Sidebar Sidebar
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

macOS Sequoia Makes It Harder to Override Gatekeeper Security

Nugget said:
Except it's nothing at all like traditional antivirus in its implementation, resource requirements, and efficacy.

Antivirus has to deeply inspect a binary at the time of execution and look for specific binary fingerprints. This comes at the expense of CPU and bandwidth every time you run any executable on the system. It's possible to subvert by altering the executable in ways which change its fingerprint but don't alter its behavior.

Signed binaries can protect against that technique without draining CPU, RAM, or bandwidth.
Click to expand...
No,

the original post was saying:

It also means that when a malicious binary is discovered out in the wild that Apple can revoke the signature on that executable preventing it from working. That's not nothing.

A malicious binary discovered out in the wild?? It means that a$$le previously signed a malicious binary?! Because a binary cannot be compromised once it is signed! If it is compromised, there is no more match between the binary and its digital certificate!
 
  • Haha
Reactions: Shirasaki
firewood said:
You only have to pay the $99 if you don't distribute your free software as open source. So this is an encouragement for more software to be distributed as open source that every competent user can not only run, but read and modify the code.
Click to expand...
The $99/year is required for FOSS projects to generate signed binaries AFAIK. Obviously it’s not required to distribute the source code but many people just want to run the app without going through the huge hassle of downloading and building the source code themselves (even though they certainly could do that if they want to). Even if you do opt for the latter route of building from source without a paid dev account, on iOS you only get a certain number of days before having to repeat the entire process again due to arbitrary app expiry set up by Apple. I know this because I tried it with iDOS which Apple refused to allow on the App Store for a long time.
 
Last edited:
  • Sad
Reactions: Shirasaki
platinumaqua said:
The ship is already in the port ready to go given that so many Mac apps now are the half-baked Electron apps and not native
Click to expand...
I don't love Electron apps. But I also don't hate them. It's better to have an Electron port than no software at all in my opinion.
 
firewood said:
You don't need to notarize apps you build and run on your own Mac. So open source does matter. Anyone who can build from source can build and run that code on their Mac without notarization.
Click to expand...
Obviously - but you spoke of “distribute” above.
That means “giving” software away to others (whether for free or paid) - not compiling/building on your own Mac and only use yourself.
 
  • Like
Reactions: Shirasaki and davide_eu
Does Apple’s notarisation prevent or protect against small-scale, targetted attacks carried out by sophisticated actors, designed to empty user’s bank accounts, or get access to exposed person’s) or something? Not very much - since the certificates are so easy to get.

This isn’t true protection but rather risk reduction against lower-tech - yet often larger-scale attacks: Someone using malicious code that’s widely available (and known) and packaging it with a popular freeware software, hardware driver. Getting access to a popular and trusted developers’s website or Github and replace their downloadable binaries with backdoored versions etc.
 
  • Like
Reactions: Shirasaki and davide_eu
antmarobel said:
I paid for my iMac M3 (with a 1 tera SSD and 16GB memory), so I wan to install whatever I want ON MY MAC!!!!!
Click to expand...
Respectfully, that's not how it works though. You bought a Mac that runs macOS. Apple makes the hardware and the software; they are inextricably tied together, which is what makes macOS so great. Maybe you're just used to how it works before you switched from PC to Mac?
 
  • Angry
  • Sad
Reactions: xflashx, Shirasaki and freedomlinux
AppliedMicro said:
Given that the „license“ isn’t properly presented to me at the time of (or prior to) purchase, there’s no „agreement“. So many don‘t understand that.
Click to expand...
I don’t think that’s how it works. Apple like every major corporation spends millions of dollars on lawyers. You accept the license when you use the software
 
  • Angry
Reactions: Shirasaki
mansplains said:
Likely an unpopular opinion, but I don't see anything wrong with the annual dev fee. A hobby cost of $99/yr is pretty low. I think it would be nice for a free tier to be available for open source projects, however. I would say a free tier for students too, but Xcode is free to learn, develop, and test up until distribution. An à la carte approach to pricing may be worth exploring. And while I'm sure Apple does want everyone to pay up, you can still pass gatekeeper in settings for now.
Click to expand...
Pay to develop software... omg...
 
  • Like
Reactions: xflashx and filchermcurr
davide_eu said:
A malicious binary discovered out in the wild?? It means that a$$le previously signed a malicious binary?! Because a binary cannot be compromised once it is signed! If it is compromised, there is no more match between the binary and its digital certificate!
Click to expand...

You're not considering the entire context of the discussion at hand. Yes, I mean a binary that was maliciously created and was then submitted for signing by Apple so that it can run without interference from the Gatekeeper protections in macOS.

You claimed that this signature provides no benefit beyond proving that the attacker spent $99. That's not correct because the signature does allow Apple to revoke that signature and prevent the binary from continuing to spread or do damage. It also ties the binary to a developer on record with their payment information. These are all benefits your post upthread overlooked in your rush to be snarky and contrary.
 
  • Like
  • Angry
Reactions: jdb8167 and Shirasaki
currocj said:
agreed. The day they remove the ability for me to install whatever I want, I am so gone. Windows here I come.
Click to expand...
Windows defender stopped me from installing Oubuild (an offshoot of scratch) which I need for my Open University course. I had to disable the app protection thing, and can only reenable by reinstalling from scratch.. (which I will prob do over xmas time when laptop is just over a year old.
 
russell_314 said:
I don’t think that’s how it works. Apple like every major corporation spends millions of dollars on lawyers.
Click to expand...
So do airlines - yet the routinely violate the law by declining required assistance and/or compensation to travellers for flight delays or cancellations.

Also, so do banks. Yet I, a layman, have caught banks I illegally discriminating or having illegal fee structures - including in their published fee structure.

There’s surprisingly little correlation between big corporations spending money on lawyers and having compliant terms and conditions.
russell_314 said:
You accept the license when you use the software
Click to expand...
Contrary to what highly-paid lawyers and billion-dollar corporations may want you - and make you - believe, clicking a button on my local computer does constitute legal agreement in every case and/or jurisdiction in the world.

Let alone does it give software vendors the right to change their licensing or service terms at will - particularly when the customer has paid for a license or service for a certain term.
 
Last edited:
You ought to be able to disable this feature. I'd settle for an obscure keyboard shortcut while clicking something in Privacy settings so that disabling Gatekeeper is not so accessible to those less capable of assessing whether something is malware or not. Just let me install stuff how I want, if that's my choice.
 
Iwavvns said:
The hardware is your property. The operating system, however, is not your property. You should read the TOS sometime.. it’s quite interesting.
Click to expand...
I know how Operating Systems and software licensing works, thanks. I am just pro-consumer and not "Companies making changes to things that I cannot turn off years after I purchased the hardware expecting software to work the way it has, until they think they know what I want."
 
  • Like
Reactions: alvindarkness and Iwavvns
davide_eu said:
Yes, when you "use", not when you buy... so there is no agreement when you buy... is the license printed on the external box?
Click to expand...
I’m not a lawyer. If you want information about this I would advise you to talk to one that specializes in this type of law. I doubt anyone here on the forums is qualified to answer.
 
kylelerner said:
I am just pro-consumer and not "Companies making changes to things that I cannot turn off years after I purchased the hardware expecting software to work the way it has, until they think they know what I want."
Click to expand...
That is a very good point! I mitigate this by adopting an attitude of “I don’t control the OS so it may change after I purchase it”. I know this sucks, but it does put things into proper perspective at the point of purchase as well as reducing the chance of disappointment later.
 
  • Like
Reactions: kylelerner
Iwavvns said:
That is a very good point! I mitigate this by adopting an attitude of “I don’t control the OS so it may change after I purchase it”. I know this sucks, but it does put things into proper perspective at the point of purchase as well as reducing the chance of disappointment later.
Click to expand...
This is true - and an unfortunate reality. I just wish the climate surrounding software, and its changes, was more peer-and-customer reviewed. This is especially true with SaaS applications, where it can change without a user-intervened update. t's also just rude that they do not give us the option to turn certain things off.
 
  • Like
Reactions: alvindarkness and Iwavvns
russell_314 said:
You accept the license when you use the software
Click to expand...
So what if I don’t want to accept the terms of license - say macOS EULA?

I go into a store and buy a Mac, without having been provided a copy of the OS license.
After the seller demonstrating it to me, with seller mentionig my being required to agree to a licence.
I mean… which low-level sales clerk would? They probably never read it either.

I unbox the computer at home, plug it in, turn it on and inevitably get presented a license “agreement” to agree to on screen.
Upon reading the license, I decide I do not want to agree to the license.

Well, I can’t use my computer as advertised then, can I?
Can’t even install an alternative operating system.
It’s literally a dead paperweight without “agreeing” to the license.

👉🏻 So what now?

Do I take it back to the store and demand full refund of the product price for not telling me that I’d have to agree to licensing terms? Well, bad news: the seller, it could be another million dollar corporation with highly paid lawyers, could just as well tell me “sorry - no open box returns”. Or no returns at all. Particularly not for a full refund. And it’s not like there is a legal right to return a product.
 
  • Like
Reactions: ProbablyDylan and kylelerner
You must log in or register to reply here.
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.
Top Bottom
Back