Hacker News Reader

Comment by noobermin | Hacker News Reader

Usually package managers on linux distros, to use an example for comparison, tend to check checksums of downloads for security purposes during any installation. For MacOS users, I guess I understand they want to use software not blessed by Apple, then isn't homebrew or whatever supposed to do the same thing?

View on HN

Handbrake for Ubuntu is distributed through the official Handbrake PPA, and this means there is still more transparency: there is a public record of the source code that went in the build process, and the binaries were automatically built from that on the Launchpad build servers.

There's a potential downside too: If a trojan gets into the PPA sources, it will be automatically downloaded and installed by users.

Of course, if the source is compromised, then all bets are off. It's all about degrees / probabilities when talking about security.

Yep, but it's not just the official source, it's also the guy's computer who uploads the source to the PPA.

Just something to keep in mind when adding a PPA: you're tying your machine's integrity to the integrity of the PPA and its keyholder(s), and this trust is tested each time you update your packages.

Most Mac users don't use anything like Homebrew. Typically you just download the software as a .zip file or equivalent, unpack it, and run it.

Apple does support code signatures for apps downloaded this way through their Developer ID program, but you have to pay $99/year to be a member of their developer program in order to do so.

In theory, you could still sign downloads using a code signing certificate you got elsewhere, but system wouldn't check it for you, and few people would bother to do it manually.

If you have Gatekeeper enabled(which it is by default), the system prevents the user from running random unsigned apps.

You can't turn Gatekeeper off anymore, at least not without using the command line. You can bypass it on an app-by-app basis by just right-clicking an app and selecting "Open" there, which is what you'd have to do if you're downloading apps like Handbrake.

>In theory, you could still sign downloads using a code signing certificate you got elsewhere, but system wouldn't check it for you, and few people would bother to do it manually.

Hence, we have occurrences like the OP. The point is checking checksums or (better) signatures is the most common way to mitigate it. Otherwise, this will continue to happen. Dare I say that is the entire reason repo managers of all stripes do this in the first place.

Even for homebrew users, installing GUI apps via homebrew usually means you'll need full Xcode installed. I, for one, only have Xcode command line tools installed and never use homebrew to install GUI apps.

Actually, Homebrew discourages building GUI apps. It's in the process of moving all GUI apps to Homebrew Cask, which doesn't support building from source. The exception is for GUI apps targeted for Linux, which can't be converted to a macOS-style appliation bundle.

Downloadable Mac apps should be signed [1]. Unfortunately not all developers do this.

[1] https://developer.apple.com/library/content/documentation/ID...

Reply on news.ycombinator.com