Hacker News Reader

Comment by liquidise | Hacker News Reader

I'm fascinated that there are people on HN who have not disabled GateKeeper. I'm not sure i've used a machine since it was added where i haven't disabled it within an hour of setting up a machine.

View on HN

How often do you install new software that's unsigned? I've only done it a couple of times, and once you override Gatekeeper for a specific app it never asks you for that one again.

I rarely find apps on the Mac app store, they're usually always from the app's creator's website. Recent ones I can think of include Bowtie and Sublime Text 3.

There's an option for app store + signed apps, which is fairly lenient. Bowtie I think is dead though, so it's possibly still unsigned at this point.

So? Once you open an app once (right click and open) it's white listed by gatekeeper.

Sublime Text 3 is signed:

    $ spctl --assess --verbose /Applications/Sublime\ Text.app
    /Applications/Sublime Text.app: accepted
    source=Developer ID

Or have you downloaded a special version from a Chinese file sharing website? :)

Most apps are signed nowadays, regardless of whether or not you're getting them from the store.

Why would you do that? It it exposes you to risk, and as has now been proven, if adopted as a general practice it exposes everyone else to risk too.

I do it because i do not use the App Store to download apps. Every open source app i download that is not signed with Apple needs GateKeeper disabled.

> Every open source app i download that is not signed with Apple needs GateKeeper disabled.

No.

Every unsigned app you download needs to be whitelisted. Right click the app, click open. It will remember your choice and whitelist the app forever more.

Solving the unsigned app problem by silently ignoring clearly invalid signatures is like solving an ant problem by burning down your house.

Reply on news.ycombinator.com