[ctmnt]

This looks cool enough, but it’s starting to drive me crazy how people are in such a rush to put out their macOS apps they can’t be bothered to get a developer account and run a one line command. It’s not hard.

I used to be sympathetic to complaints about not wanting to pay the developer account fee. But when you’re vibe coding, you’re probably paying a good chunk of change to your LLM supplier of choice every month, and the yearly developer account fee seems minor in comparison

Also, it’s just such a bad security precedent. This page describes the error you get as “the typical macOS Gatekeeper warning”, as though it were just another piece of corporate silliness, like clicking through a EULA.

[0x3f]

If you don't want your name, address, phone number on public display you need to either set up a company or set up some forwarding. If you set up a company, you'll need to get a DUNS number. If you haven't done it before and don't know about the secret shortcut way to do that, it is very annoying to get one.

Anyway, I don't see a problem with getting it out the door. People can just choose not to install it if they don't like it. I mean that's the whole idea of being early anyway, isn't it? Don't like a crappy bodged together UI? Don't like a lack of support? Don't like an unsigned app? You can wait until it has those things according to your preferences. In the meantime, the creator gets real users and feedback ASAP.

[mgrunwald_]

Thank you for saying this! As stated on the website, this is a pre-release. Those who are not sure, absolutely do not have to install this and can wait for the official, notarized release. In the meantime, the app gets tested in the real world.

[throwaway290]

It's free so why not just publish it on github then so that people could read the code and compile it themselves.

Right now it's closed source binary with a big fat "DOWNLOAD FOR FREE" button and instructions casually telling you to disable the last barrier between your system and persistent malware. Nobody should recommend this to anybody

[0x3f]

Well, depends what the author's plans are for the future. Maybe it's not always going to be free as in beer, either.

[mcjiggerlog]

You don't need to do any of that to sign and notarize an app that you are distributing yourself.

[0x3f]

You do if you don't want your legal name in there, as I said.

[coffeecantcode]

Still unbelievable that they require a DUNS number and not a simple EIN, that fact alone set our app launch back weeks.

[cyberge99]

It’s a one time inconvenience that filters out most mid level scammers. It’s a small price to pay for a reasonably clean App Marketplace.

[bennyp101]

"don't know about the secret shortcut way to do that, it is very annoying to get one"

Is that a US thing? Because in the UK you just get one for free - Companies House sends the info over to them, and a couple of days later it is available to search

[vyaa]

Secret shortcut?!?

[michaelmior]

This article[0] provides some details. Basically if you go through the lookup process on Apple's website and you don't have an existing D-U-N-S number, you can request one from D&B for free via Apple.

[0] https://support.pushpay.com/s/article/Acquire-your-D-U-N-S-n...

[0x3f]

I don't know how obvious it is these days, but the default path through D&B's website is the terrible one. They will try to extract money from you and harass you forever. You had to find Apple's own embedded form for it by using their search and going through some flow.

[vyaa]

I’ve done it! I’ve gone through the D&B website years ago and i remember it sucking. Don’t know when I’ll need to do it again but this is good to know. Thank you!

[malshe]

I just recently did all of this but the experience was not as bad as you are describing here. I got my DUNS number in 10 minutes. The only challenging part was using a Google Voice number for the account because there was an issue with the way I had created the business Apple account.

[jrmg]

don't want your name, address, phone number on public display

Where are these displayed?

[marci]

when you sign an app with your personal dev account.

[haswell]

The way I read that question was: where can other people see this information about me once I’ve published the app? i.e. say I just published an app, where would you navigate to find this info?

[0x3f]

If you sign an app your legal name gets embedded into the .app bundle. You can use e.g. `codesign` in the terminal to read it back, or if you publish to the App Store it will be in the UI, along with the others.

[haswell]

I've seen individual developer's names in the App Store, but the parent comment is also claiming that Address and Phone number is published. I've done a bit of digging, and can't seem to confirm this.

[glitchc]

What's the secret shortcut way to set up a company in your jurisdiction?

[moralestapia]

>secret shortcut

I see vagueposting has found its way into HN.

[0x3f]

I haven't done it in a while, so didn't want to give out possibly wrong directions, but:

> I don't know how obvious it is these days, but the default path through D&B's website is the terrible one. They will try to extract money from you and harass you forever. You had to find Apple's own embedded form for it by using their search and going through some flow.

[malshe]

I think your information is very much outdated. You apply for DUNS number with Apple. I didn't have to go to D&B's website nor I had to pay anything to anyone for it.

[mgrunwald_]

Gatekeeper and notarization are not silliness. They exist for a reason. I thought it would be a good idea to release the app during development when I am sure that it works correctly and then maybe get some feedback from early users.

[LatencyKills]

Ex-Apple macOS/Xcode dev here.

I just downloaded your app and ran it through hopper. There is a LOT of embedded Apple Script. I would never run an app like this with SIP disabled or without an active network blocker.

Your app requires direct access to major OS components: code signing, even during alpha should be a requirement.

[s3p]

I guess OP's point is still pretty valid though, what's the harm in signing and notarizing it?

[12345hn6789]

Sir, your car cannot access these roads. Please upgrade to the latest model.

[pdntspa]

They aren't silliness, they are levers of control and loss of freedom

[cyberge99]

They are also a barrier to entry that keeps some of the riff raff out.

[pdntspa]

Yes let's just destroy so much of what makes computers great and freedom free so we can pander to the illiterates

[71bw]

The truth is that Gatekeeper should go the way of the devil.

It is my machine and I paid for it, why does the OS care about what I do with it? The only thing this leads to is making sure your customers grow into good little lemmings.

[piva00]

You can do whatever you want if you are a power user, the tools are there to get around Gatekeeper.

For everyone else it's probably sane to have it, works as a decent filter so someone not tech-savvy don't get hurt by installing malware disguised as an app, one would just need to state incredible features that almost any normal user would like to have, and make them click to install. Gatekeeper diminishes that risk by a lot unless you learn how to bypass it, which requires you having decent skills and probably wouldn't fall for the bullshit that malware apps try to bait people with.

[jacobrast]

So that you don't accidentally run malware. MacOS is not iOS, you can run unsigned code if you really want to, but it will make you jump through a few hoops.

[71bw]

How is this better than trying to eliminate the problem between the keyboard and the computer? The user won't learn if the computer handholds them through everything.

[anamexis]

Because the vast majority of users have no interest in learning how to safely vet apps and just want to easily use their computers and not worry about malware.

[bigyabai]

That goes for the malware on the App Store too, though: https://blog.lastpass.com/posts/warning-fraudulent-app-imper...

[alsetmusic]

> The user won't learn

Full stop. I still talk to people every working day who don't realize that rebooting a computer is actually a real troubleshooting step. They seem to think it's bunk tech support mumbo jumbo rather than a genuinely useful step. It's 2026 and they're still surprised when that works.

[whimblepop]

> They seem to think it's bunk tech support mumbo jumbo

It indeed is. It's a way of coping with systems that are fundamentally illegible and unpredictable. If you have full rights over your machine and you're not running extremely shoddy software, you should never have to reboot your computer to make an issue go away. And rebooting your computer often guarantees that you'll never actually understand whatever issue is plaguing you.

Encouraging people to reboot their computers is promoting a fundamentally superstitious mode of engagement with machines that are generally reliable and predictable, instead of approaching them in terms of cause and effect. At best, it's the tired point-and-click sysadmin's workaround for not knowing what their system is doing.

Maybe for overwhelmed IT departments running half-baked operating systems loaded to the gills with invasive and meddlesome corporate spyware suites so inherently complex and complicated in their interactions with each other that the system itself is rendered more or less incomprehensible (even to the people administering it), just asking users to reboot is the right play to write in the tech support playbook. Maybe it's got the right ROI for a geek reluctantly roped into giving free tech support for a relative. But it's absolutely mumbo-jumbo and a sign that the "troubleshooter" is probably either ill-equipped to understand what's going on or just not interested.

[alsetmusic]

Sure, if you have full rights. I run my computer for weeks at a time without rebooting. However, at my employer, where there is very little control, it’s a different story.

About two weeks ago, some Adobe Acrobat update introduced a hang that results in “Acrobat won’t open.” Open Task Manager and there’s four to eight stuck processes. Kill them and it works again most of the time, but once in ten it simply doesn’t recover.

Adobe acknowledged the issue to someone on my team. There’s no need for me to understand further; telling the user that a reboot will solve it is prudent advice. It’s on Adobe to fix it. You made assumptions about the environment where I tell people to reboot without understanding the conditions and I have an immediate real world case demonstrating why your statements don’t apply.

[piva00]

The user also shouldn't need to potentially suffer massive financial impacts from not being good enough at using a computer... Even more if it's a problem that can be solved by the computer itself as it's done already.

It's like you are saying that potentially dangerous tools shouldn't have safety guards whenever possible, with little impact for the common use of the tool. Kinda absurd to think that way... If some advanced use-cases require safety guards to be removed that's when the user should be trained enough to know the risks.

People want to use a computer for their tasks, the whole motto of Apple was to make technology accessible to normal people without requiring them to be tech-savvy, what you want goes in complete opposition to that mission.

[leshenka]

I really don't understand what the issue is? Gatekeeper is merely a warning that introduces a minimal friction if what are you trying to run is created by an entity that chose not to present itself. It only happens once per application, not per launch. I've spent more time reading this thread than I have removing quarantine flags in the last five years.

Apple has a lot to be criticized for but gatekeeper (and SIP) isn't that.

[cyberge99]

Exactly. It’s a security checkpoint and auditing tool, like sudo.

[newsclues]

I want to be a power user on my Mac, I don’t want my mom’s Mac to function like my devbox.

People like and need the apple sandbox. Others need an unlocked *nix machines

[TeMPOraL]

It's fine as long as both exist and third parties are not allowed to know which one you're running.

Otherwise, you have banks and MAFIAA and others off-loading their own security and compliance costs to users by flat out discriminating based on the status of the sandbox.

[71bw]

Exactly. We won't have "hardware integrity" and other such freedom-limiting factors going the way of the dodo anytime soon if we keep handing the organizations trying to estabilish those systems ourselves lubed and ready to go.

[whimblepop]

Perhaps the feeling is (at least sometimes, if not here) mutual. Some free software developers make apps for themselves and don't particularly want users (and least of all non-technical users that they'll be expected to support). They may not be interested in participating in Apple's system of obstructing software installation, especially if they just write their software for themselves.

I've never ended up with undesired software on my system except for under two circumstances: either (a) it's installed by the OS vendor, or (b) some proprietary indie software I used got bought by a shady company who now wants to spy on me and sell my data. Systems like Gatekeeper don't protect against either.

> Also, it’s just such a bad security precedent. This page describes the error you get as “the typical macOS Gatekeeper warning”, as though it were just another piece of corporate silliness, like clicking through a EULA.

It mostly is another piece of corporate silliness. For most people it rarely does something useful. But I agree; if you're courting normie users you should just pony up and get your code signed and notarized. Otherwise just tell people that if they don't already know what Gatekeeper is and understand the risks of bypassing it as well as how to do so, your software isn't for them.

[jasonvorhe]

The fewer apps make me depend on proprietary app stores the better. Just make it a homebrew cask and you're good to go. If I were to develop macOS apps (vibed or not, whatever) I wouldn't want to pay Apple either nor jump through KYC and review hoops.

[karimf]

Totally agree. There are significantly more new apps being released. I've been visiting the /r/macapps subreddit and they're having trouble filtering new submissions. I generally like the direction that they're taking https://www.reddit.com/r/macapps/comments/1ryaeex/rmacapps_m...

Even though it's more troublesome to submit apps to App Store, it's one signal that the app is not a malware.

[g947o]

Wow, this subreddit looks like the apocalypse of vibe coded projects/apps. Kind of similar to what happened to "show HN". Too many ideas, not enough problems to solve, and likely bad implementations. The result is that nobody uses any of the apps.

In AI conversations, people often forget that at the end of a day, an actual human needs to use your stuff.

[user3939382]

Gatekeeper is a travesty and assault on user freedom. Apple should not be in charge of what you run on your computer, at all. Any exception to this should be opt in. If a user wants to insert a third party between themselves and a programmer they can elect to do that.

Let’s not forget when Apple’s certificate server was down and suddenly you couldn’t launch apps on macOS, to say nothing of the abuse of user rights.

[drfloyd51]

Users used their freedom to choose macOS. Gatekeeper is a desirable feature. They opted-in with their purchase.

[foltik]

Speak for yourself, I used my freedom to disable it.

[hspmn]

you're saying security should be optional and up to users?

lol

[user3939382]

Suggest you read up on the Free Software Foundation if you’ve come to equate security with someone else controlling your machine without your consent.

[thisislife2]

> they can’t be bothered to get a developer account and run a one line command

I applaud that they didn't kowtow to Apple's attempt to exercise control over their app and extort money from them. Why should we accede to policies that are designed to exploit us developers?

We developers add the real value to a platform. Don't believe me? Look up on how popular Sailfish OS or Windows Mobile OS is and why they failed or struggle. Apple should be grateful to this developer that they seek to add value to their platform instead of trying to figure out money grubbing ways on how to control and exploit them. (Of course, ultimately it is the users of the platform who are exploited - all charges by Apple are ultimately bore by them when they purchase an app through the App Store).

It's just sad that whether you are a user or a developer, Apple Fanbois would rather (ignorantly) place Apple's interest over their own consumer rights.

[fredoliveira]

> It's just sad that whether you are a user or a developer, Apple Fanbois would rather (ignorantly) place Apple's interest over their own consumer rights.

You think notarizing an app is "placing Apple's interest over" our own?

[thisislife2]

Yes, how notarisation works currently on the Apple platforms is designed more for Apple's benefits than an Apple developer's or user's interest. When notarization can only be done through Apple, they have undue control - for e.g. they can ban any app that you create on their platform. Bad for malwares for sure, but not good when some government or Apple decides they don't like your app. Remember that all App Stores apps are ultimately signed by Apple, not by the developer who creates it (the developer signs and uploads the app, and Apple replaces the signature with its own). Self-signing an app also require you to get a "free" developer certificate through Apple by first signing up to their developer program and agreeing to all their overbearing terms (which they use to force themselves as a middle-man, to exploit both their developers and users). A self-signed notarized apps generates two sets of hashes - one which is stored in the app and one in Apple databases for "verification".

Thus, notarization also acts as a way for Apple to spy on its user and determine what apps they run - both when you install from the App Store or when you install it from outside the App Store. The way the whole process works, open source softwares (which are popular and compete with Apple's own app and other paid apps but often cannot bear the unnecessary burden of jumping through Apple's hoops) are also tarnished with all the popups about security threats, thus discouraging their use amongst non-technical users. This is great for Apple ofcourse because they can't make money of free open source developers (unless of course, they use their code to make their own applications, which they have no qualms about).

Imagine this too - How would you like it if Apple allowed you to view websites in Safari (or other macOS browsers) only if they had an SSL certificate from Apple?

So it is a disingenuous argument that people here are being "stupid" for complaining about Notarization. It's Apple forcing itself as the middle-man here and then exploiting its developers and users that's the issue.

[eviks]

> and the yearly developer account fee seems minor in comparison

Do you not realize that spending money on other useful services makes it harder, not easier, to waste on dev fees?

[seany]

Gatekeeper should be banned. It's my machine, let me use it

[IncRnd]

You can just click to run the app. Gatekeeper doesn't stop you from running apps.

If you really want to ban Gatekeeper you can. sudo spctl --master-disable

As the saying goes about being careful, measure twice and cut once.

[seany]

A bunch of things break when you do that, though I do run my osx machine that way. The point is that it shouldn't be the default, it's the end of personal computing.

[pdntspa]

> as though it were just another piece of corporate silliness,

It IS another piece of corporate silliness. Though silliness is an extremely charitable word for what it really is

Cheering on the loss of autonomy and control over our own computers under the guise of 'silliness' is disgusting

[foltik]

Except it is just another piece of corporate silliness.

Why don’t you purchase your own developer account and sign it yourself if you trust it? Or are you saying them paying Apple $100/yr in perpetuity is what will make you trust it?

[IncRnd]

A signed executable isn't for trusting the app. It's for knowing the provenance of the app. Sure, there are some application checks that happen before listing a store app, but those checks are minimal.

[foltik]

Signing proves someone pays Apple $100/yr. The "provenance" you're getting is literally just the billing info.