6 ms·

I think the idea is wonderful, but a not-audited application that uses things like the camera is a “no go” for me. Get it notorized and ask for some money! I w

I think the idea is wonderful, but a not-audited application that uses things like the camera is a “no go” for me. Get it notorized and ask for some money! I will gladly pay it (and I hope others will do it as well). Awesome concept: ergonomics and/or posture monitoring is a market opportunity for heavy users.

xpasky 8mo ago
It's literally a single .swift file. Ask your LLM to audit it.
- micromacrofoot 8mo ago
  then I need to get someone to audit the LLM, which is considerably more difficult
  - JCharante 8mo ago
    ok but who will audit your compiler?
  - StilesCrisis 8mo ago
    Do you expect this programmer is in cahoots with Anthropic?
    - saagarjha 8mo ago
      The opposite, actually: that the code tricks the LLM.
    - micromacrofoot 8mo ago
      if you use code you can't trust to audit code you can't trust, you're not doing an audit at all personally I do not implicitly trust Anthropic or any other company
tananaev 8mo ago
Are you serious? It's open source. And there's less than 1000 lines total. Get Codex or Claude to review it if you're paranoid.
- Alejandro9R 8mo ago
  The thing is that how do you know at the end of the day that the compiled binary hasn't been tampered with "extra code" besides what's in the repo? I don't even think notarization gets rid of this problem neither, so the best you can do for this is compile it yourself. Maybe I'm wrong!
  - alexford1987 8mo ago
    Compiling it yourself is the best/only thing you can do if you really want to know what code went into a binary.
  - deleted 8mo ago
    [deleted]
  - deleted 8mo ago
    [deleted]
  - prmoustache 8mo ago
    What prevents you from compiling it if it is open-source? That's what I do with every project delivered as docker image. I rebuild the app and the image.
- encom 8mo ago
  Go easy on the guy. Mac users are so used to overpaying for trivial functionality.
wizzwizz4 8mo ago
While I disagree with you, thank you for sharing your decision-making process: you're probably not the only one who thinks this way. In general, would you pay for a notorised build of free software, if you had use for that software, even if an un-notorised build or the source code were available?
- IshKebab 8mo ago
  I seriously doubt that he actually would. And in that unlikely event he'd be in a miniscule minority. Not a good open source monetisation strategy.
  - xfactorial 8mo ago
    You may be severely wrong: I like to pay and contribute to things I use, believe it or not. I love to buy small apps from indie developers or donate some money to things I use and I love: when I was a student, of course, things were different. Nowadays, luckily, I can contribute and I do it gladly.
- xfactorial 8mo ago
  It depends: having it notarized is a way to show someone with a certain reputation of "Hey! This is my code, this is me, if something happens, you can kill the switch". If notarisation requires you some kind of payment, I would be okay with you charging me some money, if I obviously find your code has a good value for me. I read comments around here about "Well: you can compile it yourself" or "it's open source! You can check the code by yourself". And, while all of those arguments are accurate and valid, the point is "I do not feel like it" or, a little reminder, "The Great Suspender" was an example of a beautiful open source little app to suspend tabs on Google Chrome that, one glorious day, switched hands and, suddenly, after some time, someone noticed the repository and the code from the add-in were different, and those changes were made with nefarious intent. Luckily, somehow found out, but some people do not have the time or the will to be playing that game. A piece of code that requires access to my camera, regardless of size (<1000 lines of code) or build, it's something I just don't put on my computer without thinking it twice. Thank you for the tone: I hope I responded to your question :)
alin23 8mo ago
Notarization is mostly a glorified malware scan. There's no Apple engineer auditing what's being sent for notarization. Even clever malware can evade notarization scans and be distributed as a notarized binary, it has happened in the past [0] There's no better way for auditing such an app than having the code easily available and looking through it, and compiling it yourself. Which is already the case here. [0] https://thehackernews.com/2025/12/new-macsync-macos-stealer-uses-signed.html https://thehackernews.com/2025/12/new-macsync-macos-stealer-...
- burnerthrow008 8mo ago
  Your link says that Apple revoked the certificate used to sign the malware by the time the story was published.
  - jorams 8mo ago
    After a different company detected it, figured out what it did, and reported it to Apple. The app was notarized on November 17, screenshots in the researchers' post are from December 16. That's a month of fully notarized distribution.
tjohnell 8mo ago
Posturr is now notarized!

xpasky 8mo ago

It's literally a single .swift file. Ask your LLM to audit it.

micromacrofoot 8mo ago
then I need to get someone to audit the LLM, which is considerably more difficult
- JCharante 8mo ago
  ok but who will audit your compiler?
- StilesCrisis 8mo ago
  Do you expect this programmer is in cahoots with Anthropic?
  - saagarjha 8mo ago
    The opposite, actually: that the code tricks the LLM.
  - micromacrofoot 8mo ago
    if you use code you can't trust to audit code you can't trust, you're not doing an audit at all personally I do not implicitly trust Anthropic or any other company

tananaev 8mo ago

Are you serious? It's open source. And there's less than 1000 lines total. Get Codex or Claude to review it if you're paranoid.

Alejandro9R 8mo ago
The thing is that how do you know at the end of the day that the compiled binary hasn't been tampered with "extra code" besides what's in the repo? I don't even think notarization gets rid of this problem neither, so the best you can do for this is compile it yourself. Maybe I'm wrong!
- alexford1987 8mo ago
  Compiling it yourself is the best/only thing you can do if you really want to know what code went into a binary.
- deleted 8mo ago
  [deleted]
- deleted 8mo ago
  [deleted]
- prmoustache 8mo ago
  What prevents you from compiling it if it is open-source? That's what I do with every project delivered as docker image. I rebuild the app and the image.
encom 8mo ago
Go easy on the guy. Mac users are so used to overpaying for trivial functionality.

wizzwizz4 8mo ago

While I disagree with you, thank you for sharing your decision-making process: you're probably not the only one who thinks this way. In general, would you pay for a notorised build of free software, if you had use for that software, even if an un-notorised build or the source code were available?

IshKebab 8mo ago
I seriously doubt that he actually would. And in that unlikely event he'd be in a miniscule minority. Not a good open source monetisation strategy.
- xfactorial 8mo ago
  You may be severely wrong: I like to pay and contribute to things I use, believe it or not. I love to buy small apps from indie developers or donate some money to things I use and I love: when I was a student, of course, things were different. Nowadays, luckily, I can contribute and I do it gladly.
xfactorial 8mo ago
It depends: having it notarized is a way to show someone with a certain reputation of "Hey! This is my code, this is me, if something happens, you can kill the switch". If notarisation requires you some kind of payment, I would be okay with you charging me some money, if I obviously find your code has a good value for me. I read comments around here about "Well: you can compile it yourself" or "it's open source! You can check the code by yourself". And, while all of those arguments are accurate and valid, the point is "I do not feel like it" or, a little reminder, "The Great Suspender" was an example of a beautiful open source little app to suspend tabs on Google Chrome that, one glorious day, switched hands and, suddenly, after some time, someone noticed the repository and the code from the add-in were different, and those changes were made with nefarious intent. Luckily, somehow found out, but some people do not have the time or the will to be playing that game. A piece of code that requires access to my camera, regardless of size (<1000 lines of code) or build, it's something I just don't put on my computer without thinking it twice. Thank you for the tone: I hope I responded to your question :)

alin23 8mo ago

Notarization is mostly a glorified malware scan. There's no Apple engineer auditing what's being sent for notarization. Even clever malware can evade notarization scans and be distributed as a notarized binary, it has happened in the past [0] There's no better way for auditing such an app than having the code easily available and looking through it, and compiling it yourself. Which is already the case here. [0] https://thehackernews.com/2025/12/new-macsync-macos-stealer-uses-signed.html https://thehackernews.com/2025/12/new-macsync-macos-stealer-...

burnerthrow008 8mo ago
Your link says that Apple revoked the certificate used to sign the malware by the time the story was published.
- jorams 8mo ago
  After a different company detected it, figured out what it did, and reported it to Apple. The app was notarized on November 17, screenshots in the researchers' post are from December 16. That's a month of fully notarized distribution.

tjohnell 8mo ago

Posturr is now notarized!