Odd. I can get asn unsigned, un-notarised app running just fine. I just need to hold control while opening it for initial run. Something odd happening here.

Or jump through several hoops into System Settings > Privacy & Security, and authorise the app.

It's designed so regular users don't / can't bother to do so, tho

Sure, there are workarounds. But I can't ask people that download the app to perform Apple's rituals.

Why not? If you’re able to demonstrate that you’re a trusted developer, they’ll respond positively to an FAQ. It’s not uncommon.

Users are fickle. And in the 5 years I've been deploying this app I've never had to ask users to do that. I'm sure it's fixable, the solution has just eluded me this far.

Love the update from a year ago where you need to click through 3 layers of settings to run code someone else wrote on MacOS now.

And on the other end, window's UX is going down the drain year over year.

Look, I agree that this kind of non-specific rant isn’t useful but that level of response is pretty harsh. I’d at least be charitable and ask whether he’s doing something uncommon which would explain why it’s so much harder than normal.

I had such a great reply to their unkind comment. I lost it after hitting submit, because it was flagged by the time I did. I wish they left it up.

The bastion rulesets won't impact your macOS app, unless you're attempting to do something that only malware or otherwise sketchy software would do.

Surely it would be easier to simply disable internet access until the user enables it. Bonus points if you can control what it talks to at the IP stack and DNS level. Something i've wanted for decades at this point.... yea, little snitch does this, but it's not built in and belongs on my phone as well.

Preventing an app from accessing browser data feels like an approach to make people feel safe while providing no meaningful protections from most malware behavior.

> Preventing an app from accessing browser data feels like an approach to make people feel safe while providing no meaningful protections from most malware behavior.

Depends on the threat model. Yes, protecting browser data does not help if the attacker gained entry into the system by exploiting a vulnerability in the browser. But it helps against all other entry points: USB sticks laced with malware (common threat against companies), malware that came as part of an email attachment or by dodgy warez, an attacker that's already in the network (either because they're laterally moving or because the victim is in a scenario like a public wifi) and exploits some vulnerability in network-enabled software...

Classic defense in depth here, it massively raises the bar for attackers because to steal Chrome user sessions or passwords, you now need a code execution avenue but also a kernel-level or at least sandbox exploit to bypass Bastion.

> Classic defense in depth here, it massively raises the bar for attackers because to steal Chrome user sessions or passwords, you now need a code execution avenue but also a kernel-level or at least sandbox exploit to bypass Bastion.

Sure, but this is a very arbitrary threat model to prioritize that doesn't seem to affect people. What about ads? Tracking? Apps sending fingerprinting home? That seems like a more obvious place to start.

> Sure, but this is a very arbitrary threat model to prioritize that doesn't seem to affect people.

Malware exfiltrating users' browser sessions and passwords is a "very arbitrary threat model" that "doesn't seem to affect people"???

Yes

> Sure, but this is a very arbitrary threat model to prioritize that doesn't seem to affect people.

Credential stealer malware is abundant, it's often enough how attackers gain initial access to a company's internal network - grab the credentials off of Chrome, Firefox or one of the other popular password manager apps, and you're bound to find a set of credentials there. Now all you need is some piece of software that's reachable from the Internet and lacks 2FA (which applies to a shocking lot of legacy software), and you got some sort of persistent access to the network.

And in ye early days of cryptocurrencies, before hardware vaults became the norm among crypto enthusiasts, a fair amount of people got their wallets drained by targeted cookie (=session) stealers.

> What about ads? Tracking? Apps sending fingerprinting home?

That is bad, but not "someone can drain your bank account or take over your social media accounts to spam" bad.

I disagree; i think the proliferation of ads is a type of malware that has far more detrimental effects on society than credit card theft (which, incidentally, wouldn't be a problem if the industry bothered to protect their cards with basic authentication on use, which they refuse to)

I recently attempted to trace exactly which app is making a particular DNS SOA query. I can confidently say that there are very few applications in the *nix space that do proper DNS reporting at all, and Little Snitch seems to be the only one that would map the actual app. I found no working solution to match a query to a pid in Linux.

This tells me that either people rarely need to do this, or that it’s very hard to do in userland.

Disabling internet access only prevents exfiltration. Ransomware, for instance, wouldn't need to access the internet at all if it used hard-coded public keys to encrypt content.

Presumably exfiltration would work for most people, no? It is quite unusual to have physical access to a computer, and if you do generally all bets are off.

This is just the hypothetical situation where ransomware is a static binary that doesn't care about any data exfiltration - it just encrypts files in-place with a pre-defined public key. So no exfiltration, physical or over the internet, is required.

Ah, i see your point.

Hopefully that's true. If Apple misclassifies some benign action an app makes I have a feeling it'll be nigh-impossible for users to continue using the app, and I always worry that automated negative consequences my come to my Apple developer account.

Can you share the app? Maybe someone here can tell what the issue is. I'm able to distribute outside of the mac AppStore without users needing to jump through any hoops or right click etc.

It's an Electron app AND blockchain related; hackernews's two favorite things to hate. I don't expect much love from this crowd. Heh.

It's certainly either something I'm doing wrong, or a big in the software I'm using to automate signing, notification and stapling.

Here's the issue I opened on the software I'm using to automate: https://github.com/electron-userland/electron-builder/issues... that issue kinks to the PR that adds the automation.

It's a non-trivial thing to test, since it involves so many secrets and the notarization step can take over an hour, so I don't expect anyone here to actually want to look into it.

My original comment really was just venting my frustration, not a cry for help (but I might be crying soon if I can get to the bottom of this!).

I’m on mobile, so short help: in one of my projects I’m building a binary in Rust and then using Xcode to notarize it by replacing the binary of another shell app that I’m Bildung in Xcode. This works really well. Check out the description here: https://github.com/terhechte/Ebou

Thanks! I'll take a look at the specifics tomorrow.

Thanks for the response. The output of `spctl` on your latest build (2.7.2, downloaded from the build artefacts section of Github Actions gives me the following:

/Applications/Ganache.app: rejected (invalid destination for symbolic link in bundle) origin=Developer ID Application: ConsenSys AG (48XVW22RCG)

I see you're also migrating to Github Actions for this particular release and that the notarization process was working correctly on your previous CI/CD? I guess there has to be an issue with the new environment here or the way you're building it now.

Probably the five links to /usr/local/bin/python3 in node_modules. Does the app need node_modules bundled?

You could try experimenting with Hydraulic Conveyor [1]. I built it originally due to the frustrations involved in distributing P2P software during my old Bitcoin days so you won't get any hate from me about that ;)

Conveyor can package Electron apps and also do all the Mac specific stuff from any platform including Linux. So it can sign, notarize and staple the app itself, also bundling Sparkle updates as it goes. We're listed on the Electron website these days. You may have more luck with it. There's a Discord channel for help too if you get stuck.

[1] https://hydraulic.dev/ (disclosure: my company)

Thanks for this! I've made a new issue to look into switching. It'd be great to find something that Just Works™!

You are a liar.

There’s an opportunity to remedy your problem but I don’t think this is the best way to leave that offer open.

They just made something up about me that is not true. They've insulted my integrity. They are a liar. No one in good faith can disagree.

There is no 'open offer' to consider. The only thing the grandparent did was fabricate a lie, and the only reasonable response is to call them out on it.

Their comment was against HN guidelines (Assume good faith.), there's no reason to chide someone for calling them out on that.

Apple has developed the first and only generally available "evil maid" resistant computer systems. Part of participating in this secure ecosystem involves more effort on your part to comply with the security requirements.

Or you can just develop for vulnerable-as-all-getout Linux or Windows systems. Your choice.

Having an evil made fidling my computer is not a big worry in my life. Not being a slave to the gafams is.

It’s not just the evil maid but what happens if your device is stolen (or scanned by the police), or you run malware by mistake and want to restore it to a trustworthy state. Most people should worry about those more than the evil maid scenarios.

The police regularly have zero day tools available like pegasus and celebrite. It doesn't really protect against well funded attackers.

Notice how those tools don’t have perfect coverage, often don’t support fully patched devices or only work with e.g. short PINs, and in high profile cases it often takes months to crack iPhones? Nobody said this is easy but it’s a lot harder than it used to be.

None of those scenarios matter to me:

- I can't prevent the police from pegasusing my device.

- I haven't have anyone infected by a malware in years, no matter the brand of device.

- Most thief won't be able to do anything with any of my devices, no matter the brand. They are not very smart, and can't deal with a bios password, an encrypted disk or even simply a locked smartphones. They steal it anyway, and throw it away when it fails.

But in the end, I don't optimize my life for the rare occasion of being stolen.

I optimize it for my day to day problems, like being able to use my machine to do what I want to do every day, without having to hope I'm allowed to do it by corporations.

I'm much more worried about the state of society that losing a phone once to a thief.

This is why I said “most”. People here are freakishly unlike the average user and I think it’s quite reasonable to optimize for 95% of the market.

If security was a spectrum Apple has gone into ultra-violet. If The Onion did tech jokes there'd be a headline that reads: The iBrick - it doesn't work, but at least it's hacker-proof!

But thanks for reminding me I have a choice, which I actually do not.

> Apple has developed the first and only generally available "evil maid" resistant computer systems.

If you exclude themselves from the threat model of course, which I don't see why you would

Those are separate threats. You must accept the risk of your hardware manufacturer being compromised but that’s very different from also accepting the risk that any third-party with brief physical access can compromise your device.

What happened is that instead of the user having all the rights, now it's Apple having them all instead. Not a single security problem was reduced here, the thread model just moved from users to Apple.

> Not a single security problem was reduced here, the threat model just moved from users to Apple.

If you don’t understand why this isn’t true, I would respectfully start reading about what the platform does. It’s not like it was around the turn of the century where PCs and Macs were roughly equivalent.

I know what the platform does, and that's why I have this opinion and also why I don't want any of it.

Not wanting it is a valid position. Lying about it not solving real problems is not.

I'm not saying it doesn't solve real problems, I'm saying its swapping problems into others.

Sure you can find some problems that have been solved but for each of those, there's a brand new problem created and not necessarily any better than the previous one.

> the first and only generally available "evil maid" resistant computer systems.

"resistant" is a pretty low bar to pass. Do we get to include the Nintendo Switch for having eFuses?

You are deluded. Once they get physical access, you are out of luck.

Do you have any evidence to support this?

macOS @ M1 boot process looks similar to that of iOS devices: https://support.apple.com/en-gb/guide/security/secac71d5623/...

Under the assumption that SIP is not disabled, and computer doesn't have any 3rd party kernel extensions installed (both of which are safe to assume for most people), it's close to impossible to inject something in the boot chain.

---

I think the best possible option might be to replace the keyboard with the one with a hardware keylogger, and record the actual password.

Yes, that option with the keyboard would be the easiest option. See? The point on encrypting your whole disk is not to avoid tampering, but to lock your machine in public places and be sure that no one can access your data upon placing that disk in another machine, or even trying to boot it.

As always, security always operates with some threat model in mind. Of course some government-level agency with physical access and any amount of money to spend could likely get access to your device (though the usual $5 wrench is probably still the "better" way) at the price of a (or a few) zero days. But you are likely not a key person in toppling a government and it would be a giant waste on their parts.

The threat model the general populace faces ranges from something as mundane as your ex wanting to extract something from your device to basically being the know-all key to every important document, photo and data you might have. I think I can safely say that under this circumstances not even physical access poses a real threat to the device's security -- it is tamper-proof to replacing most critical parts and the boot-sequence is cryptographically secured. Biometric data is not stored in software, so not even that can be spoofed.

Yes they have but it shouldn't have to mean that the vendor has more control and trust than the user.

they put their expensive black boots on your neck, because obviously you want it

Weird. I just downloaded Ganache and it ran and opened just fine, no warnings. Are you experiencing this on your own machine, or just other machines? And what version of macOS?

The current published version is fine, thanks for trying it! I'm working on a new release, and haven't been able to get the Apple build to work. Lots has changed since the last release, certainly on my side and I presume also on Apple's.

I've manually tested on Monterey.

Ah ok, makes sense.

I’d recommend you check out Apparency [1], which can inspect .app bundles and show you what’s up with the signing on your bundle. It looks like you include a few frameworks (which also need to be signed), so maybe you have components missing signatures/with mismatched signatures.

[1] https://mothersruin.com/software/Apparency/

This looks like it will be immensely useful! Thanks!

I used to think this sentiment is overblown, but then I tried to develop a Mac and iOS app. Although I live in Canada, it took almost 3 weeks to become an Apple developer, having to supply every piece of ID in my possession and having many declined. They’re British Columbian identification in perfectly fine condition.

The development process could have been much worse, but some aspects of swift development in XCode were frustratingly rough with a range of extremely well document to barely documented APIs.

Can I do X with SwiftUI? Who knows. Does it support Y pattern well? Absolutely, and here are a dozen examples. Such a pain in the ass.

I also have no idea when my app will be approved. It just generates air quality forecasts from multiple sources, provides alerts, shows active wildfire perimeters, and doesn’t allow any access to anything else. Just uses location, optionally. It’s been weeks now.

Overall I’d rather not develop for apple’s devices again, but mostly because so little is in my control. The rest was fine. I strongly dislike having so little agency around being accepted into the platform and then publishing on it. Not having a say over my tool chain is also pretty frustrating when theirs is so buggy, slow, and unintuitive.

> Can I do X with SwiftUI? Who knows. Does it support Y pattern well? Absolutely, and here are a dozen examples. Such a pain in the ass.

SwiftUI is still very green, especially on Mac where it hasn't gotten as much attention as it has on iOS. There are some things I'm starting to use it for over UIKit on iOS, but on macOS I wouldn't bother — AppKit might be a little rough around the edges compared to UIKit, mainly due to its age, but it's a great deal more suitable for production work on macOS than SwiftUI is.

I guess that was another hang up. What should you use? Why? When is it reasonable to use cutting edge vs seasoned libraries?

Thanks for that, though. I’ll likely give that a shot soon, because my current client loves the idea of MacOS apps. I like the idea of common code to rub on multiple platforms, but it seems like it’s too green.

I think that not just on macOS, but generally in desktop software, the older, more mature, more "boring" option is going to be best in the long run even if getting up and running is faster in newer stuff. Of course platform devs would like you to think otherwise because they want buy-in for their new frameworks, but buy-in is earned. New frameworks might eventually be great, but it's going to be a while before they're able to compete with the likes of frameworks such as AppKit, which have legacies stretching back 3+ decades. That's a lot of time to allow for refinement and better covering of common use cases.

It's somewhat true on mobile, too, though to a lesser extent because mobile UI widgets don't need to be as functional, which makes it easier for new things to compete — for instance a table view with sortable, rearrangable columns and column headers is practically unheard of on mobile whereas it's a cornerstone widget on desktop. For user-facing platforms the web is the odd exception where it's somewhat the norm to jump for the latest trendy shiny thing on new projects.

It's not like Windows is any better, and Linux is kind of a free for all.

> Can I do X with SwiftUI? Who knows. Does it support Y pattern well? Absolutely, and here are a dozen examples. Such a pain in the ass.

Exactly this. Don't even get me started if you are writing a Mac Catalyst app too.

Can I use this NSEvent? No? I gotta create a bundle that's built for OSX and then load that dynamically and pass stuff as AnyObject from my AppDelegate.

Oh I'm getting .rotation and .magnify events. Is there any API I can call to ask the OS the positions of the fingers on the trackpad? No? I need to go through the GestureRecogizer? But that is returning 0 touches for a .magnify event.

All I wanted was to get the current location of the fingers so that I can decide on which axis to zoom more on. Oh there is a plist for Application Supports Indirect Events. Downstream effects not documented, well, that's how it is developing for an Apple platform.

Ha, wow, that's agonizing to read but totally on point. You nailed it.

I don't understand why Apple has decided this is okay, or why they don't direct more resources and attention to ensuring this sort of thing doesn't become reality.

Every time I submit my app for review it gets rejected and I need to go through 3-4 rounds before it finally gets approved. In one case, the app was rejected and I was asked to make a change. I made the change, and the app was rejected because of the change I was told to make.

I’d be fine with their process if there was an alternative way to get my app into my customers hands. But there isn’t, and they’re vehemently against it.

When Apple launched unlisted apps I was really excited. But these apps inexplicably seem to go through the same review process. If it’s unlisted, why do they care about anything other than security?

Apple truly makes life painful for developers. Can’t wait for alternative app stores.

KYC has way more good benefits than bad.