That middle option, the default, is Developer Signed applications. Apple keeps the keyring and can torch the developer's key if they go rogue, but the developer

That middle option, the default, is Developer Signed applications. Apple keeps the keyring and can torch the developer's key if they go rogue, but the developer does the signing. The model essentially matches Debian package distribution. (And as mentioned by oomkiller, this won't go down to unix, it is just the "application" launching.) Edit: pilaf's reply got down voted into oblivion. What he suggests is flawed because applications are not in your PATH. But in the spirit, your application could write malware into somewhere on the PATH, and could find an exploit to get the setuid bit turned on. As soon as someone realizes this, Apple should kill your signing key thereby blocking the distribution vector. It will not help in cleaning up the mess. The victim is still looking at an "erase disk, reinstall, restore backup DATA ONLY!" recovery as they should anytime they lose control of a machine.