▲ 398 points
back
286 comments
Any user who does not like Gatekeeper can turn it off on their machine in ten seconds by running this in a Terminal:
sudo spctl —-master-disable
Of course, you as the developer can’t make this choice for your users… but isn’t that as it should be? The user decides what code is allowed to run on their machines. And the default setting is restrictive because anyone who knows what they’re doing can easily change it.
P.S. Meanwhile, on iOS there’s no way to install unsigned software at all, and on Android (starting soon) the process takes 24 hours instead of ten seconds. That is actually ridiculous because it’s taking away user choice.
P.P.S. To be clear, modern macOS has plenty of other restrictions which can’t really be turned off and which I find super annoying. Gatekeeper just isn’t one of them.
Edit: I’ve just learned that as of Sequoia, you have to also tick a box in Settings after running the Terminal command. So maybe it takes 30 seconds instead of ten seconds. That’s mildly more annoying, but still doesn’t really seem like a big deal to me.
> what do you actually want?
Give me the ability to choose what I trust. “You can either trust Apple and nobody else, even yourself, or you can trust literally everybody” is obviously not a good faith implementation of this. Apple excels at steering the narrative with false conflation and false dichotomy, I’d also remind you of the came-and-went secure boot debate, which Apple successfully steered into Apple owns the encryption keys vs no encryption, and people just kind of forgot to ask, wait, why can’t I have the keys to my device?
Rather than just having the options "Done" and "Move to Bin", give me an option to actually run it without having to manually go into System Settings each and every time without disabling security features?
The added friction feels more like a way to force developers to pay Apple an annual fee for distributing rather than for my safety. Not saying it doesn't help with safety, just that it's more weighed to the former.
> what do you actually want?
I want to be able to right-click on an app and choose "Open" to run the program with an authentication dialog. You used to be able to do this, but Apple removed it in favor of an incredibly annoying process of having to go into System Settings every time.
I do not think this is the right way. The right way would be for Apple to allow for a free Developer ID for distribution if the app is free and has no in-app purchases.
This provides IMO all-around goodwill while still adhering to good release practices.
> People will say, no, that’s too big a hammer, it’s not safe… but then, like, what do you actually want? Either you keep Gatekeeper because you like the friction it introduces, or you don’t like that friction and you should go turn it off. Pick one, you obviously can’t have both!
Refusing to let you open an app isn't friction, it's complete obstruction. How about warning you and letting you run it this one time or allow it to run normally from there on?
If you want to take the risk and install some unsigned software on your machine, go ahead, but don't blame Apple, who is gatekeeping for the entire ecosystem for making the decision to keep the restrictions in place so that the other 2.5 billion users don't fall victims to malware defenselessly. Also, as a rule of thumb in cybersecurity, never underestimate human flaws or overestimate your ability to overcome them. Even the most brilliant experts cannot possibly know everything and make zero mistakes, let alone "the users" you are talking about. It is pure illusion that "the users" know exactly what's running on their machine under the hood. We should be thankful that Apple is willing to hold the lines and go this far to tighten security up when nobody forces them to. It is probably one of the best thing coming out of Jobs' relentless push for privacy and security on the iPhone.
> what do you actually want?
To make gatekeeper happy without paying a large amount of money and own Apple hardware (same thing).
I just wish Homebrew was not planning to remove packages because of this.
> $ brew doctor
> Warning: Some installed casks are deprecated or disabled. You should find replacements for the following casks:
> alacritty
> librecad
Is there workaround? Probably. But macos lost benefit of OS X's "it just works". Time to move elsewhere I guess.
10 seconds or 30 seconds, it's just too much friction to ask end users to do. I actually develop on a Mac, but I've written off Apple as a target system for hobby/open source projects. Between quarantine, code signing, and notarizing (which requires $99 a year), it's just not worth it. Good for Apple users if they like this shit--I'm just not going to bother with distributing to the platform anymore.
macOS is slowly getting like Windows, where, on a fresh install you have to go through and turn off all sorts of unwanted software just to have a sane environment where you, the user, are actually controlling your computer.
I have been developing software for Macs and PCs as an Indie for 20 years now. I sympathize with the author of the post. You get the feeling that Apple thinks you should be grateful that they allow you to develop apps for their platform.
The author didn't mention Apple's contempt for backward compatibility. Apple like to regularly nuke their entire developer system from orbit. Try running an app developed 10 years ago on the latest version of macOS. It probably won't run.
Microsoft are much better at backward compatibility and they don't force you to join a developer program. But you get totally reamed every time you have to update your authenticode digital certificate for Windows. Just the digital certificate will cost you more than $99 per year. It is a total racket.
I shared the author's frustration when figuring out how to ship such binaries to end users so I wrote a guide [0] detailing exactly how to do it. Apple's documentation is surprisingly poor and I couldn't find any blog posts so I ended up reverse engineering what works via trial and error as well as popular OSS projects on GitHub.
[0]: https://ofek.dev/words/guides/2025-05-13-distributing-comman...
Author here, just pushed a quick update to the article.
To be fair, compared to the prices of Certum and other providers if you ever want to sign something for Windows, perhaps Apple isn't uniquely overpriced (they all seem to be that way): https://www.certum.eu/en/code-signing-certificates/
Looking more into the Windows side of things, I also found Azure Artifact Signing which is supposedly affordable at 8.54 EUR per month, but unfortunately they don't actually support individual users in the EU (only in US & Canada, meanwhile EU only gets support for organizations). I'd probably have to set up a SIA (equivalent of Ltd.) here first - it was in the plans for later, but this is a bit of a roadblock for using Azure too: https://azure.microsoft.com/en-us/products/artifact-signing
My tone might have been frustrated, but I will absolutely say that the code signing industry needs to have a Let's Encrypt moment of some description - at least commoditize it like Azure Artifact Signing was trying to do, but also for individual developers, across all platforms! Sadly, that doesn't seem to be possible when the platforms are intentionally walled gardens. I don't hate the idea of code signing, though - if done right, it's a good idea, same as TLS for (many) websites.
How does anyone who cares about open source or even development more generally see this and go "Yeah that's the OS I want to use"?
I genuinely don't understand why so many developers are willing to compromise so much for a thin laptop.
This was perhaps the biggest reason I moved to Linux full-time about a year ago. I just got sick of not being able to write software and have people use it. The solution might be an "I trust this author" VS Code style dialog and that's it, but even that misses the mark a bit. I've been having a blast building on Linux and miss almost nothing about macOS. And the things I do miss I write programs for [1][2] and give them to people. Who would have guessed that would ever be so hard.
So, Linux gets a free pass for requiring chmod +x to run his tool, but needing to run xattr on MacOS is somehow worthy of an entire blog post to complain about it?
Serious question - Is it really true that Windows 11 will run an untrusted .exe without a warning?
Ugh. I just went through this ID verification process yesterday and I got it to work on /maybe/ the 8th try. Truly horrible design. Now I’m in a paperwork exchange with some random third party to get the account associated with my LLC. It would be awesome to be able to just write and distribute software, but there’s only one iOS monopoly so what are you going to do but play ball.
1 year ago i would have agreed with you. Today, I'm going to take the other side on this. The amount of malicious code embedded in software now is going up exponentially. Yes this is a painful tax imposed on all software, malicious or not, but until they figure out a better system, this system actually will disuade a certain percentage of malicious actors to give up - ESPECIALLY having to pay a fee. As a mac user, i want to know if the developer has paid a significant fee to get this software to me. It a useful signal for me. If they didn't pay and didn't upload their passport, I really want think think hard about the risks involved for myself when I run this thing.
My favorite is when someone discovers they haven't yet granted Zoom screensharing permission, and that they need to exit the call to re-launch the application with the permission granted.
As a user I actually like Gatekeeper. 95% of the time it's not a problem. the other 5% of the time I have to click a button in my settings to allow unsigned code. But at least it gives me pause to think about the source and if I really trust it (which is mostly offloaded to Apple the other 95% of the time).
Free business idea: get an Apple developer account and then agree to sign code for other people in exchange for a small piece of their income. I'm surprised that doesn't exist yet (or does it?).
> I can use SmartID to verify my ID (and age) in about 20 seconds when buying an energy drink at the local grocery store
Where do you have to show ID for that??
I spent the better part of a week failing to create an Apple account using my studio domain - not even a dev account yet, just any account at all. In large part because of the "I got frozen out and can't talk to anyone" horror stories that pop up here monthly, and the fact that my personal account already needs to go through the "your account is locked" dance on a daily basis. My best guess is constant credential stuffing plus lack of any Apple mobile device.
The main creation flow wouldn't send a verification email, and there are hints around to try through Apple Music, which got me a little farther. At phone verification, I receive the code fine (on both numbers I tried), type it in, and get an inscrutable "error" that prevents finalization.
But it turns out it was final enough that even though I can't log in at all, they felt fine sending me Mother's Day email spam. Thanks. I'll be sure to FaceTime her.
Tangential but this made me appreciate how Gatekeeper is perhaps a notorious example of a great naming choice for a piece of software.
Sometimes I wonder why we don't just treat an installation script like curl https://alx.sh | sh as a universal option for distributing applications. The provenance is there via the HTTPS certificate, and if you're already about to trust an application that can compromise your system, why not trust the installation script as well?
It's interesting that sanctioned Russian banks still find the ways to push their apps into Apple repository by disguising them as a different app. They get removed several months later, but I assume it is done only because someone complains.
Funny how a $20 cert is enough to prove identity and provide security for any domain on the web, but in order to run a calculator Apple hw, Apple HQ is the only entity on the planet capable of such complex security.
It has been like this forever and periodically someone complains, but then they just go out and buy another mac and keep producing software for macOS. If you want this to change, stop providing financial support.
Apple's ID verification failed for me and I am now banned for life. There is no opportunity to appeal this or to ever participate in the Developer Program for me. Which sucks because I am now permanently locked out of developing seriously for any of the Apple ecosystem, ever.
If I am understanding this correctly, the $99/year Apple Developer Program allows you to notarize applications for macOS so users do not receive the warning/damaged binary dialog. I simply had AI generate the signing code, and you can run that script on any CICD or on your machine and push the artifacts to a CDN. Works wonderfully for macOS, and users of my app have had no issues with it.
Let me know by replying here if you want me to share the build+sign code or have any questions.
This is exactly the sort of paternalism which drove me away from the Mac in ~2015, after I'd been using Apple hardware for thirty years. It's just too much hassle for a casual developer; I'm stuck on the belief that it is my computer, not Apple's, and I should be the one deciding what I can do with it.
On a meta note, no one uses link pages like https://links.kronis.dev/NAnEME3Kqt any more. There are better ways of tracking clicks without obfuscating the destination page from the user.
Never upload your ID. If that means not developing for a platform, don't develop for that platform.
Try to open the file, say ok to the ‘can’t check for malware’ prompt, go to settings, security, approve running the software.
Annoying, but if you’re delivering your app to semi-technical users, not really a problem.
I went through this recently. Got as far as verifying my identity, which Apple happily accepted as verified from my UK driving license. Unfortunately, they then automatically set my first and last name from that identity verification step, and some how managed to use a section of my driving license number as my surname - a string of random uppercase letters and numbers - and it's impossible to edit it. So fuck them, that's $99 they've lost.
I don't get the part about Homebrew. If you're using Homebrew, it doesn't make a ton of sense to use Itch.io. Just use Homebrew. Seems like a more appropriate place to distribute a dev tool anyway. You could set up a patreon and print a link to it when appropriate. That's basically what Vim does.
I agree that Apple is dumb of course.
Apple's not making any money on developer subscriptions. I suspect they just want to have a velvet rope, to encourage folks to be serious about their work. They don't want farting-around toys. They want developers to ship serious apps.
There'$ a rea$on that $o many people want to relea$e Apple app$. A $uperb rea$on.
It's a really lucrative market. People like to have access to customers that are used to paying a lot. One of the reasons those customers want to pay more, is that walled garden that HN members hate so much, but millions of people have no issue with (whether or not that's a good thing, is not for me to ponder. It just is).
99 bucks is peanuts. It does give you access to the entire suite of Apple tools. Anyone interested in shipping serious software, is likely to far exceed that, in the non-Apple (or Apple hardware) tools that they use to develop the software. Heck, your keyboard probably cost more than that. I remember that we used to pay Microsoft over $4,000 a year for their developer program.
Here's what Apple says about it[0]. That's what I usually do. I think someone else has shared the command line method. If it's a developer tool, then it would probably have a difficult time passing Apple's app review process, anyway, and that will really jangle your cortisol pipes.
[0] https://support.apple.com/guide/mac-help/open-a-mac-app-from...
I am not entirely against the whole notarization thing.
If it is good for the end-user, it is usually also good for the ecosystem a a whole, trust is valuable.
But ffs, they are rich enough to make this a lot less painful and hostile for developers.
And this is not a new thing, I used to develop games for iOS, from the very beginning, and while the process somewhat simplified over time, it was a huge cortisol inducing process, not to mention the regular forced OS+SDK updates where the procedures changes almost every time and could fail in not-so-evident ways.
distributing for macOS is extremely hostile and Apple continues to extort developers through fees, yearly subscriptions, and of course taking 20-30% in transaction sales.
This made me think of a potential workaround that would have a better UI: create a directory (maybe named 'Trust Zone'), and have it watched by something like automator. As soon as you move a file in there, it reacts and remove the quarantine bit on that file.
The enrollment app on Mac OS feels like a second citizen. I think Apple is slowly giving up on ensuring the experience on its own Mac apps is working as well as on iOS. I hope to be corrected now that the Macbook Neo is more popular, but I won't be holding my breath.
All that, and not a single one here is surprised at zero days or trojans or malware that come right out of this process every week.
If it works, then why aren't we surprise when it doesn't?
Because we know it doesn't work.
It seems like running with sandbox-exec should remove pretty much all the potential for an app to cause harm… is there a reason why it’s not the default, especially for these certificate-less apps?
Maybe I'm too dumb, but I haven't figured out a good way to sign just a binary (or a tar/zip containing a few binaries). I zipped up the binaries, sent them off to Apple, Apple comes back and says "yup, notarized!", and they still trigger the popup. I'm probably missing a step. I guess I'm not currently stapling the ticket to the binary, but supposedly you don't have to if you are running with a network connection.
> I'm sure that other countries also have plenty of similar services for ID and age verification
laughs in Bundesdruckerei
desktop & mobile software is run by a cartel.
they can charge you $99/yr cz they know you ain't got choices.
which is why web software is a blessing. web software runs without permissions from the gatekeeper.
That’s nothing, Google charges $900-2600 / year if you want to write an app that calls the google apis for user data
it’s as if apple forgets that some of it’s user base are people who scrap together money over long periods of time just to have a chance at affording a mac only to be told they need $99 to distribute an app. your entire user base isn’t 100% affluent people and apple doesn’t seem to grasp this
Pains me to say this but as a developer, microsoft is a whole order of magnitude better than apple
Is there no open source collective one can join which will share signing keys and handle signing?
I love when my Mac declares random PDFs malware and deletes them when I try to open them.
On two occasions I've been completely dumbstruck when the software I was using was deleted out from under me. I'm not a fan of the overuse of "gaslight", but it sure felt like that when I had to restart Docker and the OS was like "what do you mean, Docker? You've never had Docker installed! What are you talking about? Are you feeling ok?"