6 ms·

Safely open apps on your Mac

bangonkeyboard 3y ago
This page was updated yesterday to remove the following text from the final section, which was added in November 2020: In addition, over the the next year we will introduce several changes to our security checks: • A new encrypted protocol for Developer ID certificate revocation checks • Strong protections against server failure • A new preference for users to opt out of these security protections
- lapcat 3y ago
  > A new encrypted protocol for Developer ID certificate revocation checks Done. > Strong protections against server failure Unknown, but presumably done. > A new preference for users to opt out of these security protections Never done. Apple lied. https://lapcatsoftware.com/articles/ocsp-privacy.html https://lapcatsoftware.com/articles/ocsp-privacy.html
  - saagarjha 3y ago
    I’m counting on you bringing it up the next time their service experiences downtime ;)
  - paws 3y ago
    Thank you for pointing this out. The macOS appocalypse was a really shocking moment -- it was so disappointing to learn that despite the privacy marketing shtick, macOS engineers chose to have Macs phone home sensitive data in an seemingly aggressive way, with no opt out. Now in 2023 the fact that "a preference for users to opt out of these security protections" never materialized, and the copy just disappeared from the website, is quite disappointing. Great write up here [0] - thanks @lapcat! Anecdata: Ever since that day I've blackholed ocsp.apple.com/ocsp2.apple.com at the DNS level, and all my Mac apps have launched just fine since. If anyone at Apple reads this, I want to be given the choice. Warn me, stuff the setting into whatever plist -- whatever, but give me the choice. Frankly for a company with Apple's resources, it's hard to believe the OCSP test suite somehow didn't consider half-open TCP connections. If a global catastrophe like that can happen once, it can happen again - which is why, in addition to the clearly negative privacy implications, Apple should give users who care a clear opt-out. [0] https://lapcatsoftware.com/articles/ocsp.html https://lapcatsoftware.com/articles/ocsp.html
grishka 3y ago
What Apple probably doesn't want you to know is that you can also run these two commands to disable the notarization requirement, effectively reverting your security level to non-paranoid pre-Catalina: sudo spctl --master-disable sudo defaults write /Library/Preferences/com.apple.security GKAutoRearm -bool false This reveal add and select a third option, "any source", under "allow applications downloaded from". The setting will still occasionally reset after installing some system updates because it's 2023 and computers these days are extremely unreliable when it comes to remembering user preferences.
- balls187 3y ago
  That’s helpful. Broadly speaking, as a developer you should expect that none of your users will have disabled those protections and your release plan should have notarizing as a step. Asking users to disable system protection, or at the very least fiddle with system settings is a non-starter.
  - scarface_74 3y ago
    Even if a company wasn’t being purposefully malicious, shit happens. https://support.google.com/chrome/thread/15235262/chrome-update-impacts-some-macos-systems?hl=en https://support.google.com/chrome/thread/15235262/chrome-upd... And Apple isn’t immune either. There was a bug in the iTunes installer where it would erase files if there was a space in the name of the hard drive. Then some companies are just evil. https://www.zdnet.com/article/zoom-defends-use-of-local-web-server-on-macs-after-security-report/ https://www.zdnet.com/article/zoom-defends-use-of-local-web-...
  - grishka 3y ago
    > as a developer you should expect that none of your users will have disabled those protections and your release plan should have notarizing as a step. I don't want to spend $99/year for the rest of eternity for the privilege of having a slightly less scary warning when my users run my app for the first time. Thus, the readme for the one macOS app I made that has gained a bit of popularity instructs users to right-click, then select "open". Works reasonably well so far. I would absolutely have embraced notarization if it was offered for free. Otherwise it feels like straight up extortion.
cod1r 3y ago
FYI, you can add whatever developer tool you use as an exception to privacy and security rules under "Developer Tools" in the "Privacy and Security" settings. I added my terminal emulator and it seems to let me run prebuilt, unsigned binaries without any annoyances.
- grishka 3y ago
  Since it applies to process trees, I wonder what happens if you add launchd in there.
Cadwhisker 3y ago
The article does mention the trick to right-click on the app and select "Open", but the text is greyed-out. You get a different dialog box with an option to open the file and this saves a lot of clicking.
themagician 3y ago
Anyone else remember a while back when the notarization sever went down and basically every internet connected Mac on the planet suddenly couldn't open ANY application?
- andrewmcwatters 3y ago
  Well, you’re secure if you can’t do anything, right?
  - m463 3y ago
    security = 1/convenience
    - hedora 3y ago
      Computer security is often defined as Availability, Confidentiality and Integrity. By that definition, as convenience goes to zero, then availability, and therefore security goes to zero too.
- lapcat 3y ago
  It wasn't notarization, it was the OCSP for Developer ID code signing certificates.
  - themagician 3y ago
    Ah, yes. My mistake.
heartjudytenuta 3y ago
Microsoft has had digital signing with Authenticode certificates for ~20 years now but they didn't give it a fancy name like "notarization" so nobody cares. "Safely" is strong language that implies software digitally signed by Apple does not contain malware. In my experience, their system is more a sieve than the condom it purports to be.
- pornel 3y ago
  Notarization is uploading the binary to Apple. This is different from signing. And it’s not your key, but theirs.
throwaway290 3y ago
> If macOS detects that software has been modified or damaged, your Mac notifies you that the app can't be opened. The app might be broken or corrupted, or it might have been tampered with. Wow, this is a big TIL! Until now I thought all cases of "damaged" had to do with something like bad/incomplete build or wrong architecture. Now it seems like any of them could've been attempts to deliver malware from possibly infected hosts.
machael 3y ago
Don't give up if you misplaced your Bitcoin. Assistance is accessible. Computer specialist Recovery can assist you in recovering your Bitcoin if you contact them right away. Although there is no assurance of success, Computer specialist Recovery has a successful track record. After seeing your website through a Google search, I made the decision to phone you. Your expertise and professionalism immediately wowed me. You patiently responded to my questions while carefully outlining the recuperation process. Your dedication to client satisfaction also struck me as admirable. You never hid anything from me and always kept me informed of your progress. I value your existence, therefore please accept my gratitude to Computerspeciallist@engineer.com whtsapp +393512018070

This page was updated yesterday to remove the following text from the final section, which was added in November 2020: In addition, over the the next year we will introduce several changes to our security checks: • A new encrypted protocol for Developer ID certificate revocation checks • Strong protections against server failure • A new preference for users to opt out of these security protections

lapcat 3y ago
> A new encrypted protocol for Developer ID certificate revocation checks Done. > Strong protections against server failure Unknown, but presumably done. > A new preference for users to opt out of these security protections Never done. Apple lied. https://lapcatsoftware.com/articles/ocsp-privacy.html https://lapcatsoftware.com/articles/ocsp-privacy.html
- saagarjha 3y ago
  I’m counting on you bringing it up the next time their service experiences downtime ;)
- paws 3y ago
  Thank you for pointing this out. The macOS appocalypse was a really shocking moment -- it was so disappointing to learn that despite the privacy marketing shtick, macOS engineers chose to have Macs phone home sensitive data in an seemingly aggressive way, with no opt out. Now in 2023 the fact that "a preference for users to opt out of these security protections" never materialized, and the copy just disappeared from the website, is quite disappointing. Great write up here [0] - thanks @lapcat! Anecdata: Ever since that day I've blackholed ocsp.apple.com/ocsp2.apple.com at the DNS level, and all my Mac apps have launched just fine since. If anyone at Apple reads this, I want to be given the choice. Warn me, stuff the setting into whatever plist -- whatever, but give me the choice. Frankly for a company with Apple's resources, it's hard to believe the OCSP test suite somehow didn't consider half-open TCP connections. If a global catastrophe like that can happen once, it can happen again - which is why, in addition to the clearly negative privacy implications, Apple should give users who care a clear opt-out. [0] https://lapcatsoftware.com/articles/ocsp.html https://lapcatsoftware.com/articles/ocsp.html

grishka 3y ago

What Apple probably doesn't want you to know is that you can also run these two commands to disable the notarization requirement, effectively reverting your security level to non-paranoid pre-Catalina: sudo spctl --master-disable sudo defaults write /Library/Preferences/com.apple.security GKAutoRearm -bool false This reveal add and select a third option, "any source", under "allow applications downloaded from". The setting will still occasionally reset after installing some system updates because it's 2023 and computers these days are extremely unreliable when it comes to remembering user preferences.

balls187 3y ago
That’s helpful. Broadly speaking, as a developer you should expect that none of your users will have disabled those protections and your release plan should have notarizing as a step. Asking users to disable system protection, or at the very least fiddle with system settings is a non-starter.
- scarface_74 3y ago
  Even if a company wasn’t being purposefully malicious, shit happens. https://support.google.com/chrome/thread/15235262/chrome-update-impacts-some-macos-systems?hl=en https://support.google.com/chrome/thread/15235262/chrome-upd... And Apple isn’t immune either. There was a bug in the iTunes installer where it would erase files if there was a space in the name of the hard drive. Then some companies are just evil. https://www.zdnet.com/article/zoom-defends-use-of-local-web-server-on-macs-after-security-report/ https://www.zdnet.com/article/zoom-defends-use-of-local-web-...
- grishka 3y ago
  > as a developer you should expect that none of your users will have disabled those protections and your release plan should have notarizing as a step. I don't want to spend $99/year for the rest of eternity for the privilege of having a slightly less scary warning when my users run my app for the first time. Thus, the readme for the one macOS app I made that has gained a bit of popularity instructs users to right-click, then select "open". Works reasonably well so far. I would absolutely have embraced notarization if it was offered for free. Otherwise it feels like straight up extortion.

cod1r 3y ago

FYI, you can add whatever developer tool you use as an exception to privacy and security rules under "Developer Tools" in the "Privacy and Security" settings. I added my terminal emulator and it seems to let me run prebuilt, unsigned binaries without any annoyances.

grishka 3y ago
Since it applies to process trees, I wonder what happens if you add launchd in there.

Cadwhisker 3y ago

The article does mention the trick to right-click on the app and select "Open", but the text is greyed-out. You get a different dialog box with an option to open the file and this saves a lot of clicking.

themagician 3y ago

Anyone else remember a while back when the notarization sever went down and basically every internet connected Mac on the planet suddenly couldn't open ANY application?

andrewmcwatters 3y ago
Well, you’re secure if you can’t do anything, right?
- m463 3y ago
  security = 1/convenience
  - hedora 3y ago
    Computer security is often defined as Availability, Confidentiality and Integrity. By that definition, as convenience goes to zero, then availability, and therefore security goes to zero too.
lapcat 3y ago
It wasn't notarization, it was the OCSP for Developer ID code signing certificates.
- themagician 3y ago
  Ah, yes. My mistake.

heartjudytenuta 3y ago

Microsoft has had digital signing with Authenticode certificates for ~20 years now but they didn't give it a fancy name like "notarization" so nobody cares. "Safely" is strong language that implies software digitally signed by Apple does not contain malware. In my experience, their system is more a sieve than the condom it purports to be.

pornel 3y ago
Notarization is uploading the binary to Apple. This is different from signing. And it’s not your key, but theirs.

throwaway290 3y ago

> If macOS detects that software has been modified or damaged, your Mac notifies you that the app can't be opened. The app might be broken or corrupted, or it might have been tampered with. Wow, this is a big TIL! Until now I thought all cases of "damaged" had to do with something like bad/incomplete build or wrong architecture. Now it seems like any of them could've been attempts to deliver malware from possibly infected hosts.

machael 3y ago

Don't give up if you misplaced your Bitcoin. Assistance is accessible. Computer specialist Recovery can assist you in recovering your Bitcoin if you contact them right away. Although there is no assurance of success, Computer specialist Recovery has a successful track record. After seeing your website through a Google search, I made the decision to phone you. Your expertise and professionalism immediately wowed me. You patiently responded to my questions while carefully outlining the recuperation process. Your dedication to client satisfaction also struck me as admirable. You never hid anything from me and always kept me informed of your progress. I value your existence, therefore please accept my gratitude to Computerspeciallist@engineer.com whtsapp +393512018070