The true and false security benefits of Mac app notarization

from blog The Desolation of Blog, | ↗ original
Almost everyone, including Apple, has painted a false picture of the security benefit of Mac app notarization. There is a true benefit, which I haven't seen anyone mention, but I'll discuss it here. On the other hand, the publicly touted benefits of notarization are bunk, in my opinion, and I'm going to debunk them in this post too. Most notably, I'll explain how the notarization malware scan is superfluous security theater, a mere marketing gimmick that I believe ought to be abolished because of the burden it places on legitimate developers.
This is a short summary. ↗ Open original to view full content

Related

Praying for passkeys to get better
Birchtree | original ↗
Apple listened and fixed my main issue with the CTF
Birchtree | original ↗
Apple OSes Are Insecure By Design To Aid Surveillance
Jeffrey Paul | original ↗
Apple didn't steal your data, but also kinda did
The Dent | original ↗
Apple didn’t steal your data, but also kinda did
The Dent | original ↗
Licensing can be joyful (and legally dubious)
ntietz.com blog | original ↗
iMessage and outrage theatre
The Dent | original ↗
You get the good and the bad
Birchtree | original ↗
Small Mac apps I love
Muffin Man | original ↗
Weekly Update 420
Troy Hunt's Blog | original ↗

More from The Desolation of Blog

Technology is never a substitute for consent
4 Jan 2025 | original ↗

This is a follow-up to my recent blog posts Apple Photos phones home on iOS 18 and macOS 15 and The internet is full of experts. I've read a lot of the discussion about and responses to my blog posts, which has forced me to hone my own thinking and arguments on the subject. I characterized Apple's new Enhanced Visual Search feature as a privacy...

The internet is full of experts
31 Dec 2024 | original ↗

My recent blog post Apple Photos phones home on iOS 18 and macOS 15 has received widespread attention, and perhaps inevitably, it has also received widespread criticism by random internet commenters. A common criticism is that I somehow discredited myself by stating, honestly, "I don't understand most of the technical details of Apple's blog...

Apple Photos phones home on iOS 18 and macOS 15
28 Dec 2024 | original ↗

This morning while perusing the settings of a bunch of apps on my iPhone, I discovered a new setting for Photos that was enabled by default: Enhanced Visual Search. (I manually disabled it before taking the screenshot below.) Apps > Photos"> This setting is also new to Photos on macOS Sequoia, and enabled by default. Oddly, this new feature has...

Deep dive into a macOS default web browser bug
20 Dec 2024 | original ↗

This blog post has undergone some revision and correction since first published. It turns out, contrary to my initial assumption, that the code signatures of the apps is largely irrelevant. Thanks to Avi Drissman of the Google Chrome team for assistance! According to the Apple Developer Documentation, "macOS Launch Services is an API that enables...

How Safari 18.2 https upgrade works
12 Dec 2024 | original ↗

Yesterday, Apple released Safari version 18.2, included with iOS 18.2 and macOS 15.2, as a separate update for macOS 14 and 13. I've already discussed one new feature of Safari 18.2, Copy Link with Highlight, in another blog post. Now I'd like to discuss another new feature, automatic https upgrade. From Apple's announcement: Safari 18.2 on iOS,...