3 ms·
Notarization is for binaries. You can always run a Bash or Python script, I assume Apple Script is similar.
by computerfriend 3y ago
Notarization is for binaries. You can always run a Bash or Python script, I assume Apple Script is similar.
- klabb3 3y agoOk. I don’t know how Apple Scripts are distributed and invoked, but this is starting to sound like a generic “trick user to run a script from the terminal” which is a vector in all OSs. Terminal=power. The annoying thing is tons of legit projects distribute their scripts on the web and ask you to run them with curl and sh. Normalizing that paves the way for this type of attack.
- stephenr 3y agoBy default terminal in macOS doesnt have full access to the system, you specifically have to go grant it "full disk access" to get close to that. Of course that doesn't help when people with no idea what they're doing routinely disable SIP and turn off security features because being asked if you really want to run "ScammyScammersonsScam.app" once is an indignity.