Distributing unnotarized Mac apps in a text file (opens in new tab)

(lapcatsoftware.com)

114 pointssockmeistr5y ago11 comments

11 comments

9 comments · 3 top-level

jtbayly5y ago· 5 in thread

TextEdit is a wealth of problems it seems.

Only if you consider a computer, owned by a user, following that user's explicit command to run a piece of software (without further hindrance) "a problem".

It would be nice if the rest of the macOS respected the wishes of the hardware's owner equally.

gumby5y ago

Not really. In an attempt to use some DWIM to avoid surprising the user (“Text”Edit supports styled text not just in RTF but HTML) they introduced a bunch of new surprises (opening a seemingly inert text file actually allows code injection). It’s hard to say that this is clearly respecting the “wishes” of the hardware owner (I suppose the hardware owner might have wanted this, as per the article’s example, but surely that is the minority).

They don’t stop the hardware owner from opening the file in an actual text editor such as Emacs or vi.

And you can still download and run anything you like from the net, though by default they add roadblocks anyone can simply move aside. That’s probably the right thing: in my extended household of 9, really there are only two people downloading arbitrary binaries from the net and running them. And neither of us disables gatekeeper.

Wowfunhappy5y ago

It does, the hardware owner merely has to tell macOS what it wants. Open a Terminal and type:

    sudo spctl —-master-disable

And you’ll be able to run as many unnotarized apps as you wish, just by double clicking them.

However, if the hardware owner wants to disallow unnotarized software, macOS should enforce that policy.

1 more reply

1MachineElf5y ago

>It would be nice if the rest of the macOS respected the wishes of the hardware's owner equally.

Who the real owner is is going to depend on how Right To Repair initiatives work out.

jtbayly5y ago

TextEdit is great. Don’t get me wrong. But pretending like the security problems it has are a feature explicitly requested by the user is... bizarre.

ryandrake5y ago· 1 in thread

This is a neat hack, but is there a practical use case here for everyday software developers? I sincerely hope that even novice users have better sense than to download a text file from a web site, find a sketchy ZIP file inside the text file, and then follow directions in the text file. It's like downloading a movie from a sketchy web site and in the package you see a RunMe.exe file. The whole thing reeks of red flags that should tell even moderately sophisticated users "This is malware".

soulofmischief5y ago

I don't know about you, but I've been embedding data into images and sharing them for nearly 20 years. My target audience knows how to correctly consume these files.

Don't coddle the user.

rmorey5y ago

This is pretty brilliant, well done

j / k navigate · click thread line to collapse