Email or username:

Password:

Forgot your password?
past oral no mad's posts Post Back to profile
past oral no mad

I downloaded a program for macOS. The OS absolutely refuses to let me run it, falsely claiming that it's "damaged." It is not damaged, Apple just cares more about extracting profit from developer licenses and collecting data through App Store downloads.

There's a dark pattern where you can right click and select "Open," which behaves differently than double-clicking the same thing. This does not work for this program.

I had to run: `xattr -d com.apple.quarantine /Applications/ProgramName.app` to make it work.

Despicable, hostile, anti-user, anti-competitive behavior from Apple.

#buglog

7 August at 17:27 | Open on retro.social
36 comments
Chris Alemany🇺🇦🇨🇦🇪🇸

@ieure I have been using macOS since System 7 days… while Apple did start to be a little more circumspect about running randomly downloaded applications, I have never not been able to run anything. “Open” *is* the same as double clicking.
If it says it is “damaged” it’s because of an actual problem or inconsistency with the program, not some sort of conspiracy.

7 August at 20:10 | Open on mstdn.chrisalemany.ca
cassie

@chris @ieure Open is *not* the same as double clicking, Open will give an “are you sure” dialogue in cases where double clicking will directly reject it.

7 August at 20:13 | Open on mastodon.social
Chris Alemany🇺🇦🇨🇦🇪🇸

@porglezomp @ieure I have never seen that distinction/behaviour but I won’t dispute it.

7 August at 20:17 | Open on mstdn.chrisalemany.ca
past oral no mad

@chris @porglezomp I have experienced this firsthand with multiple programs I've downloaded with a browser.

Right-click, open *should* do the same thing as double-clicking. That it no longer does, that even users with years of experience find this surprising, is exactly why it's a dark pattern.

7 August at 20:40 | Open on retro.social
past oral no mad

@chris @porglezomp After removing the quarantine bit, the program launches and runs perfectly. It wasn't damaged, but Apple chose to write software which actively lies to its users. Worth pondering why they decided to do that.

7 August at 20:46 | Open on retro.social
Chris Alemany🇺🇦🇨🇦🇪🇸

@ieure @porglezomp I honestly can't be bothered with this kind of conspiracy stuff, no matter what company it is. Saying something is "damaged" isn't a lie if it's not conforming to *minimal* expectations. Yes, security is inconvenient but it's no big secret.

support.apple.com/en-ca/guide/

7 August at 20:51 | Open on mstdn.chrisalemany.ca
past oral no mad

@chris @porglezomp lmao are we hitting the denial stage of grief?

Is a program "damaged" because I haven't removed the quarantine bit?

Is Apple the one who gets to decide what software I run on my computer?

7 August at 21:10 | Open on retro.social
tessarakt
U.Lancier

@ieure @chris @porglezomp „Why“ seems relatively obvious: Apple believes to make more money that way.

But to me it raises the question: What else evil and maybe more subtle trickery might they do to cripple things or to keep the profitable ways for themselves and out of the reach of others, including the customers.

7 August at 21:41 | Open on social.tchncs.de
Zimmie

@chris @porglezomp @ieure My memory is the “damaged” thing happens when an application doesn’t have a signature at all (the system generates a local-only signature when it’s run the first time), while right-click > Open is needed for the first launch of signed applications downloaded directly rather than through the App Store.

7 August at 20:46 | Open on infosec.exchange
past oral no mad

@bob_zim @chris @porglezomp Yes, it's some nonsense like this. While I'm moderately curious to understand why it works like this, the entire setup is so odious that I don't want to pretend that it's reasonable or engage with it in any way.

I get to decide what runs on my computer. Not Apple.

7 August at 20:47 | Open on retro.social
Zimmie

@ieure @chris @porglezomp I think it’s a pretty reasonable default to keep most users safe. It’s also super easy to disable the check:

bikeshed.party/objects/e9f4384

7 August at 20:49 | Open on infosec.exchange
Rich Felker

@bob_zim @ieure @chris @porglezomp Disallowing exec and telling you why is a reasonable default.

Lying that it's damaged to trick you into not trying to find a workaround to execute it is vile and user hostile.

7 August at 21:04 | Open on hachyderm.io
past oral no mad
Brendan B.

@dalias @bob_zim @ieure @chris @porglezomp pretty much any browser will throw up a warning if you make an HTTPS connection to a website with a self signed cert too.

7 August at 21:47 | Open on mastodon.social
past oral no mad
Brendan B.
past oral no mad replied to Brendan

@distinct @dalias @bob_zim @chris @porglezomp It's not the same, though: the browser explicitly tells you exactly what the problem is, and offers options for you to choose what to do (proceed or not).

macOS does not do this.

7 August at 21:52 | Open on retro.social
Chris Alemany🇺🇦🇨🇦🇪🇸 replied to past oral no mad

@ieure @distinct @dalias @bob_zim @porglezomp
Sorry, you lost me. There is a pretty clear explanation why this is happening. I am not going to get hung up on the word “Damaged” vs. Something else. It’s not a secret, including the workaround, all someone who really doesn’t want to sign their application has to do is inform their users of the workaround. As others have said, application signing is a pretty reasonable default behaviour to protect the millions of general users.

7 August at 22:02 | Open on mstdn.chrisalemany.ca
Rich Felker

@distinct @bob_zim @ieure @chris @porglezomp The browser doesn't lie and say the DNS lookup failed or the host is unreachable. It says the certificate is untrusted and asks you how to proceed.

7 August at 22:04 | Open on hachyderm.io
Zimmie

@dalias @ieure @chris @porglezomp I’m not sure I’d call the message a lie. An app bundle isn’t just a loose binary (this message doesn’t come up for loose binaries), and a signature has been an expected item in the bundle for over a decade. A bundle which is missing expected resources *is* damaged, just as much as if the bundle were missing the Info.plist or some framework it uses.

It should definitely provide a way to find out exactly what about the app bundle is weird. NSError even provides several fields like localizedFailureReason which could easily be used for this.

@dalias @ieure @chris @porglezomp I’m not sure I’d call the message a lie. An app bundle isn’t just a loose binary (this message doesn’t come up for loose binaries), and a signature has been an expected item in the bundle for over a decade. A bundle which is missing expected resources *is* damaged, just as much as if the bundle were missing the Info.plist or some framework it uses.

7 August at 22:29 | Open on infosec.exchange
amd

@chris @porglezomp @ieure

It happens all the time and is by design.

Happened to me just this morning with a copy of freecad. If you have a few minutes and a few gigs of free space it will for you too.

7 August at 22:36 | Open on social.amd.im
stilescrisis

@chris @ieure They're changing/intentionally breaking this in Sequoia.

7 August at 20:30 | Open on mastodon.gamedev.place
:parrot:
@chris @ieure it's not the same thing if it's not verified it won't let you open it by double clicking you have to right click. since like lion or whenever they added gatekepeer
8 August at 0:14 | Open on kitty.haus
Walker

@ieure THANK YOU! I ran into the same problem, directly installing the app from a well known manufacturer website. The app is obvously not malicious, Apple did not want to load it.

7 August at 20:13 | Open on infosec.exchange
past oral no mad

@Walker Glad my griping could help you out! More things should be like that, lol.

7 August at 21:14 | Open on retro.social
jleedev

@ieure On my last mac I used ‘Folder Actions’ to run that xattr command on anything that enters my downloads folder … watch the little gear spin in the menu bar, then it's good to go

7 August at 20:15 | Open on mastodon.sdf.org
J. Ryan Stinnett

@ieure Sounds like they are about to add another layer of complexity in the next major version… 😓

developer.apple.com/news/?id=s

7 August at 20:16 | Open on merveilles.town
Merospit

@ieure And they are going to make it worse in the next version.

7 August at 20:21 | Open on infosec.exchange
Nocta

@ieure

Also, the hoops you have to go through to have an app that you compiled yourself running on your own iPhone device too: gist.github.com/Selene-Amanita

Why are most people completely fine with that??

7 August at 20:28 | Open on octodon.social
Shawn K. Quinn

@ieure Unfortunately this is par for the course for Apple.

7 August at 21:01 | Open on toot.community
past oral no mad

@skquinn Yep -- it's one reason (among many) why I switched back to Linux, use a deGoogled Android phone, etc.

Unfortunately, this is the work laptop, and I have no control over the hardware or OS.

7 August at 21:13 | Open on retro.social
Amber

@ieure@retro.social yeah I find apple’s quarantine to be annoying

7 August at 21:08 | Open on transfem.social
0x4d6165 :ecoanarchism_heart:

@ieure even windows 11 isn't that bad ​:woe:​

7 August at 21:15 | Open on wanderingwires.net
Jakob

@ieure actually that’s a thing I wanted to know before - thx for the advice

7 August at 21:32 | Open on social.hardfork.ngo
Go Up