Hacker News Reader

"Currently, if a user tries to run your software it simply won't run, and the user has to know to go into system settings and manually give it permission."

No, you don't need to go into system settings. Just right-click on the app and select "Open" from the context menu. This brings up an are-you-sure dialog that gives you the option to go ahead and run the app. If you choose to run it, Gatekeeper marks it as trusted and won't bother you about it next time.

Huh, I didn’t know of this but I did know about the settings and “sudo spctl --master-disable”. It’s probably supposed to be something you come across about as frequently as terminal commands for some then.

When the restricties was first introduced I duck duck go-ed for a few second and came across the right-click-open solution straight away.

It was also shown at WWDC.

If they get rid of option 3, they will make macs unsuitable for a lot of development outside of the Apple ecosystem (they must still be good for development for iOS and macOS apps). Surely that is a large enough part of their userbase that they won't just throw that away

>Surely that is a large enough part of their userbase that they won't just throw that away

Don’t be so sure. It’s truly impossible to predict and understand some of decisions Apple's made in the pro market.

Best one can hope for is to get an explanation 10 years from now in a podcast or blog post. If there’s still such a thing

Surely you can turn on option 3 indefinitely for local builds at least. Otherwise Apple kills the ability to develop any software while offline or behind a firewall.

Gatekeeper only applies to software downloaded from the internet. Browsers set the "quarantine" attribute for downloaded files, and then Gatekeeper kicks in on first launch.

Software that you build locally, or that you install with a package manager, is not affected.

The goal of Gatekeeper is to keep your Mac safe -- not to control what you can do on your Mac.

Would something like "cat a.out > b.out" bypass Gatekeeper? I am always puzzled by apps which know the origins of files that they open.

Yes that would bypass it. It's metadata set in the filesystem not a part of the file itself.

What I usually do is:

    xattr -d com.apple.quarantine FILE

It removes the extended attribute from the given file.

Yeah Apple has repeatedly and fairly consistently shown that they're more interested in the luxury consumer market than they are in anything else.

They might want to take some advice from Steve Ballmer.

As a life long Mac user, if option 3 is removed i will be leaving for Linux.

Yup. I have a MacBook and a really nice Linux laptop.

While I work a little faster in the Mac, it feels good running Linux. I don’t think I would be OK with option 3 - agree with you.

EDIT: I am fine with a sandbox for iOS, not macOS.

This is why I still haven't bought a tablet. I was really excited to get the latest iPad with the A12 bionic, then I started looking into open source software (only really need two: password store and ssh) and realized it essentially doesn't exist.

And with the current state of Android tablets, I guess I just won't be getting one for a while.

There are plenty of SSH and password management apps on iOS. Did they not work for you?

Open Source is what he said doesn't exist. I'm not sure, because it's been a while since I paid attention, but unless a project takes it upon themselves to go through the process of becoming an Apple Developer (do they need to decide on a person, or form a non-profit, or can they somehow register as a non-legally recognized organization?), how doe they distribute a fully open source version with some assurance that what you're running on the device is what's in the open source repo?

I'm much less interested in running someone's custom port of OpenSSH to work with a phone UI than I would be to run some official port by the OpenSSH/OpenBSD developers. How hard is it for someone to harvest private keys, passwords and remote IPs in an app like that? Not very hard at all. Breaking the chain of trust between the repo and what I can build myself (or trust a third party to do, such as a linux distro) makes it much less appealing.

For an open source ssh client there is the "Blink Shell", which can be purchased from the App store -or- you can build it yourself from source. I am unsure if the developers directly get any money when you purchase it from the app store, but they do mention the paid app with the source here <https://github.com/blinksh/blink>. It isn't often that I find myself needing to use an iPad/iPhone with SSH, but I've used WebSSH (perhaps no longer under active development) and Coda in the past.

I have not done any real research for open source password managers. But a quick search did find <https://opensource.com/article/16/12/password-managers> which lists at least one. Personally I am very happy and frequent user of 1Password (by Agile Bits) across various devices.

The Bitwarden password vault iOS app is open source.

Nowadays, when I hold macOS, it doesn't bring me joy. I moved on to Linux a few years ago. No regrets.

I installed Kubuntu 18.10 on my MacBook Pro 2015 13" (12,1) and sleep doesn't work properly because of the USB3 controller. The MacBook will suspend correctly from a cold boot, but every suspend after that the MacBook immediately wakes up as soon as it successfully suspended. This a is a common issue[1].

As long as I still can't trust Linux to successfully deal with suspending without hacks, I'm not gonna move over. It needs to be bulletproof that if I close my laptop, put it in a bag, and then later open that bag my laptop A. wakes up and B. hasn't overheated and drained the battery. macOS gives that peace of mind, and I feel that is paramount for a laptop to be usable. I can't believe this is still not a fixed problem in the Linux world in general, and especially on a 4 year old device.

[1] https://joshtronic.com/2017/03/13/getting-suspend-in-linux-w...

No one is making any money getting Linux sleep to work on a Macbook Pro 2015. That is why it doesn't work. Sleep can work on Linux, but it is hardware/driver specific. That is why you should only buy hardware where there vendor invests in proper support.

Either the vendor needs to invest in support, or you need the community to come together and build support like with Allwinner chips (which are dirt cheap, hence people building mainline, blobless support). Apple doesn't invest in Linux kernel support, and their userbase isn't motivated to do so either :/

As if.

My Asus Linux supported netbook wasn't properly a flawless experience and those beautiful AMD open source drivers mean I will never get back the same OpenGL feature level and hardware acceleration provided by fxgl, that I had at sale time.

I too attempted to get Linux working on a modern MacBook. It's terrible. The keyboard and touchpad aren't connected to the USB bus (like on any other sane laptop out there), but instead to the SPI bus. ACPI is terribly broken (it always has been, but not quite this bad) and with the newer Macs with T2 chips, there's a chance you won't even be able to access the nvme drives from Linux at all.

I wrote a post about my experiences here. I got almost everything working except Wi-Fi or ACPI/suspend. It wasn't easy and I would not recommend Apple's non-standard hardware.

https://penguindreams.org/blog/linux-on-a-macbook-pro-14-3/

If memory serves the SPI bus thing is down to the UEFI - that is, when you boot into Windows, for example, it uses it via the USB bus. I can't remember the reasoning for this.

Complaining about it on HN ain't gonna fix your problem. Either wait for someone to fix it, pay someone to fix it now (perhaps along with other funders), fix it yourself (perhaps with a hack/workaround), use MacOS instead, use different hardware, or ignore it.

Stepping back a few feet to get a bit of perspective, it does seem like the OP is using the most common developer machine in history. Devs are historically Mac people, and are afraid of newer ones, so they hoard the 2015 MBP.

It would seem that if a developer OS was going to work correctly on any machine, ever, that would be the one, since an issue there would bug the largest possible group of people who were capable of doing something about it.

But it doesn’t. I think he has a valid point.

My statements still stand. The fact that there are many users of the hardware simply means that there might be many potential funders of a feature like this, or that it is more likely for someone to fix the problem for free in the near future.

Indeed. But it does tend to lend more credence to the point of the person you responded to, which is "nobody is ever going to make Linux work on a computer".

You're certainly correct that that's due to a combination of nobody caring enough to pay for that to happen (and the few people who could in fact do something about it simply configuring their own personal machine to work correctly.)

> Devs are historically Mac people

No, this is simply untrue. Once you step outside of the US SV and WebDev bubble, there are millions of developers writing code for on Windows and Linux for stuff that you never even heard of. Mostly because it's unsupported on Mac due to the locked down ecosystem. Obscure machine controllers and their drivers, planning software, banking software, regulatory mandated software for certifications, etc.

It is really funny, since it wasn't too long ago since I met the first mac-developer. I wondered quite a bit about that.

I did industrial cs, so development was mostly focused on embedded devices and nobody here used a mac for anything.

Wouldn't have worked anyway, since people tend to be tinkerers. That is usually not a group using locked down environments.

I battled this for months and no workaround worked. It sadly forced me back to macOS. I'd reopen the lid later and find the battery drained and lose work if I hadn't saved before closing the lid.

Why wait? You can do it gradually. I've been using Macs since 1985, and I still have one on my desk at work, but I noticed a few years ago that I'd gravitated toward doing most everything on Linux without really thinking about it. Just get a Thinkpad or something, put Ubuntu or Mint on it, and see how it feels.

Why wait?

Indeed. I made the switch years ago and there's less hassle on the Linux side. The big vendors are just so control-oriented now.

Why wait?

Because I don't want Linux. MacOS largely still just works and Linux is moving away from its strengths as quickly as possible. I don't want systemd. I don't want pulse audio. I don't want Wayland. Linux's strength, for me, has been that it's unixy. If I'm moving to a non-unixy setup, like Linux is becoming, I want it to be as polished and well supported as possible. Linux, simply put, is none of those.

And, quite frankly, I don't want a Thinkpad (and I can't stand that eraser tip pointing thing). I bought a 2015 rMBP late last year and cross shopped offerings from Dell, Lenovo, and one of those Linux laptop companies whose name is escaping me right now. The Mac won out and didn't command a premium over comparably specced alternatives.

I'll spare the ranting about the Gnome 3, new GIMP UI and systemd in general (but these are both major issues for me and symptomatic of a culture I don't want to buy into). I recently tried to set up a Pi Zero with an Audioquest DragonFly DAC. The DAC just works in FreeBSD and MacOS with no hassle. I was able to tweak ALSA to get sound out of it, but shairport-sync can't set the volume (which works just fine on FreeBSD). WiFi was a struggle as well. I forgot what an archaic mess of procfs tunables and bizarre config files Linux on the desktop can be, and I don't want to spend my days debugging my desktop system.

One of my coworkers at megacorp got the officially sanctioned Linux laptop (some Dell thing). Like a good end user he installed updates as they became available. Turns out megacorp bought the Windows version of the laptop and installed Linux on it. Well, my coworker installed some firmware updates that promptly re-enabled secure boot borking his system. He lost a day trying to figure out what happened (Dell wouldn't support Linux on it and corporate IT was entirely indifferent). I don't want to dodge a minefield masquerading as a support matrix.

It seems like it's been the year of the Linux on the desktop for most of my adult life.

Edit: Downvotes don't win over users.

I think that is a strange argument to make for preferring macs over Linux. Many of the things you mentioned are inspired by osx counterparts (for example, launchd was the main inspiration for systemd)

I think that is a strange argument to make for preferring macs over Linux. Many of the things you mentioned are inspired by osx counterparts (for example, launchd was the main inspiration for systemd)

How is it a strange argument? Apple did a good job developing its daemons, and did so for a brand new operating system. Pottering did an abysmal job imitating Apple and is doing a worse job at maintaining his software (e.g. Pottering refusing to open CVEs for known vulnerabilities), and has worked tirelessly to replace working solutions.

If I want non-unix, I go with MacOS. If I want unix-ish, Linux doesn't fit the bill. Much like how I chafe at the GIMP developers chasing non-existent "pro" users with unwieldy UI changes, Linux on the desktop seems to be chasing change for change's sake.

You can avoid using systemd[1]. If you don't like the churn of desktop environments, may I suggest Xfce ? It is usable and does not overhaul things that often.

I personally prefer systemd and moved from Ubuntu to ArchLinux a long time ago in order to use it. But I agree with you, the constant overhaul of UI is a problem which is why I have stuck to Xfce for a long time. I however, do not use GIMP, but there may be other options out there.

By the way MacOS is Unix, it is a POSIX compliant OS. Also, you can run Linux on your Mac.

[1] http://without-systemd.org/wiki/index.php/Linux_distribution...

Right, I can do a lot of things with Linux with enough effort. But for a desktop OS I want things to just work. Pretty much any major distro that's supposed to just work is going to be systemd at this point.

And, sure, MacOS is unix-ish but Apple is ripping more and more of the old NextStep and BSDish things in favor of their own stuff with each version. As long as it just works I'm pretty happy. There are, however, lots of little quirks and gaps with their POSIX layer which is why I'd hesitate to call it a proper UNIX.

Also, you can run Linux on your Mac.

Which would be great if I wanted Linux. I don't. MacOS is working just fine for me.

macOS is certified UNIX under the Single Unix Specification: https://en.wikipedia.org/wiki/Single_UNIX_Specification#macO...

Yep, I'm well aware. But as I said the little quirks and whatnot make MacOS feel less unixy. Obviously they're not deal breakers for me, but things like telnet, ftp, and OpenSSL disappearing make it seem like Apple is moving away from SUS (more than it is?). The delta between MacOS and everything else seems to grow with each release. It's probably worth noting that no vendor has tried to get Linux SUS certified and most distributions aren't even LSB compliant.

In fairness, the command-line world of the BSDs of the 1980s is long gone in some respects, and this is not just some Apple/NeXT idiosyncrasy.

OpenBSD's ftp command has become a generic multiple-protocol file transfer tool, different to the ftp commands of the other BSDs. (FreeBSD puts this functionality into a tool named fetch, instead.)

The r- commands were eliminated from FreeBSD some time ago, with much the same happening to them as happened with telnet on MacOS. They are no longer in the operating system, but are applications that one can install from packages/ports.

BSD re-vamped its command-line interface to ps in 1990. It has been getopt-based, and documented as such, for 29 years and 7 days.

rc.local was labelled obsolete in FreeBSD in 1995, and deleted from base in 1998.

And so on.

Citations needed for the personal attacks. For reference, my bug reports to systemd and the ones filed by my coworkers have been handled quickly and professionally.

https://news.ycombinator.com/item?id=14722573

https://www.theregister.co.uk/2017/07/28/black_hat_pwnie_awa...

https://github.com/systemd/systemd/issues/5144

Hence, I doubt the security community requests what is asked for in this issue. And I am pretty sure it's not our job as developers to file CVEs for any bug – regardless how small – we encounter. CVEs are after all not our currency, but the security community's...

"Refusing" is a bit strong here.

I agree this was a bug, but hardly a remote code exploit. The thread is very level headed and someone else filed the CVE. In the OSS community I run in this is normal, in fact I'd say it's very common for the primary developer to have a differing opinion about severity. But security doesn't depend on one bug ticket or one maintainer. There are many entities and teams at play that check and balance.

"Refusing" is a bit strong here.

How so? In your own words:

someone else filed the CVE.

Having someone else override Poettering does not mean "Pottering did not refuse". It simply means saner heads prevailed.

You don't win a pwnie for high quality code, and the vulns they listed (as well as ones discovered subsequent to the award) all smack of low quality code. As the lead of a core piece of technology I expect more than childish whinging about how "CVEs aren't our currency". You like Pottering, great. I don't, and more to the point I don't like the results of his influence on Linux. When posed the question "why not switch to Linux now?" systemd is high on the list of reasons.

I don't "like" Pottering because I don't know the person in the slightest. I have found systemd to be useful software and interactions on the issue queue have been reasonable.

I was a happy Upstart user before Upstart threw in the towel too.

Also, thanks for the citation. I still strongly feel you've shown something that doesn't warrant a personal attack. As someone who gladly uses systemd while having no particular attachment to it, I find the aggressive and personal attacks confusing.

I can't reply at your depth, but Apple and Google also appear to have won a "pwnie", whatever that is. I think think they still do respectable work in spite of it.

No. According to Lennart Poettering, the inspiration for systemd was upstart.

No, he looked at upstart and found it severely lacking. launchd was much more the inspiration.

In Lennart Poettering's very own words, written on xyr own WWW site back in 2010, xe stated that xe "took a lot of inspiration" from Upstart.

Read http://0pointer.de/blog/projects/systemd.html, specifically the criticism on Upstart.

Systemd having taken such a different path to solving the startup and service problem, I don't think you can really say that Upstart inspired systemd, perhaps only Upstart's failings.

And yet it is that very page where Lennart Poettering says exactly what I quoted. You have an argument with Lennart Poettering, and are trying to argue that xe did not take inspiration from what xe said that xe did.

That says nothing at all about its design or architecture or quality or usability. Windows 1.0 was inspired by the Macintosh.

> Edit: Downvotes don't win over users.

HN policy is to not gripe or discuss reasons for being downvoted.

You can’t just “get a thinkpad or something.” The latest X1 Carbon, for example, requires quite a bit of massaging to work with Linux. (Though that’s more a fault of PC makers than Linux. Because the PC market is so price sensitive, the BOM is constantly changing. So just because one generation of a laptop works well with Linux doesn’t mean the next generation will.)

Thanks for the information. I am on my seventh "just get a thinkpad" running Linux now, but I haven't tried the consumer models.

The carbon is a business model.

Do you have any info on the issues with the latest (2019?) X1 Carbon? I was looking at it to replace my Dell XPS, but I'd like to be able to run Linux on it at some point.

"As a life long Mac user, if option 3 is removed i will be leaving for Linux."

I agree, however I suspect I will still by mac hardware.

So, for me, it's really not a dollar-vote against this behavior ... unfortunately ...

I interpret the "by default" as meaning the exact same thing as "Developer ID is required by default for Mac apps" today. Or in other words, I would assume that getting around a non-notarized app in the future would have the exact same sequence of steps as getting around a non-Developer ID-signed app today.

I don't know about the landscape on macOS, but aren't signed apps still the exception?

I hate signed apps to be honest. They ruined the software landscape on mobile, and I don't want to see any of this on a machine that is used for work.

Security advantages are marginal, the lock-in isn't.

How does it work if you want to write your own software and run it locally on your machine?

You just chmod it, in my experience. Not sure what happens if you need to really install something on your own machine

I'd imagine it's another tier for Gatekeeper (the mechanism in macOS that verifies this). Gatekeeper can be outright disabled if desired (appears missing from the System Preferences UI though), allowing all unsigned code to run.

Currently, if an app isn't signed and you have Gatekeeper set to "Allow apps downloaded from App Store and Identified Developers", you'll get a prompt stating it isn't permitted to run. If you open it using the context menu, you'll get a button in that prompt to "Run Anyway". Alternatively, recently blocked apps by Gatekeeper appear in System Preferences allowing for manual override as well.

I'd imaging the notary service would be included in the "App Store and Identified Developers" section, and the same restrictions apply.

As for your own software, XCode signs it with your Apple ID automatically. Everything else, via terminal is the same as always.

There's no interaction with Gatekeeper there. An executable you've built yourself will just run normally (assuming it has the x attribute of course).

OK, quick lesson in how Gatekeeper works:

When you download a Mac app from the web, or save it from an email, a bit of metadata called the "quarantine attribute" is attached to it. When you try to run an app with the QA, Gatekeeper checks whether it's allowed to run; by default this will be allowed if it's signed. If it doesn't pass GK, you can still run it anyway by right-clicking on it and choosing "Open". When the app runs, regardless of whether GK passed it or you overrode GK, the QA is removed. After that GK no longer cares about it, and the app will just run normally without further fuss.

Safari and Apple Mail automatically add the QA to anything they download, and most 3rd party browsers and email clients now do the same. But if you download an app using most command line tools (curl, wget, ftp, scp, etc), or if you build it yourself from source, then the QA never gets attached to it in the first place, so GK doesn't care about it and the app just runs normally.

As far as I can tell the new notarization system doesn't change any of this, it just adds another form of code signing.

That's like the "Zone" alternate data stream in Windows/NTFS for the Windows folks. And as in Windows some apps add them, some don't. (Windows ZIP vs 7-zip)

I'd read the 'by default' as it being turned on system-wide and up to the user to override on a per case basis. Of course Apple's ideal model is that they want everything going through them. They're going to enable it 'by default' and if customers don't scream too much, they'll likely make it mandatory a release or two later.

What you describe in your point number 3 is not for apps, but for kexts (Kernel Extensions). Upon installation they won't run by default, but the user is allowed to go to System Preferences > Security and give it permission to run.

GateKeeper (the mechanism that enforces this) can be easily disabled. It could even be disabled from the UI, up until a few releases ago.

My understanding is that if you’ve released Developer ID-signed software in the past, you won’t have to notarize just yet.