News for hackers. Stuff that matters.
Re:Apple Accidentally Approved Malware to Run on macOS by dessant on Tuesday September 01, 2020 @08:54AM (#24341231)
It's astonishing that the developer community is fine with requiring open source projects to pay $99/yr for notarization to run on macOS. Malware authors will happily pay the developer account fees, as seen here, while open source projects are seriously hindered.

It should be possible to verify developers and distribute open source apps without a cost on macOS.

Re:Apple Accidentally Approved Malware to Run on macOS by amelius on Tuesday September 01, 2020 @11:23AM (#24342775)
I think open source licenses are ripe for an update with the following clauses to deal with FAANG companies:

    This software shall not be used on platforms that hinder users in their free choice of software.

    This software shall not be used to create or in conjunction with adware, spyware, or other malicious software.
(Perhaps after a lawyer has reworded it properly so people can't pretend to not understand what is meant here)

Another one I'd like to see is:

    This software is free for personal use, and for commercial use by companies with an annual revenue less than $1B.

    (For commercial uses that are not covered by this license, please contact our licensing department)
Re:Apple Accidentally Approved Malware to Run on macOS by 3pt14159 on Tuesday September 01, 2020 @11:46AM (#24343046)
> This software is free for personal use, and for commercial use by companies with an annual revenue less than $1B.

I've been advocating for something similar:

> This software is free for any entity that does not contain material stakeholders (bond holders, debt holders, etc) that are billionaires. A yearly licence fee of $1m waives this requirement.

Something like that. I'm sick of wealth centralization. If a startup wants to use the software, great! Once Peter Thiel invests though it's $1m a year. My core beef with billionaires is that they do not pay their fair share in taxes. The push all their money into shell companies or park it overseas and we end up with doctors that actually save peoples lives paying double or triple the tax rate that the ultra wealthy pay.

Re:Apple Accidentally Approved Malware to Run on macOS by specialist on Tuesday September 01, 2020 @04:55PM (#24346957)
"My core beef with billionaires is that they do not pay their fair share in taxes."

Mine is pretending they're not freeloading. A close second is the performant persecution complex. Third might be the rationalist rhetoric about slippery slopes (eg anything less than Freedom Markets™ is socialism).

Re:Apple Accidentally Approved Malware to Run on macOS by Someone on Tuesday September 01, 2020 @12:34PM (#24343575)
“This software shall not be used on platforms that hinder users in their free choice of software”

That’s the GPL, isn’t it? Version 3 was specifically created to close loopholes w.r.t. to that (https://en.wikipedia.org/wiki/Tivoization: “Tivoization is the creation of a system that incorporates software under the terms of a copyleft software license (like the GPL), but uses hardware restrictions or digital rights management to prevent users from running modified versions of the software on that hardware“)

Re:Apple Accidentally Approved Malware to Run on macOS by amelius on Tuesday September 01, 2020 @02:49PM (#24345346)
No that line is different from the GPL. For example, you could still sell the software without distributing the source or without allowing users to link against your code.
Re:Apple Accidentally Approved Malware to Run on macOS by jackhack on Tuesday September 01, 2020 @11:51AM (#24343115)
I appreciate your eagerness and positivity but I fear it's not a solution. After all, who defines 'hinder', 'adware' or 'spyware'? (I'm reminded of the phrase "one man's terrorist is another man's freedom fighter".) Any company willing to make adware/spyware probably isn't above ignoring a plea in a license agreement. There are laws against burglary, assault, embezzlement, murder, too, and even with very harsh penalties (e.g. death penalty) they are not always sufficient to deter all criminal behavior.

A $1B limit? no problem - "we'll just send this over to our little 500M subsidiary."

the root problem is the consumer doesn't care and there is a cultural lack of care and trust and humanity. I don't know of any solution to this but the problem runs extremely deep. In fact, there may be no cure, as these problems are noted as the cardinal sins the Christian bible documented and Dante' famously illustrated : Lust, Gluttony, Greed, Sloth, Wrath, Envy, Pride. Solve that and the rest comes easy.

Re:Apple Accidentally Approved Malware to Run on macOS by eqtn on Tuesday September 01, 2020 @01:41PM (#24344444)
> who defines 'hinder', 'adware' or 'spyware'? The new license should define this.

> A $1B limit? no problem - "we'll just send this over to our little 500M subsidiary."

The new license can acknowledge this too

Re:Apple Accidentally Approved Malware to Run on macOS by viraptor on Tuesday September 01, 2020 @06:26PM (#24347849)
The developer account is much cheaper than lawyers and process required to set up a 500M subsidiary, so I don't think we even need to think of this edge case.
Re:Apple Accidentally Approved Malware to Run on macOS by cesarb on Tuesday September 01, 2020 @11:49AM (#24343083)
These would be "field of use" restrictions. Licenses with these kinds of restrictions are normally not considered open source (see items 5 and 6 of both the DFSG and the OSD).
Re:Apple Accidentally Approved Malware to Run on macOS by selykg on Tuesday September 01, 2020 @11:43AM (#24343011)
If malware is going to ignore a variety of other things, do you honestly think they'd abide any licensing? I doubt they really care and will happily break that agreement and they're fine doing so until someone can take them to court to stop it (who's going to pay that fee? and I doubt finding the author of such malware is going to be particularly easy, never mind their country of operation may not even make any of this straight forward at all)
Re:Apple Accidentally Approved Malware to Run on macOS by amelius on Tuesday September 01, 2020 @11:50AM (#24343091)
Companies do care, see the JSLint case:

https://news.ycombinator.com/item?id=5138866

Re:Apple Accidentally Approved Malware to Run on macOS by dgellow on Tuesday September 01, 2020 @09:17AM (#24341419)
What makes you thing that open source developers are fine with that? What are their other choices? Apple doesn’t care.
Re:Apple Accidentally Approved Malware to Run on macOS by pmontra on Tuesday September 01, 2020 @10:05AM (#24341818)
The choice is don't build for MacOS. In the long run Apple won't be happy with that and maybe they'll waive the fee.
Re:Apple Accidentally Approved Malware to Run on macOS by cornstalks on Tuesday September 01, 2020 @10:39AM (#24342248)
> In the long run Apple won't be happy with that and maybe they'll waive the fee.

I think you greatly overestimate how much Apple cares about this.

Re:Apple Accidentally Approved Malware to Run on macOS by viro on Tuesday September 01, 2020 @11:11AM (#24342640)
I think you underestimate how many power users use macOS. Most of their privacy and security marketing isn't really targeted at normal people. The avg. person doesn't really care that much.
Re:Apple Accidentally Approved Malware to Run on macOS by an_opabinia on Tuesday September 01, 2020 @11:23AM (#24342782)
It’s pretty impressive that Ubuntu and Arch (Power User-only experiences in my mind) are considered an alternative to macOS by anyone at all. It shows the Linux desktop is actually delivering something very valuable despite the numbers. Although that the numbers don’t tell the whole story isn’t really saying much.

What if it turned out that ease of use and OS-wide app consistency was the easy part all along? That building good APIs - which includes not changing them, making a good publishing experience - which includes not changing your rules every six months, and making your developers rich - which includes lowering fees - were the hard parts?

Besides the average person does care about privacy and security. Keychain is a product everyone on macOS and iOS uses. Imagine if the OS forced Private Browsing to actually work.

Re:Apple Accidentally Approved Malware to Run on macOS by dhagz on Tuesday September 01, 2020 @01:27PM (#24344275)
The thing to remember is that, under all the chrome and Apple styling, macOS is rooted in BSD. So the power users who enjoy the *nix-y bits of macOS and are looking for a replacement will look for something that gives them more of that.
Re:Apple Accidentally Approved Malware to Run on macOS by extremeMath on Tuesday September 01, 2020 @03:25PM (#24345872)
Is this a real thing? Like there are people that don't VM/SSH into Linux but use shell?

What demographic is this? College kids and Apple employees?

It seems like minor benefit in an otherwise atrocious platform.

Re:Apple Accidentally Approved Malware to Run on macOS by viro on Tuesday September 01, 2020 @04:14PM (#24346485)
Over the years I haven't found very many unix tools I couldn't install with homebrew. I'm also a big fan of the move from Bash to ZSH. Why start up a VM or SSH into another machine if I can just use Terminal or Iterm.
Re:Apple Accidentally Approved Malware to Run on macOS by extremeMath on Wednesday September 02, 2020 @08:40AM (#24352619)
I don't understand.

What commands are you sending your macbook outside installations?

It's not like you are running a server, you still need to SSH into the server to do anything.

Re:Apple Accidentally Approved Malware to Run on macOS by dTal on Tuesday September 01, 2020 @02:10PM (#24344836)
For what it's worth, look-and-feel is arguably more consistent on an OSS desktop than the average commercial workstation, these days. The vast majority of free apps and DEs are built on either GTK or QT, which have a broadly similar feel and can be themed to look identical. Meanwhile, closed/commerical apps are a mess of in-house toolkits and embedded web interfaces, and Windows even has several inconsistent styles in the base install.
Re:Apple Accidentally Approved Malware to Run on macOS by nobodyandproud on Tuesday September 01, 2020 @11:32AM (#24342884)
How reliable is the security vetting in the Ubuntu store?
Re:Apple Accidentally Approved Malware to Run on macOS by throWaythxMod on Tuesday September 01, 2020 @12:49PM (#24343764)
You are overestimating how many power users use Apple products.

If you are technology literate, you've seen the evils of Apple for decades.

A power user fixes their own problem, not waits years for Apple to fix it.

Re:Apple Accidentally Approved Malware to Run on macOS by viro on Tuesday September 01, 2020 @01:48PM (#24344545)
This is clearly anecdotal, but nearly every dev/engineer from every company I have ever worked for has had an MBP as their work laptop.
Re:Apple Accidentally Approved Malware to Run on macOS by extremeMath on Tuesday September 01, 2020 @02:43PM (#24345272)
I'm the other way, I've never seen a Macbook in an (Engineering) office setting, four fortune 500, two small businesses.

I've seen them at University and some non STEM students homes.

That said, I see iPhones at work, but probably because they are not critical to doing anything other than email.

Re:Apple Accidentally Approved Malware to Run on macOS by athms on Tuesday September 01, 2020 @04:38PM (#24346779)
I worked at SAP for seven years in their cloud business and about half the engineering staff had MBP laptops. Some engineering teams used only Macs. Operations was the same way. Engineering computer usage in India was mostly Windows, China was ~50% Macs, US/Canada was ~80% Macs, and Europe was ~50% Macs.
Re:Apple Accidentally Approved Malware to Run on macOS by extremeMath on Wednesday September 02, 2020 @08:38AM (#24352606)
Software is not Engineering. You guys call your developers Engineers?
Re:Apple Accidentally Approved Malware to Run on macOS by viro on Wednesday September 02, 2020 @09:24AM (#24352947)
Re:Apple Accidentally Approved Malware to Run on macOS by extremeMath on Wednesday September 02, 2020 @01:45PM (#24355730)
"One of the core issues in software engineering is that its approaches are not empirical enough because a real-world validation of approaches is usually absent, or very limited and hence software engineering is often misinterpreted as feasible only in a "theoretical environment.""

Software engineering is Engineering like sandwich Engineer is Engineering.

They should use "specialist". It's not like they are using science to prove something will work.

Re:Apple Accidentally Approved Malware to Run on macOS by mattl on Tuesday September 01, 2020 @02:25PM (#24345047)
They do waive it for non-profits, if they have the right paperwork. I'm sure Mozilla/Apache/WordPress/Free Software Foundations could get a $0 key if they wanted.
Re:Apple Accidentally Approved Malware to Run on macOS by AnthonyMouse on Tuesday September 01, 2020 @10:17AM (#24341941)
How would that get them to waive the fee? If your app is open source and they wanted it that bad they could just build it themselves, or develop their own replacement for it, and anybody else can pound sand.

They have you over a barrel and they know it.

Re:Apple Accidentally Approved Malware to Run on macOS by pmontra on Tuesday September 01, 2020 @10:26AM (#24342058)
So let's Apple port, build and distribute open source for MacOS. I have no problem with that. Yet I bet it would cost Apple more than the money they do from the license they sell to OS developers.
Re:Apple Accidentally Approved Malware to Run on macOS by AnthonyMouse on Tuesday September 01, 2020 @10:31AM (#24342128)
But they're not going to do that for your project, only the ones they actually care about. In fact they already do this. Your macOS comes with bash (the old one because they don't like the new license) and a slew of other open source software. The whole thing is built on top of BSD. So they take what they want and then make you pay them for anything else.
Re:Apple Accidentally Approved Malware to Run on macOS by pmontra on Tuesday September 01, 2020 @10:36AM (#24342207)
No problem with MacOS having only the open source programs Apple care about. In that scenario if Apple want that developers keep buying their hardware they'll have care about a lot of software or hope that everybody will be happy to work in a Linux VM, possibly with a Linux desktop. Imagine a Mac with no docker, no GNU userland and dev tools (if they're a thing on MacOS), no vim, no Node, no Python, etc.
Re:Apple Accidentally Approved Malware to Run on macOS by AnthonyMouse on Tuesday September 01, 2020 @10:43AM (#24342299)
How is that supposed to help all the small time developers that are trying to get started on a side project and want to distribute it to their 200 existing customers who Apple doesn't care about at all?
Re:Apple Accidentally Approved Malware to Run on macOS by pmontra on Tuesday September 01, 2020 @11:06AM (#24342582)
They're not the developers I was thinking about. I was thinking about the kind of open source projects that are installed by 100k-100M people.

Misunderstanding sorted out, let's see. If I wanted to reach 200 customers on MacOS (real or leads) probably I can invest 0.5 USD per customer and see if I end up making some money because one of them hires me to do anything.

Re:Apple Accidentally Approved Malware to Run on macOS by throWaythxMod on Tuesday September 01, 2020 @12:47PM (#24343733)
I haven't been building Apps on their platform. Apple advertises to me daily.

Not sure if related.

Re:Apple Accidentally Approved Malware to Run on macOS by Razengan on Tuesday September 01, 2020 @11:03AM (#24342544)
> It's astonishing that the developer community is fine with requiring open source projects to pay $99/yr for notarization to run on macOS.

There is NO "requirement" for notarization. This FUD keeps getting perpetuated, but you can publish macOS software without paying $99 year.

> It should be possible to verify developers and distribute open source apps without a cost on macOS.

The cost is convincing your users to trust you and allow your unsigned app to bypass Gatekeeper.

I've seen some tools do just that, explaining that they cannot afford the notarization fee.

Re:Apple Accidentally Approved Malware to Run on macOS by kevhito on Tuesday September 01, 2020 @11:26AM (#24342817)
> you can publish macOS software without paying $99 year.

Can you point to straightforward apple instructions for doing so?

I publish an open source project used in classrooms, mostly used by my own students but also others. Despite strong and principled objections, which I hung on to for years, I have simply given up and now pay the fee. I'd love to not have apple be the gatekeeper. But they are. Every release, every update, every summer when I go to fix a few bugs, the restrictions get tighter and tighter, and old workarounds stop working.

I work entirely on Linux and Win10, but I maintain a mac laptop and pay the $99/yr out of pocket just to keep this project alive. I've spent tens of days trying to find a way around either of these requirements, but it's just too difficult (for me, or for my students, or for others wanting to try my software).

Re:Apple Accidentally Approved Malware to Run on macOS by Razengan on Tuesday September 01, 2020 @11:39AM (#24342969)
> Can you point to straightforward apple instructions for doing so?

Take a look at how other apps do it, such as:

• MacDown https://macdown.uranusjr.com (also on GitHub)

Download → Right/Control-click → Open → Confirm

There are several such apps and open-source tools that are not notarized, some quite popular. Some of them provide those instructions next to their download links.

Re:Apple Accidentally Approved Malware to Run on macOS by gundmc on Tuesday September 01, 2020 @01:47PM (#24344529)
See the below discussion on why this is not a realistic or user-friendly option.

https://news.ycombinator.com/item?id=24217116

Re:Apple Accidentally Approved Malware to Run on macOS by Razengan on Tuesday September 01, 2020 @02:33PM (#24345146)
Exactly which part of “Download → Right-click → Open → Confirm” is user-unfriendly?

Those steps are literally all it takes. It’s barely 40 keystrokes to list them.

As a user and the resident tech support for people young and old, I am glad that there’s such a barrier against the execution of arbitrary software and it’s easily skippable if one so explicitly chooses.

In any case, how is it any worse than the Windows nag prompts that people accepted more than a decade ago?

Re:Apple Accidentally Approved Malware to Run on macOS by dessant on Tuesday September 01, 2020 @02:50PM (#24345384)
The linked article clearly demonstrates that running apps without notarization on macOS is much more complicated than you describe it to be, to the point of it feeling insurmountable for less technical users.

Perhaps you've configured your device in a way that gives you an easier execution path, or the app is employing a workaround to bypass Gatekeeper.

It seems MacDown uses such a temporary workaround to make the process less painful for macOS users: https://github.com/MacDownApp/macdown/issues/1106#issuecomme...

Re:Apple Accidentally Approved Malware to Run on macOS by _qulr on Tuesday September 01, 2020 @07:40PM (#24348406)
> what gets me every time is that the "right-click" trick only works the second time you try to launch the app. The first time, right-click or not, MacOS won't let you launch the app.

https://news.ycombinator.com/item?id=24219099

Re:Apple Accidentally Approved Malware to Run on macOS by gamegod on Tuesday September 01, 2020 @11:06AM (#24342589)
When did this change? You need to codesign/notarize your application lest users get the super scary warning that tells them to move it to trash when they try to run it. Apple literally tells your users your app is garbage unless you pay for this. Definition of a shakedown.
Re:Apple Accidentally Approved Malware to Run on macOS by Razengan on Tuesday September 01, 2020 @11:17AM (#24342710)
Perhaps the warning could be improved.

For now, a dev has to add an explanation next to the download link, and let the users decide.

Re:Apple Accidentally Approved Malware to Run on macOS by holstvoogd on Tuesday September 01, 2020 @11:40AM (#24342989)
From what I've read, Apple will require notarization on Apple silicon. If that holds for both desktop apps and cli software, it would be neigh impossible to use a mac for development. So I imagine/hope they will have a way of handling OSS better.
Re:Apple Accidentally Approved Malware to Run on macOS by jshier on Tuesday September 01, 2020 @12:04PM (#24343271)
That's not true. They're requiring all executables to be signed on Apple Silicon systems, but that's as an ad hoc signature added by the linker at link time. There's no additional cost or overhead on AS.
Re:Apple Accidentally Approved Malware to Run on macOS by enjeyw on Tuesday September 01, 2020 @09:27AM (#24341503)
I see your point and principle , but the salary-opportunity-cost on the number of hours that the average piece of OSS takes to develop would surely dwarf 99 dollars, making that fee maybe 1% of the total effective cost.
Re:Apple Accidentally Approved Malware to Run on macOS by rowanG077 on Tuesday September 01, 2020 @09:56AM (#24341735)
This is simply not true. Many OS developers are working in lower income countries. Or aren't even employed yet because they are in school.

Your assessment only works for working developers in high income countries. And even then requiring 99 dollars is insane.

Re:Apple Accidentally Approved Malware to Run on macOS by machello13 on Tuesday September 01, 2020 @10:10AM (#24341874)
Insane is a bit of a strong word — it seems like a reasonable way to ensure that the world isn't flooded with incredibly low-effort apps. I know, I know — the world is already full of those, but I imagine it would be a lot worse if people didn't have to put down $99.

Also, the $99 is the blanket cost to be an Apple Developer, including access to the App Store, technical support, etc. and it seems like a reasonable fee to ensure those resources aren't swamped.

It is a shame about people who can't afford it — I know Apple has a scholarship program for students but I'm sure it can't do it for everyone. I'm not saying I'm in favor of it. But it seems like there are some pretty clear reasons why this is the way it is beyond "Apple greedy".

Re:Apple Accidentally Approved Malware to Run on macOS by eptcyka on Tuesday September 01, 2020 @10:32AM (#24342149)
The app store is full of low effort apps, and the 99$ entry fee really doesn't matter. I think it still is a "Apple greedy". If I were to operate a personal fleet of devices, I wouldn't be able to build my own software once and run it on the fleet. I'd have to build it everywhere. If Microsoft were to do the same thing, people certainly wouldn't be trying to rationalize it as anything else but the money grab that it is.
Re:Apple Accidentally Approved Malware to Run on macOS by machello13 on Tuesday September 01, 2020 @12:25PM (#24343496)
> The app store is full of low effort apps

If you notice, I actually mentioned this in my comment. I think it would be much worse. $99 isn't enough to stop everyone from making crappy apps, but it's definitely enough to stop a lot. Think of every low-effort app made by some 12 year old who discovered Xcode for the first time.

> If I were to operate a personal fleet of devices, I wouldn't be able to build my own software once and run it on the fleet. I'd have to build it everywhere.

I don't understand what this means. If I understand you correctly, then no, you can definitely deploy internal apps to Apple devices without putting it on the App Store.

Re:Apple Accidentally Approved Malware to Run on macOS by eptcyka on Tuesday September 01, 2020 @12:33PM (#24343573)
If I can deploy internal apps to Apple devices without getting them notarized, then open source devs can distribute their apps to their users without them being notarized too, no? What is the measurable difference here? Obviously, open source apps still work today, but they won't soon. macOS will become a lot more like iOS soon.
Re:Apple Accidentally Approved Malware to Run on macOS by AshamedCaptain on Tuesday September 01, 2020 @11:29AM (#24342850)
> [the $99 fee] seems like a reasonable way to ensure that the world isn't flooded with incredibly low-effort apps

Lol. In my experience a fee is a way to _ensure_ it is filled with incredibly low-effort apps (which tend to be the most profitable).

Re:Apple Accidentally Approved Malware to Run on macOS by donmcronald on Tuesday September 01, 2020 @01:42PM (#24344463)
Code signing in general is a terrible industry. Malware authors gladly pay those fees, even for EV code signing certificates, because scamming has high margins.

$99 almost seems reasonable until you consider Apple bakes in a mechanism for curation (they own the signing keys, right?).

IMHO code signing should be separate from curation systems and should focus on tying code back to a specific individual, not a company. It’s a huge pain to change your identity vs starting a new company to distribute malware.

The current systems are built to wrest control of everything. They don’t care about quality or accountability.

Re:Apple Accidentally Approved Malware to Run on macOS by _qulr on Tuesday September 01, 2020 @10:48AM (#24342360)
> Also, the $99 is the blanket cost to be an Apple Developer, including access to the App Store, technical support, etc.

This is actually the problem. If an open source developer doesn't want access to the App Store, technical support, etc., they still have to pay for those things.

Re:Apple Accidentally Approved Malware to Run on macOS by jmull on Tuesday September 01, 2020 @10:27AM (#24342073)
I agree Apple should make the developer fee a nominal amount for all kinds of developers.

The baseline for a Mac or iOS OSS developer is still someone with a Mac and many hours of time to spend on non-paying work. So we're probably talking about students and the temporarily unemployed in first-world countries, not so much low-income counties.

Seems like a full developer account should be free for the asking for students, IMO.

Re:Apple Accidentally Approved Malware to Run on macOS by jmull on Tuesday September 01, 2020 @10:12AM (#24341893)
$99/year is such a small amount relative to the costs of software development that it's hard to worry about. Meanwhile, there is good value. (The developer resources Apple provides are not free.)

You can argue that Apple should provide developer resources at no cost, but that just means someone else is paying for them or you will pay them in some other way... or do without.

I think at this point in the tech boom we can all understand that when a company gives you stuff of value at no cost there are significant tradeoffs and paybacks. In software development, I think you want most arrangements to be straightforward transactions. The strings attached to no-cost things tend to build up and cause problems, especially if you have success.

Edit: I struck a nerve, but I don't think this should be very controversial. I'll try to take the objections one at a time in comments.

Re:Apple Accidentally Approved Malware to Run on macOS by AnthonyMouse on Tuesday September 01, 2020 @10:20AM (#24341982)
> The developer resources Apple provides are not free.

So then why is the charge for signing and not for developer tools? That way if I wanted to I could use somebody else's tools instead of paying Apple.

> I think at this point in the tech boom we can all understand that when a company gives you stuff of value at no cost there are significant tradeoffs and paybacks.

Which is why I paid so much for my copy of gcc. Wait, hold on.

Re:Apple Accidentally Approved Malware to Run on macOS by snazz on Tuesday September 01, 2020 @10:32AM (#24342154)
Apple gives away Xcode and allows people to sign apps for their own iOS devices for free (although they must resign those apps every week). This is intended to allow students and other non-professional developers to learn to code and experiment with Apple developer tools without paying any money.

Of course, Apple spends huge amounts of money on developer infrastructure (Xcode, LLVM, and Swift, for example). Since each additional copy of a piece of software does not incur additional costs for the developer, Apple can subsidize the development of developer tools using the $99 fee taken from (generally) professional developers who wish to publish their apps on the App Store or take advantage of notarization on macOS.

Many major open-source projects are largely developed by employees of large technology companies and foundations with significant budgets. The Linux kernel's largest committers oftentimes work at companies like Red Hat and Intel. Just because you get a given piece of open-source software for free does not mean that its development was done by volunteers in their free time.

Re:Apple Accidentally Approved Malware to Run on macOS by AnthonyMouse on Tuesday September 01, 2020 @10:38AM (#24342228)
> Of course, Apple spends huge amounts of money on developer infrastructure (Xcode, LLVM, and Swift, for example).

So then why do I have to pay them if I'm using emacs and gcc and C++?

> Just because you get a given piece of open-source software for free does not mean that its development was done by volunteers in their free time.

Yet, in many cases, that's exactly what happened. And even when it isn't, if it's distributed under a free software license then it keeps them from screwing you over because any adverse changes can be reverted.

Re:Apple Accidentally Approved Malware to Run on macOS by jmull on Tuesday September 01, 2020 @11:17AM (#24342708)
> So then why do I have to pay them if I'm using emacs and gcc and C++?

You may still be using developer resources like documentation. But yeah, a flat fee for a wide variety of services risks edge cases where someone using only minimal resources gets a poor deal. Of course, an alternative is a nickel-and-diming pay-as-you-go micro-transaction scheme, which your main users will hate.

Also, strictly speaking, you don't have to pay them. Vote with your dollars and platform support as a developer. If enough people do, Apple may reevaluate.

Re:Apple Accidentally Approved Malware to Run on macOS by AnthonyMouse on Tuesday September 01, 2020 @11:46AM (#24343039)
> You may still be using developer resources like documentation.

That's not any different. If I write a POSIX-compliant program then it should run on macOS without having used any of Apple's documentation. And if they charged for documentation (which is dumb) it would create a market for third party macOS documentation that I could use instead.

> But yeah, a flat fee for a wide variety of services risks edge cases where someone using only minimal resources gets a poor deal. Of course, an alternative is a nickel-and-diming pay-as-you-go micro-transaction scheme, which your main users will hate.

Offering a flat fee for everything is not inconsistent with offering individual things a la carte. They could offer both. But the bigger point is that it should be possible to produce and distribute software without having any business relationship with Apple whatsoever. I don't want to use anything they make, I just want to have access to my customers who use macOS.

> Also, strictly speaking, you don't have to pay them. Vote with your dollars and platform support as a developer. If enough people do, Apple may reevaluate

That doesn't work at this level of power imbalance. Your software would have to be important enough to get your customers to switch to a different platform, and not have any viable competitors who remain on macOS even if it means higher profits due to the reduced competition. In other words, you would have to be a monopoly yourself in order to have any leverage.

Re:Apple Accidentally Approved Malware to Run on macOS by jmull on Tuesday September 01, 2020 @12:47PM (#24343738)
> I don't want to use anything they make, I just want to have access to my customers who use macOS.

These are conflicting statements. You will have a very difficult time supporting your Apple-using customers without using any Apple stuff yourself.

Re:Apple Accidentally Approved Malware to Run on macOS by AnthonyMouse on Tuesday September 01, 2020 @03:22PM (#24345829)
If I write an application in Java, it should run on macOS the same as it does anywhere else, and if it doesn't then I submit a bug report to the maintainers of the JRE. What do I need from Apple?
Re:Apple Accidentally Approved Malware to Run on macOS by comex on Tuesday September 01, 2020 @01:05PM (#24343996)
If you write a program strictly to POSIX, your program doesn't have a GUI and is run from the terminal, which already bypasses Gatekeeper by default.
Re:Apple Accidentally Approved Malware to Run on macOS by AnthonyMouse on Tuesday September 01, 2020 @03:09PM (#24345655)
It doesn't have to be strictly to POSIX to not use anything Apple-specific, e.g. you can get a GUI using Qt or Gtk, or Java. For that matter, there are X.org implementations for macOS.
Re:Apple Accidentally Approved Malware to Run on macOS by namanaggarwal on Tuesday September 01, 2020 @10:49AM (#24342370)
> Apple gives away Xcode and allows people to sign apps for their own iOS devices for free

Yes they do, to entice developers to build apps for their phones which they sell for a premium. Remember Ballmer (different company, similar context) .. Developers, developers, developers...

Re:Apple Accidentally Approved Malware to Run on macOS by Someone1234 on Tuesday September 01, 2020 @10:17AM (#24341945)
> $99/year is such a small amount relative to the costs of software development that it's hard to worry about

Huh? Some Open Source/Free software have a $0 budget.

Re:Apple Accidentally Approved Malware to Run on macOS by jmull on Tuesday September 01, 2020 @10:58AM (#24342463)
Software development typically requires at least a computer (a Mac for MacOS and iOS development), internet service, and electricity.

Dwarfing those, though, is the significant time software development takes. For OSS, the time is donated, whether by individuals or by corporate sponsors who sometimes dedicate employee hours to projects of particular value to them. But in either case the donator has to be in a position to afford it, which typically means significant income from other means.

Re:Apple Accidentally Approved Malware to Run on macOS by traib on Tuesday September 01, 2020 @12:00PM (#24343221)
> But in either case the donator has to be in a position to afford it, which typically means significant income from other means.

Even if someone has the time and resources to contribute to OSS, it does not automatically follow that they should be willing to spend said time and resources on notarization (of all things).

Put another way, not every purchase is worthwhile just because you have a million dollars in the bank.

Re:Apple Accidentally Approved Malware to Run on macOS by Juliate on Tuesday September 01, 2020 @10:42AM (#24342290)
The resources, time and hardware implicated in the production of open source software, when all added up represent far more than US$99, in terms of value.

You may say that a FLOSS project has no bank account, but it does not have $0 budget (unless it has no value, and is produced with nothing of value, by noone whose time has value).

Re:Apple Accidentally Approved Malware to Run on macOS by _qulr on Tuesday September 01, 2020 @10:52AM (#24342396)
You don't pay the developer fee with "value", you pay it with legal currency. Which requires a bank account or credit card.
Re:Apple Accidentally Approved Malware to Run on macOS by pier25 on Tuesday September 01, 2020 @10:24AM (#24342038)
Apple gets its money back on the hardware alone.
Re:Apple Accidentally Approved Malware to Run on macOS by 9HZZRfNlpR on Tuesday September 01, 2020 @10:30AM (#24342116)
The world is bigger than the US, Im from a fairly wealthy part of the world on average - - eastern Europe but I can't afford it or buy their products just so I can use their tooling. Probably people living in poorer parts of the world are laughing even harder.
Re:Apple Accidentally Approved Malware to Run on macOS by jmull on Tuesday September 01, 2020 @10:39AM (#24342241)
Right. Since you pretty much need at least one Mac in the first place, $99/year isn't really that burdensome in comparison.
Re:Apple Accidentally Approved Malware to Run on macOS by acallaghan on Tuesday September 01, 2020 @10:27AM (#24342072)
Apple are a multi-trillion dollar company, they don't need more money
Re:Apple Accidentally Approved Malware to Run on macOS by jmull on Tuesday September 01, 2020 @10:36AM (#24342200)
That doesn't change the fact that developer resources cost money that has to be paid for somehow.

If Apple doesn't charge developers, they could, e.g., pay for it through more margin on device sales, which means Apple customers are paying for it. That sounds nice for developers, but that's going to cause the developer resources to lose developer focus. Developer resources will be treated as marketing expenses and the scope and character of them will reflect this.

Re:Apple Accidentally Approved Malware to Run on macOS by _qulr on Tuesday September 01, 2020 @10:59AM (#24342475)
You're taking the current Apple developer program as an eternal truth, when in fact it has changed significantly over time.

Before the App Store, you could develop for the Mac completely free. There was a developer program, which was much more expensive than $99 per year, but it was mainly concerned with WWDC and pre-release builds. There was even a hardware discount for developers, which was very popular, and effectively made the developer program pay for itself in many cases.

Re:Apple Accidentally Approved Malware to Run on macOS by jmull on Tuesday September 01, 2020 @12:18PM (#24343431)
> You're taking the current Apple developer program as an eternal truth, when in fact it has changed significantly over time.

Well, I've been developing Mac software for 25 years, so I've seen the developer program changes. Generally, it's gotten a lot cheaper and a lot better over time. (Except there's never been anything like the old Inside Macintosh books, and I guess there never will be.) I guess that's why $99/year doesn't bother me. Historically speaking, it's a great deal.

I'm sure there are more changes to come, but none of us knows what that will be, so there's not much to discuss.

> Before the App Store, you could develop for the Mac completely free.

I haven't kept track of a timeline on this, so I'm sure you're right, but you're talking about a transient state. Before Xcode you had to pay a lot for Apple's developer tools (which I can't remember the name of), or pay a lot for the superior (or so I believed at the time) CodeWarrior. At first, Xcode itself wasn't exactly free, because it was bundled with the OS updates, which cost a decent amount back then.

I guess at various times there has been more or less you could do at the free tier, but it has seemed to me that you could only rarely do a decent job of releasing and supporting mac apps without paying for something.

Re:Apple Accidentally Approved Malware to Run on macOS by _qulr on Tuesday September 01, 2020 @01:08PM (#24344035)
> At first, Xcode itself wasn't exactly free, because it was bundled with the OS updates, which cost a decent amount back then.

Xcode and Mac OS X were included on disc with Mac hardware. This is how I became a developer.

When Mac OS X was released, that was the period when Apple truly embraced open source and Unix. Since iPhone, however, there's been a lot of backtracking in that area, which I find very unfortunate.

In general, macOS is becoming more and more like iOS. Consequently, it is becoming more hostile to openness.

Re:Apple Accidentally Approved Malware to Run on macOS by addicted on Tuesday September 01, 2020 @11:13AM (#24342658)
It’s hilarious that according to Apple fans, Apple as a $2 tn dollar company cannot afford the program it was giving away for free as a $10bn company.
Re:Apple Accidentally Approved Malware to Run on macOS by EricE on Tuesday September 01, 2020 @03:39PM (#24346062)
You know why rich people are rich?

They don't spend all their money!

Yup, a bit glib but it gets to the essence...

Re:Apple Accidentally Approved Malware to Run on macOS by valuearb on Tuesday September 01, 2020 @11:16AM (#24342692)
Apple has more money than me, hence they should give me free iPhones and Macs.