[HN Gopher] Ventura has changed app quarantine with a new xattr
___________________________________________________________________
Ventura has changed app quarantine with a new xattr
Author : rcarmo
Score : 77 points
Date : 2023-03-13 08:23 UTC (14 hours ago)
(HTM) web link (eclecticlight.co)
(TXT) w3m dump (eclecticlight.co)
| cobertos wrote:
| I didn't know about extended attributes before this, but also I
| grew up with Windows and now Linux and just haven't run into
| them.
|
| Do people other than the OS tend to use these? Are they well-
| trodden and portable between OS's? I've seen Unity's .meta files
| and kind of haten them but assumed they were sort of the "the
| way"
| kccqzy wrote:
| I pretty much treat them as macOS only. Useful for things like
| Spotlight comments, Finder tags, and other macOS-exclusive
| features.
|
| They were originally introduced in Tiger, by the way.
| https://arstechnica.com/gadgets/2005/04/macosx-10-4/7/
| PeterWhittaker wrote:
| > I didn't know about extended attributes before this, but also
| I grew up with Windows and now Linux and just haven't run into
| them.
|
| Extended attributes have existed in Linux for many years and
| are used extensively in security controls.
|
| The two most common examples are likely access control lists
| (ACLs) and SELinux contexts.
|
| For the latter, many commands (mv, cp, ls, ps, etc.) have a -Z
| option to preserve or view the SELinux context associated with
| a file/process.
| loeg wrote:
| > I didn't know about extended attributes before this, but also
| I grew up with Windows and now Linux and just haven't run into
| them.
|
| The _somewhat_ similar mechanism on Windows is Alternative Data
| Streams. ADS are like named subfiles below your main file. If
| you squint pretty hard, unix xattrs look kind of similar --
| they 're also named binary objects attached to files. But
| xattrs are typically limited to much smaller amounts of data
| due to implementation details, and are also namespaced with
| some sort of integer enum (on Linux, "user" and "system" are
| common).
|
| I would not really assume they're a portable construct,
| although commonly used unix-likes (Mac and Linux) both support
| them in their most popular filesystems.
| ciupicri wrote:
| One of the most popular ADS is probably the Zone.Identifier
| [1][2] which is how Windows knows if the program you're
| trying to run was downloaded from the Internet.
|
| [1]: https://learn.microsoft.com/en-
| us/openspecs/windows_protocol...
|
| [2]: https://devblogs.microsoft.com/scripting/powertip-use-
| powers...
| newaccount74 wrote:
| I wish these internal behaviors of macOS were documented
| somewhere. A lot of these security features are pretty neat, but
| developers have to use trial and error to figure out how they
| work.
|
| If something doesn't work, we have to wonder if it is by design
| or by accident, and the only way to know is to use a tech support
| incident, hope it gets escalated to the right person, and see if
| you get an answer.
|
| Every year I worry if Apple breaks something in one of my apps,
| and when they do I have to scramble to find a workaround that
| hopefully doesn't impact my users.
| oneplane wrote:
| If I'm not mistaken, the point of internal (private) elements
| and public parts is exactly that: the vendor doesn't need to
| maintain a public interface for the parts you're not supposed
| to touch. So as long as you don't use them, you should be safe.
|
| There are of course different problems in the realm of changing
| public APIs and that just sucks. On the other hand, it sucks
| less than having 3 decades of baggage that nobody really asks
| for.
| newaccount74 wrote:
| The problem is when those internal changes break existing
| apps that never intended to depend on Apple internals.
|
| When it happens it's really frustrating to try to figure out
| why the app suddenly doesn't work as expected any more and
| what to change to make it work again.
| erulabs wrote:
| Ventura is a 150 year old city where 100k people live. I know
| this is HN, but can we not let mega-companies capture names like
| this? "macOS Ventura" is far clearer.
|
| </grouch-with-a-friend-named-Alexa>
| coldtea wrote:
| I think one great thing that makes people superior to GPT is
| our increased capacity for context sensitive semantics and
| nuance...
| masklinn wrote:
| > Ventura is a 150 year old city where 100k people live. I know
| this is HN, but can we not let mega-companies capture names
| like this?
|
| Ventura is 5 different cities, two different municipalities,
| hundreds of people, a racehorse, at least one freeway, two
| planes, a ship, a car, a bus company, a guitar brand (defunct),
| an engine, a film festival, a design show, three albums, two
| songs, and two bands. And an OS codename. The exclusivity
| you're claiming never existed, and the name capture either
| doesn't either, or is a long-done deal.
|
| Hell, the name of the city you're talking about isn't even
| Ventura, it's San Buenaventura.
| byteknight wrote:
| You're so confidently incorrect its beyond comical.
|
| In California, Ventura CITY and Ventura county.
|
| A simple Gooling negates the need for you to be so wrong in
| one comment.
|
| Enjoy: https://www.cityofventura.ca.gov/
| https://www.ventura.org/
| naniwaduni wrote:
| Gotta love confidently incorrect attempts at calling out
| other people for being confidently incorrect!
| AdamJacobMuller wrote:
| You'd think you would quadruple check that first.
| Jtsummers wrote:
| > You're so confidently incorrect its beyond comical.
|
| > In California, Ventura CITY and Ventura county.
|
| > A simple Gooling negates the need for you to be so wrong
| in one comment.
|
| > Enjoy: https://www.cityofventura.ca.gov/
| https://www.ventura.org/
|
| From your first link:
|
| https://www.cityofventura.ca.gov/594/About-Ventura
|
| > Ventura, officially named San Buenaventura, was founded
| in 1782 when Saint Junipero Serra established Mission San
| Buenaventura, the ninth of the California missions.
| [deleted]
| isametry wrote:
| I also have a cool link for you:
| https://news.ycombinator.com/newsguidelines.html
| acdha wrote:
| It's not that simple:
|
| > Ventura, officially named San Buenaventura, was founded
| in 1782 when Saint Junipero Serra established Mission San
| Buenaventura, the ninth of the California missions. Serra
| named the mission after the Italian Saint Bonaventure,
| hence the nickname that Ventura is the "city of good
| fortune."
|
| https://www.cityofventura.ca.gov/594/About-Ventura
|
| https://visitventuraca.com/blog/when-san-buenaventura-
| became...
|
| So I would be nicer in general but also take this as a
| distraction from the main point that tech companies
| shouldn't squat on human names. The geographic names will
| be around long after the OS version is obsolete. I know
| multiple Alexas and a Siri who will be quite happy if
| Amazon and Apple rebrand, too.
| [deleted]
| erulabs wrote:
| All the more reason for clarity?
| masklinn wrote:
| If "app quarantine" and "xattr" make you think somebody is
| referring to a city, racehorse, or band, I'm not sure the
| allowed size of titles on HN is sufficient to disambiguate.
| And I don't think many HN title make the cut either.
| swsieber wrote:
| I thought it was pretty clear with the word "app" in there.
| bombcar wrote:
| I had to read it three times before I worked out it wasn't
| some city in California doing something with transfers on a
| Covid-19 quarantine app.
| tiffanyh wrote:
| Companies use cities & national park names in products because
| you can't trademark those names.
|
| So you don't have to worry about being sued over name
| infringement.
| wahnfrieden wrote:
| macOS Ventura is the official name. The linked site is a Mac
| blog so they omitted the prefix. Your anger should be directed
| at hn policy for requiring original headlines at the cost of
| clarity, not Apple or the Mac blog
| erulabs wrote:
| Fair point. I'm not angry, I'm just getting old :P
| prpl wrote:
| Don't worry, there is at least a lifetime on the usage.
| detrites wrote:
| Actually...
|
| > please use the original title, unless it is misleading
|
| The policy appears to invite the adding of clarity. Ie,
| disambiguation in this case.
| dylan604 wrote:
| Yes, because on a tech related forum, the disambiguation of
| city name vs the name of an OS is front of mind on almost
| all readers
| andybak wrote:
| I had no idea what it was about. I don't keep MacOS
| version names in my head. I assumed it was the name of a
| company. "Mac" somewhere in the title would have been
| very useful.
| afandian wrote:
| I used to when they were big cats. It's been downhill
| since...
| partdavid wrote:
| Why? Macintosh is a kind of apple. Apples are fruits.
| Quarantine is a public health protocol. Surely we need to
| make it "Operating system for Cupertino
| (California)-based 'Apple Computer Inc.' computers
| version 13 changes app privilege management scheme with
| new xattr". Way better.
| masklinn wrote:
| Surely you also need to specify that these are said
| operating system's extended attribute feature and not the
| generic and platonic ideal for extended attributes? A
| reader might get confused and think this applies to
| Linus's Unix Which Is Not Actually An Unix.
| doodpants wrote:
| No, McIntosh is a kind of apple. Macintosh is a computer.
| throwaway744678 wrote:
| I thought it was some kind of rain coat
| akerl_ wrote:
| It seems you've tumbled down a slippery slope.
| mtlmtlmtlmtl wrote:
| This is such a lazy take. It only takes one word to
| impose context on the rest of a sentence. MacOS is all
| you need. Not everyone pays attention to Apple's
| computers. I only this year realised their OS is no
| longer called OS X, for crying out loud.
|
| There is very little reason to pay any attention to MacOS
| unless you actually use it.
| mort96 wrote:
| I don't think people read "macOS" and immediately think
| of the Macintosh apple.
| zamnos wrote:
| Wait, which California are you referring to? There's
| three, California in the US, and then Baja California,
| and Baja California Sur in Mexico. There are also quite a
| few in the UK, not to mention California, Ohio,
| California, Pennyslvania, and California, Missouri. Don't
| forget California, Trinidad and Tobago, or California,
| Ubay, Bohol, Philippines; California, Ontario, Canada,
| California, Parana, Brazil; California, Santandet,
| Colombia.
|
| Hang on, I just realized that I'm assuming you're
| referring to a place. There's also the movie California,
| a movie from 1927, 1947, 1963, and 1977. There's also the
| rock band by that name, a Blink 182 album, a Diplo EP,
| and a Joni Mitchell song. The California is also a US
| Navy ship, maybe you meant that one?
|
| Please help, I'm very confused. Which California are you
| referring to? I'm sorry but this conversation simply
| cannot continue until you clear that up. If it's the
| California Nebula, I must admit though that I've yet to
| visit, though the pictures look lovely this time of year.
| vlunkr wrote:
| These version names are around for one year, if you're
| not a Mac user, it's pretty easy to be out of the loop.
| It's a safe place to draw the line.
| detrites wrote:
| Even as a Mac user it can get a bit much.
| smoldesu wrote:
| In the original context of a Mac-focused blog, I think it
| makes sense. On HN though, I have to admit I had no idea
| which it was because of the way it's worded. If the
| subject was "Apple" or "MacOS" then it would read much
| nicer imo.
| [deleted]
| [deleted]
| Ruq wrote:
| Apple's security measures feel like they're designed to protect
| Apple, with users as an accidental side effect.
| lockhouse wrote:
| I think Apple struck an excellent balance with Gate Keeper.
| Your average user can't run random software they accidentally
| download from shady sources, but yet it's easy enough for power
| users to get around if they're willing to accept the risks.
|
| If Apple ever takes away the option to run software that hasn't
| been notarized then I'll feel differently.
| m463 wrote:
| they did it with ios.
|
| my opinion of apple would change drastically if they let me
| run my own software on ios. Heck, I can't even access my full
| filesystem on ios.
|
| (EDIT: without asking permission, let alone paying or
| renewing a cert)
| lilyball wrote:
| They didn't take it away on iOS, it was never a feature of
| iOS to begin with.
| renewiltord wrote:
| You have to pay Apple for the developer program membership
| but after that you can write your own code and run it on
| the iPhone.
| m463 wrote:
| you shouldn't have to ask permission, let alone pay
| lockhouse wrote:
| You don't even have to pay them. With some admittedly
| major limitations, you can do that with a free Apple
| developer account.
| kitsunesoba wrote:
| Apple has been pretty clear in that they consider Macs to
| be in a wholly different category of devices than iPhones,
| iPads, Apple Watches, and Apple TVs. It's why they bothered
| to make booting arbitrary operating systems a publicly
| accessible feature on M-series Macs, which they absolutely
| didn't have to do, with the iPhone/iPad having served as
| the basis of M-series Macs.
| [deleted]
| smoldesu wrote:
| > which they absolutely didn't have to do
|
| Strictly speaking, Apple doesn't _have_ to do anything.
| They 're judged against the quality of their prior
| products though, and prior Macs have worked well with an
| unlocked bootloader. If Apple threw that feature away
| (like the headphone jack or 32-bit software), then it
| would have been noteworthy, but it's not. You're
| ascribing goodwill to something as simple as a non-
| removed feature.
|
| Whatever the case is with Macs, regulators at-large don't
| seem to agree with Apple's product segmentation. If they
| want to distinguish iPhones from Macs, they'll have to
| find a way that doesn't undermine user authority.
| lapcat wrote:
| There are many known instances where malware from shady
| sources has been notarized.
|
| Anyone in the world with $99 can join the Apple Developer
| Program, and Apple's automated malware checker is not that
| great.
|
| Moreover, any innocent appearing app can download another app
| and run it without having to go through Developer ID or
| notarization, so the whole thing is security theater.
| oneplane wrote:
| What it mostly provides is a revocation mechanism, which in
| itself is relatively powerful. On top of that, there is the
| notary mechanism which further strengthens the option of
| creating a digital immunity system. The main issue is the
| balance between security and usability, which is not
| something that is perfectly solved within a single decade.
| whartung wrote:
| It's certainly an improvement, but in the end it ends up like
| the "type in your password to continue installation".
|
| If an app is not notarized, you can right click and open it.
|
| Do either of these enough, and it becomes automatic. Back in
| the day, on Windows, pretty much everything out of the box
| had to be installed "as admin". Even the most mundane apps
| required admin. Folks just routinely simply logged in as
| "admin", giving every random app privilege, make the
| limitation effectively pointless.
|
| Many apps on the Mac require an admin to install them. It's
| not universal, like it seemed to be on Windows, but many apps
| require admin. It's not a leap to blindly right click on a
| new downloaded installer, and type in your password to
| install it. Or "<App> wants to access removable media" "OK!"
|
| We're conditioned to just click through these warnings
| because, honestly, we just want the software, and we just
| want it to work. We don't want to interview everything as a
| hostile party.
| nyanpasu64 wrote:
| Just the other day I tried installing a custom Webcord
| build to fix "select all" on macOS
| (https://github.com/SpacingBat3/WebCord/issues/319).
| Surprisingly this time, right-click and open didn't make
| the "app corrupted" message go away, and I had to disable
| Gatekeeper entirely to install the package.
| cobbal wrote:
| I find the command `xattr -r -d com.apple.quarantine
| SomeApp.app` goes a long way toward fixing many
| gatekeeper problems. For some reason, the right click
| often fails for me.
| mrguyorama wrote:
| Supposedly the right click method only works if you have
| already attempted to open the app a normal way, and
| gotten the "error" message. Only then can you right click
| to open anyway.
___________________________________________________________________
(page generated 2023-03-13 23:02 UTC)