8 ms·

macOS gatekeeper and file quarantine bypass

351 points by robertkrahn01 5y ago

deleted 5y ago
[deleted]
tehwebguy 5y ago
Does this mean we can trick Big Sur into not treating TypeScript files like DVD rips?
smoldesu 5y ago
Gatekeeper is one of the most frustrating things I have to fight whenever I try using MacOS. It feels like DRM for my applications, which in turn makes everything feel clunkier, and less integrated. I would genuinely pay Apple extra for a version of MacOS that just trusts me and lets me install what I want without the some esoteric mechanism stopping me at every step of the way...
- minhazm 5y ago
  You can disable Gatekeeper. https://disable-gatekeeper.github.io/ https://disable-gatekeeper.github.io/
- kstrauser 5y ago
  What frustrates you about it? I rarely bump into Gatekeeper and I'm doing the normal dev things.
  - Isthatablackgsd 5y ago
    I'm assuming you don't use the package manager like Homebrew or MacPorts? this is where the gatekeeper will annoy the hell out of me. Apps installed via Homebrew often will encounter Gatekeeper alerts. Half of them will give the option to open it and the other half, the gatekeeper --demands-- gently ask me to put it in the Trash without the option to open it.
    - lilyball 5y ago
      Homebrew and MacPorts don't add the quarantine flag to the software they're installing. If you're getting Gatekeeper alerts for software installed this way, then something else must be going on.
      - saagarjha 5y ago
        Homebrew Cask does.
    - herrkanin 5y ago
      I'm using homebrew all day long, and I don't remember ever having this issue.
      - xrisk 5y ago
        Homebrew cask.
        ezfe 5y ago
        I use Homebrew Cask and don't run into any unusual problems with Gatekeeper. The flow is always the same as if I manually downloaded it (meaning I sometimes get a prompt on first run, but that's expected).
    - breakfastduck 5y ago
      You need to disable gatekeeper like shown in another of the comments. It’ll permanently create a new option in your settings to allow installations from “anywhere” too.
      - Wowfunhappy 5y ago
        Nitpick, I don't actually think the option in System Preferences is permanent? Is it still there if you change it back and restart System Preferences?
  - lovelyviking 5y ago
    Sometimes I compile my program and when I move it to the Applications folder and trying to run MacOS says, you do not have permission to do it. May be it's not a gatekeeper, who knows. The keyword here is sometimes This is what I Love about current state of MacOS. To fix it nothing works until you delete it completely and only then if you lucky etc ... It just reminds me those old good days with Microsoft many years ago. Turn it off then turn it on few times .. it may work ...
    - mlindner 5y ago
      I've always found it to be extremely consistent and never does anything strange like you're describing. Works for me.
    - Klonoar 5y ago
      Is this an Xcode project, or something outside of it? I regularly build both and have run them in the same way you're talking about here, without issue... the latter migth be a bit more nuanced, but when set up properly does work fine, so I'm inclined to think this is more a problem with how you're doing things.
      - lovelyviking 5y ago
        Yes it's pure XCode project, that I regularly build it and run in the same way. Who would expectg such sequence right? And no! it doesn't work fine all the time, because sometimes it doesn't as I desribed. And I do not bother to deeply search for the cause of it unless I must for my project and also because Apple would not pay me for that and next version would have another stupid bug anyway. "I'm inclined to think this is more a problem with how you're doing things." Of course, who would expect to see bug in XCode right? I'll tell you the secret, this is not the first bug I've spotted in Apple product during 10 years. Honestly I do not even know what their QA team is doing if I can find few bugs manually within 10 minutes of usage ... Yesterday I have found another one with sound system, because they didn't thouhgt about one scenario in their logic. They really should spend their money on people like me instead of wasting their money on QA team that doesn't work properly :) ...Or perhaps I should take a look at their QA team to spot bugs in their working process ))
- Wowfunhappy 5y ago
  Then turn it off. Open the Terminal and run: sudo spctl --master-disable That's it, it will never bother you again, unless you turn it back on or reinstall the OS from scratch. If macOS is still too limiting, you can also turn off System Integrity Protection, at which point you can do just about whatever the heck you want. I personally kept both Gatekeeper and SIP turned off, back when I used modern macOS. But if they are turned on, they ought to work.
  - joshspankit 5y ago
    Does turning those off still leave the logs redacted? Or do you also have to install the profile after you tell it to get out of your way?
    - Wowfunhappy 5y ago
      I don’t use Big Sur but I don’t think it has any affect on logs. Without SIP, you could patch the kernel or something and change whatever you want, but that would of course be nuts. I share your curiosity. If your computer isn't already managed, installing an MDM profile in order to view logs is ridiculous. I don’t even think there’s a way to do it without paying money.
      - comex 5y ago
        That page is somewhat misleading. MDM is one way to install configuration profiles, but you can also install them by hand. No signing required, either. You can just stick that XML in a file with extension .mobileconfig, then double-click the file, and it will prompt you to install it. Or download a signed version from here (not my site): https://georgegarside.com/blog/macos/sierra-console-private/enable-unified-log-private-data.mobileconfig https://georgegarside.com/blog/macos/sierra-console-private/...
    - azinman2 5y ago
      That has nothing to do with log redaction. That's to prevent private data escaping apps and either being sent to Apple or readable by others. You want that on.
- cloogshicer 5y ago
  Agreed. It's ridiculous that we can't even fully disable it in the latest macOS releases (the commands others posted below don't work in Big Sur to completely disable quarantine). Thankfully there is a simple workaround: https://hiringengineersbook.com/post/disable-quarantine/ https://hiringengineersbook.com/post/disable-quarantine/
  - Wowfunhappy 5y ago
    Note, the single command does turn off Gatekeeper. File quarantine is separate and needs a separate command. That is as it should be IMO, they’re completely different things.
    - cloogshicer 5y ago
      Right, but do you know if there is a command to actually turn off quarantine? I mean really turning it off, not just removing it from already existing files. To my knowledge, that doesn't exist.
- fiddlerwoaroof 5y ago
  Apple has been moving toward a capability-based security model for a while now, I think: it’s a bit annoying because their implementation also acts like DRM, but I think the mode itself is a better security model than standard POSIX file permissions and ACLs
- gdavisson 5y ago
  It's not that macOS doesn't trust you, it's that macOS doesn't trust the programs you're running. Specifically, it doesn't trust the programs to do what you want them to, and only what you want them to. And it's not just a matter of protecting you against out-and-out malware (although that's certainly part of it), it's a matter of protecting you against developers whose interests don't entirely align with yours. Developers who really want to spy on their users seem to be the biggest group (see, for example, the recent Apple vs. Facebook kerfuffle). Unfortunately, distrusting software does add friction, especially if you add (/update-via-unsupported-mechanisms) new software frequently. "Are you sure you meant to run this program? It looks weird to me; I think you should get rid of it. Should it really have access to your contacts/camera/etc?" macOS is acting a little like an overprotective parent here, and it's certainly annoying. But the threats it's trying to protect you from are real. You can turn the protections off (with a certain amount of work), but then you're vulnerable to all the stuff it's there to protect you from. P.s. I don't mean to completely defend Apple here. Their preferred solution is to have all software distribution go through their App store... where they get a cut of the price. Which means they're also on the list of developers whose interests don't entirely align with yours.
  - kevincox 5y ago
    This is a weird way to justify it. I told macOS to run that program because I trust it. If macOS trusts me then it transitively trusts the program I told it to run. In other words macOS doesn't trust me to validate programs before I try to run them.
  - smoldesu 5y ago
    I understand what Apple's intentions here are, but abstracting away a security risk is only inviting disaster, and it's kinda endemic of an issue throughout Apple's ecosystem: their whole game is about reducing the power of the end user. It makes sense from some angles, security being one, but it also impedes the freedom of choice. Instead of engineering their software to appeal to the lowest common denominator, they should be empowering people who want to push beyond that envelope and offering extensibility to those who want to take advantage of it.
lovelyviking 5y ago
>But first, go update your macOS systems to 11.3 Unofortunately the risk is to high. Last time I was trying to update to 11.2 my MacBook M1 showed black screen with instruction to find another Mac. During Covid situation I had to endanger myself with going to look for this 'another' Mac. No thank you very much. Not possible for now, who knows will it stuck this time or not. I do not wish loose my ability to work again. Looks like to update safely you need to have another Mac. I mean if you for sure wish to get the guaranteed result. BTW, I was reporting about this situation over here and about my surprise to the amount of bugs I have stumbled on . For those who was fast to suggest that there is some hardware issue with this specific machine - you were too fast to suggest something that you wanted very much to be the case. I leave it to your karma why you wanted it but No hardware issues have been found so far till this very day. It passes all tests including speed tests. All of the problems were software bugs and issues. All of them were perfectly known when you search the info about them. For instance ScreenShot was slow when Mic was selected as sound input source for Screen Video Recording. ScreenShot have nothing to do with Mic as far as I know because no sound is recorded in ScreenShot last time I've checked :) and yet it was slow because of that(I guess it was trying to initialize the Mic for each screenshot). Once you select None as sound input source for Screen Video Recording the ScreenShot works again quickly like it supposed to be. If this is not funny then what is? And it's very known problem if you google it, yet some people were donwvoting even that! Some people do not like facts it seems. So I state again what I was stating back then. It's so far the buggiest Mac I ever had.
kossTKR 5y ago
Does anyone know how trustworthy this objective-see project is? I remember once installing several of his apps, but then coming to the conclusion that i don't know enough - even though he consistently seems to find and fix flaws in OSX. Why isn't Apple hiring this man? EDIT: Why are people downvoting this question? If i'm implying something then i'm unaware of it.
- savoytruffle 5y ago
  Some people don't want to be coerced into working remotely near Cupertino …
  - kossTKR 5y ago
    And that's fair, i wouldn't either, what i mean is they should seriously consider giving him some consultancy fees, bounties / whatever since he's consistently doing good work.
  - jrochkind1 5y ago
    i don't get it
- ghughes 5y ago
  The tools are legit, and the bugs are real, but he has a distasteful habit of feeding sensationalist quotes to outlets like Forbes and Vice. This time, he told Forbes that "the hacks effectively take Mac security back a decade" [1], and Vice quotes him as saying "this is likely the worst or potentially the most impactful bug to everyday macOS users in recent memory". [2] Forbes ran the story with the headline "The ‘Worst Hack In Years’ Hits Apple Computers", and that's bullshit. 1. https://www.forbes.com/sites/thomasbrewster/2021/04/26/update-your-mac-now-the-worst-hack-in-years-hits-apple-computers/ https://www.forbes.com/sites/thomasbrewster/2021/04/26/updat... 2. https://www.vice.com/en/article/wx5855/massive-mac-apple-security-bug-malware-hack https://www.vice.com/en/article/wx5855/massive-mac-apple-sec...
  - kossTKR 5y ago
    Thanks for the insight! Seems like quite a talented dude but with the mandatory eccentricity that seemingly often comes with . Great to know that the tools are legit.
pehtis 5y ago
I will never understand why "Show all filename extensions" is unchecked by default in Finder.
- benhurmarcel 5y ago
  Unchecked by default is fine, what bothers me a lot is that it's impossible to display filename extensions on iOS/iPadOS.
- Closi 5y ago
  It's also unchecked in Windows by default - I suspect that in reality the concept of extensions probably confuses some users, who end up changing the extension and then struggle to work out how to open their saved files. ( I always prefer to see the extensions too though :) )
  - symlinkk 5y ago
    This is an outdated mindset. Literally everyone knows the difference between .docx and .jpg in 2021.
    - inb4_cancelled 5y ago
      You're living in a beautiful bubble.
  - setr 5y ago
    Windows gives you a big warning when you change the extension, which seems to me both sufficient and better than hiding the extension altogether (which, like URL hiding, is a fairly dangerous and largely unnecessary convenience)
    - judge2020 5y ago
      I've learned to never underestimate users' ability to shoot themselves in the foot. People will click through any popup dialogue which might suggest that their decision to perform an action was wrong.
pier25 5y ago
Did Apple finally fix the bug where every Big Sur update nukes Xcode tools like Git?
- ezfe 5y ago
  No problems here - I'm on beta cycle so I get new Big Sur updates fairly often (every few weeks) and haven't had any git issues.
jdlshore 5y ago
Fascinating article. Short version: there was a bug in the part of Apple’s Gatekeeper code that checked whether a file was an application bundle. Bundles that only contained a script, and not a plist file, were considered “not a bundle,” and this bypasses the Gatekeeper checks. The issue is fixed in the latest version of Big Sur. Be sure to upgrade. It’s being exploited in the wild.
- submeta 5y ago
  What about macOS Catalina users? Any updates / fixes for them? Do you happen to know?
  - therealmarv 5y ago
    The bad thing is: They patched Catalina less than Big Sur with the new update :( Compare "Gatekeeper" fixed issues here: https://support.apple.com/en-us/HT212326 https://support.apple.com/en-us/HT212326 Catalina https://support.apple.com/en-us/HT212325 https://support.apple.com/en-us/HT212325 Big Sur Feels for me that they only patched one part of it on Catalina but gates are more open on the older macOS. Really don't like that.
  - phnofive 5y ago
    It appears this behavior was introduced in Catalina, so I’d assume a complimentary fix to 11.3 will be available for 10.x - no word on timing AFAIK.
    - ilikepi 5y ago
      Security Update bundles were released for Catalina and Mojave as well. The list of security fixes for the Big Sur update 11.3 has three entries mentioning Gatekeeper: https://support.apple.com/en-us/HT212325 https://support.apple.com/en-us/HT212325 ...whereas the list for Catalina has only one: https://support.apple.com/kb/HT212326 https://support.apple.com/kb/HT212326
- benatkin 5y ago
  > Be sure to upgrade. This is a technical crowd, so some of us don't need to rush to download things like this. I'll upgrade when it's convenient, thank you very much.
deleted 5y ago
[deleted]
aledalgrande 5y ago
Is it me or Apple isn't even listing the patch in the 11.3 changelog? https://developer.apple.com/documentation/macos-release-notes/macos-big-sur-11_3-release-notes https://developer.apple.com/documentation/macos-release-note...
- infinita740 5y ago
  Security patches are in a separate article: https://support.apple.com/en-us/HT212325 https://support.apple.com/en-us/HT212325
  - aledalgrande 5y ago
    Oh cool thanks!
zanethomas 5y ago
nice!!!
sharikone 5y ago
I feel that macOS has slowly become a mess. From Lion, more or less. Overcomplicated and bloated security features, telemetry, iOSification of the UI, dumbed down settings, bugs.. Perhaps the time has come to shed some legacy and restart again from scratch (like Google Fuchsia) or to invest some of the hundreds of billions they have in refining the software so it actually works
Quiark 5y ago
Somehow none of this is applied to packaged shell script into an .app which runs on double-click with no message whatsoever. Malware doesn't always have to be a binary...
lilyball 5y ago
I’m really disappointed that this blog post didn’t dive into why the bug vanishes with SIP disabled.

351 points by robertkrahn01 5y ago

deleted 5y ago

[deleted]

tehwebguy 5y ago

Does this mean we can trick Big Sur into not treating TypeScript files like DVD rips?

smoldesu 5y ago

Gatekeeper is one of the most frustrating things I have to fight whenever I try using MacOS. It feels like DRM for my applications, which in turn makes everything feel clunkier, and less integrated. I would genuinely pay Apple extra for a version of MacOS that just trusts me and lets me install what I want without the some esoteric mechanism stopping me at every step of the way...

minhazm 5y ago
You can disable Gatekeeper. https://disable-gatekeeper.github.io/ https://disable-gatekeeper.github.io/
kstrauser 5y ago
What frustrates you about it? I rarely bump into Gatekeeper and I'm doing the normal dev things.
- Isthatablackgsd 5y ago
  I'm assuming you don't use the package manager like Homebrew or MacPorts? this is where the gatekeeper will annoy the hell out of me. Apps installed via Homebrew often will encounter Gatekeeper alerts. Half of them will give the option to open it and the other half, the gatekeeper --demands-- gently ask me to put it in the Trash without the option to open it.
  - lilyball 5y ago
    Homebrew and MacPorts don't add the quarantine flag to the software they're installing. If you're getting Gatekeeper alerts for software installed this way, then something else must be going on.
    - saagarjha 5y ago
      Homebrew Cask does.
  - herrkanin 5y ago
    I'm using homebrew all day long, and I don't remember ever having this issue.
    - xrisk 5y ago
      Homebrew cask.
      - ezfe 5y ago
        I use Homebrew Cask and don't run into any unusual problems with Gatekeeper. The flow is always the same as if I manually downloaded it (meaning I sometimes get a prompt on first run, but that's expected).
  - breakfastduck 5y ago
    You need to disable gatekeeper like shown in another of the comments. It’ll permanently create a new option in your settings to allow installations from “anywhere” too.
    - Wowfunhappy 5y ago
      Nitpick, I don't actually think the option in System Preferences is permanent? Is it still there if you change it back and restart System Preferences?
- lovelyviking 5y ago
  Sometimes I compile my program and when I move it to the Applications folder and trying to run MacOS says, you do not have permission to do it. May be it's not a gatekeeper, who knows. The keyword here is sometimes This is what I Love about current state of MacOS. To fix it nothing works until you delete it completely and only then if you lucky etc ... It just reminds me those old good days with Microsoft many years ago. Turn it off then turn it on few times .. it may work ...
  - mlindner 5y ago
    I've always found it to be extremely consistent and never does anything strange like you're describing. Works for me.
  - Klonoar 5y ago
    Is this an Xcode project, or something outside of it? I regularly build both and have run them in the same way you're talking about here, without issue... the latter migth be a bit more nuanced, but when set up properly does work fine, so I'm inclined to think this is more a problem with how you're doing things.
    - lovelyviking 5y ago
      Yes it's pure XCode project, that I regularly build it and run in the same way. Who would expectg such sequence right? And no! it doesn't work fine all the time, because sometimes it doesn't as I desribed. And I do not bother to deeply search for the cause of it unless I must for my project and also because Apple would not pay me for that and next version would have another stupid bug anyway. "I'm inclined to think this is more a problem with how you're doing things." Of course, who would expect to see bug in XCode right? I'll tell you the secret, this is not the first bug I've spotted in Apple product during 10 years. Honestly I do not even know what their QA team is doing if I can find few bugs manually within 10 minutes of usage ... Yesterday I have found another one with sound system, because they didn't thouhgt about one scenario in their logic. They really should spend their money on people like me instead of wasting their money on QA team that doesn't work properly :) ...Or perhaps I should take a look at their QA team to spot bugs in their working process ))
Wowfunhappy 5y ago
Then turn it off. Open the Terminal and run: sudo spctl --master-disable That's it, it will never bother you again, unless you turn it back on or reinstall the OS from scratch. If macOS is still too limiting, you can also turn off System Integrity Protection, at which point you can do just about whatever the heck you want. I personally kept both Gatekeeper and SIP turned off, back when I used modern macOS. But if they are turned on, they ought to work.
- joshspankit 5y ago
  Does turning those off still leave the logs redacted? Or do you also have to install the profile after you tell it to get out of your way?
  - Wowfunhappy 5y ago
    I don’t use Big Sur but I don’t think it has any affect on logs. Without SIP, you could patch the kernel or something and change whatever you want, but that would of course be nuts. I share your curiosity. If your computer isn't already managed, installing an MDM profile in order to view logs is ridiculous. I don’t even think there’s a way to do it without paying money.
    - comex 5y ago
      That page is somewhat misleading. MDM is one way to install configuration profiles, but you can also install them by hand. No signing required, either. You can just stick that XML in a file with extension .mobileconfig, then double-click the file, and it will prompt you to install it. Or download a signed version from here (not my site): https://georgegarside.com/blog/macos/sierra-console-private/enable-unified-log-private-data.mobileconfig https://georgegarside.com/blog/macos/sierra-console-private/...
  - azinman2 5y ago
    That has nothing to do with log redaction. That's to prevent private data escaping apps and either being sent to Apple or readable by others. You want that on.
cloogshicer 5y ago
Agreed. It's ridiculous that we can't even fully disable it in the latest macOS releases (the commands others posted below don't work in Big Sur to completely disable quarantine). Thankfully there is a simple workaround: https://hiringengineersbook.com/post/disable-quarantine/ https://hiringengineersbook.com/post/disable-quarantine/
- Wowfunhappy 5y ago
  Note, the single command does turn off Gatekeeper. File quarantine is separate and needs a separate command. That is as it should be IMO, they’re completely different things.
  - cloogshicer 5y ago
    Right, but do you know if there is a command to actually turn off quarantine? I mean really turning it off, not just removing it from already existing files. To my knowledge, that doesn't exist.
fiddlerwoaroof 5y ago
Apple has been moving toward a capability-based security model for a while now, I think: it’s a bit annoying because their implementation also acts like DRM, but I think the mode itself is a better security model than standard POSIX file permissions and ACLs
gdavisson 5y ago
It's not that macOS doesn't trust you, it's that macOS doesn't trust the programs you're running. Specifically, it doesn't trust the programs to do what you want them to, and only what you want them to. And it's not just a matter of protecting you against out-and-out malware (although that's certainly part of it), it's a matter of protecting you against developers whose interests don't entirely align with yours. Developers who really want to spy on their users seem to be the biggest group (see, for example, the recent Apple vs. Facebook kerfuffle). Unfortunately, distrusting software does add friction, especially if you add (/update-via-unsupported-mechanisms) new software frequently. "Are you sure you meant to run this program? It looks weird to me; I think you should get rid of it. Should it really have access to your contacts/camera/etc?" macOS is acting a little like an overprotective parent here, and it's certainly annoying. But the threats it's trying to protect you from are real. You can turn the protections off (with a certain amount of work), but then you're vulnerable to all the stuff it's there to protect you from. P.s. I don't mean to completely defend Apple here. Their preferred solution is to have all software distribution go through their App store... where they get a cut of the price. Which means they're also on the list of developers whose interests don't entirely align with yours.
- kevincox 5y ago
  This is a weird way to justify it. I told macOS to run that program because I trust it. If macOS trusts me then it transitively trusts the program I told it to run. In other words macOS doesn't trust me to validate programs before I try to run them.
- smoldesu 5y ago
  I understand what Apple's intentions here are, but abstracting away a security risk is only inviting disaster, and it's kinda endemic of an issue throughout Apple's ecosystem: their whole game is about reducing the power of the end user. It makes sense from some angles, security being one, but it also impedes the freedom of choice. Instead of engineering their software to appeal to the lowest common denominator, they should be empowering people who want to push beyond that envelope and offering extensibility to those who want to take advantage of it.

lovelyviking 5y ago

>But first, go update your macOS systems to 11.3 Unofortunately the risk is to high. Last time I was trying to update to 11.2 my MacBook M1 showed black screen with instruction to find another Mac. During Covid situation I had to endanger myself with going to look for this 'another' Mac. No thank you very much. Not possible for now, who knows will it stuck this time or not. I do not wish loose my ability to work again. Looks like to update safely you need to have another Mac. I mean if you for sure wish to get the guaranteed result. BTW, I was reporting about this situation over here and about my surprise to the amount of bugs I have stumbled on . For those who was fast to suggest that there is some hardware issue with this specific machine - you were too fast to suggest something that you wanted very much to be the case. I leave it to your karma why you wanted it but No hardware issues have been found so far till this very day. It passes all tests including speed tests. All of the problems were software bugs and issues. All of them were perfectly known when you search the info about them. For instance ScreenShot was slow when Mic was selected as sound input source for Screen Video Recording. ScreenShot have nothing to do with Mic as far as I know because no sound is recorded in ScreenShot last time I've checked :) and yet it was slow because of that(I guess it was trying to initialize the Mic for each screenshot). Once you select None as sound input source for Screen Video Recording the ScreenShot works again quickly like it supposed to be. If this is not funny then what is? And it's very known problem if you google it, yet some people were donwvoting even that! Some people do not like facts it seems. So I state again what I was stating back then. It's so far the buggiest Mac I ever had.

kossTKR 5y ago

Does anyone know how trustworthy this objective-see project is? I remember once installing several of his apps, but then coming to the conclusion that i don't know enough - even though he consistently seems to find and fix flaws in OSX. Why isn't Apple hiring this man? EDIT: Why are people downvoting this question? If i'm implying something then i'm unaware of it.

savoytruffle 5y ago
Some people don't want to be coerced into working remotely near Cupertino …
- kossTKR 5y ago
  And that's fair, i wouldn't either, what i mean is they should seriously consider giving him some consultancy fees, bounties / whatever since he's consistently doing good work.
- jrochkind1 5y ago
  i don't get it
ghughes 5y ago
The tools are legit, and the bugs are real, but he has a distasteful habit of feeding sensationalist quotes to outlets like Forbes and Vice. This time, he told Forbes that "the hacks effectively take Mac security back a decade" [1], and Vice quotes him as saying "this is likely the worst or potentially the most impactful bug to everyday macOS users in recent memory". [2] Forbes ran the story with the headline "The ‘Worst Hack In Years’ Hits Apple Computers", and that's bullshit. 1. https://www.forbes.com/sites/thomasbrewster/2021/04/26/update-your-mac-now-the-worst-hack-in-years-hits-apple-computers/ https://www.forbes.com/sites/thomasbrewster/2021/04/26/updat... 2. https://www.vice.com/en/article/wx5855/massive-mac-apple-security-bug-malware-hack https://www.vice.com/en/article/wx5855/massive-mac-apple-sec...
- kossTKR 5y ago
  Thanks for the insight! Seems like quite a talented dude but with the mandatory eccentricity that seemingly often comes with . Great to know that the tools are legit.

pehtis 5y ago

I will never understand why "Show all filename extensions" is unchecked by default in Finder.

benhurmarcel 5y ago
Unchecked by default is fine, what bothers me a lot is that it's impossible to display filename extensions on iOS/iPadOS.
Closi 5y ago
It's also unchecked in Windows by default - I suspect that in reality the concept of extensions probably confuses some users, who end up changing the extension and then struggle to work out how to open their saved files. ( I always prefer to see the extensions too though :) )
- symlinkk 5y ago
  This is an outdated mindset. Literally everyone knows the difference between .docx and .jpg in 2021.
  - inb4_cancelled 5y ago
    You're living in a beautiful bubble.
- setr 5y ago
  Windows gives you a big warning when you change the extension, which seems to me both sufficient and better than hiding the extension altogether (which, like URL hiding, is a fairly dangerous and largely unnecessary convenience)
  - judge2020 5y ago
    I've learned to never underestimate users' ability to shoot themselves in the foot. People will click through any popup dialogue which might suggest that their decision to perform an action was wrong.

pier25 5y ago

Did Apple finally fix the bug where every Big Sur update nukes Xcode tools like Git?

ezfe 5y ago
No problems here - I'm on beta cycle so I get new Big Sur updates fairly often (every few weeks) and haven't had any git issues.

jdlshore 5y ago

Fascinating article. Short version: there was a bug in the part of Apple’s Gatekeeper code that checked whether a file was an application bundle. Bundles that only contained a script, and not a plist file, were considered “not a bundle,” and this bypasses the Gatekeeper checks. The issue is fixed in the latest version of Big Sur. Be sure to upgrade. It’s being exploited in the wild.

submeta 5y ago
What about macOS Catalina users? Any updates / fixes for them? Do you happen to know?
- therealmarv 5y ago
  The bad thing is: They patched Catalina less than Big Sur with the new update :( Compare "Gatekeeper" fixed issues here: https://support.apple.com/en-us/HT212326 https://support.apple.com/en-us/HT212326 Catalina https://support.apple.com/en-us/HT212325 https://support.apple.com/en-us/HT212325 Big Sur Feels for me that they only patched one part of it on Catalina but gates are more open on the older macOS. Really don't like that.
- phnofive 5y ago
  It appears this behavior was introduced in Catalina, so I’d assume a complimentary fix to 11.3 will be available for 10.x - no word on timing AFAIK.
  - ilikepi 5y ago
    Security Update bundles were released for Catalina and Mojave as well. The list of security fixes for the Big Sur update 11.3 has three entries mentioning Gatekeeper: https://support.apple.com/en-us/HT212325 https://support.apple.com/en-us/HT212325 ...whereas the list for Catalina has only one: https://support.apple.com/kb/HT212326 https://support.apple.com/kb/HT212326
benatkin 5y ago
> Be sure to upgrade. This is a technical crowd, so some of us don't need to rush to download things like this. I'll upgrade when it's convenient, thank you very much.

deleted 5y ago

[deleted]

aledalgrande 5y ago

Is it me or Apple isn't even listing the patch in the 11.3 changelog? https://developer.apple.com/documentation/macos-release-notes/macos-big-sur-11_3-release-notes https://developer.apple.com/documentation/macos-release-note...

infinita740 5y ago
Security patches are in a separate article: https://support.apple.com/en-us/HT212325 https://support.apple.com/en-us/HT212325
- aledalgrande 5y ago
  Oh cool thanks!

zanethomas 5y ago

nice!!!

sharikone 5y ago

I feel that macOS has slowly become a mess. From Lion, more or less. Overcomplicated and bloated security features, telemetry, iOSification of the UI, dumbed down settings, bugs.. Perhaps the time has come to shed some legacy and restart again from scratch (like Google Fuchsia) or to invest some of the hundreds of billions they have in refining the software so it actually works

Quiark 5y ago

Somehow none of this is applied to packaged shell script into an .app which runs on double-click with no message whatsoever. Malware doesn't always have to be a binary...

lilyball 5y ago

I’m really disappointed that this blog post didn’t dive into why the bug vanishes with SIP disabled.