Hacker News Reader

Comment by newaccount74 | Hacker News Reader

Shell scripts are affected by quarantine just like any other executable.

The easiest solition is, as kybernetyk says, to right-click the app. If you do that, you can bypass most the warnings.

Another possibility would be to install the app in a way that doesn't set the quarantine attribute, eg. with curl, rsync or brew cask.

But Apple has been tightening seccurity year after year, so it's questionable how long all the workarounds will continue working.

My recommendation would be to just notarize the app - Mac users expect notarized software, and if you tell users they need to bypass the security checks, then a lot of people will think you are sketchy.

View on HN

> My recommendation would be to just notarize the app

The problem is that this involves having a developer ID, which costs $100/year — which is the one thing I'd like to avoid. Hence my question. The apps I'm contemplating about would be free and open-source so I won't be making any money on them.

Rhetorical questions: how much salary do you make on other work? How much have you spent on your hardware?

Real question: why is $100/yr such an egregious amount of money?

If it’s a matter of principle, perhaps targeting macOS also lies outside those principles.

This would have been a completely unattainable amount of money as a high school student. In college, that money was better spent on school supplies and food, and spending cash was short. After college it took me the better part of a decade to get to the point where $100/year felt like something I could feasibly consider spending and not risk missing rent in January.

$100/year is a lot of money to people in a wide variety of life situations. Being unable to afford this does not make them any less of a programmer.

I bought Turbo Pascal and Turbo C++ versions for Windows 3.1 as high-school student.

Each of them were between 150 and 200 euros on today's money.

High school student allowance in early 1990's Portugal after decades of dictatorship wasn't that great either.

Was it a subscription service, though? That doesn't seem like a terrible deal if you get a perpetual license - meanwhile forking over $99/year for some basic functionality wrapped in Service Credit seems like a racket to me.

No it wasn't, nor are Apple devices given for free to students.

Anyone that can afford Apple hardware as an high school student surely can afford the dev subscription.

Anyone that can afford a Lexus can also pay for a heated seat subscription. Does that make it right for them to sell it?

Yes, a company has the right to do whatever they want with their products.

It is up for the customers to validate their business decisions.

Customers can only validate it if they have a choice. How does an iPhone developer validate or invalidate Apple's behavior? They're basically a hostage on Apple's platform, and the only thing keeping them there is the fact that they get paid. Apple shouldn't have the negotiating power they wield, and regulators are taking action to stop them from abusing it.

By becoming a developer of something else.

You don't have that choice if you're building a service that relies on having a mobile app. You are required to have presence on iOS if you want any semblance of success.

It might be news for you, many countries in the world have a very superficial presence of iOS devices, and not every company is a multinational.

Second, Web also exists.

Third, this whole thread is about macOS.

You are the one who tried to introduce an extremely general argument, which I guess you are no longer interested in defending?

> Yes, a company has the right to do whatever they want with their products. > It is up for the customers to validate their business decisions.

So, to verify: you do agree that your argument at least does not apply to the iPhone?

I wasn't the one moving the goalpost into iOS app store.

Still the point stands.

I'm the one who pushed the discussion onto the tangentially-related Apple mobile platform, guilty as charged.

Do you want to defend Apple's absolute control over the iPhone in front of God, Saurik and everyone, or admit that the world's richest company operates out of greed sometimes?

Greed? No. Profit motivated. Of course. They are a business. Businesses generally exist to make a profit. The more profit they make, the stronger and more resilient they become. Apple, having been very close to bankruptcy a couple of times means that they have a strong motivation to make a profit. Nothing is without reason, whether or not you like the reason. I guess corporate greed is a thing, but then so are the very real costs of operating services. Ranting about a business being successful or being the wealthiest just smacks of petty anti-capitalist jealousy. I get it, Apple were supposed to fail and they didn’t.

Are Apple’s fees worth 15%[1] of the vendors revenue? Possibly not, though as a provider, they are entitled to make a profit.

[1] Yes, yes; 30% if the vendor make > $1,000,000. Let get real, the significant majority of the app that you are arguing about are likely to be grossing less than that. And of course 15% of $0 is $0, so the argument is completely moot for freely distributed apps.

> Possibly not, though as a provider, they are entitled to make a profit.

The big thing people seem to disagree with is Apple forcing themselves to be a provider (and thereby forcing their entitlement to a profit). Apple is certainly entitled to compensation when people use their service, but no computer should force it's services on the user. Regulators seem to really hate that bit, and it will be interesting to see how Apple responds to the Digital Markets act.

That doesn't make them an iPhone developer anymore, does it?

Which is the whole point of how customers make the difference regarding platform business decisions.

UWP died because the large pool of Windows developers didn't want to buy into it.

UWP died because there were better ways to make Windows apps.

Which Windows developers as Microsoft customers decided to keep using.

App developers are not the "customer" of these curated store platforms any more than cereal manufacturers are the "customer" of a grocery store.

If you try to take your business elsewhere, you have no market, because no one else is able to create a store which targets the same market. This is entirely unlike a grocery store, because if Safeway is unreasonable you can launch an entire store just for your own products and people can shop at both.

However, with these curated store platforms, a user can only use the App Store. They can get a different phone--at ridiculous expense, as there are numerous anticompetitive lock-in mechanisms with respect to licenses that prevent this: I would, for example, lose access to all of the music and books and apps I've ever bought--but then they aren't able to use the App Store anymore.

The problem is that virtually all sane people only carry around a single phone. This is not true of grocery stores or frankly any other form of store unless you map the analogy to geographic regions, where people have to move to a new house in a different community--at great difficulty and expense--to get to another grocery store. Even if you only have a monopoly over one "small" region, that's still a monopoly.

This is not really the case for mass market consumer goods (like the cereal example in your post). Safeway and Kroger are a duopoly not far off of Apple’s app store monopoly and if you don’t like their terms, there aren’t exactly alternative viable channels for your cereal.

I get what you're saying, but I think the fact that convenience stores are anything but a monopoly just further illustrates how disparate Apple's authority is here. The power Apple wields is like if there was one cereal store, and if you didn't like the selection they had then you "just find another breakfast food". It doesn't, and shouldn't have to be a binary choice.

And the customer has the right to hack their car to activate their already installed heated seats on their own terms because they own the damn thing.

Depends on the laws of the country.

Who says the HS student is buying the hardware themselves? It could have been a gift, a hand-me-down, a school computer, etc. As a HS student I was poor as shit, no allowance and lived in a rural area where getting a part-time job would require a car and all the expense with that.

Yeah and selling apps on Apple hardware will surely be top priority in such cases.

They didn't say they wanted to sell the app, just sign and distribute it. Maybe they want to put their FOSS project on the App Store, but can't until they get a "real job" first.

No need for the app store for that.

Plus I have known many offshore colleagues from African and Asian countries that managed to be successful in selling software, despite the conditions they were raised in.

So painting the Apple story as gate keeping is playing it short, there are many ways to skin a rabbit.

You'll need the App Store if you want it on iPhone, which means you need to pay the subscription.

I'm not going to sit around all day and play pity-party with you about impoverished developers. I've known my fair share too, and I might even be one depending on your definition of poor living conditions. The point is simple: Apple stops people from doing arbitrary stuff for no reason. Perhaps you don't care; I'm not arguing that. Maybe it doesn't stop people from getting rich; obviously, money is still made. Regardless, everyone knows their deal stinks like shit - the cat's out of the bag. Apple bought themselves a couple months with the 15% punch-line, but the laughing stops next year.

This isn't controversial or high-concept stuff. You should be able to freely install stuff on your iPhone even if you don't personally intend to. It seems like by-and-large, the democratic world agrees.

And me thinking this whole thread was about Mac apps for macOS.

If only the App Store were that simple.

The whole point of the post was exactly not using it, so it doesn't matter how simple or complex it happens to be.

Alright.

Yet you can afford to buy a Mac?

Looking around in the average small city in the US today, McDonalds is paying $15-$20 an hour.

McDonalds pays you in compensation for actual physical labor. You pay Apple to flip an arbitrary bit on your iCloud account that enables features that should be enabled by-default on devices you bought and paid-for.

Bit of a difference there, perhaps something worth being upset about.

That has nothing to do with the fact that $100 is affordable to the average college student working at a fast food company.

But even if I buy your argument, are you saying that selling software also has no value since once you write it, the marginal cost of delivering software is basically $0

Distributing software has zero cost. Apple can bundle services with it (vuln scanning, CI/CD, cloud resources, etc.) but copying data is inherently a free process. You may object to that all you wish, but the entirety of the internet stands as evidence that software distribution is normalized and free.

The problem was never that Apple wanted to offer cloud resources or scan for known exploits. Go wild, Microsoft does that too and it works great for them. People are only mad when Apple conflates completely arbitrary capabilities with their $99 dev service fee. I should not need a recurring subscription to install an App from Github. We're not in 2005 anymore, we're done selling feature phones.

So once software is made, delivering it to the customer is just “delivering data”. Do you think that all software should be free and people shouldn’t charge for software?

All software is free. I have 4 versions of MacOS archived on my disk right now, and you can get your own copies on the internet archive. Want to pirate Mac software? Go get it, nobody will stop you. The only price that everyone pays on the internet, is free.

Every platform that respects the freedom and authority of it's users seems to agree that all software is free. As Apple is an American company, it would make me very happy to see them agree with those values.

Are you a software developer? How does your company make money?

Selling support.

Distributing software is inherently not a zero cost process and it suggests an amount of ignorance in the space to say that it is.

I’ve been paying the $100/yr to sell my iPhone apps since I was 15. It’s really not very much money, even to a high school kid.

I think this is the first time I’ve seen someone dig in so passionately that the fee is unreasonable. Most people just pay it and keep building.

The fee isn't unreasonable. The things they block off is. Until Apple lets me install an IPA file as easily as something from the App Store, I will mercilessly mock them for extorting the very developers that make them rich. The closing noose is why I left MacOS, and the reason why I could never daily-drive iOS. It's dumb, and anti-consumer.

I'll happily answer any further questions, but I'm afraid my opinion isn't as interesting as you think it is.

What does any of this have to do with Mac development? Anyone can already install anything on the Mac even if it is unsigned by right clicking.

I'm replying to the parent, who was talking about selling and distributing iPhone apps. Moreover, this discussion started with me highlighting which things should be in the subscription (CI/CD time, VPSes, direct support) versus things that shouldn't be in it (freely managing arbitrary software). Conflating the iPhone's capabilities with the developer program is Apple's fault, not mine.

Most people aren't "mad" about this -- and in this case, GP is complaining that they simply don't want to, not that they can't afford it or anything. There are also fee waivers available for registered non-profits, those in education etc. -- so it's not as binary as you're making out.

You also don't need any subscription to install any macOS app, but without it being signed by a developer, you have to -- le gasp -- control-click or right-click, and accept the warning that the developer is unverified. Hardly a massive tax on end users.

How do you know they weren't gifted it, or bought it used, or that it's some older hardware revision?

Wanting to work on software for macOS doesn't automatically mean you own a $3000 MacBook Pro...

And have you seen the prices of even used ARM Macs that by definition aren’t more than two years old?

Did GP claim to be on Apple Silicon? No? Stop assuming.

That aside, if GP did run an Apple Silicon machine, there's also the market to buy used, and buy lower-spec models like the base-spec Mac Mini or MacBook Air.

Once again, these aren't $3000 machines, and you don't know whether the machine they use was gifted, loaned, used, a work machine, etc. -- although the decided choice by their own admission, and their profile, suggests cost wasn't a factor for them.

Do you have a point, or are you just looking to argue? The response was in your incredulous "Yet you can afford to buy a Mac?" accusation to GP -- which is loaded with baseless assumptions. I reasonably pointed out any ways someone could own a Mac without significant or any cost to themselves. Nobody said anything about it being the most modern or powerful machine, all GP said was that they want to create FOSS apps for Mac, and didn't agree with paying the $99/yr Developer program fee for signing apps as an "authorised developer."

Then don’t pay the $99 fee and tell the users they have to right click to run it.

It can be an "egregious" amount to those in a variety of circumstances -- developing countries, students, those without employment, or living paycheck-to-paycheck as is... not everyone who is or wants to be a dev is making tens/hundreds of thousands of bucks per year.

GP says they're "Ex VKontakte, Telegram" in their profile though, which would imply they've made some money at least... and their comments read as more of an unwillingness to pay the $99, not an inability to do so ¯\_(ツ)_/¯

As a developer from a developing country, $100/yr is really expensive.

> How much have you spent on your hardware?

The hardware itself has some value though

And giving people enough confidence in you that paying $100 a year isn’t?

Does your app have value? It’s not hardware.

Sucks for non-commercial work though. Not every app is intended to make money, but as I understand it all have to pay. 100 USD a year is quite an expensive hobby.

Then let the end user jump through a hoop and describe how to bypass GateKeeper.

Is it? In the grand scheme of things, I would argue not. My partner, for instance, knits. Cheap hobby, right? Nope. Specialist needles, yarn, etc. all adds up. She certainly spends more than $100 per year on it. How about photography? Or fishing? Most arts and craft type hobbies? You get the picture...

> And giving people enough confidence in you that paying $100 a year isn’t?

Why stop at Apple then? Why not paying the antivirus companies as well?

Do you pay for SSL certs for your websites to help give customers confidence that you are who you say you are?

No I don't? There's LetsEncrypt.

And I'm not sure it's relevant either since SSL does give additional technical security, Apple stamping doesn't.

It's not that I can't afford $100/year. I simply don't like Apple's security model where they consider themselves an unquestionably trusted party. I also don't want these kinds of dependencies. It's more like an act of protest.

I'm targeting macOS because that's the OS I use. I use it because the two alternatives suck a lot more. Modern Mac hardware is also really nice and a joy to use. The integration of software and hardware is unmatched by any competition.

If you think Apple sucks look at signing binaries on Windows. If you don‘t use the Microsoft App Store it‘s much more expensive and annoying.

It basically requires you to be incorporated and hire a notary so you‘re probably spending $ 1000 or more for the first year. Renewal is cheaper but you will still be paying at least $ 100 a year.

Also if you know a good affordable way for a code signing certificate on Windows answer to this comment. I gave up the last time I tried.

I've been using:

https://www.ksoftware.net/code-signing-certificates/

Last time I looked they had the best pricing I could find at about $70/year. However, you still have to jump through the antiquated hoops for them to validate your business. One of the hoops was something like "have a business address and phone number listed in a commercial directory" which was particularly tricky to do for us since we don't have a company office anywhere and don't have a company phone number. In 2022, it should be reasonable for a software company to exist without a published phone number. I think we got around that by setting up a Twilio or Google Voice number and then adding a business listing in Google to one of our owner's residential addresses. Totally useless but apparently good enough to pass validation.

You can get an OV code signing certificate for 84$ per year - https://www.ksoftware.net/code-signing-certificates/

I'm using it for my app, and I never had any issues. You don't need to incorporate a company to get this certificate ( https://support.sectigo.com/PS_KnowledgeDetailPageFaq?Id=kA0... scroll down to the Individual Validation Requirements).

If your ID has your address printed on it, then you are lucky and can just take a photo of the ID and yourself holding the ID. If you don't, then you need to go to a notary and sign a special form provided by Sectigo.

Sectigo doesn't even need to call you anymore, as it was about 5-10 years ago.

The downside of the OV certificate is that Windows Defender will show a blue pop-up saying that your app might put the user's PC at risk. Good thing is that it will eventually go away after some time. For my app it took about a year.

Maybe it’s just me, but I would never go through a random certificate authority like “K Software”. Users are not cryptographically verifying the developer’s signing identity, they are trusting KSoftware’s attestation that the signed binary is authentic.

> If your ID has your address printed on it, then you are lucky and can just take a photo of the ID and yourself holding the ID. If you don't, then you need to go to a notary and sign a special form provided by Sectigo.

That's the problem ID's don't have addresses printed on them in most European countries. So you have to get a notary and this is really expensive. There is a system to proof your place of residence here without a notary but these companies don't accept them.

Uh.... what? Unless something drastically changed in the last couple weeks Windows does not go out of it's way to prevent you from running executables unless they are cryptographically signed by Windows.

There's no reason to do windows code signing unless you're writing a hardware driver(?).

Try downloading and running an unsigned exe using Edge. I'm not a fan of the term "dark pattern" as it gets overused, but the UI design in those flows is pretty much the definition of the term. You can bypass the warnings and run the program but it makes Apple's magic right click look intuitive.

Windows has this thing where "unpopular" software gets blocked by default. I'm not sure how exactly it works, but it's annoying.

If you use it and want to develop for it, you can't really whine about how they do things and want to do things differently as an "act of protest" -- you either pay the money to do it their way -- which massively reduces the amount of trash apps on the App Store, and helps increase user trust compared to random apps being able to open and do what they want without warning -- or you accept your potential users won't have that simplicity.

If you love the hardware and the integration, and have the money, what exactly is your issue? -- if you were about FLOSS more than anything you wouldn't be pushing the proprietary platform stuff to begin with, and if you don't like the "walled garden" approach you shouldn't be using Apple ¯\_(ツ)_/¯

The same things apply to the Microsoft Store for apps, and similar (but to a much lesser degree) for the likes of the Ubuntu Software Center. It's about trust, ease of use, and having apps and updates all handleable from one location.

If you're distributing the app yourself, outwith the App Store, you don't have any of those "dependencies" -- and if your complaint is paying to have your code signed properly as a dev, that's the same across macOS and Windows, in a similar vein to SSL certs for websites. Sure, you can work without it, but you're going to alienate and scare some users by doing so.

> if you don't like the "walled garden" approach you shouldn't be using Apple

But I use none of Apple's online services. Not even the app store. App store for me is the place to update Apple apps, and that's really it.

> and if your complaint is paying to have your code signed properly as a dev, that's the same across macOS and Windows,

Windows? I know you can sign Windows executables, but why would anyone want to? I have Windows 11 on a VM. It runs unsigned executables just fine and, unlike macOS, doesn't treat them like they're radioactive. You just get a differently-colored confirmation window if you run them as administrator.

> in a similar vein to SSL certs for websites

And before Let's Encrypt and other similar free automatic CAs came along, SSL/TLS was very niche.

See, it's about choice. If you want to throw your money away for some reason, sure you can still pay for an SSL certificate. Or you can use Let's Encrypt for free, set it up once and forget. Your users would see a lock icon either way. No such luck with macOS app signing — Apple is your only option.

I like Android's security model better. You sign your apk with a self-signed certificate. No signing identity is enforced upon initial installation, but if you release an update, the new apk has to be signed with the same certificate. You can install an apk with the same package id but a different signature only after you uninstall the previous one (and delete all its private data). This helps with security and data integrity. I see no reason why Apple couldn't adopt a similar scheme on their platforms, except that they want all control they could get away with.

> Windows? I know you can sign Windows executables, but why would anyone want to? I have Windows 11 on a VM. It runs unsigned executables just fine and, unlike macOS, doesn't treat them like they're radioactive. You just get a differently-colored confirmation window if you run them as administrator.

It ought to! I'd love to see this in Linux and the BSD's too. Signing applications and binaries should be the norm.

> And before Let's Encrypt and other similar free automatic CAs came along, SSL/TLS was very niche.

Let's Encrypt came about to help with security. Happy to hear arguments pro a similar service for application signing, but it will have to follow similar, or tighter restrictions and you'd still be at the whim of third party.

> I like Android's security model better. You sign your apk with a self-signed certificate.

That is most definitely not a security policy. Self-signing is no different to not signing at all. There is no provenance, no chain-of-trust.

Absolutely this.

> There is no provenance, no chain-of-trust.

We should've probably started with the fact that I despise security policies based on provenance, chains of trust, public key infrastructure, and third parties. This kind of "security" feels extremely fragile and unnecessarily centralized. We somehow live with how SSH identifies servers by their keys, with no third-party verification, and consider that an okay level of security. Why can't we use the same approach for TLS and for executable signatures? What's so fundamentally different that third parties are required in these cases?

SSH doesn’t rely on PKI. Using SSH certificates is a password replacement for accessing remote services. While it is a kind of identity verification, its purpose is not the same an application signing.

Self signing is open to too much abuse. The whole point of signing is that the provenance can be verified (yes, checksums are a thing) and that the signing can be revoked should something bad happen. Notarising code is the process of a third party verifying your identity. So rather than saying, “hey, you can trust me”, you are asking a third party to vet and prove that you are trustworthy. If you can’t see the value in that for all parties - including the most important party, your customers - then that’s up to you. No sane SOC will allow unsigned or self-signed binaries. Consumers with the slightest bit of savvy will not run unsigned or self-signed binaries, and OS vendors need to take care of the rest. Thinking of the Confidentiality, Integrity and Availability triad, your solution is unworkable.

Everyone used to run unsigned binaries all the time for the entire previous history of computing and somehow the hell didn't break loose. What changed?

> Consumers with the slightest bit of savvy will not run unsigned or self-signed binaries

I'm a "consumer with the slightest bit of savvy" and I despise code signing schemes that care about the signing identity, so you're already wrong. I absolutely will run unsigned and self-signed binaries. I trust myself and my own judgement more than I do anyone else in the entire universe.

$100 a year means that no one makes applications for Mac OS on a whim, etc and it ensures that all the applications come from a purely profit-motive driven persons. It commercializes the entire OS and prevents software for people, instead of software for profit, from even existing in the ecosystem.

Real question: Why defend Apple charging developers $100 a year for the service of developing for their OS?

Do we think it costs Apple $100 a year to grant this?

The burden should be on Apple to justify this.

You’ll notice I made no argument in defense of Apple. You can definitely develop for their desktop OS without paying that $100 fee. If you don’t want to use all the free languages out there that will run on many platforms (macOS included), and you’d rather use Apple’s tools to build natively, well now you have to spend money on Apple hardware.

If you need an argument in defense of paying $100/yr for a signing certificate: it’s definitely a barrier to entry. It makes high volume scams based on obtaining signing keys too expensive. If it were free for all, it would be a free-for-all for scammers … until the world asked Apple to “do something about it” and that something would be charging for access to those certs.

If you want to distribute FLOSS apps without cost, do so on platforms that support it, or look at how jailbroken iDevices can have apps side loaded.

If you want to distribute Mac apps you don't need a Developer ID. You can literally control-click (or right-click) the app and click Open, and you'll be given a warning asking if you're sure, as it's from an unidentified developer -- simple.

It's not a "problem" -- it's a choice.

If you want to distribute Mac apps without having to have an FAQ about Gatekeeper, suck it up and pay the $99.

$100 is cheap. Getting an Extended Validation code signing certificate to accomplish the equivalent goal on Windows (having no scary security dialog box when users download and open your program) costs even more.

$100 is cheap to an American working as a software developer. That’s not most people, most Americans, or most software developers.

We're comparing what you get for the money.

A $100 developer account from Apple allows you to sign software so that there will be no scary dialog boxes when a user downloads your software off the internet and opens it.

An ~$100 code signing certificate for use on Windows will allow you to digitally sign your Windows application, but users will still see a scary dialog box from Windows SmartScreen when they download your software unless you spend a good bit more to step up to an Extended Validation certificate.

If you don't want to pay, you'll just have to accept that users are going to see a scary dialog box, and take care to warn them that it will happen on your website.

If they are free and open source can you use the github distribution feature the OA mentioned?

I’m in this situation too, having to pay to be able to distribute macOS binaries of VICE. Quite annoying. I wish they’d make exceptions for open source.

Reply on news.ycombinator.com