4 ms·
Seems very basic looking at the source. The real value is in binary obfuscation I suppose, if that's even needed when mcOS doesn't use any sort of "antivirus".
by k4rli 2y ago
Seems very basic looking at the source. The real value is in binary obfuscation I suppose, if that's even needed when mcOS doesn't use any sort of "antivirus".
- rafram 2y agomacOS does have a built-in antivirus, XProtect: https://support.apple.com/guide/security/protecting-against-malware-sec469d47bd8/web https://support.apple.com/guide/security/protecting-against-...
- fragmede 2y agoApple has the means to stop random unsigned binaries from running with out intense user intervention, so I wouldn't say there isn't any.
- kevincox 2y agoIIUC this is based on a pretty simple fingerprint of the executable. So a motivated attacker can produce different builds that break the signature resulting in each build being "new" and being allowed by default. This is different than the "notarization" process which requires uploading the executable and Apple has a change of better identifying variants. I don't think notarization is yet required or done on unknown executables by default. (In fact I think they need to be signed to be notarized.)
- wutwutwat 2y agoUnless you change the default settings to allow untrusted apps, code that isn't notarized won't be allowed to run https://support.apple.com/guide/security/gatekeeper-and-runtime-protection-sec5599b66df/web https://support.apple.com/guide/security/gatekeeper-and-runt...