9 ms·

Read what Gruber writes about that Gatekeep feature: My favorite Mountain Lion feature, though, is one that hardly even has a visible interface. Apple is calli

by st3fan 15y ago

Read what Gruber writes about that Gatekeep feature: My favorite Mountain Lion feature, though, is one that hardly even has a visible interface. Apple is calling it “Gatekeeper”. It’s a system whereby developers can sign up for free-of-charge Apple developer IDs which they can then use to cryptographically sign their applications. If an app is found to be malware, Apple can revoke that developer’s certificate, rendering the app (along with any others from the same developer) inert on any Mac where it’s been installed. In effect, it offers all the security benefits of the App Store, except for the process of approving apps by Apple. Users have three choices which type of apps can run on Mountain Lion: * Only those from the App Store * Only those from the App Store or which are signed by a developer ID * Any app, whether signed or unsigned The default for this setting is, I say, exactly right: the one in the middle, disallowing only unsigned apps. This default setting benefits users by increasing practical security, and also benefits developers, preserving the freedom to ship whatever software they want for the Mac, with no approval process.

pilif 15y ago
Gruber was telling that the Apple ID was going to be free. It isn't. It requires a Mac Developer account as far as I could understand it. When I was 15 I wrote a Taskbar dialer for Windows 9x and later NT (this was in the modem days. Of course I haven't updated it in ages and the only reason my old webpage is still there is because I found it by accident in an old backup, but here is a google search for it: https://www.google.com/search?ie=UTF-8&q=RasInTask https://www.google.com/search?ie=UTF-8&q=RasInTask). I published that on the various download pages and it was good enough to even be featured in dead-tree publications. Back then I had no permission to use a computer ("they make you stupid" was my parents argument) and certainly no credit card to pay anybody to do development - and even then, as a minor I would probably never have gotten that certificate. With this rule in place I would never have been able to publish that dialer. I would never have felt how it is to make something that others can use and find useful. I would never have ended up where I am today. Does this stop malware? Does this stop fraudulent call centers? Does this stop malicious people from telling people to turn it off and then still installing the malware? No. Does it stop people like me from ever getting to their career of their dreams? Likely. I might be an old fart, but this is far from acceptable.
- jbrennan 15y ago
  >Back then I had no permission to use a computer ("they make you stupid" was my parents argument) and certainly no credit card to pay anybody to do development - and even then, as a minor I would probably never have gotten that certificate. Yes but things change. Old fart or not, you're into technology, we all have to realize things change!
  - chairface 15y ago
    And he's saying that this change is for the worse. He has made substantive arguments, and you have responded with a useless platitude.
- Tyrannosaurs 15y ago
  Hold on, XCode is free (without a developer login) you could install that and write the app. You can then publish it on websites exactly as you did and those who choose the appropriate security setting can run it. You have a smaller audience yes, but you can still do what you did. And while this doesn't stop Malware, it does raise the bar a little higher. Out of interest how would you feel about it if developer licenses were free for students?
  - pilif 15y ago
    Out of interest how would you feel about it if developer licenses were free for students? I would be much happier (to the effect of actually seeing more good than bad in this restriction) if getting that ID was a matter of filling out a form an passing a turing test - so, for example, if any apple ID could be used to get a signing certificate, that would be much better. (edit: this is not about the money. It's about they way of payment (minors don't have credit cards) and the required paperwork that, among other things, require you to be an adult)
    - Tyrannosaurs 15y ago
      That's interesting. My feeling is that the problem her is with the Apple Developer network rather than the functionality - I think the functionality just highlights the problem. Personally I'd like to see the price on Developer licenses dropped and made free for full time or part time students. I think it would make commercial and PR sense for Apple too - show that they are developer friendly and make the Mac attractive as the machine of choice for the next generation of programmers (who will then also be a shoe in on coding iOS apps).
mike-cardwell 15y ago
Malware writers will just get free ids and sign their malware. Will all of these OSX devices be regularly polling Apple to get a list of revoked certs? I guess this would be useful to prevent malware being installed, but it's not going to be massively useful to remove already installed malware. Especially if that malware can interrupt the polling. I wonder how difficult it will be to get developer IDs. Might be a market for them. Will be fun to uninstall a developers software from every machine by stealing his cert, releasing some malware signed with it, and then waiting for Apple to push out a revocation cert.
- st3fan 15y ago
  If you are worried about that then just allow apps from the Mac App store? For many people that will be a good choice.
- JonnieCache 15y ago
  >Malware writers will just get free ids and sign their malware. Or, the signing key will be stolen, like it always is. I'd wager that blackhats around the world are currently tendering to cartels for this contract as we speak.
  - shadowfiend 15y ago
    Neither of these will work, because (a) the signing key is per-developer and (b) the entire point is that when your malware is found to be signed with key X, key X is revoked and your software no longer runs. That's the purpose of the system...
    - rmc 15y ago
      So the signing key for $COMPANY will now be worth money for extorsion.
      - shadowfiend 15y ago
        And is, again, instantly revokable. It'll be annoying if it's stolen, but you just revoke it, give the company the new one, and update the app in the app store (or your download, if you're not in the store). This is arguably far better than being unknowingly hit by malware.
josteink 15y ago
Read what Gruber writes about that Gatekeep feature: Read what the world's biggest Mac-shill has to say to defend the world's least open company and biggest patent-troll? Thanks, but no thanks. I'll go for something open and free, and you wont get anything like that out of Cupertino.
- ceol 15y ago
  >you wont get anything like that out of Cupertino. You do know the core OS, Darwin[0], is open source? See also http://opensource.apple.com/ http://opensource.apple.com/ You may have even heard of a little rendering engine named WebKit that Apple helped create. [0]: http://en.wikipedia.org/wiki/Darwin_(operating_system) http://en.wikipedia.org/wiki/Darwin_(operating_system)
andyjohnson0 15y ago
I'm wondering if Apple have described the circumstances, apart from the malware scenario, in which they would revoke a developer ID and the associated signing certificate? Also, do users get the choice to accept a certificate revocation?
mnutt 15y ago
It preserves the freedom for developers to ship whatever they want, though I wouldn't say it benefits them. But it's within the realm of possibility for Apple to start refusing support to users who disable GateKeeper. I would disable it anyway, but how many other users would?

by st3fan 15y ago

pilif 15y ago

Gruber was telling that the Apple ID was going to be free. It isn't. It requires a Mac Developer account as far as I could understand it. When I was 15 I wrote a Taskbar dialer for Windows 9x and later NT (this was in the modem days. Of course I haven't updated it in ages and the only reason my old webpage is still there is because I found it by accident in an old backup, but here is a google search for it: https://www.google.com/search?ie=UTF-8&q=RasInTask https://www.google.com/search?ie=UTF-8&q=RasInTask). I published that on the various download pages and it was good enough to even be featured in dead-tree publications. Back then I had no permission to use a computer ("they make you stupid" was my parents argument) and certainly no credit card to pay anybody to do development - and even then, as a minor I would probably never have gotten that certificate. With this rule in place I would never have been able to publish that dialer. I would never have felt how it is to make something that others can use and find useful. I would never have ended up where I am today. Does this stop malware? Does this stop fraudulent call centers? Does this stop malicious people from telling people to turn it off and then still installing the malware? No. Does it stop people like me from ever getting to their career of their dreams? Likely. I might be an old fart, but this is far from acceptable.

jbrennan 15y ago
>Back then I had no permission to use a computer ("they make you stupid" was my parents argument) and certainly no credit card to pay anybody to do development - and even then, as a minor I would probably never have gotten that certificate. Yes but things change. Old fart or not, you're into technology, we all have to realize things change!
- chairface 15y ago
  And he's saying that this change is for the worse. He has made substantive arguments, and you have responded with a useless platitude.
Tyrannosaurs 15y ago
Hold on, XCode is free (without a developer login) you could install that and write the app. You can then publish it on websites exactly as you did and those who choose the appropriate security setting can run it. You have a smaller audience yes, but you can still do what you did. And while this doesn't stop Malware, it does raise the bar a little higher. Out of interest how would you feel about it if developer licenses were free for students?
- pilif 15y ago
  Out of interest how would you feel about it if developer licenses were free for students? I would be much happier (to the effect of actually seeing more good than bad in this restriction) if getting that ID was a matter of filling out a form an passing a turing test - so, for example, if any apple ID could be used to get a signing certificate, that would be much better. (edit: this is not about the money. It's about they way of payment (minors don't have credit cards) and the required paperwork that, among other things, require you to be an adult)
  - Tyrannosaurs 15y ago
    That's interesting. My feeling is that the problem her is with the Apple Developer network rather than the functionality - I think the functionality just highlights the problem. Personally I'd like to see the price on Developer licenses dropped and made free for full time or part time students. I think it would make commercial and PR sense for Apple too - show that they are developer friendly and make the Mac attractive as the machine of choice for the next generation of programmers (who will then also be a shoe in on coding iOS apps).

mike-cardwell 15y ago

Malware writers will just get free ids and sign their malware. Will all of these OSX devices be regularly polling Apple to get a list of revoked certs? I guess this would be useful to prevent malware being installed, but it's not going to be massively useful to remove already installed malware. Especially if that malware can interrupt the polling. I wonder how difficult it will be to get developer IDs. Might be a market for them. Will be fun to uninstall a developers software from every machine by stealing his cert, releasing some malware signed with it, and then waiting for Apple to push out a revocation cert.

st3fan 15y ago
If you are worried about that then just allow apps from the Mac App store? For many people that will be a good choice.
JonnieCache 15y ago
>Malware writers will just get free ids and sign their malware. Or, the signing key will be stolen, like it always is. I'd wager that blackhats around the world are currently tendering to cartels for this contract as we speak.
- shadowfiend 15y ago
  Neither of these will work, because (a) the signing key is per-developer and (b) the entire point is that when your malware is found to be signed with key X, key X is revoked and your software no longer runs. That's the purpose of the system...
  - rmc 15y ago
    So the signing key for $COMPANY will now be worth money for extorsion.
    - shadowfiend 15y ago
      And is, again, instantly revokable. It'll be annoying if it's stolen, but you just revoke it, give the company the new one, and update the app in the app store (or your download, if you're not in the store). This is arguably far better than being unknowingly hit by malware.

josteink 15y ago

Read what Gruber writes about that Gatekeep feature: Read what the world's biggest Mac-shill has to say to defend the world's least open company and biggest patent-troll? Thanks, but no thanks. I'll go for something open and free, and you wont get anything like that out of Cupertino.

ceol 15y ago
>you wont get anything like that out of Cupertino. You do know the core OS, Darwin[0], is open source? See also http://opensource.apple.com/ http://opensource.apple.com/ You may have even heard of a little rendering engine named WebKit that Apple helped create. [0]: http://en.wikipedia.org/wiki/Darwin_(operating_system) http://en.wikipedia.org/wiki/Darwin_(operating_system)

andyjohnson0 15y ago

I'm wondering if Apple have described the circumstances, apart from the malware scenario, in which they would revoke a developer ID and the associated signing certificate? Also, do users get the choice to accept a certificate revocation?

mnutt 15y ago

It preserves the freedom for developers to ship whatever they want, though I wouldn't say it benefits them. But it's within the realm of possibility for Apple to start refusing support to users who disable GateKeeper. I would disable it anyway, but how many other users would?