5 ms·

so you cannot build apps for mac unless you pay the dev fees? even if you do the whole distribution yourself and avoid app store?

Hamuko 3y ago
You can build and distribute them, but it's very ugly. When a person first tries to open your unsigned and unnotarized application, they get a big warning that the app cannot be opened. They need to actively whitelist it by going to the system settings or by right-clicking the application bundle and selecting "Open" from the menu. And the warning that it gives to users is such that your average user won't even have any idea that whitelisting is an option. https://support.apple.com/en-us/HT202491 https://support.apple.com/en-us/HT202491 While the process is fairly simple, it basically excludes all normal people from using your application if you don't sign them. So any application that wants to distribute outside macOS experts needs to get their application signed and notarized.
- aprilnya 3y ago
  you could put a note in the dmg (drag app to apps folder screen) that says to right click->open when opening for the first time
josephcsible 3y ago
Technically you can, but if you do, Apple will lie to everyone who tries to use your app by telling them that it's dangerous and probably contains malware, and will make them jump through a bunch of hoops and try to talk them out of it at every step before they can actually run it.
- deleted 3y ago
  [deleted]
- vachina 3y ago
  Sounds like a racket. MSFT does the same with SmartScreen, regardless whether your executables are benign or not, unless you pay them (or a third party) for a signing cert.
  - aaronbrethorst 3y ago
    Yep, AAPL has a $2.8 trillion market cap because of all the $99 fees they charge developers.
  - TeaDude 3y ago
    Oh goodness. I get this crap all the time at work. Apparently Adobe Acrobat isn't a commonly downloaded application. Somehow I fail to believe that...
    - Alupis 3y ago
      The result? Everybody ignores SmartScreen warnings now...
  - seba_dos1 3y ago
    The last time I've seen it SmartScreen did not make the option to continue completely undiscoverable though.
- pivo 3y ago
  I don't like the $99 fee either, but to be fair, Apple will tell you that they can't tell if the app is dangerous. Not that it is dangerous. Specifically, they will tell you that the app Cannot Be Opened Because the Developer Cannot be Verified You can of course open it the app anyway by disregarding this protection for the specific app in settings.
  - josephcsible 3y ago
    > Apple will tell you that they can't tell if the app is dangerous. Not that it is dangerous. Specifically, they will tell you that the app Cannot Be Opened Because the Developer Cannot be Verified Okay, how about this? They're trying their hardest to give everyone the impression that it's dangerous without explicitly saying so.
    - ris58h 3y ago
      But it is dangerous by definition. Run unknown binary is dangerous. I wish macos had an easy way to sandbox apps.
      - josephcsible 3y ago
        > But it is dangerous by definition. Run unknown binary is dangerous. Making Apple $99 richer doesn't make your app any less dangerous.
        TylerE 3y ago
        It makes random apps much less likely to be dangerous. https://news.ycombinator.com/item?id=36086537 https://news.ycombinator.com/item?id=36086537 is an analogous case. When the primary provider of free domains names went away, there was a HUGE reduction in phishing websites. Those types would spin up thouands of sites on xyz, vip and similar TLDs faster than the white hats could whackamole them. A domain going from $0 to $10 vastly curtailed that activity. You don't have to make something impossible, you just have to make it not cost effective to shot gun it.
- Domenic_S 3y ago
  > make them jump through a bunch of hoops and try to talk them out of it at every step before they can actually run it. Right click --> open --> open. 3 clicks is not "a bunch of hoops".
  - josephcsible 3y ago
    It's 3 clicks if you know how to do it, which they go out of their way to not tell you in the error you get when you try to run it like any other program.
    - derefr 3y ago
      If they told you how to do it, then what would even be the point? The whole idea is to add a stumbling block in the path of malware authors getting users to run a trojan. Anything the user learns to do by rote without first understanding the security implications provides zero security. Like the Windows Vista elevation prompt — users just learned to hit "Yes" and got infected anyway.
      - ris58h 3y ago
        > If they told you how to do it, then what would even be the point? To warn a user.
        derefr 3y ago
        And what would be the point of doing that? You have to have some behavioral outcome you expect. Do you expect people to react by not running the program? Why? If you find out that they are in fact still running the program just as much with the warning in place, because they aren't reading the warning... then have you actually "warned the user"?
  - heavyset_go 3y ago
    Users don't know that, though. macOS treats the app that they want to use like they're radioactive and don't work, and doesn't give them the explicit option of running what they want anyway. They have to know some magic ritual to open it.
- jmull 3y ago
  The message (before first run only) just says the software "can’t be opened because Apple cannot check it for malicious software." and "This software needs to be updated. Contact the developer for more information." Anyway, it's only hard to run if you have no idea what you're doing... pretty much the same people who should not be running executables randomly downloaded from the internet are the ones blocked by hurdles like this.
  - howinteresting 3y ago
    "This software needs to be updated" is an outright lie.
    - throw74775 3y ago
      No it’s not. It needs to be updated in order for it to run without that warning. If the user has permission to disable the warning, they can, otherwise the app needs to be updated.
      - howinteresting 3y ago
        Well, no, because the latest version of a lot of software will still produce the warning since the developer refuses to pay the Apple extortion fee.
      - nojonestownpls 3y ago
        Yeah, all Apple users know that "this software needs to be updated" means "the software itself is fine, the developer just needs to pay us money". It's obvious, not misleading or an attempt to create FUD at all.
        howinteresting 3y ago
        Why doesn't Apple say what you said? "The software itself might or might not be fine, the developer just needs to pay us money"? Because then their extortion racket would be laid bare to consumers. Open source and not-for-profit software has been put at a disadvantage here, which I think is very bad for several reasons.
misnome 3y ago
You can, but users need to right-click and click “open” the first time they open the app.
deleted 3y ago
[deleted]
hobo_mark 3y ago
Never used a mac, but I assume that is only for installing from the store, correct? If I publish an open source program that one installs with `brew install` or whatever it's called none of this applies?
- judge2020 3y ago
  Yes, all of it is open for development. The only thing about mac is that, if you want to distribute apps via the web, you'll need to instruct the user to bypass the code signing requirement by right-clicking on the app or DMG and clicking open from there. Getting a Developer ID code signing certificate is only available with a paid developer account.
- weaksauce 3y ago
  yes and no. you can't sign your app with a certificate so if you want to have a frictionless install you have to pay. (the friction is having to explain that you have to press ctrl while clicking and then click open and then click trust this app) command line utilities don't have this friction and brew mainly installs command line utilities (though there are app binaries distributed through a separate brew thing... keg or cask or cellar or something like that) traditionally you would need to pay the 99 bucks to install a binary on your ipad or iphone or iwatch. those need to have the certificate signed by apple to run on the phone for general security reasons so some website couldn't sideload an app. now you can do all of that without paying the 99 bucks... but if you wanted to sell it on the app store or distribute it for external testing you still need to pay.
  - dingledork69 3y ago
    > general security reasons Cash cow reasons*. The system is designed to be secure even against signed apps.
- deleted 3y ago
  [deleted]
slmjkdbtl 3y ago
Most macOS apps don't go the App Store route, but user have to manually click a checkbox in system preference to say "I allow app from any developer", it is an issue distributing to people who doesn't know a lot about software
- lapcat 3y ago
  > user have to manually click a checkbox in system preference to say "I allow app from any developer" The "Anywhere" option no longer exists in System Preferences/Settings: https://support.apple.com/HT202491 https://support.apple.com/HT202491 It was removed in macOS Sierra.
  - slmjkdbtl 3y ago
    Oh right, you need to run sudo spctl --master-disable in order to have that option

Hamuko 3y ago

You can build and distribute them, but it's very ugly. When a person first tries to open your unsigned and unnotarized application, they get a big warning that the app cannot be opened. They need to actively whitelist it by going to the system settings or by right-clicking the application bundle and selecting "Open" from the menu. And the warning that it gives to users is such that your average user won't even have any idea that whitelisting is an option. https://support.apple.com/en-us/HT202491 https://support.apple.com/en-us/HT202491 While the process is fairly simple, it basically excludes all normal people from using your application if you don't sign them. So any application that wants to distribute outside macOS experts needs to get their application signed and notarized.

aprilnya 3y ago
you could put a note in the dmg (drag app to apps folder screen) that says to right click->open when opening for the first time

josephcsible 3y ago

Technically you can, but if you do, Apple will lie to everyone who tries to use your app by telling them that it's dangerous and probably contains malware, and will make them jump through a bunch of hoops and try to talk them out of it at every step before they can actually run it.

deleted 3y ago
[deleted]
vachina 3y ago
Sounds like a racket. MSFT does the same with SmartScreen, regardless whether your executables are benign or not, unless you pay them (or a third party) for a signing cert.
- aaronbrethorst 3y ago
  Yep, AAPL has a $2.8 trillion market cap because of all the $99 fees they charge developers.
- TeaDude 3y ago
  Oh goodness. I get this crap all the time at work. Apparently Adobe Acrobat isn't a commonly downloaded application. Somehow I fail to believe that...
  - Alupis 3y ago
    The result? Everybody ignores SmartScreen warnings now...
- seba_dos1 3y ago
  The last time I've seen it SmartScreen did not make the option to continue completely undiscoverable though.
pivo 3y ago
I don't like the $99 fee either, but to be fair, Apple will tell you that they can't tell if the app is dangerous. Not that it is dangerous. Specifically, they will tell you that the app Cannot Be Opened Because the Developer Cannot be Verified You can of course open it the app anyway by disregarding this protection for the specific app in settings.
- josephcsible 3y ago
  > Apple will tell you that they can't tell if the app is dangerous. Not that it is dangerous. Specifically, they will tell you that the app Cannot Be Opened Because the Developer Cannot be Verified Okay, how about this? They're trying their hardest to give everyone the impression that it's dangerous without explicitly saying so.
  - ris58h 3y ago
    But it is dangerous by definition. Run unknown binary is dangerous. I wish macos had an easy way to sandbox apps.
    - josephcsible 3y ago
      > But it is dangerous by definition. Run unknown binary is dangerous. Making Apple $99 richer doesn't make your app any less dangerous.
      - TylerE 3y ago
        It makes random apps much less likely to be dangerous. https://news.ycombinator.com/item?id=36086537 https://news.ycombinator.com/item?id=36086537 is an analogous case. When the primary provider of free domains names went away, there was a HUGE reduction in phishing websites. Those types would spin up thouands of sites on xyz, vip and similar TLDs faster than the white hats could whackamole them. A domain going from $0 to $10 vastly curtailed that activity. You don't have to make something impossible, you just have to make it not cost effective to shot gun it.
Domenic_S 3y ago
> make them jump through a bunch of hoops and try to talk them out of it at every step before they can actually run it. Right click --> open --> open. 3 clicks is not "a bunch of hoops".
- josephcsible 3y ago
  It's 3 clicks if you know how to do it, which they go out of their way to not tell you in the error you get when you try to run it like any other program.
  - derefr 3y ago
    If they told you how to do it, then what would even be the point? The whole idea is to add a stumbling block in the path of malware authors getting users to run a trojan. Anything the user learns to do by rote without first understanding the security implications provides zero security. Like the Windows Vista elevation prompt — users just learned to hit "Yes" and got infected anyway.
    - ris58h 3y ago
      > If they told you how to do it, then what would even be the point? To warn a user.
      - derefr 3y ago
        And what would be the point of doing that? You have to have some behavioral outcome you expect. Do you expect people to react by not running the program? Why? If you find out that they are in fact still running the program just as much with the warning in place, because they aren't reading the warning... then have you actually "warned the user"?
- heavyset_go 3y ago
  Users don't know that, though. macOS treats the app that they want to use like they're radioactive and don't work, and doesn't give them the explicit option of running what they want anyway. They have to know some magic ritual to open it.
jmull 3y ago
The message (before first run only) just says the software "can’t be opened because Apple cannot check it for malicious software." and "This software needs to be updated. Contact the developer for more information." Anyway, it's only hard to run if you have no idea what you're doing... pretty much the same people who should not be running executables randomly downloaded from the internet are the ones blocked by hurdles like this.
- howinteresting 3y ago
  "This software needs to be updated" is an outright lie.
  - throw74775 3y ago
    No it’s not. It needs to be updated in order for it to run without that warning. If the user has permission to disable the warning, they can, otherwise the app needs to be updated.
    - howinteresting 3y ago
      Well, no, because the latest version of a lot of software will still produce the warning since the developer refuses to pay the Apple extortion fee.
    - nojonestownpls 3y ago
      Yeah, all Apple users know that "this software needs to be updated" means "the software itself is fine, the developer just needs to pay us money". It's obvious, not misleading or an attempt to create FUD at all.
      - howinteresting 3y ago
        Why doesn't Apple say what you said? "The software itself might or might not be fine, the developer just needs to pay us money"? Because then their extortion racket would be laid bare to consumers. Open source and not-for-profit software has been put at a disadvantage here, which I think is very bad for several reasons.

misnome 3y ago

You can, but users need to right-click and click “open” the first time they open the app.

deleted 3y ago

[deleted]

hobo_mark 3y ago

Never used a mac, but I assume that is only for installing from the store, correct? If I publish an open source program that one installs with `brew install` or whatever it's called none of this applies?

judge2020 3y ago
Yes, all of it is open for development. The only thing about mac is that, if you want to distribute apps via the web, you'll need to instruct the user to bypass the code signing requirement by right-clicking on the app or DMG and clicking open from there. Getting a Developer ID code signing certificate is only available with a paid developer account.
weaksauce 3y ago
yes and no. you can't sign your app with a certificate so if you want to have a frictionless install you have to pay. (the friction is having to explain that you have to press ctrl while clicking and then click open and then click trust this app) command line utilities don't have this friction and brew mainly installs command line utilities (though there are app binaries distributed through a separate brew thing... keg or cask or cellar or something like that) traditionally you would need to pay the 99 bucks to install a binary on your ipad or iphone or iwatch. those need to have the certificate signed by apple to run on the phone for general security reasons so some website couldn't sideload an app. now you can do all of that without paying the 99 bucks... but if you wanted to sell it on the app store or distribute it for external testing you still need to pay.
- dingledork69 3y ago
  > general security reasons Cash cow reasons*. The system is designed to be secure even against signed apps.
deleted 3y ago
[deleted]

slmjkdbtl 3y ago

Most macOS apps don't go the App Store route, but user have to manually click a checkbox in system preference to say "I allow app from any developer", it is an issue distributing to people who doesn't know a lot about software

lapcat 3y ago
> user have to manually click a checkbox in system preference to say "I allow app from any developer" The "Anywhere" option no longer exists in System Preferences/Settings: https://support.apple.com/HT202491 https://support.apple.com/HT202491 It was removed in macOS Sierra.
- slmjkdbtl 3y ago
  Oh right, you need to run sudo spctl --master-disable in order to have that option