Hacker News Reader

>In theory, you could still sign downloads using a code signing certificate you got elsewhere, but system wouldn't check it for you, and few people would bother to do it manually.

Hence, we have occurrences like the OP. The point is checking checksums or (better) signatures is the most common way to mitigate it. Otherwise, this will continue to happen. Dare I say that is the entire reason repo managers of all stripes do this in the first place.

If you have Gatekeeper enabled(which it is by default), the system prevents the user from running random unsigned apps.

You can't turn Gatekeeper off anymore, at least not without using the command line. You can bypass it on an app-by-app basis by just right-clicking an app and selecting "Open" there, which is what you'd have to do if you're downloading apps like Handbrake.

Even for homebrew users, installing GUI apps via homebrew usually means you'll need full Xcode installed. I, for one, only have Xcode command line tools installed and never use homebrew to install GUI apps.

Actually, Homebrew discourages building GUI apps. It's in the process of moving all GUI apps to Homebrew Cask, which doesn't support building from source. The exception is for GUI apps targeted for Linux, which can't be converted to a macOS-style appliation bundle.