Just that it's worse than never allowing something.
        mikeash 15y ago
nextparadigms 15y ago
Shouldn't it work the same way for iOS, too? It seems Android is the only one who's allowing you you to make that choice. Neither iOS nor WP7 allow it.
courtewing 15y ago
I don't necessarily think Gatekeeper is a bad thing, but I worry about the impact if Apple were to make the default setting for Gatekeeper be Mac-store-only. Having the option to install other software would be great, but such a move would further marginalize non-Apple-approved software in a huge way. Assuming a large portion of Mac users are not the type to lower default security settings, then that could have a severe impact on the way people think about software in the "wild".
bishnu 15y ago
Agreed on all points. I think it's far likelier that this form of tiered app access will make its way over to iOS eventually.

tptacek 15y ago

I don't want to disagree with your core point, because you're right; to a certain extent, OS X has always needed more defenses against malware than it has owned up to. But you can't find a large-scale Windows deployment anywhere that hasn't had to deal with an actual in-the-wild malware outbreak. Security people in corporate America do malware cleanups for Windows several times a week. At the same time, you'll have a hard time finding anyone in the real world that got hit by "Mac Defender".

nikcub 15y ago
but that is because the target plane for OS X is so small and not worthwhile. If OS X was 95% of the corporate market and made up large networks it would be targeted just as regularly as Windows is. there is nothing technically superior in OS X that prevents it from being a malware target (prob inferior to win7)

batista 15y ago

What Mac Defender malware? The one that affected 0.1% of OS X users? Not to mention: Mac Defender was a TROJAN. You HAD to install it yourself for it to work. From Wikipedia: "Mac Defender (also known as Mac Protector, Mac Security,[1]Mac Guard,[2] and Mac Shield)[3] is an internet rogue security program that can be installed by unwitting users of computers running the Mac OS X operating system". The exact same thing can happen to any operating system. You can install malware YOURSELF even in OpenBSD.

gkefalas 15y ago
Right, which would be rendered pretty ineffective by Gatekeeper, now, at least for people that don't know about the launch-from-disk trick or other workarounds (basically, the same people that would potentially be vulnerable). Gatekeeper's a small, small step that doesn't add much inconvenience to developers, but it does help a bit and I'm surprised at how long it's taken to arrive at something so basic & logical.
- nkassis 15y ago
  I'd be surprised that people would just turn that feature off pretty quickly after getting a new Mac. There are tons of application out there that aren't sign and aren't malware. People will come to view this feature like the annoying warning about bad SSL certs.
  - glassx 15y ago
    ...or UAC on Windows Vista/Seven.
  - gkefalas 15y ago
    Hm, that's a good point: "warning fatigue" that users get. I hadn't thought about it from that point of view; I guess how fatiguing it is will really depend on how quickly developers in general get aboard the "sign your application" train, so I'd be curious to see the response from the legions of independent Mac software developers that aren't using the App Store for delivery.
  - 15y ago

ByronFortescue 15y ago

There has been malware protection since Snow Leopard and Lion in the form of Xprotect. However, it can't hurt to offer an extra layer of protection with signing apps.

mcantelon 15y ago

Just like meatspace states use child pornography to justify Internet monitoring and control, Apple will use malware to justify locking down software. Not distributing software via the App Store will now remove a segment of Apple's user base from a software vendor's market so vendors will likely do whatever they can to get in the App Store. Apple now gets the ability to censor software on their non-iOS hardware.

danudey 15y ago
Well you could hypothesize that that's where it's going, but at the moment, they're going to allow signed, non-app-store apps by default as well. All a dev needs to do now is to sign their binary when they build it and problem solved. I can't see why anyone actively maintaining an app wouldn't make the small change required.
- mcantelon 15y ago
  Even if you sign the binary, you are still getting shut out of the market for the segment of users that select App Store only. You pay Apple the App Store cut or you limit your market... not a great choice to have to make.

brown9-2 15y ago

I agree with this; but at the same time, what is the reason for tying the iCloud and Notification Center features to App Store installs only?

riobard 15y ago
Easy. iCloud syncing and storage costs money. Notifications go through Apple's servers, which also costs money to run. Apple wants its 30% share of the price to cover these costs. Make sense?
jonhendry 15y ago
That means iCloud won't be accessed except by applications that have been scrutinized by Apple, which cuts down on an avenue of attack by malware, and makes it less likely that an application bug will cause problems with iCloud. The first thing that comes to mind with Notification Center is that perhaps it could be used for phishing-type attacks, by presenting a notification that appears to be from something else.

Duff 15y ago

Apple is ahead of the curve -- this is coming to Windows as well, although perhaps through 3rd parties. About 2 years ago, my then employer was considered a "strategic" customer to one of the big security/AV vendors. They came in to give us their dog and pony show about the future of security, etc... which basically said that the current strategy of using AV to "blacklist" bad stuff is ineffective. (I asked the awkward question "So WTF am I paying for your ineffective AV product?") The only thing that makes me nervous about "Gatekeeper" is that it is Apple-controlled, and Apple is a mercurial vendor whom I don't really trust to do things that are in my interest. I'd be happier if I could trust other certifying authorities, which would mitigate the impact of Apple cutting of the oxygen to unsigned applications in the future.

brudgers 15y ago

I think it has less to do with a concern over malware than it does with an opportunity to further control development for the platform. I suspect Apple will retain the right to pull applications from user's computers for any TOS violation, not just those involving malware. Even when those TOS violations are due to a change in the TOS.