News for hackers. Stuff that matters.
Re:Apple Accidentally Approved Malware to Run on macOS by Razengan on Tuesday September 01, 2020 @11:03AM (#24342544)
> It's astonishing that the developer community is fine with requiring open source projects to pay $99/yr for notarization to run on macOS.

There is NO "requirement" for notarization. This FUD keeps getting perpetuated, but you can publish macOS software without paying $99 year.

> It should be possible to verify developers and distribute open source apps without a cost on macOS.

The cost is convincing your users to trust you and allow your unsigned app to bypass Gatekeeper.

I've seen some tools do just that, explaining that they cannot afford the notarization fee.

Re:Apple Accidentally Approved Malware to Run on macOS by kevhito on Tuesday September 01, 2020 @11:26AM (#24342817)
> you can publish macOS software without paying $99 year.

Can you point to straightforward apple instructions for doing so?

I publish an open source project used in classrooms, mostly used by my own students but also others. Despite strong and principled objections, which I hung on to for years, I have simply given up and now pay the fee. I'd love to not have apple be the gatekeeper. But they are. Every release, every update, every summer when I go to fix a few bugs, the restrictions get tighter and tighter, and old workarounds stop working.

I work entirely on Linux and Win10, but I maintain a mac laptop and pay the $99/yr out of pocket just to keep this project alive. I've spent tens of days trying to find a way around either of these requirements, but it's just too difficult (for me, or for my students, or for others wanting to try my software).

Re:Apple Accidentally Approved Malware to Run on macOS by Razengan on Tuesday September 01, 2020 @11:39AM (#24342969)
> Can you point to straightforward apple instructions for doing so?

Take a look at how other apps do it, such as:

• MacDown https://macdown.uranusjr.com (also on GitHub)

Download → Right/Control-click → Open → Confirm

There are several such apps and open-source tools that are not notarized, some quite popular. Some of them provide those instructions next to their download links.

Re:Apple Accidentally Approved Malware to Run on macOS by gundmc on Tuesday September 01, 2020 @01:47PM (#24344529)
See the below discussion on why this is not a realistic or user-friendly option.

https://news.ycombinator.com/item?id=24217116

Re:Apple Accidentally Approved Malware to Run on macOS by Razengan on Tuesday September 01, 2020 @02:33PM (#24345146)
Exactly which part of “Download → Right-click → Open → Confirm” is user-unfriendly?

Those steps are literally all it takes. It’s barely 40 keystrokes to list them.

As a user and the resident tech support for people young and old, I am glad that there’s such a barrier against the execution of arbitrary software and it’s easily skippable if one so explicitly chooses.

In any case, how is it any worse than the Windows nag prompts that people accepted more than a decade ago?

Re:Apple Accidentally Approved Malware to Run on macOS by dessant on Tuesday September 01, 2020 @02:50PM (#24345384)
The linked article clearly demonstrates that running apps without notarization on macOS is much more complicated than you describe it to be, to the point of it feeling insurmountable for less technical users.

Perhaps you've configured your device in a way that gives you an easier execution path, or the app is employing a workaround to bypass Gatekeeper.

It seems MacDown uses such a temporary workaround to make the process less painful for macOS users: https://github.com/MacDownApp/macdown/issues/1106#issuecomme...

Re:Apple Accidentally Approved Malware to Run on macOS by _qulr on Tuesday September 01, 2020 @07:40PM (#24348406)
> what gets me every time is that the "right-click" trick only works the second time you try to launch the app. The first time, right-click or not, MacOS won't let you launch the app.

https://news.ycombinator.com/item?id=24219099

Re:Apple Accidentally Approved Malware to Run on macOS by gamegod on Tuesday September 01, 2020 @11:06AM (#24342589)
When did this change? You need to codesign/notarize your application lest users get the super scary warning that tells them to move it to trash when they try to run it. Apple literally tells your users your app is garbage unless you pay for this. Definition of a shakedown.
Re:Apple Accidentally Approved Malware to Run on macOS by Razengan on Tuesday September 01, 2020 @11:17AM (#24342710)
Perhaps the warning could be improved.

For now, a dev has to add an explanation next to the download link, and let the users decide.

Re:Apple Accidentally Approved Malware to Run on macOS by holstvoogd on Tuesday September 01, 2020 @11:40AM (#24342989)
From what I've read, Apple will require notarization on Apple silicon. If that holds for both desktop apps and cli software, it would be neigh impossible to use a mac for development. So I imagine/hope they will have a way of handling OSS better.
Re:Apple Accidentally Approved Malware to Run on macOS by jshier on Tuesday September 01, 2020 @12:04PM (#24343271)
That's not true. They're requiring all executables to be signed on Apple Silicon systems, but that's as an ad hoc signature added by the linker at link time. There's no additional cost or overhead on AS.