Hacker News new | ask | show | jobs
by jaredklewis 41 days ago
I don’t disagree with your post but I’m still unclear on how you envision gatekeeper should work.

You want the ability to choose a different “authorities” that verify and sign binaries? That makes sense to me but is unlikely to relieve any of the issues in the post.

Also what do you mean by “even yourself?” What would that option look like?

2 comments

Right next to where Apple's root CA is, you add your own.
Yea, that makes sense to me. But again, would not address most (any?) of the complaints in this post.
You could like, just trust a single binary. Have a button right there in the popup that already shows up.
Maybe “Gatekeeper Light” hidden under advanced settings would satisfy everyday users + the technical crowd

For plenty of users, a button right there in the popup is almost the same as no Gatekeeper for most scenarios, but if we can handle it why not let us

Isn't that what right clicking and selecting Open does?
They disabled the right-click-and-select-open feature; you now have to go to Settings to run the app.
Oh, that sucks.

In any case, Gatekeeper is mostly intended to save grandmas who are at risk of downloading random malware from the internet.

If you're a developer who is reasonably aware of how computers work you might as well disable Gatekeeper entirely. You're taking many times more risk every time you use Terminal.

Nowadays (as of Sequoia, I think), I find that I need to run `xattr -c Foo.app` to clear the “this was downloaded from the Internet” bit on the application bundle before I can right-click, “Open” it. Used to be that you only needed to do that with .apps extracted from zip archives, but it seems to apply to .apps copied out of disk images (DMGs) now, too.