Top
Best
New

Posted by firexcy 9 hours ago

Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software(github.com)
183 points | 152 commentspage 3
Rockjodd 8 hours ago|
> https://github.com/jdx/mise

Just dropping this here for those who don't know about it. It solves most of my CLI dependencies.

0xbadcafebee 9 hours ago||
Homebrew is famous for making life hard for users. It makes "design decisions" that often conflict with users' needs, all in order to live up to the personal preferences of the project leads.

Personally I use asdf to manage my software on Macs. It too has also changed its design recently to become user-hostile (the command-line tool no longer prints the options for the commands, and it's full of bugs since a recent major version change).

For anyone looking to make an alternative to Homebrew: check out asdf's plugin system! It is insanely easy for anyone to make an asdf plugin, install it, use it. It's just a directory of plaintext files/scripts somewhere on the web. I made a couple plugins for unpackaged apps within like 30 minutes of learning how plugins worked. Very "unix philosophy" (in a good way)

(aside: I'm not a "Mac person" (forced to use one by work), so I know this is an unpopular opinion, but Macs feel worse to use than either Windows or Linux. At least Windows has WSL2 if you like command-lines (or PowerShell if you're into that). OTOH Macs ship with insanely outdated incompatible tools, and the 3rd-party options are annoying as hell. Why do technical people keep using Macs?)

queenkjuul 7 hours ago||
Apple loves to change which tools they ship, too, it at least have for the last few years as system updates were routinely breaking our build scripts at work, mostly when Apple would replace a GNU tool with a BSD tool without warning i think.

I agree though, Finder is a joke, the macOS system preferences has gotten incredibly cluttered and hard to use, the ever stricter code signing and download-opening restrictions are frustrating, and i can't even just install and run the docker CLI--docker on Mac requires Desktop and commercial use of Desktop requires a license.

All 3 systems have things about them that annoy me, but I'm with you that Mac is my least favorite. And it kinda sucks because the global text shortcuts (command-arrow, command-delete etc) are really handy and hard to replicate on other systems, and at least traditionally it's been a very pretty and well integrated desktop, the system itself just drives me up a wall.

Aaron2222 2 hours ago|||
> i can't even just install and run the docker CLI--docker on Mac requires Desktop and commercial use of Desktop requires a license.

That's not on Apple. Docker needs the Linux kernel (for Linux containers), so it's no different to needing something like Docker Desktop to use Docker on Windows. Yeah, Docker changed the license on Docker Desktop, but there's plenty of alternatives (Podman Desktop, Rancher Desktop, Colima, Apple's own container tool, or just running a Linux VM in Lima).

alwillis 5 hours ago|||
> Apple loves to change which tools they ship, too, it at least have for the last few years as system updates were routinely breaking our build scripts at work, mostly when Apple would replace a GNU tool with a BSD tool without warning i think.

It's a licensing issue; Apple has never shipped GPLv3 software. This has been discussed dozens of times on HN.

Of course you can use Homebrew to install a GNU toolchain to your heart's content.

0xbadcafebee 2 hours ago|||
Well there's now an MIT-licensed Rust rewrite of GNU coretools. Maybe in a few years they'll ship that, and we won't have to faff about with crappy 3rd party solutions. (I mean, seriously, when Windows ships with better dev tools than you? That's embarrassing.)
Onavo 8 hours ago||
Try mise

https://mise.jdx.dev/dev-tools/comparison-to-asdf.html

davidkellis 9 hours ago||
Does this affect the linux version of homebrew? I'm hoping this has no effect.
angulardragon03 9 hours ago|
No, because there is no codesigning/notarization on Linux.
shevy-java 9 hours ago||
"Locking this thread. Not interested in arguing the merits of this. It's already been communicated to third parties."

Well!

Note: I think one problem of homebrew is called ... Apple. That is, they depend on whatever Apple decides.

Granted, this is similar to Microsoft; and to some extent to Linux, though people can make more modifications on Linux normally.

I am a Linux users so this does not affect me, and I also wrote my own "package" manager (basically just some ruby scripts to compile things from source), but at the same time I also think that at the end of the day, the user should decide what he or she wants. This is also why my scripts support systemd - I don't use/need systemd myself, but my tools should be agnostic, so I don't project my own opinion onto them.

There is of course a limitation, which is available time - often I just lack time to support xyz. But I keep that spirit alive - software should serve the human, not the other way around. (I have no substantial opinion on the feature itself here, that is to me it seems ok to remove it; the larger question is who dictates something onto users and what workarounds exist. Do workarounds exist? From reading the issue tracker, it seems the homebrew maintainers say that there are no workarounds, and thus it should be removed. If that is true then they have a point, but people also downvoted that, so perhaps there are workarounds - in which case these should be supported. I really don't know myself - to me apple is more like a glorified Windows, so basically the same. All software should be liberated eventually.)

westondeboer 8 hours ago||
TL;DR

Homebrew is removing --no-quarantine because:

Apple is killing Intel support.

Apple Silicon won’t run unsigned apps anyway.

Homebrew will soon require all apps to pass Gatekeeper.

They don’t want to help users bypass macOS security.

This is basically a security + future-compatibility cleanup.

Aaron2222 2 hours ago|
> Apple Silicon won’t run unsigned apps anyway.

Technically true, but misleading. The macOS kernel won't execute an Apple Silicon binary that doesn't have a signature, but as Apple documents, an ad-hoc signature is enough to meet that requirement. That won't get you past Gatekeeper, but that's no different to how it is with unsigned Intel binaries.

superkuh 9 hours ago||
It may be Apple policy to prevent users from doing what they want because "security" is the most important thing for a their bank/shopping terminals. But I thought the whole point of using homebrew was to empower the user to use Apple devices like a normal computer without the hassle of having to do it manually? The developer has made it clear this is not the use case and that it helped with it was unintentional and undesired. The actual use case for homebrew remains unclear given this new information.
nemothekid 9 hours ago|
As I understand it `--no-quarantine`, as it is currently implemented, is a noop on ARM Macs. So if Homebrew has two options:

1. Play cat and mouse with Apple to ensure `--no-quarantine` works

2. Deprecate and remove the feature.

saagarjha 5 hours ago|||
No, it definitely has an effect on Apple silicon. Without this you will be blocked from running ad-hoc signed code.
superkuh 9 hours ago|||
Well, 2. is what the people are asking for but aren't getting. They want deprecation and a ENV flag to enable. It'd be enough. But even that isn't being allowed which is weird for a power-user program. I can't help but think, "Don't obey in advance."
nemothekid 8 hours ago||
2 is what is happening. The feature is being deprecated and will likely be removed in the next MacOS version.

>I can't help but think, "Don't obey in advance."

They aren't obeying in advance. They simply aren't doing the work to find another Gatekeeper bypass for ARM64.

supportengineer 9 hours ago||
It seems this mostly affects Intel systems.
JohnTHaller 9 hours ago|
Only true because this only works on Intel code. You can't use the typical method to bypass Gatekeeper because Apple removed it for ARM64 code.
saagarjha 5 hours ago||
No, the mechanism is the same.
Aaron2222 2 hours ago||
To clarify, the macOS kernel requires a signature on all Apple Silicon binaries, but this can just be an ad-hoc signature. Ad-hoc signed Apple Silicon applications are treated much the same as unsigned Intel ones.
mvdtnz 7 hours ago||
I can run whatever I want on my Windows and Linux machines. I wouldn't put up with this, but I guess some people really feel they need their silly fruit computers.
platevoltage 1 hour ago|
You run something that Windows doesn't like (like an Activator), Windows straight up deletes the application.
theturtle 8 hours ago|
[dead]
More comments...