Hacker News Reader

Comment by pjmlp | Hacker News Reader

Not after Catalina.

Future versions of macOS will require signed software (notarized as per Apple terminology), even outside of the store.

What is new in security at WWDC.

I don't fully understand the difference. But signed is different from notarized. Notarized means you uploaded the binary to Apple. Previously, you can sign without doing that.

I haven't looked enough to understand what is gained by notary. Does Apple want to search your binary for maliciousness or rulebreaking (potentially even at a later date) so that it might revoke the notarization/signature?

In order to avoid repeating myself, from WWDC 2019:

"Advances in macOS Security"

https://developer.apple.com/videos/play/wwdc2019/701/

"All About Notarization"

https://developer.apple.com/videos/play/wwdc2019/703

Thanks.

Some of this stuff seems a tad disingenuous. Like preventing debugging. The debugger APIs on Mac already pop up a password prompt, limiting the usability in malware (and actual use, like trying to debug over ssh). Meanwhile, a culture of producing separate binaries for debug and for end users (debug builds lacking optimization, allowing additional permissions) is in my experience a great way to fail to reproduce legit customer-facing bugs during development and have greater difficulty diagnosing them when they occur on a real live user machine.

As far as I understand, notarization is intended to catch malware before it can be distributed. The traditional signing mechanism can protect users against malicious software because Apple can pull certificates used to sign malware.

Notarized≠signed. I suggest you watch the videos that you've posted; they go into detail about the changes in macOS Catalina and when they apply.

On the go now, I will post the video minutes and slide pages afterwards.

Signed is not the same to Sandboxed on macOS, afaik.

It's not, but sandboxing requires code signing.

Watch the security talk. macOS is on the path to adopt iOS permissions model and long term roadmap is to apply the sandbox to everything, with the option to explicitly disable it on per-case basis.

A path similar to how Windows 10 is now converging the Win32 and UWP sanbox models, or how ChromeOS sandboxes GNU/Linux processes.

> macOS is on the path to adopt iOS permissions model and long term roadmap is to apply the sandbox to everything

I do not see where this is mentioned.

I will show it later then.

That will be the Mac books death.

Many open source projects will not participate in this.

If this kills brew you will also loose a lot of devs.

iPhone and iPad don't seem to have suffered from lack of open source projects.

Neither do game consoles or the large population using Windows based systems.

I never cared for brew on the occasional moments I get to use Apple computers, XCode and default tooling is more than enough.

Which is like what the large majority of developers targeting Apple devices actually care about.

The MacBook is a general purpose computing platform. The iPhone and iPad are not. Locking down the Mac will make it unusable for many, many people. It will indeed be the death of the platform, as most devs abandon it entirely.

As a Mac user who develops high performance scientific applications portable between all UNIXen (Linux/Mac/BSD), I still can write my code pretty easily on the platform.

I personally don't use Homebrew, et al. but, I have a Linux VM which handles that stuff pretty well.

I didn't develop a Mac specific "application" though.

The large majority of devs that buy Macs aren't UNIX FOSS devs, rather devs that care about Apple platform.

My experience has been the opposite. Of all the people I've worked with using Macs, all of them were developing cross-platform open source software. I've yet to meet a single developer making MacOS applications.

They would better off sponsoring OEMs that try to keep BSDs and GNU/Linux hardware alive then.

On my Mac circle it is all about store apps and Web apps (Java/.NET Core based).

This doesn't match my experience so far, could you point me to your sources for this claim?

Just like you, my experience so far.

Then again, I only hang around with Mac devs that target iDevices and macOS, using Objective-C, Swift, C++ and Web.

This doesn't kill package managers like Homebrew.

Reply on news.ycombinator.com