OS X Mountain Lion Limits Apps to Mac App Store, Signed Apps by Default

[interrobang]

Rosetta was always going to be a temporary bridge as Apple was paying licensing fees to Transitive, the company who developed that technology. That's on top of Apple's own development costs.

This got worse, or at least didn't change, when IBM bought Transitive in 2008.

I know this because the head of design at Transitive was my lecturer at Uni.

Fitting in those licensing costs into the $29 cost of Lion just wouldn't work, nothing to do with outdated technology. Nice try at scaremongering though.

What does this have to do with the price of tea in China?

Supporting everything has a cost. Having that radio button in System Preferences, and the underlying architecture to allow or deny unsigned applications adds complexity, which has a cost in development and maintenance and testing time. Continuing to develop two distinct execution models for signed and unsigned applications over time will require more resources than simply mandating signed code.

You are correct that Rosetta (and Classic before it) was a bridge technology. Likewise, the Gatekeeper preference is a bridge technology.

I expect that the global "Anywhere" option will disappear in 10.9, with the only remaining option being the ability to right-click and allow individual unsigned applications.

If there is a version of OS X (OS 11? OS XI, whatever) after 10.9, I expect that right-click option will disappear then.

That is how Apple transitions work.

 

[pubwvj]

Evil

Big Brother is Back!

 

[Ritmo]

Can't believe people still think apple will keep normal os x alive. Well I'll be back in couple years saying I told you so. In the meantime I'll enjoy my snow leopard - last good OS X.

 

[paradox00]

To be honest, I don't like the potential this has for power users who aren't Apple developers. I am certainly not going to have a Mac as my next main computer (after switching from Windows back in 2001) and instead I'll have a dual-booting MacBook running Windows and OS X only for the sake of iOS development as, to be honest, that'll be all that OS X will be good for.

The fact that the technology has been implemented, despite there being an "off switch" (that is not on by default) to allow you to install non-App Store apps is a detrimental to me and makes the Mac far less useful as far as I'm concerned. There is no promise that Apple won't at some point turn on the off-switch. In fact, it is advantageous for them to do so. Think about it? Why allow people to install random apps from anywhere, signed or not, when you can force them to buy from you and give you a 30% cut of every app sold? The "off-switch" smells only of a transition feature to be turned off once every major app is already available on the App Store.

Not cool, Apple, not cool.

I don't think you quite understand what Apple did. The Mac App store only option is turned off by default. The signed apps only option is the one turned on by default. Signed apps can come from both inside and outside the app store.

 

[SockRolid]

"Gatekeeper"? Reminds me of something...

The security software created by Cathedral Software in "The Net" (1995) is called Gatekeeper.
The movie features beige plastic Macs with floppy drives running Mac OS System 7, modems,
MacWorld SF 1995, big clunky analog cell phones, and Sandra Bullock in a bikini at the beach.

 

[milo]

By making the default so that 99% of users will only run MAS apps...

Except that's NOT the default, at least not in this initial beta release.

One thing I thought of is if Grandma or your girlfriend - who loves her iPhone goes out and buys a MacBook Air and Office and tries to install it won't work. They aren't going to know about GateKeeper and I doubt we see Office in the App Store in the next year or so.

Wouldn't that cause frustration and dis-statisfaction to rise? Also more genius bar appointments with frustrated users who can't install software purchased at Best Buy

The only thing that needs to be done to fix that is for Office to get an update so that it's signed with a certificate. Shouldn't be a problem since the OS release is months away. One thing that does bring up is that many apps probably will get updates to add certificates - it would be nice if Gatekeeper had some sort of option with unsigned apps to check and see if that app has an update.

 

[Casey4147]

Aaack!

Okay, apologies to all if this has been stated already, but I only made it thru to page three before I lost it and had to post something.

Someone upstream commented that this was Apple attempt to adapt UAC to the Mac. Sorry, UAC was modeled after OS X's admin-level authentication, was typically over thought by Microsoft for Vista, and calmed down to a manageable level in Win7.

I've got a question for y'all. How many of you are running your machines in a user account?

Most consumers have no idea what I just asked. Most power users know and I would hope that they are running as users of their machines, not as admins. When you set up your Mac, you're asked to create an account. You aren't warned that this account allows one to do most anything they want to the computer. They aren't advised to create a second account at a user level and run their day-to-day in that account. Most consumers probably have never realized that there's a difference.

First thing I do when I set up a new Mac for personal use is to create a second account, at user level, and stay the hell out of the admin account. It's so easy to get things done in OS X that way, and only needing to provide the admin credentials when I need to - software install, mostly. I'll go so far as to say you're stupid not to do it. Running day-to-day as an admin lets the badness into your computer - yes, it still triggers an admin account credential request, but sooner or later someone's going to find a way around that. Hope it never happens, but let's be realistic here, if it can be made, it can be unmade.

Gatekeeper, to me, sounds great. It's a simplification to Apple levels of Windows' Enterprise-level AppLocker function (and let me tell you, that can be a royal pain in the arse if a software install procedure isn't written right). By default, Gatekeeper is going to block any unsigned apps, and it can be set to a more paranoid (read Enterprise-friendly) App Store-only level, or set to Everything for those who don't want to be bothered by it. Is it a step towards a waled-garden approach? Could be, Apple has been known to take an intermediate step on their way to where they're headed, but I truly doubt they'll hobble the desktop OS that badly. They know there's some things you need to do that an iPad can't handle (at least, I thought that until I saw WinZip hit the iOS App Store yesterday...). And it's been widely stated that, if you need to, you can still run an unsigned app by right-clicking or control-clicking and choosing Open - just like Win7's Run As Admin right-click-contextual-menu option. Simple. Almost elegant.

Me, I"m liking the look of this.

 

[PracticalMac]

I myself love to live dangerously!

 

[iSee]

This is a good thing!

The best way people have of avoiding malware now is to assess the credibility of the source and then proceed only if we trust the source.

E.g., when you download and run some app, somewhere along the line you get a prompt: are you sure?

And that's it.

It sucks because you've got to spend time researching the publisher of the software AND the site you downloaded it from to find out if either is dodgy. Honestly, do you do the research every time? And what if it doesn't become known that the software (or site) is malware until *after* you've done your research? The first you might know of it is when the Trojan Horse steals your identity or turns your computer into a zombie.

All the gatekeeper does at the default settings is have Apple assess the credibility of the source and to do so continuously.

That's it. There's no boogey man here.

You don't have to take Apple's advice if you don't want to. If it blocks your favorite app one day, shut gatekeeper off and keep on using it... After you reinstall the OS, I bet you leave it on the default.

Speculating about the future intentions of Apple is all well and good, but at this point all Apple has done is offer us a little more info to protect ourselves from malware than we previously had. I just can't find dark intent in that. Of course Apple could make a power grab on our computers in the future... but there is nothing here to indicate that they are moving in that direction.

 

[PodPacker]

Wirelessly posted (Mozilla/5.0 (iPhone; CPU iPhone OS 5_0_1 like Mac OS X) AppleWebKit/534.46 (KHTML, like Gecko) Version/5.1 Mobile/9A405 Safari/7534.48.3)

Oh well. When we heard about SOPA we all knew the end of "the fun" was coming. Soon enough Microsoft will imement something like this and then do "what they do best" and network and partner and take computing away from the masses again.

 

[cube]

This would be OK if the Mac App Store allowed applications developed with any technology.

Like it is, it makes a tougher business case for alternative technologies better than Cocoa and Objective C.

 

[diamond.g]

Correct.

BZZZT Wrong. This is about making developers obtain certificates so that the end user can be sure that their copy of the app whether it is free or not and whether it is downloaded from the appstore or not is a genuine copy and not a trojan. The devs will be jumping through hoops whereas the majority of end users will eventually upgrade all of their apps from outside of the appstore to signed versions. The typical user will not want to bother with apps from devs who are not willing to take ownership of their "work" and sign them for authenticity.

Hey, what are the lotto numbers for this Friday's draw? A user will always have the ability to bypass the system but they will have to make a conscious "choice" and it will be their fault if things get screwed up.

It will be a boon for Apple in that they will not have to support end user systems that were screwed up with unsigned counterfeit apps and can just offer to backup the data and do a restore of the OS.

What happens to open source apps like VLC?

 

[Bubba Satori]

The security software created by Cathedral Software in "The Net" (1995) is called Gatekeeper.
The movie features beige plastic Macs with floppy drives running Mac OS System 7, modems,
MacWorld SF 1995, big clunky analog cell phones, and Sandra Bullock in a bikini at the beach.

Somebody remembers. Well done.

 

[registerednerd]

The security software created by Cathedral Software in "The Net" (1995) is called Gatekeeper.
The movie features beige plastic Macs with floppy drives running Mac OS System 7, modems,
MacWorld SF 1995, big clunky analog cell phones, and Sandra Bullock in a bikini at the beach.

Oh good, it's not just me who wondered if anyone at Apple had seen that movie when they named Gatekeeper. They might as well have called iCloud Skynet, at that rate.

 

[dejo]

Before "The Net" had Gatekeeper, there was also the one from "Ghostbusters".

 

[Renzatic]

I just stumbled upon this gem.

http://www.darktable.org/

Damnit! No Windows install? You tease!

Oh well, I'll bookmark it for future prosperity. Because it does look like a pretty slick little program.

 

[gnasher729]

The Implementation: I'm furious that Apple is drawing a distinction between MAS apps and signed apps. The options should be "Confirm Unsigned Apps" and "Run Everything". Apple is clearly trying to scare users into only shopping the MAS, thereby driving developers to the MAS. I don't care for the MAS or Apple's terms, and I think (hope?) if they push too hard here it will raise antitrust issues. MAS is not healthy for the Mac community.

Why "scaring"? This is like going to a used car dealer, and he sells some cars that have been checked for technical problems by the dealership (appstore), and some other cars where they checked that the seller is legit (signed apps), and next door you can buy cars, no questions asked (unsigned).

 

[gkpm]

This would be OK if the Mac App Store allowed applications developed with any technology.

Like it is, it makes a tougher business case for alternative technologies better than Cocoa and Objective C.

First you can still sign (for free) and distribute apps outside of the App Store, this setting does not get in the way of that (unless the user specifically choose to only allow apps from the store)

Scripting languages like Python and Ruby also don't trigger the Gatekeeper so you can use those freely.

I'm not 100% sure about Java but suspect it'll be the same thing. As long as you have the JVM installed then you should be able run Java code without gatekeeper getting in the way.

----------

OK, I think this wasn't covered before so here it goes:

What apps aren’t protected?

• Anything already on your system is grandfathered in.
• Files transferred or installed using fixed media like DVDs, USB drives, and other portable media.
• Files downloaded by applications that don’t set the quarantine bit.
• Scripts and other code that isn’t executable.

https://securosis.com/blog/os-x-10.8-gatekeeper-in-depth

This means if your e.g. torrent client doesn't set the quarantine bit, Gatekeeper doesn't get involved at all.

 

[cube]

First you can still sign (for free) and distribute apps outside of the App Store, this setting does not get in the way of that (unless the user specifically choose to only allow apps from the store)

Scripting languages like Python and Ruby also don't trigger the Gatekeeper so you can use those freely.

I'm not 100% sure about Java but suspect it'll be the same thing. As long as you have the JVM installed then you should be able run Java code without gatekeeper getting in the way.

----------

OK, I think this wasn't covered before so here it goes:

What apps aren’t protected?

• Anything already on your system is grandfathered in.
• Files transferred or installed using fixed media like DVDs, USB drives, and other portable media.
• Files downloaded by applications that don’t set the quarantine bit.
• Scripts and other code that isn’t executable.

https://securosis.com/blog/os-x-10.8-gatekeeper-in-depth

This means if your e.g. torrent client doesn't set the quarantine bit, Gatekeeper doesn't get involved at all.

I am saying that if you can't distribute your commercial application in the Mac App Store, there will be pressure to develop it in an inferior Apple-blessed technology.

 

[polaris20]

It'll do office doc's just fine..

LibreOffice sucks compared to Office 2010/2011.

Gimp will do all the editing I need..

Photoshop is the industry standard, and yet there's no Linux version.

Miro will convert all the video files I need.

I don't edit movies..

and the rest I don't do

I don't really care what you do or don't do. I'm referring to the general user base, of which many do one of the things I mentioned.

If you're a hardcore Office user, then Libre/Open Office won't do. Believe me, I've tried, and they're not completely compatible, which is important in business and even education.

If you're into imaging, GIMP won't do.

FOSS does a great job of coming up with apps that get 80% there to their commercial counterparts. Unfortunately that's not close enough, for a lot of people. In case you haven't noticed, the Linux Desktop Revolution still hasn't happened.

I love Linux. Ubuntu is awesome (well, except Unity). But it doesn't fit the needs of the general, average desktop user.

 

[leroypants]

Image

Completly true, of course the drones will downrate the truth.

 

[Renzatic]

I love Linux. Ubuntu is awesome (well, except Unity). But it doesn't fit the needs of the general, average desktop user.

Depends. What do you consider to be the needs of the general, average desktop user? If you're talking about enterprise, or movie/3D/photo editing, I can somewhat agree with you on that front. Linux has some nice alternatives, but they're not quite up there with the biggest and the best.

...but the average user? As in people who want to talk to their friends and family, share recipes, listen to music, watch movies, and post BS on Facebook? Linux works just fine for that.

 

[GermanyChris]

LibreOffice sucks compared to Office 2010/2011.



Photoshop is the industry standard, and yet there's no Linux version.



I don't really care what you do or don't do. I'm referring to the general user base, of which many do one of the things I mentioned.

If you're a hardcore Office user, then Libre/Open Office won't do. Believe me, I've tried, and they're not completely compatible, which is important in business and even education.

If you're into imaging, GIMP won't do.

FOSS does a great job of coming up with apps that get 80% there to their commercial counterparts. Unfortunately that's not close enough, for a lot of people. In case you haven't noticed, the Linux Desktop Revolution still hasn't happened.

I love Linux. Ubuntu is awesome (well, except Unity). But it doesn't fit the needs of the general, average desktop user.

There is more than Libreoffice you know. There are also universal formats I got a bachelor using only linux and I graduted in 98.

I thought we were talking about me?

I neither know nor care what the greater computer using public uses or desires.

Linux will do everything the average user needs no matter the distro. Edit **I consider myself the averge computer user**

If there was a mass exodus from OSX (which there won't) all it would do is spur on development of those industry standard commercial programs. I do believe Adobe would love to tell Apple to go fly a kite.

 

[leroypants]

I can't even imagine would have happened if Microsoft tried something like this.

 

[Eidorian]

...but the average user? As in people who want to talk to their friends and family, share recipes, listen to music, watch movies, and post BS on Facebook? Linux works just fine for that.

A friend of a friend years ago jokingly ran "the porn test" before giving a passing grading on a new distribution of Linux.

I stick with MP3, h.264, and YouTube playback out of the box.