Hacker News new | ask | show | jobs
by zimpenfish 1944 days ago
IIRC, from vague memories of things flying past, Big Sur won't let a modified binary run once it's been checked by Gatekeeper. Which means the first run gets checked and notarised but when you add the `index.html`, the on-disk binary has changed and Gatekeeper won't allow it to run - I guess it's to prevent malicious code modifications, etc.
6 comments
easton 1943 days ago
It looks like you can get around this by adding Terminal.app as a "developer tool" (i.e. it can create processes without hitting Gatekeeper), maybe that works? (once I did that and relaunched terminal, I can run cosmopolitan binaries).

https://docwhat.org/upgrading-to-catalina

link
jart 1944 days ago
Oh wow that's good to know. Maybe you have to do something like `cat foo.com >foo2.com` after you've modified it with the zip tool.
link
anderspitman 1943 days ago
Thank goodness AAPL is here to protect us from doing cool stuff.
link
oscargrouch 1943 days ago
Its good from a security perspective, but also its a nightmare to know that the mothership knows everything you run on your machine.

This will also prevent distribution from outside of their appstore giving it will prevent updates.

So as anything Apple, the world security here is being used as code for personal machines remotely controlled by the mothership.

You trade privacy and freedoms for a little convenience.

link
zimpenfish 1942 days ago
> This will also prevent distribution from outside of their appstore giving it will prevent updates.

I think that if an app is correctly codesigned, Gatekeeper has no issue with it. Also if it's not correctly codesigned but you've ticked "allow unsigned binaries", you can still run them.

> the mothership knows everything you run on your machine

I can't remember the details from the last time this came up but IIRC it only sends a hash and possibly even then only the first time you launch it. Either way, they're not going to block out-of-appstore distribution except if you're a known malicious actor.

link
safeaim 1943 days ago
Yeah, but this isn't Big Sur, it's Catalina. But maybe it's the same protection there as well?

The binary didn't work on Ubuntu 18.04 nor CentOS8 either, but I'll report a issue later on today.

link
Wowfunhappy 1942 days ago
What happens if you switch off Gatekeeper?

`sudo spctl --master-disable`

link