macOS Sequoia Makes It Harder to Override Gatekeeper Security

[russell_314]

What else did I buy that game for, it not to play it?

I have a reasonable expectation to play the game, if I bought it. So I’ll just click on and ignore the EULA - just as “they” ignored me when not presenting the “agreement” to me prior to purchase (and no, that doesn’t mean I have to jump through hoops to acquire it somewhere else due to small print on the box) - and get on with my life.

And here you go answer your own question. Replace “game” with “Mac” and “macOS” in the above paragraph and there’s your answer.

Although you can’t ignore the EULA when it comes to games in the USA. The game will just close. Is this different in the EU? With any application if you don’t accept the EULA, the application closes.

Oh, yeah, I was almost waiting for that.
Cause I also vaguely remember such wording when having set up a Mac.

But here’s the thing: I may not have bought it from Apple. In fact, I didn’t buy my last Macs from them.
So why should I return my computer to them?

Do you buy your games directly from the game developers? There are some online games you can buy this way but most physical games which are getting to be fewer and far between except for console games are bought from a retail store that has no direct relation to the game developer.

Yes, it actually does.
It would require too much effort.

Suing third parties does take too much effort, just so that I can use a hundreds-of-Euros product that I have a reasonable expectation of being able to use? You can keep that stance in the lawsuit-happy United States of consumer Abuse - thank you very much.

Not really. In the USA lawyers do all the work for you and you could just collect a check. It’s even more convenient because the cost of all these lawsuits get added to the price when you buy products so you’re paying for them indirectly. It’s awesome.

The box wasn’t even handed to me before having paid in store. And I’m not obliged to read things to obtain and read things that may be available “somewhere else” - particularly when said “agreement” can and does change over time.

In the USA games are locked behind glass and you don’t get to touch it till after you pay. Also, I don’t think there is a license agreement on the outside of the package so even if you did get to touch it you wouldn’t be able to see the license agreement. You don’t get to see that till you open the game and put it in whatever device it plays in. If you click ”Don’t accept”, the game just closes and you can’t play it. At that point, it’s non-returnable at least in the USA. I can’t speak for the EU because I don’t live there.

I certainly won’t spend any more money or time to take or ship my Mac to a third party like Apple..

If you bought it from a third-party seller, you would have to return it to them. Apple will only accept returns from people who bought from them.

I have a reasonable expectation to be able to use my computer.

And like everyone that buys one, they actually use it. So yes, your expectation should be met.

They can’t legally enforce EULA presented after purchase to me, and clicking a button does not constitute such consent or agreement (that is also prevailing legal opinion in a sizeable part of the EU - other jurisdictions certainly may view that differently).

Well, they can and so far have seem to do so. I’m sure at some point in the future with the EU you’re going to have to sign a contract and initial each paragraph like purchasing an automobile before you buy a Mac agreeing to the EULA. It’s going to be glorious like those annoying accept cookies pop ups on every website that I have to click thanks to the EU.

 

[nottorp]

Well, they can and so far have seem to do so. I’m sure at some point in the future with the EU you’re going to have to sign a contract and initial each paragraph like purchasing an automobile before you buy a Mac agreeing to the EULA. It’s going to be glorious like those annoying accept cookies pop ups on every website that I have to click thanks to the EU.

By opening this post in your browser you agree to give me your first born and half your house.

Here, you agreed to the kind of EULA you're advocating for. Send your first born. And the money for half your house. I don't want the physical item, but since I now own it you need to compensate me. Legal in the US?

 

[firewood]

Does disabling it via command line still work?

Removing the quarantine bit from the command line seems to no longer works. But you might be able to re-codesign an app with your own Apple ID from the command line to run it on your Mac.

 

[JuicyGoomba]

All this gatekeeping by Apple and Microsoft is doing is pushing tech literate people towards Linux.

Windows 11 is abysmal. The UI is nice, and that's as far as it goes.

I ain't touching MacOS for anything, outside of the ridiculous security practices that are force fed just because they want to keep Martha safe from nasty files she might download from Facebook, you literally have to spend hours installing basic features that are available in every other OS and Linux distro by default.

We are now at the point in this timeline where ChromeOS looks like the most competent mainstream OS going. What a world we live in.

 

[ArtOfWarfare]

it's a huge barrier for scammers.

You couldn't have that more backwards. The barrier is that Apple charges $99/year to notarize software. People distributing useful stuff for free don't want to pay Apple's Mafia fee. The people trying to steal from victims on the other hand are perfectly willing to hand over the $99 protection fee.

 

[Nugget]

I don't entirely disagree with you, but I'd like a (complicated) way to revert the change for myself. From recovery or something maybe, like how System Integrity Protection is currently managed. That should make everyone happy no?

It seems to me that the people who are upset over this change are primarily upset because of what they believe this move foretells, not the specifics of this change itself. On its face, this change doesn't really represent a significant change in macOS behavior and absolutely does not change the user's ability to bypass Gatekeeper if they want to. There are no situations where Gatekeeper was able to be bypassed before but with this change can not be bypassed. It's not a functional change, just a UI change.

Many here seem to believe, however, that Apple are maliciously moving towards a day when macOS will be unable to run unsigned binaries and that they are being deceitful about their true intentions. They see this as further evidence that their theory is correct. Those people are not going to be happy because they are not angry about the current reality but are in fact worried and upset over actions they believe Apple will take in the future.

I don't see evidence of this theory and I don't view this change as a step down that slippery slope. Others clearly do. Time will tell, I suppose.

 

[Nugget]

You couldn't have that more backwards. The barrier is that Apple charges $99/year to notarize software. People distributing useful stuff for free don't want to pay Apple's Mafia fee. The people trying to steal from victims on the other hand are perfectly willing to hand over the $99 protection fee.

Apple have simply moved the controls to bypass Gatekeeper on a specific binary from one part of the OS to another part of the OS. That's all this change represents. Nothing more. That specific change -- as described in the article -- does pose an additional barrier to scammers fore a variety of reasons. Moving the control to Settings instead of a right-click action on the binary allows for more detailed and nuanced description of what's happening, makes the process more complicated and more of a burden, and moves it to an area of the OS that (in theory) raises a user's sense of concern and attention towards what is happening. All of these things work against scammers to make it more difficult to convince or compel a user to disable the OS level protections which are preventing a malicious binary from running.

I don't agree with your analysis at all.

 

[Bazza1]

Here's a thought Apple - fix the long-term and current issues with your OS and built-in software before restricting users from installing better products without the limitations your Store imposes.

 

[Jerry Fritschle]

The tech illiterate wouldn’t know about the Control-Click shortcut.

For power users, this is a step back imo.

The article mentioned download sites that instructed users to use the shortcut. That's not a good look.

 

[russell_314]

By opening this post in your browser you agree to give me your first born and half your house.

Here, you agreed to the kind of EULA you're advocating for. Send your first born. And the money for half your house. I don't want the physical item, but since I now own it you need to compensate me.

Only if you want to pay the child support 😂

Legal in the US?

Maybe 🤷‍♂️😂

 

[Fishrrman]

It's still possible to DISABLE Gatekeeper.

First way -- using terminal.
Open terminal.
Enter:
sudo spctl --master-disable

Hit return, enter password.
Done.

You can check to be sure it's disabled either looking at Privacy & Security -- the "anywhere" indication should show in the popup menu.

Second way -- using "Mountain Tweaks".

There's a FREE and very OLD utility out there called "Mountain Tweaks" (from back in the days of OS Mountain Lion!).
What it does is provide a graphical interface to execute some basic terminal commands to set up various items in the OS.
Although it's old, much of it STILL WORKS.

You can use the "Mountain Lion Tweaks" panel to disable Gatekeeper if you wish.

Personal experience:
One of the FIRST THINGS I do with a new Mac or OS install is to DISABLE Gatekeeper.
Also, I disable SIP as well:
Boot to recovery
Open terminal
Enter:
csrutil disable
Quit terminal and reboot.

 

[asiga]

The descent of macOS towards iOS-ification continues apace... When these laptops eventually become glorified iPads + keyboards, as seems likely, I'll just move back to Linux.

Yes, I'm fully aware I'm a sample size of exactly one.

Apple declares the open source community to be their enemy. Who is running Apple these days? With this step, Apple effectively closes the door to portable software, GitHub, Macports, Homebrew, Sourceforge, and every open source initiative (except big projects that are "trustworthy" according to the new big brother in town, of course).

To those of us who chose Apple back in the day as a means for both escaping from Microsoft, and being able to run a good UNIX system with good design, this step really puts Apple at the same (if not worse) category as Microsoft. Bad, bad, bad.

I mean: Why have you become *evil*, Apple????? Don't you understand we are enough with one Microsoft on planet Earth?

I really love the Mac for writing open source software, Apple. If you don't change this crazy strategy, my days with you are numbered.

 

[nt5672]

The descent of macOS towards iOS-ification continues apace... When these laptops eventually become glorified iPads + keyboards, as seems likely, I'll just move back to Linux.

Yes, I'm fully aware I'm a sample size of exactly one.

Nope, at least 2, we are replacing Mac's with Linux here too. Not everything, but we no longer run mac servers. The mac has just become too glitchy, unreliable, too nanny state, and hard to manage compared to Linux.

 

[JuicyGoomba]

Apple declares the open source community to be their enemy. Who is running Apple these days? With this step, Apple effectively closes the door to portable software, GitHub, Macports, Homebrew, Sourceforge, and every open source initiative (except big projects that are "trustworthy" according to the new big brother in town, of course).

To those of us who chose Apple back in the day as a means for both escaping from Microsoft, and being able to run a good UNIX system with good design, this step really puts Apple at the same (if not worse) category as Microsoft. Bad, bad, bad.

I mean: Why have you become *evil*, Apple????? Don't you understand we are enough with one Microsoft on planet Earth?

I really love the Mac for writing open source software, Apple. If you don't change this crazy strategy, my days with you are numbered.

Again, ChromeOS is looking very appealing now for anyone after a lightweight work laptop that's both fast and efficient and can run Linux apps.

Yes you're in bed with Google still, but if you connect to the internet then you already are.

 

[Nugget]

With this step, Apple effectively closes the door to portable software, GitHub, Macports, Homebrew, Sourceforge, and every open source initiative (except big projects that are "trustworthy" according to the new big brother in town, of course).

Can you explain what you mean by this? I just don't see it.

The change described here doesn't impact your ability to run any software on macOS whatsoever. Every single piece of open source software that you could run previously can still be run. You are still able to bypass Gatekeeper entirely or for specific executables after this change as you were before this change. This is not a functional change, just a UI change.

Why do you read so much doom and malicious intent into this change?

 

[JuicyGoomba]

Can you explain what you mean by this? I just don't see it.

The change described here doesn't impact your ability to run any software on macOS whatsoever. Every single piece of open source software that you could run previously can still be run. You are still able to bypass Gatekeeper entirely or for specific executables after this change as you were before this change. This is not a functional change, just a UI change.

Why do you read so much doom and malicious intent into this change?

Why are you simping for Apple is the real question?

It's a negative change, and you're confused about why people are being... negative?

As many have already stated, Ctrl + Click was a convenient workaround and a "good enough" middle ground between allowing people who aren't tech illiterate to use their PC as they want to, while also protecting Facebook Moms from the evil nasty downloads.

Removing that is a significant pain point for anyone who relies on the shortcut regulary, and it makes no sense to remove it.

Regardless of Apple's true intentions, the reaction here shows that once again anti-consumerism is coming to the forefront with the mask of "security and privacy".

Here's a little bit of insight into Apple's business practices for those still drinking the Tim Appleaid, the whole "privacy and security for everyone" schtick that Apple do is purely for profit, not for you as consumers.

 

[Nugget]

Why are you simping for Apple is the real question?

We can discuss this like adults, right? No need for insults or slurs.

It's a negative change, and you're confused about why people are being... negative?

Is it? I view this change as merely relocating the Gatekeeper bypass controls from an unintuitive right-click operation to the Settings app where users are already conditioned to visit when they want to change privacy or security controls on their Mac. I can see many reasonable and justifiable motivations behind this move. It does not functionally change the user's relationship with open source or otherwise unsigned binaries in any tangible way that I can see.

Am I wrong about that?

As many have already stated, Ctrl + Click was a convenient workaround and a "good enough" middle ground between allowing people who aren't tech illiterate to use their PC as they want to, while also protecting Facebook Moms from the evil nasty downloads.

I can understand why Apple may feel why a Ctrl-click context menu is no longer a sufficient barrier for novice users. It's less clear to the user what they are actually instructing their Mac to do, it affords less opportunity for in-app messaging to the user. It doesn't provide a way for users to undo the permissions change. It's unconnected to the Settings where users are likely to expect that feature to exist, especially now that the Settings app has a history of being where a user would go to control privacy and security settings on their machine. This move places the Gatekeeper bypass controls in the same location where a user already goes to do things like control an application's access to location information or other more granular app-level permissions. All of these things make sense to me and seem like plausible motivations for Apple to have made this change.

Removing that is a significant pain point for anyone who relies on the shortcut regulary, and it makes no sense to remove it.

Nothing has been removed with this change, only relocated.

Regardless of Apple's true intentions, the reaction here shows that once again anti-consumerism is coming to the forefront with the mask of "security and privacy".

Here's a little bit of insight into Apple's business practices for those still drinking the Tim Appleaid, the whole "privacy and security for everyone" schtick that Apple do is purely for profit, not for you as consumers.

None of this seems to follow from the facts at hand. I really don't understand your reaction and attitude here. Sounds more personal than it does objective, to be honest.

 

[sashavegas]

It's still possible to DISABLE Gatekeeper.

First way -- using terminal.
Open terminal.
Enter:
sudo spctl --master-disable

Hit return, enter password.
Done.

You can check to be sure it's disabled either looking at Privacy & Security -- the "anywhere" indication should show in the popup menu.
View attachment 2403705

Second way -- using "Mountain Tweaks".

There's a FREE and very OLD utility out there called "Mountain Tweaks" (from back in the days of OS Mountain Lion!).
What it does is provide a graphical interface to execute some basic terminal commands to set up various items in the OS.
Although it's old, much of it STILL WORKS.

You can use the "Mountain Lion Tweaks" panel to disable Gatekeeper if you wish.

Personal experience:
One of the FIRST THINGS I do with a new Mac or OS install is to DISABLE Gatekeeper.
Also, I disable SIP as well:
Boot to recovery
Open terminal
Enter:
csrutil disable
Quit terminal and reboot.

sudo spctl does not work anymore. To disable it you must create profile and install it

 

[lkrupp]

I'm a power user who is highly tech literate and I didn't know about Control-Click (or at least forgot about it). I don't know every last keyboard shortcut that's available in macOS.

It's not a problem to pull up settings unless you need to do it dozens of times per day.

And who, exactly, would be installing dozens of unsigned apps a day?

 

[canadianreader]

This is gatekeeping Apple is telling devs if you want to develop an app for the mac pay $99 per year. In a few years Apple will not let you install any app outside the App Store "to keep users secure".

 

[leapp]

Good. Anything to help the tech illiterate gullible keep from compromising themselves. For users who know what they are doing, no big issue at all if they want to install unsigned apps from god knows where. More power to them but no sympathy of they get nailed.

I guess that's one view. Here's another: Apple is taking another step in maintaining total control of our lives. Apple fans should be jarred by this news, not happy or relieved. We can't upgrade, we can't fix, we can't decide what we want to put on the systems. Thank you Apple demigods! And the worst part is that they explain this in ways that make it sound good for us. **It's not for us and it is not good for us.**

It's my computer, back off apple!

 

[Fishrrman]

"sudo spctl does not work anymore. To disable it you must create profile and install it"

Nope.
I have the latest developer copy of Sequoia, and have disabled Gatekeeper as I described above in reply 211 of this thread.

I was running Sequoia when I posted that reply, and if you look at it, you will see the screenshot I took in System Settings...

 

[Spock]

This makes me nervous for the future of software for the Mac, I don't want to have a Mac that is fully reliant on the Mac App Store. If that is a direction they want to go, I hope they add an S Mode feature that Windows has that can be disabled by the user.

 

[AppliedMicro]

Although you can’t ignore the EULA when it comes to games in the USA. The game will just close. Is this different in the EU? With any application if you don’t accept the EULA, the application closes.

I click “accept” and then ignore the EULA. Since it’s unenforceable due to not having been adequately presented to me prior to purchase. At least when buying boxed products.

In the USA lawyers do all the work for you and you could just collect a check. It’s even more convenient because the cost of all these lawsuits get added to the price when you buy products so you’re paying for them indirectly. It’s awesome.

Awesome. For lawyers.
Not for average consumers that pay inflated prices.

In the USA games are locked behind glass and you don’t get to touch it till after you pay. Also, I don’t think there is a license agreement on the outside of the package so even if you did get to touch it you wouldn’t be able to see the license agreement. You don’t get to see that till you open the game and put it in whatever device it plays in. If you click ”Don’t accept”, the game just closes and you can’t play it. At that point, it’s non-returnable at least in the USA

You do see the problem with that!?

Selling something and then preventing you from using it sounds very much like bait and switch, if not downright fraud.

Going back to your original point:

You own the hardware but you don’t own the OS. You only have a license to use it within the terms of the license agreement

…and said OS license was bundled with the hardware. They advertise what it can do. And that’s the reasonable expectation I can rely on - without being bound by surprising conditions only presented to me after sale.

Well, they can and so far have seem to do so. I’m sure at some point in the future with the EU you’re going to have to sign a contract and initial each paragraph like purchasing an automobile before you buy a Mac agreeing to the EULA. It’s going to be glorious like those annoying accept cookies pop ups on every website that I have to click thanks to the EU.

The EU isn’t the culprit here. If anything, they’ll just require companies to properly inform the buyer/user, disclose the terms and obtain consent appropriately.

If anyone’s at fault, it’s the companies that believe they have to inundate their customers with paragraphs and pages of legalese junk - that no one reads anyway.

 

[firewood]

Many here seem to believe, however, that Apple are maliciously moving towards a day when macOS will be unable to run unsigned binaries and that they are being deceitful about their true intentions. They see this as further evidence that their theory is correct.

Apple makes Billions from apps. Thus macOS has to allow the development of apps, which means power users will always be able to sign their binaries. So pay up your $99, and become a real power user.