Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.
I am wondering if the Flashback malware would have been prevented if this new Gatekeeper feature was enabled. I am wondering how effective this additional feature is going to prevent certain types of attacks. Well, I think it is 100% impossible to prevent malicious things happening, but certain types of attacks are preventable.

Code signing is just one of Gatekeeper's features. Sandboxing is another level of security that is borrowed from iOS.

When you build your app profile you tell Apple/the system, what it is allowed to do. The App does not have full access to directly change anything on the system. It makes a request to the Gatekeeper system and if it isn't allowed in the profile the system will stop the request.

For example: If you write a video playback app you build the app profile to do only that. If the app is exploited via a flaw and it tries to read the contents of your password file the OS would not allow it.

Because of this change depending on how your code is written it might be a huge undertaking to implement Gatekeeper.
 
I fully support this, but I have one MAJOR concern:

Will developers be able to sign apps with a free developer account?
As far as I know, currently, this is not the case. And as the main goal of a signature is to know for sure a responsible person behind an application, this will likely not be different in the future.

It's not so much about the money, but it is an additional burden which costs time. I just hope, they simplify this whole signing and packaging thing into something easy. Currently, I have 6 certificates in my keychain manager. And I have no idea what they do. I just select one and verify my app until it is approved. Great security.
 
Apple is just trying to close down outsiders to the Apple Ecosystem. And for you fanboys out there, where are the posts from apple 3rd party developers praising this?

:confused:

Panic, probably one of the bigger Mac developers, went to a discussion with Apple about it, blogged about it, and had thought it was a positive thing for the future.

http://www.panic.com/blog/2012/02/about-gatekeeper/

And, honestly, who cares if all apps are required to be signed. That would be a GOOD thing - I'd much rather their be less unscrupulous apps out there.

In case you haven't realized, iOS is pretty popular and normal people don't seem to mind all that much.
 
Gee, I wonder what prompted this? :D

Gatekeeper could be a MAJOR PIA for end users. You can turn on the predecessor via command line in Lion. Anytime you need to install software not signed you have to turn it off via command line, install the software and turn it back on. Most end users aren't going to be able to deal with this.
 
Gatekeeper could be a MAJOR PIA for end users. You can turn on the predecessor via command line in Lion. Anytime you need to install software not signed you have to turn it off via command line, install the software and turn it back on. Most end users aren't going to be able to deal with this.

Gatekeeper is controlled in System Preferences, not command line....
 
Sorry to burst your bubble but there are several apps that just are not going to ever get distributed in the MAS - in many cases it's just fundamentally incompatible with the way their business operates.

And that's fine. They can still get their stuff out there, but it's on them to prove they aren't sketchy, and honestly, that's how it should be. There are far too many people out there trying to mess with people to just pretend it doesn't happen anymore.
 
And that's fine. They can still get their stuff out there, but it's on them to prove they aren't sketchy, and honestly, that's how it should be. There are far too many people out there trying to mess with people to just pretend it doesn't happen anymore.
And I agree - that's why Apple implemented the code signing - to provide a central system since they know things aren't going to be app store only.
 
Gatekeeper could be a MAJOR PIA for end users. You can turn on the predecessor via command line in Lion. Anytime you need to install software not signed you have to turn it off via command line, install the software and turn it back on. Most end users aren't going to be able to deal with this.

There is an option to override if an app isn't signed by control-clicking.
 
I'm sorry, is my logic off here or does this whole system seem very useless?

Your logic is off. The point is, most apps will be certified and hopefully users will be VERY cautious about installing any app that isn't. You're right, most malware devs aren't going to get certified but once this system is released hopefully it will be harder to convince users to install their malware.


My main concern is that signing will be limited to paid developer accounts

I see your point, but I have to wonder how many devs are so small that they can't afford $99 per year. And personally I'd like to see the developers of the apps I use testing on OSX betas, which are only available to paid developers.


What I want to know is where Apple's icon design team went.

Doesn't matter, that logo isn't used in OSX (as an icon or anything else). Gatekeeper is found within the Security system pref panel (and actually I don't think they're using "gatekeeper" in the OS either). It's just a graphic used in their marketing, no reason to really care.


Guess who doesn't have a developer id yet?

At this point it looks like nobody has one (including Apple), they probably haven't released any.


As long as Mac users will still be able to install apps from developers which choose not to distribute through the App store (And are presumably therefore going to be 'unsigned'?)

You misunderstand how it works. This signing program is for apps not distributed through the app store. The app store really has nothing to do with it, really it's designed to make people more comfortable installing apps they didn't get through the app store.
 
There is the potential that the government could see this as a system by which it can force Apple to block infringing applications. Say, a game console emulator or a program that allows one to search for torrents.

Any computer with a closed-source OS is a such a system. If they really wanted to, Apple could issue a software update at any time that prohibits any specific piece of software from running. They're the authors of the system - they can do whatever they want! The only reason they haven't done it is because it's not something they're interested in doing. Stop freaking out, people...
 
That is a step in the right direction... The functionality in Lion is more a pain than anything.

That's because the functionality in Lion wasn't supposed to be there for Joe common. Some people just happened to figure out that the code was in place in Lion.

Apple is officially introducing Gatekeeper with Mountain Lion. That should give you a clue.

----------

I'm simply hoping that in the future Apple starts to treat the iPad more like a Macbook and less like a phone. And yes, this all has a lot to do with that. If gatekeeper and the MAS make Apple feel like Macs are just a little bit safer, the idea of 'treating an iPad like a Mac' suddenly becomes less scary to Apple execs, doesn't it?

The fact they are increasing security on the Mac makes you hopeful they will loosen it on iOS ?

Sorry, but you're bound for disappointment with that line of thinking. App signing has been here since day 1, mandatory, on iOS. Now it's become an option to the user on Macs to make it mandatory too. There is no loosening of policies here that indicate some kind of shift in Apple's attitude, quite the contrary. It seems Apple wants to recreate the walled garden from iOS on the Mac, albeit in a less restrictive way for now.

----------

Can you explain why, it in theory would not. A security hole typically get's the bad guy in, that is the first step. The second step is to execute code that is downloaded to the machine once the first step is accomplished. This code would not run how ever, since it would not be signed.

The code signing checks are for apps launched from within OS X's Cocoa frameworks. Bash still seems to run unsigned code just fine, and it uses the POSIX exec() system call family instead of the NSTask and other Cocoa APIs.

I haven't done extended testing, but Gatekeeper seems to be half-baked if anything.
 
Any computer with a closed-source OS is a such a system. If they really wanted to, Apple could issue a software update at any time that prohibits any specific piece of software from running. They're the authors of the system - they can do whatever they want! The only reason they haven't done it is because it's not something they're interested in doing. Stop freaking out, people...

Not to mention that the government could do this anyway without gatekeeper. They could just pass a law forcing a company to implement such a system. It would be the same methodology anyhow.
 
The code signing checks are for apps launched from within OS X's Cocoa frameworks. Bash still seems to run unsigned code just fine, and it uses the POSIX exec() system call family instead of the NSTask and other Cocoa APIs.

I suspect that it's Mach-O files that needs to be signed (executable binaries), Cocoa is built on-top of the fundamental system calls. For example sending a alloc message to a class boils down to a calloc call behind the scenes. But for something like a bash script, each command, is executed as a separate process, which if part of the system would not need to be signed (or already signed by Apple).
 
Last edited:
That's because the functionality in Lion wasn't supposed to be there for Joe common. Some people just happened to figure out that the code was in place in Lion.

Apple is officially introducing Gatekeeper with Mountain Lion. That should give you a clue.



Wow thanks for enlightening me O wise one...... I didn't figure that out by myself. I was simply making a comment on usability and that the predecessor had none.
 
Question is, can you use a free Apple Developer account to gain a signed certificate? This thread has contradictory posts regarding the matter.
 
Last edited:
Is it not using the same code signing code? Is it not using the same monolithic single source online store?

Sure you can install any app from any source now but with code signing in place you are one OS patch away from NOT doing that.

I would say this is more of a logical conclusion then a absurd conclusion.

Ok, we get that you're worried about your Mac becoming 'restricted' like iOS devices are, but Gatekeeper actually moves the Mac a step *farther* from that scenario, not a step closer.

Prior to Gatekeeper, signed OS X apps could only be had from the Mac AppStore. At that point, a single OS patch could prevent you from installing anything that wasn't available in the AppStore.

Now, with Gatekeeper, signed apps can be had from *anyone* who bothers to get a key and sign their app. If Apple wanted to restrict everyone to AppStore apps only, they now need to require signed-only apps, *and* revoke every key that was used outside the AppStore. This would also catch in-AppStore apps written by developers who have also released software *outside* the AppStore, so it would also require splitting the keys, and getting all those developers to start using their new keys in the AppStore before Apple could go this route.

So, as you can see, Gatekeeper is evidence that Apple *isn't* going to do what you're so worried about.

On the other hand, Gatekeeper *does* allow a *user* (or administrator) to configure a system such that only signed apps will run. But that's a small step forward from a security stand-point, so nobody seems to be complaining about that aspect.

----------

Can you explain why, it in theory would not. A security hole typically get's the bad guy in, that is the first step. The second step is to execute code that is downloaded to the machine once the first step is accomplished. This code would not run how ever, since it would not be signed.

Or, if it *were* signed, it could be stopped dead by revoking the signing key as soon as the payload is discovered.

If getting the signing key requires a paid developer account, then the cat & mouse game of constantly updating the payload to evade the anti-malware code becomes *quite* expensive for the malware developers, and the whole platform loses quite a bit of it's 'charm' for them.

If not, the constant spamming for new keys provides more clues about the location and *real* identity of those malware developers, improving the chances that they'll be caught and/or stopped. Again, this reduces the 'charm' of OS X for malware developers (though not by as much as the prior scenario).

----------

I'm not a developer by any stretch of the imagination.

But... there is just something about this I don't like. I do not want to be told what I can and cannot install by Apple.

As long as Mac users will still be able to install apps from developers which choose not to distribute through the App store (And are presumably therefore going to be 'unsigned'?), then I can live with it. But it seems like a step in the direction of total control, and thats what I don't like.

It does work for the iPhone, and thats great - but my Mac is not a phone and I expect more from it.

Well, the publicly available info shows you'll be just fine, because the Gatekeeper options from a user standpoint are:
  1. Signed code only!
  2. Ask before allowing unsigned code.
  3. Allow any signed or unsigned code without asking.

Note: Signed code can be had from the AppStore *or* from any other location if the developer has a signing key. That's the new change with the Gatekeeper addition. Before, you could only get signed apps from the AppStore.

----------

And that's fine. They can still get their stuff out there, but it's on them to prove they aren't sketchy, and honestly, that's how it should be. There are far too many people out there trying to mess with people to just pretend it doesn't happen anymore.

And with Gatekeeper, you can at least know that the copy you have is the genuine article, and not some hacked-up, malware-ridden version. That goes a long way toward being *able* to prove that your apps aren't 'sketchy'.

----------

Maybe again, that's because you weren't supposed to use it in Lion ? :rolleyes:

Yep. It only existed in Lion to allow *developers* to test their signed apps to make sure everything behaved as expected on a system where Gatekeeper was set up more/less restrictive than the default of "ask before running unsigned code". Why someone would complain about the end-user-friendliness of an intended-for-developers-only-at-this-stage system is beyond me. :confused:
 
I suspect that it's Mach-O files that needs to be signed (executable binaries), Cocoa is built on-top of the fundamental system calls. For example sending a alloc message to a class boils down to a calloc call behind the scenes. But for something like a bash script, each command, is executed as a separate process, which if part of the system would not need to be signed (or already signed by Apple).

You didn't understand my post at all. Unsigned binaries launched from bash, compiled from source, run great on a system set to run only signed code. The signature check is not in the kernel, at least in the implementation in Lion.
 
You didn't understand my post at all. Unsigned binaries launched from bash, compiled from source, run great on a system set to run only signed code.

Wow, that is a serious flaw if this is the same in Mountain Lion...

----------

Not to mention that the government could do this anyway without gatekeeper. They could just pass a law forcing a company to implement such a system. It would be the same methodology anyhow.

Passing a law is a little harder and time consuming then getting a court order to revoke a key.
 
You didn't understand my post at all. Unsigned binaries launched from bash, compiled from source, run great on a system set to run only signed code. The signature check is not in the kernel, at least in the implementation in Lion.

How about downloaded binaries not compiled from source, it would make sense to not have to sign code you compile your self. After all you know where that came from. In the end Gatekeeper is there to add trust to binaries from someone else. There are some solid arguments why certificates is a good strategy for Apple on this blog (made before Gatekeeper was announced). http://blog.wilshipley.com/2011/11/real-security-in-mac-os-x-requires.html
 
I never said anything about a cast iron guarantee. I nearly stated that they have said several times that the MAS is not going to be the only method to get apps. And really, in real life there is no cast iron guarantee. Apple can promise whatever they want and violate it tomorrow. I just know that they aren’t that dumb to do that in this instance.

Did I miss the link you posted where they stated explicitly that the MAS is not going to be the only method to get apps?
 
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.