Most active commenters
  • saagarjha(3)

←back to thread

MacOS Catalina: Slow by Design?

(sigpipe.macromates.com)
2031 points jrk | 19 comments | 22 May 20 15:39 UTC | HN request time: 0.207s | source | bottom
Show context
davidvartan ◴[22 May 20 15:53 UTC] No.23273396[source]▶
> a degraded user experience, as the first time a user runs a new executable, Apple delays execution while waiting for a reply from their server.

The way to avoid this behavior is to staple the notarization ticket to your bundle (or dmg/pkg), i.e. "/usr/bin/stapler staple <path>." Otherwise, Gatekeeper will fetch the ticket and staple it for the user on the first run.

(I'm the author of xcnotary [1], a tool to make notarization way less painful, including uploading to Apple/polling for completion/stapling/troubleshooting various code signing issues.)

[1] https://github.com/akeru-inc/xcnotary

replies(5): >>23273530 #>>23273867 #>>23273940 #>>23275792 #>>23279360 #
scottlamb ◴[22 May 20 16:36 UTC] No.23273940[source]▶
> The way to avoid this behavior is to staple the notarization ticket to your bundle (or dmg/pkg)

Maybe in some cases, but the article says "even if you write a one line shell script and run it in a terminal, you will get a delay!"

Shell scripts don't come in bundles. I don't think this kind of stapling is possible for them? I don't think it'd be reasonable to expect users to do this anyway.

replies(1): >>23274045 #
1. davidvartan ◴[22 May 20 16:44 UTC] No.23274045[source]▶
The Gatekeeper behavior is specific to running things from Finder (not Terminal), and only if you downloaded it via a browser that sets the com.apple.quarantine xattr.

Two posts from Apple dev support (Cmd+F "eskimo") describe this in more detail.

https://forums.developer.apple.com/thread/127709

https://forums.developer.apple.com/thread/127694

replies(4): >>23274142 #>>23274402 #>>23275448 #>>23278587 #
2. nemosaltat ◴[22 May 20 16:51 UTC] No.23274142[source]▶
I recently learned that `xattr -cr path/to/my.app` solves the “this App is damaged would you like to move it to the trash” you get when you copy an app from one Mac to another.
replies(1): >>23274362 #
3. rhizome ◴[22 May 20 17:06 UTC] No.23274362[source]▶
That might be the Windows-iest feature of OSX I've ever heard of.
replies(2): >>23274887 #>>23275013 #
4. JadeNB ◴[22 May 20 17:09 UTC] No.23274402[source]▶
> The Gatekeeper behavior is specific to running things from Finder (not Terminal), and only if you downloaded it via a browser that sets the com.apple.quarantine xattr.

The article says the described problem isn't limited in this way:

> This is not just for files downloaded from the internet, nor is it only when you launch them via Finder, this is everything. So even if you write a one line shell script and run it in a terminal, you will get a delay!

replies(2): >>23274503 #>>23275861 #
5. ◴[22 May 20 17:16 UTC] No.23274503[source]▶
6. cosmojg ◴[22 May 20 17:47 UTC] No.23274887{3}[source]▶
It seems macOS is going downhill fast these days.
replies(1): >>23275418 #
7. noisem4ker ◴[22 May 20 17:59 UTC] No.23275013{3}[source]▶
What would that mean?
replies(1): >>23275283 #
8. bobbylarrybobby ◴[22 May 20 18:25 UTC] No.23275283{4}[source]▶
It would appear to mean it's a hacky, over-technical solution to a problem that shouldn't exist in the first place, as copying things from one computer to another should just work™. This is one place where macOS used to shine and seems to be increasingly falling behind in.
9. withinboredom ◴[22 May 20 18:38 UTC] No.23275418{4}[source]▶
No, it’s just that they’re becoming more popular. When you become a popular desktop OS, governments and militaries want to start using it which comes with some strange requirements. It also means that you can’t rely on “obscurity” to provide any sort of security, where before you could overlook some things.
replies(1): >>23275723 #
10. reuben_scratton ◴[22 May 20 18:41 UTC] No.23275448[source]▶
Quinn The Eskimo at Apple's forums is a 10x support engineer, his posts have helped me fix dozens of problems.
replies(2): >>23275574 #>>23276175 #
11. saagarjha ◴[22 May 20 18:54 UTC] No.23275574[source]▶
He needs to be, because Apple Developer Technical Support is chronically understaffed.
12. catalogia ◴[22 May 20 19:07 UTC] No.23275723{5}[source]▶
Can you cite any sources for your claim that these things are being implemented to satisfy government/military requirements?
replies(1): >>23276209 #
13. staticfloat ◴[22 May 20 19:21 UTC] No.23275861[source]▶
If you read the comments of the article and do your own testing, you will find that reality appears to be more complicated than the article suggests. Users have shown using both timing and wireshark that the shell scripts do not appear to be triggering notarization checks.
14. Someone ◴[22 May 20 19:53 UTC] No.23276175[source]▶
Unless somebody took over his name he’s been at Apple for almost 25 years, and was already being interviewed as such 20 years ago (http://preserve.mactech.com/articles/mactech/Vol.16/16.06/Ju...)

His site (http://www.quinn.echidna.id.au/Quinn/WWW/) supports its claim “I'm not a great believer in web” :-)

replies(1): >>23278111 #
15. o-__-o ◴[22 May 20 19:56 UTC] No.23276209{6}[source]▶
DISA?

I don’t know why grand op is downvoted. DoD requirements literally require a timeout setting for screensavers to begin locking. This has caught systems which have a race condition where you can move your mouse quickly and gain desktop access before it locks.

The long term effects come from the required changes to the development security model to remain productive and profitable (took MSFT a few OOB hotfixes and service packs to fix that example above, look when gnome kde xscreensaver etc introduced that feature etc)

replies(1): >>23278090 #
16. saagarjha ◴[22 May 20 23:05 UTC] No.23278090{7}[source]▶
> This has caught systems which have a race condition where you can move your mouse quickly and gain desktop access before it locks.

I fail to see how this is a race condition rather than how a screensaver is supposed to work?

replies(1): >>23278603 #
17. saagarjha ◴[22 May 20 23:07 UTC] No.23278111{3}[source]▶
It's interesting to see a time when Apple seemed to allow employees to have side projects…
18. xenadu02 ◴[23 May 20 00:17 UTC] No.23278587[source]▶
This is the way things worked prior to Catalina but is no longer the case.
19. o-__-o ◴[23 May 20 00:19 UTC] No.23278603{8}[source]▶
Because it’s not, that’s why I pointed to xscreensaver feature implementation. Lock time is separate from screensaver activation time which is separate from energy saving activation time.

What defines when a locking screen saver is “locked”? 10m? Or 10m1s? You are making assumptions and that is what DISA spells out. Which forces the OS design to change in subtle ways. Like xattrs on files as great grand op was alluding to.

Does that provide clarity into how development security models evolve over the lifetime of an application?