5 ms·

What Apple probably doesn't want you to know is that you can also run these two commands to disable the notarization requirement, effectively reverting your sec

What Apple probably doesn't want you to know is that you can also run these two commands to disable the notarization requirement, effectively reverting your security level to non-paranoid pre-Catalina: sudo spctl --master-disable sudo defaults write /Library/Preferences/com.apple.security GKAutoRearm -bool false This reveal add and select a third option, "any source", under "allow applications downloaded from". The setting will still occasionally reset after installing some system updates because it's 2023 and computers these days are extremely unreliable when it comes to remembering user preferences.

balls187 3y ago
That’s helpful. Broadly speaking, as a developer you should expect that none of your users will have disabled those protections and your release plan should have notarizing as a step. Asking users to disable system protection, or at the very least fiddle with system settings is a non-starter.
- scarface_74 3y ago
  Even if a company wasn’t being purposefully malicious, shit happens. https://support.google.com/chrome/thread/15235262/chrome-update-impacts-some-macos-systems?hl=en https://support.google.com/chrome/thread/15235262/chrome-upd... And Apple isn’t immune either. There was a bug in the iTunes installer where it would erase files if there was a space in the name of the hard drive. Then some companies are just evil. https://www.zdnet.com/article/zoom-defends-use-of-local-web-server-on-macs-after-security-report/ https://www.zdnet.com/article/zoom-defends-use-of-local-web-...
- grishka 3y ago
  > as a developer you should expect that none of your users will have disabled those protections and your release plan should have notarizing as a step. I don't want to spend $99/year for the rest of eternity for the privilege of having a slightly less scary warning when my users run my app for the first time. Thus, the readme for the one macOS app I made that has gained a bit of popularity instructs users to right-click, then select "open". Works reasonably well so far. I would absolutely have embraced notarization if it was offered for free. Otherwise it feels like straight up extortion.
  - FpUser 3y ago
    >"Otherwise it feels like straight up extortion." Which it is
  - jeroenhd 3y ago
    Apple is probably lucky that so few people use Macs, because the EU would have a field day with this notarization bullshit if they'd managed to get a 10% market share on computers.
    - kanbara 3y ago
      how is it bullshit? windows is/was laden with malware, requiring antivirus, just full of crap for decades.
      - olyjohn 3y ago
        Yeah and Macs didn't have that problem back before signing apps was a requirement either.
      - jeroenhd 3y ago
        Agreed, and during those decades legislation and execution thereof sorely lacked. Now in the DMA/DSA times, things are different. It took them a couple of decades, but the EU is starting to take action.
    - grishka 3y ago
      Yet somehow, Windows 10 and 11 are dripping with contempt for the user, but the EU still hasn't acknowledged that as an antitrust problem worth investigating. Their insistence on pushing users into Edge alone should be enough IMO. Stuff like Edge "accidentally" opening on startup and some links "accidentally" opening in Edge instead of your default browser and your default browser setting getting "accidentally" reset to Edge and the taskbar shortcut for Edge "accidentally" reappearing.
      - TerrifiedMouse 3y ago
latchkey 3y ago
> The setting will still occasionally reset after installing some system updates because it's 2023 and computers these days are extremely unreliable when it comes to remembering user preferences. The sudo touchid mod gets reset so often now that I've stopped bothering with it. Ok, you win apple!
- grishka 3y ago
  I was just thinking that I should make a shell script with these commands and the touch ID one and add it as a login item. Sudo shouldn't be a big deal, just set the owner to root and set the SUID bit.
- MBCook 3y ago
  It may be official now! I just saw today that Sonoma contains an example pam config file with that line commented out. Uncomment, copy it over the default file, win. Far less hidden. https://mastodon.social/@StrangeNoises/110910261899874868 https://mastodon.social/@StrangeNoises/110910261899874868
  - latchkey 3y ago
    YES! Confirmed! Thank you!
    - MBCook 3y ago
      Oh you posted that as a story. Heh. That’s a great idea. Why don’t I ever think of that? Glad I could help. It ran through my feed today by chance.
      - latchkey 3y ago
        My comments aren't entertaining enough to get enough upvotes for karma farming, so I post cool links that I find.
        MBCook 3y ago
KennyBlanken 3y ago
I don't want to necessarily disable it. What I do want is to be able to click "yes yes, I don't care this time / ever for this binary, fuck off." I don't even mind if you make me fingerprint auth for it. What drives me insane: the inconsistent/invisible functionality around this stuff. In Ventura, if you double-click an unsigned app, it won't run, with a big scary message that it cannot be verified. ...except if you right-click and select "open", you can now click on a button that lets you run the app anyway. This is not remotely obvious or even indicated in any way. There's nothing that explains this to the user, nada. It just behaves differently if you select "open" instead of double-clicking. How on earth that compliant with Apple's human interface guidelines?
- userbinator 3y ago
  This is not remotely obvious Apple stopped emphasising discoverability a long time ago.
  - fiddlerwoaroof 3y ago
    Making the option that bypasses the security measures less obvious is a feature. This is a case of assuming that developers are Apple’s model user when it’s non-developers who are likely to install “Macsweeper” because a popup ad told them they had a virus.
    - fiddlerwoaroof 3y ago
      Additionally, discoverability is relative to experience: I’m a developer and, as such, I can be assumed to know about right-click menus. So putting something there that’s more intended for me _is_ designing a discoverable user interface.
      - pxc 3y ago
        That you can right-click is not surprising. That's not the major thing to be discovered. The major thing to be discovered is that the behavior, which intuitively, should be identical, is silently different.

balls187 3y ago

That’s helpful. Broadly speaking, as a developer you should expect that none of your users will have disabled those protections and your release plan should have notarizing as a step. Asking users to disable system protection, or at the very least fiddle with system settings is a non-starter.

scarface_74 3y ago
Even if a company wasn’t being purposefully malicious, shit happens. https://support.google.com/chrome/thread/15235262/chrome-update-impacts-some-macos-systems?hl=en https://support.google.com/chrome/thread/15235262/chrome-upd... And Apple isn’t immune either. There was a bug in the iTunes installer where it would erase files if there was a space in the name of the hard drive. Then some companies are just evil. https://www.zdnet.com/article/zoom-defends-use-of-local-web-server-on-macs-after-security-report/ https://www.zdnet.com/article/zoom-defends-use-of-local-web-...
grishka 3y ago
> as a developer you should expect that none of your users will have disabled those protections and your release plan should have notarizing as a step. I don't want to spend $99/year for the rest of eternity for the privilege of having a slightly less scary warning when my users run my app for the first time. Thus, the readme for the one macOS app I made that has gained a bit of popularity instructs users to right-click, then select "open". Works reasonably well so far. I would absolutely have embraced notarization if it was offered for free. Otherwise it feels like straight up extortion.
- FpUser 3y ago
  >"Otherwise it feels like straight up extortion." Which it is
- jeroenhd 3y ago
  Apple is probably lucky that so few people use Macs, because the EU would have a field day with this notarization bullshit if they'd managed to get a 10% market share on computers.
  - kanbara 3y ago
    how is it bullshit? windows is/was laden with malware, requiring antivirus, just full of crap for decades.
    - olyjohn 3y ago
      Yeah and Macs didn't have that problem back before signing apps was a requirement either.
    - jeroenhd 3y ago
      Agreed, and during those decades legislation and execution thereof sorely lacked. Now in the DMA/DSA times, things are different. It took them a couple of decades, but the EU is starting to take action.
  - grishka 3y ago
    Yet somehow, Windows 10 and 11 are dripping with contempt for the user, but the EU still hasn't acknowledged that as an antitrust problem worth investigating. Their insistence on pushing users into Edge alone should be enough IMO. Stuff like Edge "accidentally" opening on startup and some links "accidentally" opening in Edge instead of your default browser and your default browser setting getting "accidentally" reset to Edge and the taskbar shortcut for Edge "accidentally" reappearing.
    - TerrifiedMouse 3y ago

latchkey 3y ago

> The setting will still occasionally reset after installing some system updates because it's 2023 and computers these days are extremely unreliable when it comes to remembering user preferences. The sudo touchid mod gets reset so often now that I've stopped bothering with it. Ok, you win apple!

grishka 3y ago
I was just thinking that I should make a shell script with these commands and the touch ID one and add it as a login item. Sudo shouldn't be a big deal, just set the owner to root and set the SUID bit.
MBCook 3y ago
It may be official now! I just saw today that Sonoma contains an example pam config file with that line commented out. Uncomment, copy it over the default file, win. Far less hidden. https://mastodon.social/@StrangeNoises/110910261899874868 https://mastodon.social/@StrangeNoises/110910261899874868
- latchkey 3y ago
  YES! Confirmed! Thank you!
  - MBCook 3y ago
    Oh you posted that as a story. Heh. That’s a great idea. Why don’t I ever think of that? Glad I could help. It ran through my feed today by chance.
    - latchkey 3y ago
      My comments aren't entertaining enough to get enough upvotes for karma farming, so I post cool links that I find.
      - MBCook 3y ago

KennyBlanken 3y ago

I don't want to necessarily disable it. What I do want is to be able to click "yes yes, I don't care this time / ever for this binary, fuck off." I don't even mind if you make me fingerprint auth for it. What drives me insane: the inconsistent/invisible functionality around this stuff. In Ventura, if you double-click an unsigned app, it won't run, with a big scary message that it cannot be verified. ...except if you right-click and select "open", you can now click on a button that lets you run the app anyway. This is not remotely obvious or even indicated in any way. There's nothing that explains this to the user, nada. It just behaves differently if you select "open" instead of double-clicking. How on earth that compliant with Apple's human interface guidelines?

userbinator 3y ago
This is not remotely obvious Apple stopped emphasising discoverability a long time ago.
- fiddlerwoaroof 3y ago
  Making the option that bypasses the security measures less obvious is a feature. This is a case of assuming that developers are Apple’s model user when it’s non-developers who are likely to install “Macsweeper” because a popup ad told them they had a virus.
  - fiddlerwoaroof 3y ago
    Additionally, discoverability is relative to experience: I’m a developer and, as such, I can be assumed to know about right-click menus. So putting something there that’s more intended for me _is_ designing a discoverable user interface.
    - pxc 3y ago
      That you can right-click is not surprising. That's not the major thing to be discovered. The major thing to be discovered is that the behavior, which intuitively, should be identical, is silently different.