Hacker News Reader

Comment by jtokoph | Hacker News Reader

> Note that in an upcoming release of macOS, Gatekeeper will require Developer ID signed software to be notarized by Apple.

Does this mean that anything distributed outside of the App Store will have to be approved by Apple? Will the App Store sandboxing rules apply to outside apps too?

View on HN

No, that's not what it means. Currently there are three security tiers for applications on macOS: App Store, not App Store but cryptographically signed, and not cryptographically signed. All three can be run.

That sentence means that in the future, the second category (applications which are not on the App Store but are cryptographically signed) will need you to generate a certificate with Apple. Nothing about the app store's sandboxing rules, and nothing about all applications -- you can run unsigned applications to your heart's content.

It's another slow gradual step toward total lockdown.

I feel like eventually I'll have to abandon Mac, but for what? Linux is still flaky and Windows adware unless you spring for Enterprise.

I would pay for a commercial Linux as polished as MacOS, but there may not be enough of me. (It could also have a list of officially supported hardware to at least approach the stability benefits of Apple's vertically integrated HW/SW stack.)

I mean RHEL Workstation is a very polished Linux environment. It might not be up to date enough for your needs but it's very stable and we'll documentated. Not the best for a laptop though.

I would spring for Fedora or Ubuntu and deal with the lack of paid support for my own personal use but then again I've been using Linux for a while.

Both options are perfectly stable desktops, it's really the commerical software support that will get you.

Ubuntu has Ubuntu Advantage paid support.

Elementary OS is quite polished and takes many cues from OSX.

Not debating Apple's overall trajectory, but I think it's cynical to call this a step towards lockdown. Mitigating certificate forgery attacks ultimately increases trust in software distributed outside Apple's walled garden.

* Assuming Apple never decides to flip certain switches, after the OS infrastructure and hardware support are in place

Turns out that even compiled software can be modified to suit the user’s intent, thankfully.

(Note: Not talking about Apple now, hypothetically...) How would one do this on a fully trust-chained system with processor support?

Barring software bugs that allow for arbitrary code exec as the binary?

Signed package + necessary keys embedded in silicon -> processor verfies signature at memory load -> processor disallows user privilege escalation to write to arbitrary memory

How is this not lock-down? If Apple doesn't like VLC or whatever software competes with their interests they can simply not renew their membership.

Are you talking about the old policy?

You can run unsigned apps. The new policy affects the process for signing apps.

But things like gdb just don’t work unless they’ve been signed. So, if Apple starts blocking unnotarized aogned apps, whether or not these programs will run will depend on whether Apple considers them malicious

You can still self-sign your apps.

I'm in the same spot as you and am eyeing Elementary OS.

What is adware about windows 10? I work on windows 10 pro and it seems fine.

The enterprise Linux distributions have lists with compatible hardware:

https://access.redhat.com/ecosystem/search/#/category/Laptop... https://www.suse.com/yessearch/ https://certification.ubuntu.com/desktop/

How do you run unsigned code on iOS. e.g. How can I build an XCode project and have it run on my iPhone?

This article is about "Mac Apps", as the title states. I figure—unless posted elsewhere—that iOS hasn't changed and is still as restrictive as ever.

You cannot run unsigned code on ios. However you can, for free, generate codesigning certs (that expire after 7 days).

C’mon, apple will never allow you to run your own code without their say so.

On macOS? You totally can. You can also do the same on iOS, but in a much more limited way.

You can now, but this is clearly a step in the direction of locking down the platform.

Weren't most developers already generating a certificate with Apple for the second category? I was paying apple 99/yr when I was actively developing a non-app-store app largely just so I could get the app signed with my developer id. I tried reading into alternatives it seemed like a risky process. Ideally I'd like to pay a bit less if I'm not using the benefits of app-review, but the notarization process seems like a decent compromise.

Even on windows my experience is that signed-non-windows-store apps can get flagged as malicious upon download if they're fairly niche/aren't used by many people, supposedly using an EV Cert helps with that. The user experience is actually worse from my experience (windows will show something red, then you have to click some non-obvious buttons to successfully run the app).

Yeah, Gatekeeper has always had Apple as the sole root of trust. What’s changing is that each app will now have to be uploaded to Apple to be ‘notarized’, rather than signing being a purely offline process with a previously obtained certificate.

> Even on windows my experience is that signed-non-windows-store apps can get flagged as malicious upon download

But I’m Windows, any approved CA can issue a certificate, not just a Microsoft.

Apple’s new regime is not only restricted to Apple being the only CA, but that Apple is the only one who can sign the apps.

That’s immensely restrictive.

It is still a writing on the wall. It makes no sense to tighten the security on signed apps if it is not to prevent unsigned app from running at one point. Which is clearly the direction of travel (and what Microsoft also did with WinRT and Windows 10 S). I don't have to wait until the final destination to not like the direction.

Notarized, not approved. It's not a manual process, doesn't involve App Store-like approval rules, and doesn't require sandboxing.

But in the future, it could, as apple boils the frog bit by bit.

Apple was very clear that the notarization process is not an App Store review. It could be, at some point, but as it stands currently there are so many apps that don't fit into the sandbox model that they'd just be shooting themselves in the foot.

What exactly is this if it's not a review process? If you violate Apple's policies you are banned. Of course your app won't stay in queue for review but once Apple found they don't like your app you can no longer sign it and I'm pretty sure they can make gatekeeper stop the existing installs as well.

It's automated scanning for malware. That's it.

So they cannot scan apps signed by a 3rd party cert authority?

That's irrelevant really - Gatekeeper only uses Apple's root when determining if software is signed.

Give the fucking shenanigans we've seen from the commercial CA's recently, I'm not surprised.

Of course it could. Almost anything "could". But it doesn't, as of right now.

This exact discussion first happened when the original iPhone came out. It's been a decade+ now, and nothing has happened to your ability to run whatever you want on a Mac.

If this really happens to be some sort of frog-boiling conspiracy, it's progress must be glacial. Which doesn't square very well with the other usual criticisms, namely that Apple doesn't care about the Mac, and that they suffer from short-termism.

> boils the frog bit by bit.

That’s a myth: https://en.wikipedia.org/wiki/Boiling_frog

It's a metaphor, he doesn't think Tim Cook has a big pot

But the thing he's trying to use as a metaphor has been proven scientifically false, so the metaphor doesn't actually mean what the OP thinks it does.

Have any better metaphors?

Well I don't agree with your basic premise that this change is bad for either users or developers, so no.

Well. Seeing that the frog boiling thing is a myth....

https://www.theatlantic.com/technology/archive/2006/09/the-b...

It's pretty much the same(notarized/approved). The only difference is that Apple may not "reject" the app before you publish it, but once it decides to "ban" it you can no longer sign it as they suspend your developer account. I can think of uTorrent as a possible victim of this "notarization" process. Apple can quickly put peer to peer file sharing apps on the "malicious/banned" list just like they did on Appstore.

They can do that already, and have been able to for years (block software) with XProtect.

No. Users can still disable Gatekeeper for complete control, just as they can disable Secure Boot on PCs, and just as they can disable Google Play Protect and enable "unknown sources" on Android.

Nitpick: Secure boot is about the firmware protecting the machine at boot time against unauthorized OSes or OS-modifications, establishing trust in the boot-media.

App-signing is about protecting the user within an already booted OS, trusted or not.

These are very different concepts.

Yeah, I agree. Just comparing them in that they both restricted users' perceived control and autonomy.

Secure boot is 100% under the users control. You can load your own keys.

Similarly in Windows you can control which CAs (or individual cettificates) you trust.

They 100% respect the users freedom.

Very much unlike Apple does with gatekeeper.

Reply on news.ycombinator.com