6 ms·

> while that shown in blue is the stapled notarisation ticket (optional) This is correct, but practically speaking non-notarized apps are pretty terrible to us

> while that shown in blue is the stapled notarisation ticket (optional) This is correct, but practically speaking non-notarized apps are pretty terrible to use for a user enough so that this isn't optional and you're going to pay your $99/yr Apple tax. (This only applies to distributed software, if you are only building and running apps for your own personal use, its not bad because macOS lets you do that without the scary warnings) For users who aren't aware of notarization, your app looks straight up broken. See screenshots in the Apple support site here: https://support.apple.com/en-us/102445 https://support.apple.com/en-us/102445 For users who are aware, you used to be able to right click and "run" apps and nowadays you need to actually go all the way into system settings to allow it: https://developer.apple.com/news/?id=saqachfa https://developer.apple.com/news/?id=saqachfa I'm generally a fan of what Apple does for security but I think notarization specifically for apps outside the App Store has been a net negative for all parties involved. I'd love to hear a refutation to that because I've tried to find concrete evidence that notarization has helped prevent real issues and haven't been able to yet.

jclay 10mo ago
I thought the macOS notarization process was annoying until we started shipping Windows releases. It’s basically pay to play to get in the good graces of Windows Defender. I think all-in it was over $1k upfront to get the various certs. The cert company has to do a pretty invasive verification process for both you and your company. Then — you are required to use a hardware token to sign the releases. This effectively means we have one team member who can publish a release currently. The cert company can lock your key as well for arbitrary reasons which prevents you from being able to make a release! Scary if the release you’re putting out is a security patch. I’ll take the macOS ecosystem any day of the week.
- deltaknight 10mo ago
  The EV cert system is truly terrible on Windows. Worst of all, getting an EV cert isn’t even enough to remove the scary warnings popping up for users! For that you still need to convince windows defender that you’re not a bad actor by getting installs on a large number of devices, which of course is a chicken-and-egg problem for software with a small number of users. At least paying your dues to Apple guarantees a smooth user experience.
  - ryandrake 10mo ago
    Wow. I haven't written software for Windows in over a decade. I always thought Apple was alone in its invasive treatment of developers on their platform. Windows used to be "just post the exe on your web site, and you're good to go." I guess Microsoft has finally managed to aggressively insert themselves into the distribution process there, too. Sad to see.
    - deleted 10mo ago
      [deleted]
    - etbebl 10mo ago
      I get that if you're distributing software to the wider public, you have to make sure these scary alerts don't pop up regardless of platform. But as a savvy user, I think the situation is still better on Windows. As far as I've seen there's still always a (small) link in these popups (I think it's SmartScreen?) to run anyway - no need to dig into settings before even trying to run it.
      - Archit3ch 10mo ago
        Are you sure? I had not used Windows for years and assumed "Run Anyway" would work. Last month, I tested running an unsigned (self-signed) .MSIX on a different Windows machine. It's a 9-step process to get through the warnings: https://www.advancedinstaller.com/install-test-certificate-from-msix.html https://www.advancedinstaller.com/install-test-certificate-f... Perhaps .exe is easier, but I wouldn't subject the wider public (or even power users) to that. So yeah, Azure Trusted Signing or EV certificate is the way to go on Windows.
    - jeroenhd 10mo ago
      > Windows used to be "just post the exe on your web site, and you're good to go." That's also one of the main reasons why Windows was such a malware-ridden hellspace. Microsoft went the Apple route to security and it worked out. At least Microsoft doesn't require you to dismiss the popup, open the system settings, click the "run anyway" button, and enter a password to run an unsigned executable. Just clicking "more details -> run anyway" still exists on the SmartScreen popup, even if they've hidden it well. Despite Microsoft's best attempts, macOS still beats Windows when it comes to terribleness for running an executable.
- dceddia 10mo ago
  The situation on Windows got remarkably better and cheaper recently-ish with the addition of Azure code signing. Instead of hundreds or thousands for a cert it’s $10/month, if you meet the requirements (I think the business must have existed for some number of years first, and some other things). If you go this route I highly recommend this article, because navigating through Azure to actually set it up is like getting through a maze. https://melatonin.dev/blog/code-signing-on-windows-with-azure-trusted-signing/ https://melatonin.dev/blog/code-signing-on-windows-with-azur...
  - jonathanlydall 10mo ago
    Thanks for the link, I see only available to basically US, Canada and EU though.
  - Razengan 10mo ago
    > it’s $10/month So $120 a year but no it's only Apple with a "tAx"
    - TimeBearingDown 10mo ago
      Millions of Windows power users are accustomed to bypassing SmartScreen. A macOS app distributed without a trusted signature will reach a far smaller audience, even of the proportionately smaller macOS user base, and that's largely due to deliberate design decisions by Apple in recent releases.
  - lwkl 10mo ago
    That's not easier and cheaper than before. That's how it's always been only now you can buy the cert through Azure. For an individual the Apple code signing process is a lot easier and more accessible since I couldn't buy a code signing certificate for Windows without being registered as a business.
    - dceddia 10mo ago
      > That's how it's always been only now you can buy the cert through Azure. Where can you get an EV cert for $120/year? Last time I checked, all the places were more expensive and then you also had to deal with a hardware token. Lest we talk past each other: it's true that it used to be sufficient to buy a non-EV cert for around the same money, where it didn't require a hardware token, and that was good enough... but they changed the rules in 2023.
- TobbenTM 10mo ago
  You certainly don't need a hardware token, you can store it in any FIPS 140 Level 2+ stores. This includes stuff like Azure KeyVault and AWS KMS. Azure Trusted Signing is 100% the best choice, but if for whatever reason you cannot use it, you can still use your own cloud store and hook in the signing tools. I wrote an article on using AWS KMS earlier this year: https://moonbase.sh/articles/signing-windows-binaries-using-aws-kms/ https://moonbase.sh/articles/signing-windows-binaries-using-... TLDR: Doing this yourself requires a ~400-500$/year EV cert and miniscule cloud costs
  - jonathanlydall 10mo ago
    Can confirm this, we use Azure KeyVault and are able to have Azure Pipelines use it to sign our release builds. We’re (for the moment) a South African entity, so can’t use Azure Trusted Signing, but DigiCert has no issue with us using Azure KeyVault for our EV code signing certificate. I had ours renewed just this week as it happens. Cost something like USD 840 before tax, don’t have a choice though and in the grand scheme of things it’s not a huge expense for a company.
- jezek2 10mo ago
  I solved it by putting a "How to install.rtf" file alongside the program. Another alternative would be to bundle this app: https://github.com/alienator88/Sentinel https://github.com/alienator88/Sentinel It allows to easily unlock it by drag'n'drop.
  - tyre 10mo ago
    What is the subset of users who are going to investigate and read an rtf file but don’t know how to approve an application via system settings (or google to do so)?
    - jezek2 10mo ago
      I would say quite a lot of users because even the previous simple method of right clicking wasn't that known even by power users. Lot of them just selected "allow applications from anyone" in the settings (most likely just temporarily). In one application I also offered an alternative by using a web app in case they were not comfortable with any of the option. Also it's presented in a .dmg file where you have two icons, the app and the "How to install". I would say that's quite inviting for investigation :)
- Klonoar 10mo ago
  I have been trying to get people to realize that this is the same or worse for like a year now. It’s unfortunate it’s come to this but Apple is hardly the worst of the two now.
- rxliuli 10mo ago
  That's right, there's a similar comparison between the iOS App Store and Android Play Store. Although the annual $99 fee is indeed expensive, the Play Store requires every app to find 12 users for 14 days of internal testing before submission for review, which is utterly incomprehensible, not to mention the constant warnings about inactive accounts potentially being disabled.
TheDong 10mo ago
> notarization has been a net negative for all parties involved Notarization made it significantly harder to cross-compile apps for macOS from linux, which means people have to buy a lot of macOS hardware to run in CI instead of just using their existing linux CI to build mac binaries. You also need to pay $99/year to notarize. As such, I believe it's resulted in profit for Apple, so at least one of the parties involved has had some benefit from this setup. Frankly I think Apple should keep going, developer licenses should cost $99 + 15% of your app's profit each year, and notarization should be a pro feature that requires a macbook pro or a mac pro to unlock.
mrpippy 10mo ago
The stapled ticket is optional beyond notarization itself. If you notarize but don’t staple the ticket, users may need an internet connection to check the notarization status.
sholladay 10mo ago
I’m only aware of two times that Apple has revoked certificates for apps distributed outside of the App Store. One was for Facebook’s Research App. The other was for Google’s Screenwise Meter. Both apps were basically spyware for young teens. In each case, Apple revoked the enterprise certificate for the company, which caused a lot of internal fallout beyond just the offending app, because internal tools were distributed the same way. Something may have changed, though, because I see Screenwise Meter listed on the App Store for iOS. https://www.wired.com/story/facebook-research-app-root-certificate/ https://www.wired.com/story/facebook-research-app-root-certi... https://www.eff.org/deeplinks/2019/02/google-screenwise-unwise-trade-all-your-privacy-cash https://www.eff.org/deeplinks/2019/02/google-screenwise-unwi...
- lapcat 10mo ago
  The article is about macOS apps, but you're talking about iOS apps. Apple revokes macOS Developer ID code signing certificates all the time, mostly for malware, but occasionally for goodware, e.g., Charlie Monroe and HP printer drivers. Also, infamously, Apple revoked the macOS Developer ID cert of Epic Games, as punishment for their iOS App Store dispute.
internet2000 10mo ago
Maybe half of the 3rd party apps I have on my applications folder right now are not notarized. It’s really not that big of a deal.
- jonathanlydall 10mo ago
  It’s a friction point for potential customers, so we do it with our Electron based app, The USD 99 annual fee is almost inconsequential, the painful part was getting a DUNS number (we’re a South African entity) and then getting it to work in a completely automated manner on our build server. Fortunately, once set up it’s been almost no work since.
- sneak 10mo ago
  It is a big deal. You can no longer just right click apps to run them, you have to take a trip to a subpanel of system settings, after clicking though two different dialogs that are designed to scare you into thinking something is wrong (one mentions malware by name). For normal users this might as well be impossible. Remember, your average user needs a shortcut to /Applications inside the .dmg image otherwise they won’t know where to drag the app to to install it.
sneak 10mo ago
The problem is not that it’s $99/year. The problem is that it requires strong ID, and if you are doing it as a company (ie if you don’t want Apple to publicize your ID name to everyone who uses your app) then you have to go through an invasive company verification process that you can fail for opaque reasons unrelated to fraud or anything bad. The system sucks. I’d love to be able to sign my legitimate apps with my legitimate company, but I don’t wish to put the name on my passport onto the screens of millions of people, and my company (around and operating for 20-ish years now) doesn’t pass the Apple verification for some reason. I also can’t use auto-enroll (DEP) MDM for this reason.
- tensor 10mo ago
  I think the lack of any human to talk to is the worst part of modern tech. Especially for business, where your income may depend on it. It's beyond cruel to prevent people from operating with no explanation of why and no way to find out how to fix it.
- bitwize 10mo ago
  Well, what can I say except that the 80s, with their little independent app vendors shipping floppy disks in little baggies, are long behind us. Computers are now commonplace enough, with all the attendant dangers, that platform vendors are demanding a bit of accountability if you want to ship for their platforms, and unfortunately accountability means money and paperwork. The platform vendors are well within their rights to do so. They have a right to protect their reputations, and when malicious or buggy software appears on their platform, their reputation suffers. Half or more of the blue screens on Windows in the late 90s and early 2000s for instance, were due to buggy third-party drivers, yet Microsoft caught the blame for Windows crashing. It took a new driver model, standards on how drivers are expected to behave, and signed drivers to bring this under control. The future is signed code with deep identity verification for every instruction that runs on a consumer device, from boot loader through to application code. Maybe web site JavaScript will be granted an exception (if it isn't JIT-compiled). This will be a good thing for most consumers. Until Nintendo cleaned out all the garbage and implemented strict controls on who may publish what on their console, the North American video game market was a ruin. The rest of computing is likely to follow suit, for similar reasons.
jezek2 10mo ago
In my case, as a developer of a programming language that can compile to all supported platforms from any platform the signing (and notarization) is simply incompatible with the process. Not only is such signing all about control (the Epic case is a great example of misuse and a reminder that anyone can be blocked by Apple) it is also anti-competitive to other programming languages. I treat each platform as open only when it allows running unsigned binaries in a reasonable way (or self-signed, though that already has some baggage of needing to maintain the key). When it doesn't I simply don't support such platform. Some closed platforms (iOS and Android[1]) can be still supported pretty well using PWAs because the apps are fullscreen and self-contained unlike the desktop. [1] depending on if Google will provide a reasonable way to run self-signed apps, but the trust that it will remain open in the future is already severely damaged
- conradev 10mo ago
  The signing is definitely about control, as is all things with Apple, but there are security benefits. It's a pretty standard flow for dev tools to ad-hoc (self) sign binaries on macOS (either shelling out to codesign, or using a cross-platform tool like https://github.com/indygreg/apple-platform-rs https://github.com/indygreg/apple-platform-rs). Nix handles that for me, for example. It makes it easy for tools like Santa or Little Snitch to identify binaries, and gives the kernel/userspace a common language to chat process identity. You can configure similar for Linux: https://www.redhat.com/en/blog/how-use-linux-kernels-integrity-measurement-architecture https://www.redhat.com/en/blog/how-use-linux-kernels-integri... But Apple's system is centralized. It would be nice if you could add your own root keys! They stay pretty close to standard X.509.
saagarjha 10mo ago
Apple’s Mac security team in general kind of sucks at their job. They are ineffectual at stopping real issues and make the flow for most users more annoying for little benefit.

jclay 10mo ago

I thought the macOS notarization process was annoying until we started shipping Windows releases. It’s basically pay to play to get in the good graces of Windows Defender. I think all-in it was over $1k upfront to get the various certs. The cert company has to do a pretty invasive verification process for both you and your company. Then — you are required to use a hardware token to sign the releases. This effectively means we have one team member who can publish a release currently. The cert company can lock your key as well for arbitrary reasons which prevents you from being able to make a release! Scary if the release you’re putting out is a security patch. I’ll take the macOS ecosystem any day of the week.

deltaknight 10mo ago
The EV cert system is truly terrible on Windows. Worst of all, getting an EV cert isn’t even enough to remove the scary warnings popping up for users! For that you still need to convince windows defender that you’re not a bad actor by getting installs on a large number of devices, which of course is a chicken-and-egg problem for software with a small number of users. At least paying your dues to Apple guarantees a smooth user experience.
- ryandrake 10mo ago
  Wow. I haven't written software for Windows in over a decade. I always thought Apple was alone in its invasive treatment of developers on their platform. Windows used to be "just post the exe on your web site, and you're good to go." I guess Microsoft has finally managed to aggressively insert themselves into the distribution process there, too. Sad to see.
  - deleted 10mo ago
    [deleted]
  - etbebl 10mo ago
    I get that if you're distributing software to the wider public, you have to make sure these scary alerts don't pop up regardless of platform. But as a savvy user, I think the situation is still better on Windows. As far as I've seen there's still always a (small) link in these popups (I think it's SmartScreen?) to run anyway - no need to dig into settings before even trying to run it.
    - Archit3ch 10mo ago
      Are you sure? I had not used Windows for years and assumed "Run Anyway" would work. Last month, I tested running an unsigned (self-signed) .MSIX on a different Windows machine. It's a 9-step process to get through the warnings: https://www.advancedinstaller.com/install-test-certificate-from-msix.html https://www.advancedinstaller.com/install-test-certificate-f... Perhaps .exe is easier, but I wouldn't subject the wider public (or even power users) to that. So yeah, Azure Trusted Signing or EV certificate is the way to go on Windows.
  - jeroenhd 10mo ago
    > Windows used to be "just post the exe on your web site, and you're good to go." That's also one of the main reasons why Windows was such a malware-ridden hellspace. Microsoft went the Apple route to security and it worked out. At least Microsoft doesn't require you to dismiss the popup, open the system settings, click the "run anyway" button, and enter a password to run an unsigned executable. Just clicking "more details -> run anyway" still exists on the SmartScreen popup, even if they've hidden it well. Despite Microsoft's best attempts, macOS still beats Windows when it comes to terribleness for running an executable.
dceddia 10mo ago
The situation on Windows got remarkably better and cheaper recently-ish with the addition of Azure code signing. Instead of hundreds or thousands for a cert it’s $10/month, if you meet the requirements (I think the business must have existed for some number of years first, and some other things). If you go this route I highly recommend this article, because navigating through Azure to actually set it up is like getting through a maze. https://melatonin.dev/blog/code-signing-on-windows-with-azure-trusted-signing/ https://melatonin.dev/blog/code-signing-on-windows-with-azur...
- jonathanlydall 10mo ago
  Thanks for the link, I see only available to basically US, Canada and EU though.
- Razengan 10mo ago
  > it’s $10/month So $120 a year but no it's only Apple with a "tAx"
  - TimeBearingDown 10mo ago
    Millions of Windows power users are accustomed to bypassing SmartScreen. A macOS app distributed without a trusted signature will reach a far smaller audience, even of the proportionately smaller macOS user base, and that's largely due to deliberate design decisions by Apple in recent releases.
- lwkl 10mo ago
  That's not easier and cheaper than before. That's how it's always been only now you can buy the cert through Azure. For an individual the Apple code signing process is a lot easier and more accessible since I couldn't buy a code signing certificate for Windows without being registered as a business.
  - dceddia 10mo ago
    > That's how it's always been only now you can buy the cert through Azure. Where can you get an EV cert for $120/year? Last time I checked, all the places were more expensive and then you also had to deal with a hardware token. Lest we talk past each other: it's true that it used to be sufficient to buy a non-EV cert for around the same money, where it didn't require a hardware token, and that was good enough... but they changed the rules in 2023.
TobbenTM 10mo ago
You certainly don't need a hardware token, you can store it in any FIPS 140 Level 2+ stores. This includes stuff like Azure KeyVault and AWS KMS. Azure Trusted Signing is 100% the best choice, but if for whatever reason you cannot use it, you can still use your own cloud store and hook in the signing tools. I wrote an article on using AWS KMS earlier this year: https://moonbase.sh/articles/signing-windows-binaries-using-aws-kms/ https://moonbase.sh/articles/signing-windows-binaries-using-... TLDR: Doing this yourself requires a ~400-500$/year EV cert and miniscule cloud costs
- jonathanlydall 10mo ago
  Can confirm this, we use Azure KeyVault and are able to have Azure Pipelines use it to sign our release builds. We’re (for the moment) a South African entity, so can’t use Azure Trusted Signing, but DigiCert has no issue with us using Azure KeyVault for our EV code signing certificate. I had ours renewed just this week as it happens. Cost something like USD 840 before tax, don’t have a choice though and in the grand scheme of things it’s not a huge expense for a company.
jezek2 10mo ago
I solved it by putting a "How to install.rtf" file alongside the program. Another alternative would be to bundle this app: https://github.com/alienator88/Sentinel https://github.com/alienator88/Sentinel It allows to easily unlock it by drag'n'drop.
- tyre 10mo ago
  What is the subset of users who are going to investigate and read an rtf file but don’t know how to approve an application via system settings (or google to do so)?
  - jezek2 10mo ago
    I would say quite a lot of users because even the previous simple method of right clicking wasn't that known even by power users. Lot of them just selected "allow applications from anyone" in the settings (most likely just temporarily). In one application I also offered an alternative by using a web app in case they were not comfortable with any of the option. Also it's presented in a .dmg file where you have two icons, the app and the "How to install". I would say that's quite inviting for investigation :)
Klonoar 10mo ago
I have been trying to get people to realize that this is the same or worse for like a year now. It’s unfortunate it’s come to this but Apple is hardly the worst of the two now.
rxliuli 10mo ago
That's right, there's a similar comparison between the iOS App Store and Android Play Store. Although the annual $99 fee is indeed expensive, the Play Store requires every app to find 12 users for 14 days of internal testing before submission for review, which is utterly incomprehensible, not to mention the constant warnings about inactive accounts potentially being disabled.

TheDong 10mo ago

> notarization has been a net negative for all parties involved Notarization made it significantly harder to cross-compile apps for macOS from linux, which means people have to buy a lot of macOS hardware to run in CI instead of just using their existing linux CI to build mac binaries. You also need to pay $99/year to notarize. As such, I believe it's resulted in profit for Apple, so at least one of the parties involved has had some benefit from this setup. Frankly I think Apple should keep going, developer licenses should cost $99 + 15% of your app's profit each year, and notarization should be a pro feature that requires a macbook pro or a mac pro to unlock.

mrpippy 10mo ago

The stapled ticket is optional beyond notarization itself. If you notarize but don’t staple the ticket, users may need an internet connection to check the notarization status.

sholladay 10mo ago

I’m only aware of two times that Apple has revoked certificates for apps distributed outside of the App Store. One was for Facebook’s Research App. The other was for Google’s Screenwise Meter. Both apps were basically spyware for young teens. In each case, Apple revoked the enterprise certificate for the company, which caused a lot of internal fallout beyond just the offending app, because internal tools were distributed the same way. Something may have changed, though, because I see Screenwise Meter listed on the App Store for iOS. https://www.wired.com/story/facebook-research-app-root-certificate/ https://www.wired.com/story/facebook-research-app-root-certi... https://www.eff.org/deeplinks/2019/02/google-screenwise-unwise-trade-all-your-privacy-cash https://www.eff.org/deeplinks/2019/02/google-screenwise-unwi...

lapcat 10mo ago
The article is about macOS apps, but you're talking about iOS apps. Apple revokes macOS Developer ID code signing certificates all the time, mostly for malware, but occasionally for goodware, e.g., Charlie Monroe and HP printer drivers. Also, infamously, Apple revoked the macOS Developer ID cert of Epic Games, as punishment for their iOS App Store dispute.

internet2000 10mo ago

Maybe half of the 3rd party apps I have on my applications folder right now are not notarized. It’s really not that big of a deal.

jonathanlydall 10mo ago
It’s a friction point for potential customers, so we do it with our Electron based app, The USD 99 annual fee is almost inconsequential, the painful part was getting a DUNS number (we’re a South African entity) and then getting it to work in a completely automated manner on our build server. Fortunately, once set up it’s been almost no work since.
sneak 10mo ago
It is a big deal. You can no longer just right click apps to run them, you have to take a trip to a subpanel of system settings, after clicking though two different dialogs that are designed to scare you into thinking something is wrong (one mentions malware by name). For normal users this might as well be impossible. Remember, your average user needs a shortcut to /Applications inside the .dmg image otherwise they won’t know where to drag the app to to install it.

sneak 10mo ago

The problem is not that it’s $99/year. The problem is that it requires strong ID, and if you are doing it as a company (ie if you don’t want Apple to publicize your ID name to everyone who uses your app) then you have to go through an invasive company verification process that you can fail for opaque reasons unrelated to fraud or anything bad. The system sucks. I’d love to be able to sign my legitimate apps with my legitimate company, but I don’t wish to put the name on my passport onto the screens of millions of people, and my company (around and operating for 20-ish years now) doesn’t pass the Apple verification for some reason. I also can’t use auto-enroll (DEP) MDM for this reason.

tensor 10mo ago
I think the lack of any human to talk to is the worst part of modern tech. Especially for business, where your income may depend on it. It's beyond cruel to prevent people from operating with no explanation of why and no way to find out how to fix it.
bitwize 10mo ago
Well, what can I say except that the 80s, with their little independent app vendors shipping floppy disks in little baggies, are long behind us. Computers are now commonplace enough, with all the attendant dangers, that platform vendors are demanding a bit of accountability if you want to ship for their platforms, and unfortunately accountability means money and paperwork. The platform vendors are well within their rights to do so. They have a right to protect their reputations, and when malicious or buggy software appears on their platform, their reputation suffers. Half or more of the blue screens on Windows in the late 90s and early 2000s for instance, were due to buggy third-party drivers, yet Microsoft caught the blame for Windows crashing. It took a new driver model, standards on how drivers are expected to behave, and signed drivers to bring this under control. The future is signed code with deep identity verification for every instruction that runs on a consumer device, from boot loader through to application code. Maybe web site JavaScript will be granted an exception (if it isn't JIT-compiled). This will be a good thing for most consumers. Until Nintendo cleaned out all the garbage and implemented strict controls on who may publish what on their console, the North American video game market was a ruin. The rest of computing is likely to follow suit, for similar reasons.

jezek2 10mo ago

In my case, as a developer of a programming language that can compile to all supported platforms from any platform the signing (and notarization) is simply incompatible with the process. Not only is such signing all about control (the Epic case is a great example of misuse and a reminder that anyone can be blocked by Apple) it is also anti-competitive to other programming languages. I treat each platform as open only when it allows running unsigned binaries in a reasonable way (or self-signed, though that already has some baggage of needing to maintain the key). When it doesn't I simply don't support such platform. Some closed platforms (iOS and Android[1]) can be still supported pretty well using PWAs because the apps are fullscreen and self-contained unlike the desktop. [1] depending on if Google will provide a reasonable way to run self-signed apps, but the trust that it will remain open in the future is already severely damaged

conradev 10mo ago
The signing is definitely about control, as is all things with Apple, but there are security benefits. It's a pretty standard flow for dev tools to ad-hoc (self) sign binaries on macOS (either shelling out to codesign, or using a cross-platform tool like https://github.com/indygreg/apple-platform-rs https://github.com/indygreg/apple-platform-rs). Nix handles that for me, for example. It makes it easy for tools like Santa or Little Snitch to identify binaries, and gives the kernel/userspace a common language to chat process identity. You can configure similar for Linux: https://www.redhat.com/en/blog/how-use-linux-kernels-integrity-measurement-architecture https://www.redhat.com/en/blog/how-use-linux-kernels-integri... But Apple's system is centralized. It would be nice if you could add your own root keys! They stay pretty close to standard X.509.

saagarjha 10mo ago

Apple’s Mac security team in general kind of sucks at their job. They are ineffectual at stopping real issues and make the flow for most users more annoying for little benefit.