Hacker News Reader

Comment by coldtea | Hacker News Reader

It's about unsigned (not notarized) binaries. Not about using only apps from the app store.

You can use homebrew, third party apps from the web, apps you've built yourself, etc, just fine. They just need a signature.

Kind of like Chrome, Safari, FF, blocking non https websites (with Apple being the CA tho).

This has been announced years ago, and was extended last year, and is now enforced.

View on HN

> They just need a signature.

And you need to pay Apple for the certificate to sign them. And never piss them off lest they revoke it.

That isn't true. You can use ad-hoc signatures generated during the build. The point is to detect tampering and damage.

ad-hoc signed apps expire after a week, then you need to rebuild. It's not a viable solution for distributing apps. If you want other people to use something you wrote you have to pay Apple.

Reminds me of the session at WWDC 2012 where Peter Kiehtreiber (aka Perry the Cynic) introduced Gatekeeper and Developer ID.

Even back then, Apple was not kidding about forcing as much code as possible through some identity system before it could run.

To quote the distinguished gentleman, with a touch of sarcasm:

"If you're currently shipping unsigned code, what the hell is wrong with you!?"

It was announced and there has always been a way to disable it. There is also a way to disable it on the intel macs.

And no it has not been announced before that you will be forced into notarization.

Was homebrew binaries signed before?

Reply on news.ycombinator.com