Hacker News Reader

Comment by grishka | Hacker News Reader

What Apple probably doesn't want you to know is that you can also run these two commands to disable the notarization requirement, effectively reverting your security level to non-paranoid pre-Catalina:

    sudo spctl --master-disable
    sudo defaults write /Library/Preferences/com.apple.security GKAutoRearm -bool false

This reveal add and select a third option, "any source", under "allow applications downloaded from".

The setting will still occasionally reset after installing some system updates because it's 2023 and computers these days are extremely unreliable when it comes to remembering user preferences.

View on HN

That’s helpful.

Broadly speaking, as a developer you should expect that none of your users will have disabled those protections and your release plan should have notarizing as a step.

Asking users to disable system protection, or at the very least fiddle with system settings is a non-starter.

Even if a company wasn’t being purposefully malicious, shit happens.

https://support.google.com/chrome/thread/15235262/chrome-upd...

And Apple isn’t immune either. There was a bug in the iTunes installer where it would erase files if there was a space in the name of the hard drive.

Then some companies are just evil.

https://www.zdnet.com/article/zoom-defends-use-of-local-web-...

> as a developer you should expect that none of your users will have disabled those protections and your release plan should have notarizing as a step.

I don't want to spend $99/year for the rest of eternity for the privilege of having a slightly less scary warning when my users run my app for the first time. Thus, the readme for the one macOS app I made that has gained a bit of popularity instructs users to right-click, then select "open". Works reasonably well so far.

I would absolutely have embraced notarization if it was offered for free. Otherwise it feels like straight up extortion.

>"Otherwise it feels like straight up extortion."

Which it is

Apple is probably lucky that so few people use Macs, because the EU would have a field day with this notarization bullshit if they'd managed to get a 10% market share on computers.

Yet somehow, Windows 10 and 11 are dripping with contempt for the user, but the EU still hasn't acknowledged that as an antitrust problem worth investigating. Their insistence on pushing users into Edge alone should be enough IMO. Stuff like Edge "accidentally" opening on startup and some links "accidentally" opening in Edge instead of your default browser and your default browser setting getting "accidentally" reset to Edge and the taskbar shortcut for Edge "accidentally" reappearing.

The EU seem pretty soft on Microsoft these days. The Activision-Blizzard buy out when off without a hitch in the EU.

Since Edge is built ontop of Chromium and it is a distant 2nd to Google’s Chrome would that trigger EU compliance issues?

It doesn't matter which engine it uses if it does a lot of stuff to represent Microsoft's own interests. Data collection, Bing integrations, other bullshit features like offering loans in payment forms (I remember reading about that), etc

>Yet somehow, Windows 10 and 11 are dripping with contempt for the user, but the EU still hasn't acknowledged that as an antitrust problem worth investigating. Their insistence on pushing users into Edge alone should be enough IMO.

At this point, I'm not sure it's worth investigating. This isn't the 90s when everyone was running application software directly on their PC; now everything is done in the cloud or through your web browser somehow. I honestly find it funny when Windows users have all kinds of agony because of that "contempt" you refer to; if they don't like it, they're free to switch to another OS. I've been watching this for over 25 years now but people just won't give up Windows, even when they only use it for web browsing, so I've lost all sympathy for them, even though the Windows user experience keeps getting worse.

The fact so much is don’t in the browser now makes their abusive pushing of Edge even more egregious.

I agree. It's high time the EU took action against Microsoft.

how is it bullshit?

windows is/was laden with malware, requiring antivirus, just full of crap for decades.

Yeah and Macs didn't have that problem back before signing apps was a requirement either.

Agreed, and during those decades legislation and execution thereof sorely lacked.

Now in the DMA/DSA times, things are different. It took them a couple of decades, but the EU is starting to take action.

Is it $99/year regardless of local cost of living?

In that sense yes that is understandable.

As an American developer, $99/year is something I can afford, can write off as a business expense, and hopefully make back with software proceeds.

It should be noted, keeping the bar annoying but not prohibitive with a token fee does cut down on both junk submissions and malware.

Play Store account cost me $25 as a one-time fee and that does the job of keeping the junk out just fine. There's no good reason why it has to be a recurring payment.

> can write off as a business expense, and hopefully make back with software proceeds.

That's if your software involves money. Mine doesn't — it's all pure altruism. I just want to put my stuff out there for other people who might want it.

Are you also on F-Droid?

> the privilege of having a slightly less scary warning

That’s what you see. Users see it differently. I’m not running random exes on my computer. Even package managers are run in containers and VMs

I don't want to necessarily disable it. What I do want is to be able to click "yes yes, I don't care this time / ever for this binary, fuck off." I don't even mind if you make me fingerprint auth for it.

What drives me insane: the inconsistent/invisible functionality around this stuff. In Ventura, if you double-click an unsigned app, it won't run, with a big scary message that it cannot be verified.

...except if you right-click and select "open", you can now click on a button that lets you run the app anyway.

This is not remotely obvious or even indicated in any way. There's nothing that explains this to the user, nada. It just behaves differently if you select "open" instead of double-clicking.

How on earth that compliant with Apple's human interface guidelines?

This is not remotely obvious

Apple stopped emphasising discoverability a long time ago.

Making the option that bypasses the security measures less obvious is a feature. This is a case of assuming that developers are Apple’s model user when it’s non-developers who are likely to install “Macsweeper” because a popup ad told them they had a virus.

Additionally, discoverability is relative to experience: I’m a developer and, as such, I can be assumed to know about right-click menus. So putting something there that’s more intended for me _is_ designing a discoverable user interface.

That you can right-click is not surprising. That's not the major thing to be discovered. The major thing to be discovered is that the behavior, which intuitively, should be identical, is silently different.

That feels like such an understatement to me. macOS seems almost uniquely undiscoverable in my experience.

But this makes me curious! What versions of Mac OS nailed discoverability and how? I'd love to look at old videos and/or emulate hardware for them and play around.

OS 9 and before emphasized discoverability:

https://i.stack.imgur.com/bdY7i.jpg

Sometime at or after OS X, the industry pivoted to surprise and delight instead, and so did Apple. (Not sure who pioneered it.)

This feeds in well with the whole "cult of apple" thing, since to use the laptop / phone, you have to get other users to show you cool non-discoverable tricks. Take this article explaining basic functionality in Finder for example:

https://www.lifewire.com/use-mac-finder-2260739

I've been using OS X for about 10 years, and didn't know half that stuff.

Instead, I know just enough Mac OS CLI to know to avoid macports and brew, and to instead use a hypervisor or ssh to a machine with a reasonable filesystem layout.

Here's an article plugging surprise and delight. I'm not a fan, so I'm not going to try to enumerate its purported advantages:

https://medium.com/@davidporretta/surprise-and-delight-in-ux...

(Begrudgingly sent from an apple device.)

This is a great reply! Thanks so much. :)

> The setting will still occasionally reset after installing some system updates because it's 2023 and computers these days are extremely unreliable when it comes to remembering user preferences.

The sudo touchid mod gets reset so often now that I've stopped bothering with it. Ok, you win apple!

It may be official now! I just saw today that Sonoma contains an example pam config file with that line commented out.

Uncomment, copy it over the default file, win.

Far less hidden.

https://mastodon.social/@StrangeNoises/110910261899874868

YES! Confirmed! Thank you!

Oh you posted that as a story. Heh. That’s a great idea. Why don’t I ever think of that?

Glad I could help. It ran through my feed today by chance.

My comments aren't entertaining enough to get enough upvotes for karma farming, so I post cool links that I find.

Trust me, I get it. The cool links are what drew me to HN, however they’re found.

We appreciate your service :)

Thanks!

I try this occasionally and always disable it again. For some reason I find the fingerprint sensor is far less reliable for this particular use case. When I try to authenticate, I have to try repeatedly to get it to recognise my fingerprint. I know it’s the same hardware and software doing the matching, so it doesn’t really make any sense to me.

I don’t use it either. I don’t need sudo enough so I just don’t find the need. My password is strong but it’s not like it’s 58 characters.

I love Touch ID in general on this Mac. This just didn’t do anything special for me, so I never really adopted it.

I don't use sudo that much either, but it was always one of those things that was fun to adopt because it was theoretically a one time change. Set and forget. Once Apple started to update the OS more frequently, I stopped bothering trying to keep up with the resets. Thankfully this annoyance is fixed!

I was just thinking that I should make a shell script with these commands and the touch ID one and add it as a login item. Sudo shouldn't be a big deal, just set the owner to root and set the SUID bit.

Sadly, DisplayLink breaks that functionality (???). I've been unable to work around that breakage on my work Mac. :(

This should help:

  defaults write com.apple.security.authorization ignoreArd -bool true

I did find that online, but unfortunately it did not help. :(

I'm not sure if this is because that info is out of date, or due to some other issue specific to my work machine and what the org has installed/configured on it.

Reply on news.ycombinator.com