4 ms·

> Codex Desktop for macOS triggers a persistent macOS Gatekeeper/SystemPolicy loop after launch. As a Linux guy, I recently did some macOS development and was

> Codex Desktop for macOS triggers a persistent macOS Gatekeeper/SystemPolicy loop after launch. As a Linux guy, I recently did some macOS development and was incredibly annoyed by the "security" features, which seem designed to shift blame for security issues from Apple to users. macOS is constantly throwing up security screens and warnings about completely normal programs the user knowingly installed and trusted. If a developer pays for an Apple Developer account, signs their software, and a user knowingly downloads and installs it, that software should be allowed to run and do what the user wants.

deleted 3mo ago
[deleted]
- deleted 3mo ago
  [deleted]
frizlab 3mo ago
Fully disagree. I actively want to know when a program tries to access my hard drive and stuff…
- jacobgold 3mo ago
  I understand the motivation, but the implementation results in little more than security theater in practice. If you say "yes", the program can do almost anything and you'll have no idea what it's actually doing. If you say "no", you often can't use it for its intended purpose. They took the iOS model and applied it to their desktop OS and it's just lazy and broken.
  - nfbdhdfbf 3mo ago
    At least 50% of the time I see these warnings, the application is attempting to access something I wouldn’t have expected to access. I’m very happy to have the option to say “no” in those cases, so I can either validate that it’s legitimate or delete the sloppy software before it messes things up. It might be a lazy model, I imagine Apple could’ve done something better if they still gave a damn about desktop, but I’ll take this over nothing. It actively provides value to me.
    - frizlab 3mo ago
      Maybe Apple could have done better, but I’m not sure how. There is an option to ask for access to a given folder only (if the dev does its job right) in addition to either full access or not. At some point there has to be some kind of trust to be given.
appplication 3mo ago
I’ve been developing on MacOS for years and don’t think I’m familiar with what you’re talking about. I’m familiar with the warnings, but hardly ever see them.
- jacobgold 3mo ago
  I meant distributing software for macOS.
  - appplication 3mo ago
    That’s fair. What’s the Apple-recommended way to avoid this? I interact with a lot of software and tend not to hit it but I also don’t really interact with downloaded executables
    - jacobgold 3mo ago
      I assume Apple would prefer everyone use the Mac App Store exclusively? I'm not even sure if that solves the problem but it's a non-starter for me anyway.
    - perryizgr8 3mo ago
      You don't interact with downloaded executables? How do you procure your executables? From USB drives? Every single executable that didn't ship with the computer from the factory was downloaded. Even the ones built into the OS if you ever let it update.
- throw1234567891 3mo ago
  When you download an unsigned program and try to launch it, you get a warning and refusal to run until you go to system settings / privacy and security, and allow the program to run from there.
jrflo 3mo ago
It is super annoying when you first set up a Mac and is really over the top. Definitely geared more towards the average user rather than developers. But, once you get through the barrage of approvals during initial use you're basically good to go for the lifetime of that machine. That said, I really wish there was a "I know what I'm doing" checkbox to avoid a lot of that BS...
- addaon 3mo ago
  > That said, I really wish there was a "I know what I'm doing" checkbox to avoid a lot of that BS... The "I know what I'm doing" approach is the absence of the checkbox. Each of these decisions matters, and gives you insight into what the programs you're installing are trying to do today, independent of what they did when you last installed them (and maybe audited them) five years ago. Neither default behavior of "disallow all" (which would prevent correct operation of many programs) or "allow all" (which would likely violate your trust assumptions) is safe -- thought and human decision-making based on your own risk model and your own intended use of the installed software is needed.

deleted 3mo ago

[deleted]

deleted 3mo ago
[deleted]

frizlab 3mo ago

Fully disagree. I actively want to know when a program tries to access my hard drive and stuff…

jacobgold 3mo ago
I understand the motivation, but the implementation results in little more than security theater in practice. If you say "yes", the program can do almost anything and you'll have no idea what it's actually doing. If you say "no", you often can't use it for its intended purpose. They took the iOS model and applied it to their desktop OS and it's just lazy and broken.
- nfbdhdfbf 3mo ago
  At least 50% of the time I see these warnings, the application is attempting to access something I wouldn’t have expected to access. I’m very happy to have the option to say “no” in those cases, so I can either validate that it’s legitimate or delete the sloppy software before it messes things up. It might be a lazy model, I imagine Apple could’ve done something better if they still gave a damn about desktop, but I’ll take this over nothing. It actively provides value to me.
  - frizlab 3mo ago
    Maybe Apple could have done better, but I’m not sure how. There is an option to ask for access to a given folder only (if the dev does its job right) in addition to either full access or not. At some point there has to be some kind of trust to be given.

appplication 3mo ago

I’ve been developing on MacOS for years and don’t think I’m familiar with what you’re talking about. I’m familiar with the warnings, but hardly ever see them.

jacobgold 3mo ago
I meant distributing software for macOS.
- appplication 3mo ago
  That’s fair. What’s the Apple-recommended way to avoid this? I interact with a lot of software and tend not to hit it but I also don’t really interact with downloaded executables
  - jacobgold 3mo ago
    I assume Apple would prefer everyone use the Mac App Store exclusively? I'm not even sure if that solves the problem but it's a non-starter for me anyway.
  - perryizgr8 3mo ago
    You don't interact with downloaded executables? How do you procure your executables? From USB drives? Every single executable that didn't ship with the computer from the factory was downloaded. Even the ones built into the OS if you ever let it update.
throw1234567891 3mo ago
When you download an unsigned program and try to launch it, you get a warning and refusal to run until you go to system settings / privacy and security, and allow the program to run from there.

jrflo 3mo ago

It is super annoying when you first set up a Mac and is really over the top. Definitely geared more towards the average user rather than developers. But, once you get through the barrage of approvals during initial use you're basically good to go for the lifetime of that machine. That said, I really wish there was a "I know what I'm doing" checkbox to avoid a lot of that BS...

addaon 3mo ago
> That said, I really wish there was a "I know what I'm doing" checkbox to avoid a lot of that BS... The "I know what I'm doing" approach is the absence of the checkbox. Each of these decisions matters, and gives you insight into what the programs you're installing are trying to do today, independent of what they did when you last installed them (and maybe audited them) five years ago. Neither default behavior of "disallow all" (which would prevent correct operation of many programs) or "allow all" (which would likely violate your trust assumptions) is safe -- thought and human decision-making based on your own risk model and your own intended use of the installed software is needed.