[HN Gopher] Going All in on the Mac App Store
       ___________________________________________________________________
        
       Going All in on the Mac App Store
        
       Author : s3cur3
       Score  : 58 points
       Date   : 2020-12-23 20:16 UTC (2 hours ago)
        
 (HTM) web link (www.unboundapp.com)
 (TXT) w3m dump (www.unboundapp.com)
        
       | sneak wrote:
       | This is disappointing and sad. The more people who do this, the
       | more difficult it becomes for those who don't.
       | 
       | You can't download even free apps from the App Store without
       | providing an email address, phone number, and street address (to
       | get an Apple ID). The App Store app also sends the mac's hardware
       | serial number to Apple when you launch it, associating it with
       | your identity in the logs. The email and phone required are
       | verified so you can't just make some shit up.
       | 
       | This means that to get any apps from the App Store, even free
       | ones, you must be thoroughly de-anonymized.
       | 
       | Not caring about privacy because you have nothing to hide is like
       | not caring about free speech because you have nothing to say.
       | 
       | Developers should reject the App Store on customer privacy
       | grounds alone. When this becomes the sole method of distributing
       | apps on the mac, as it is on iOS, the world becomes a much worse
       | place, as then the US government had permanent access without a
       | warrant to every app you use.
       | 
       | Please don't contribute to building that world.
        
         | globalproctd wrote:
         | ... you can install apps on Mac without going through the App
         | Store.
        
         | s3cur3 wrote:
         | Is the implication that I, a random guy across the internet, am
         | a better steward of your personally identifying information
         | than Apple? I'm not saying you're wrong, but that definitely
         | doesn't match my own intuitions.
        
           | sneak wrote:
           | The implication is that, regardless of price, making the App
           | Store more useful and valuable harms privacy for everyone, as
           | it reduces the ability of people to resist Apple restricting
           | features or functionality to App Store only, as they have
           | already done with VPN apps using the NetworkExtension API.
           | These cannot be installed outside of the App Store at all,
           | even self-built ones.
           | 
           | There is also the issue of surveillance. Apple processed
           | warrantless FISA surveillance orders for 30,000 users last
           | year, per their own transparency report.
           | 
           | It's possible that people don't want Apple (and by extension
           | the FBI and US military, with no probable cause or warrant
           | required) knowing the apps they purchase and use, or when, or
           | on which devices.
           | 
           | Being App Store only prohibits that, and requires that your
           | users be subject to this surveillance.
           | 
           | It's the same issue with posting to Instagram, for example:
           | deciding to donate free content to Facebook there makes the
           | product more attractive to Facebook's users and makes it
           | harder for small businesses to opt out of using Facebook's ad
           | business. Decisions like this make the whole world worse.
        
             | mirthflat83 wrote:
             | Lmao. Might as well solely accept bitcoin to protect the
             | user's privacy. That would be a fantastic user experience.
        
         | orf wrote:
         | > Developers should reject the App Store on customer privacy
         | grounds alone
         | 
         | Consumers go where it's most convenient, and sellers follow
         | them. Anything else is wishful thinking at best.
        
         | [deleted]
        
         | amelius wrote:
         | Plus some things like sexual content are banned from the App
         | Store.
         | 
         | The App Store might be safe and all, just like Disneyland is a
         | safe place for kids, but I personally prefer the real world.
        
       | s3cur3 wrote:
       | OP here, happy to answer any questions. I know Apple gets a lot
       | of well-deserved flack, but for a small-time dev like me, them
       | taking a 15% cut makes things a lot simpler for me.
        
         | abhinav22 wrote:
         | I was thinking about this as well. When you are small, it's
         | definitely a lifesaver. When you get big, then you have to
         | figure it out.
         | 
         | But when you are small, you have enough problems to solve to
         | bring a quality product to market, this is one headache you can
         | happily avoid.
        
         | ben509 wrote:
         | How does the no paid upgrade issue affect you?
        
         | ummonk wrote:
         | On the consumer side I also would prefer 15% higher pricing
         | than to have to deal with various different payment forms as
         | well as the difficulty of keeping track of and canceling
         | various subscriptions.
        
           | thewebcount wrote:
           | Yeah, same here. And even when it's a processor I know like
           | Stripe, Square, or Shopify, I don't really trust those
           | companies very much. I've gotten spam, other people's
           | receipts, etc. from them and their tech support is horrible
           | for the consumer. And if they aren't a name I know like one
           | of the above, I'm really leery of giving them my email and
           | credit card info!
        
             | cuddlybacon wrote:
             | Same here. The last time I bought software that wasn't thru
             | a well known store or processor I ended up with some
             | fraudulent purchases on my next credit card bill[0]. Since
             | then, I'll never do that again.
             | 
             | [0] - Thankfully my bank handled this without issue.
        
         | offtop5 wrote:
         | I completely agree with your direction, having Apple take the
         | responsibility to safeguard user data makes things much easier.
         | 
         | For better or worse Apple can do no wrong and the eyes of its
         | customers, so even if they did somehow get hacked, you wouldn't
         | have hundreds of angry emails headed your way.
         | 
         | I personally really do love the walled garden of owning a Mac,
         | when I'm working on a song or music video, I just want it to
         | work using final cut and logic. If I really feel like compiling
         | the Linux kernel from scratch, I have a PC for that
        
         | smoldesu wrote:
         | I'm really sorry to hear you've been forced into this
         | situation. I seldom use MacOS these days, but when I do, buying
         | an app from the App Store is the one thing I'm least likely to
         | do. I hope that one day it becomes viable to distribute your
         | app through a less centralized platform.
        
         | blunte wrote:
         | Are you not concerned with Apple potentially delisting you or
         | rejecting a future update due to some reason which may or may
         | not be clear? I suppose you can always go back to direct if
         | that happens, but people who bought via App Store will be out
         | of luck for updates then.
        
           | s3cur3 wrote:
           | Eh, I toe the line as far as policy is concerned. I'm not
           | worried, personally.
        
         | fartcannon wrote:
         | Please don't do this. You're short term gain is the worlds long
         | term loss.
        
           | quesera wrote:
           | Are you arguing for a zero-middleman retail relationship? Or
           | just anti-Apple?
        
         | RyJones wrote:
         | I bought it, I'll give it a whirl. I've been importing my
         | photos from Flickr, which has led to thousands of duplicates.
        
           | s3cur3 wrote:
           | Sweet! Give me a shout if you run into issues. :)
        
         | sieabahlpark wrote:
         | That's precisely the point though. It works for small devs but
         | as you grow that 15% is enough to pay a team to build your own
         | app store.
         | 
         | That's the problem with the model.
        
       | [deleted]
        
       | W-Stool wrote:
       | Some years ago I looked at developing a MacOS app and
       | distributing it through the App Store. I came away from that
       | experience with two showstoppers:
       | 
       | - Apple does not disclose to you who bought your app.
       | 
       | - There is no mechanism to make paid updates possible. If you
       | want to release a big update and get paid you need to release a
       | new app. There is no way to contact current users and offer them
       | an inexpensive update.
       | 
       | Are these two issues still true of the MacOS App Store?
        
         | layoutIfNeeded wrote:
         | >Apple does not disclose to you who bought your app.
         | 
         | Maybe because it's none of your business?
        
         | killion wrote:
         | Reeder did a really great job of dealing with this. I use
         | Reeder 4 and got a one time modal on launch that Reeder 5
         | exists and what the potential reasons to upgrade would be.
        
         | ska wrote:
         | > Apple does not disclose to you who bought your app.
         | 
         | This is a feature.
         | 
         | The paid update thing is a bit of a challenge on both sides; it
         | does seem like someone should have come up with a better way to
         | do this.
        
         | jimbokun wrote:
         | Do developers get around the "no updates" problem with "In App
         | Purchases"?
         | 
         | Or do "In App Purchases" not really allow for deploying new
         | code and features?
        
           | valuearb wrote:
           | You can use IAP for upgrades. it's just a bit more work,
           | grows your testing matrix significantly and is a bit more
           | confusing to your customers.
        
           | gowld wrote:
           | That's a janky workaround. You have support both the old and
           | new features/behaviors in one app, and push an update that
           | wraps the old and new features in code like
           | 'if(IAP_X_ENABLED())'.
           | 
           | Any architectural refactorings aren't compatible with that
           | model, so you'd have to launch MyApp2019 and MyApp2020, and
           | hope Apple lets you do that.
        
           | cuddlybacon wrote:
           | Another work-around I've seen is updating the old app that
           | has a one-time popup to alert users to the new version. As a
           | user, I can live with that as long as it is a one-time popup.
           | 
           | This is really something the store should handle.
        
         | valuearb wrote:
         | No upgrades is a lamentable omission, but subscriptions and IAP
         | can help replace it (not as well tho).
         | 
         | Protecting purchasers privacy is a great customer benefit,
         | which also helps increase developer sales. For example, App
         | Store customers never have to worry about being spammed by some
         | developer they bought an app from.
         | 
         | You can still find out who is using your apps, just ask them
         | within the app. They may not tell you, but again that's a happy
         | customers right.
        
       | gumby wrote:
       | I buy directly from the publisher whenever that is an option
       | simply because I figure they need the 30% more than Apple does.
       | 
       | But I agree that the App Store is a far better experience both in
       | purchase and then upgrade. My mum has one non-app store app on
       | her Mac and is always befuddled by the upgrade prompt. Even for
       | my own use I find the App Store upgrade is almost always better
       | than other means.
        
       | camhart wrote:
       | A "better experience"? Maybe for a Mac only app. But once your
       | product spreads across multiple platforms is much easier for the
       | customer to download the app for all platforms in one place--your
       | website.
        
         | s3cur3 wrote:
         | Indeed! In this case, Unbound is Mac only, and probably will
         | remain so for its entire life.
        
       | racl101 wrote:
       | As a consumer I hate the Mac App Store so much if only for the
       | reason that every time I want to do something I have login again
       | and again. The Mac App store is quite buggy. Sometimes I have to
       | log in two times in a row. I hate it so fucking much that I
       | almost consider not buying a good product just to avoid the Mac
       | App Store's shitty app.
       | 
       | I also hate that the purchase is tied to my Apple ID, especially
       | for a utility that I'd like to use in another computer. Say a
       | workstation where I might have a different Apple ID.
       | 
       | If an app, for example, can be installed in two work machines, I
       | don't want my Apple ID to dictate which machines.
       | 
       | Anyways rant over.
       | 
       | I get that for the seller's point of view the Mac App Store's
       | updated policy is a boon.
        
         | LeoPanthera wrote:
         | For what it's worth, the "log in repeatedly" bug has hit me
         | too, but I discovered that if I sign out and then sign in
         | again, it remains fixed for weeks if not months. Worth a try.
        
         | redkoala wrote:
         | Steam is a desktop App Store done right. If only they would
         | move more into the app space rather than game space.
        
         | sleepyhead wrote:
         | The App Store is great for products from unknown developers and
         | in other cases where I'm not to sure if I fully trust the
         | software/developer. In other cases I prefer to buy direct.
        
         | SomeHacker44 wrote:
         | I get it worse. Sometimes it goes in a permanent loop asking
         | for my password infinitely many times and doing nothing, until
         | I Force Quit, which does not usually help the problem.
         | 
         | It truly sucks and I regret the few purchases I made with it.
         | But, the light is at the end of the tunnel: Windows 10 and WSL.
        
           | smoldesu wrote:
           | I think the light you're referring to is Linux, and the
           | tunnel is Windows :D
           | 
           | On a more serious note, you shouldn't be so dismissive of
           | open source desktop environments, KDE 5 is quite usable
           | today, and GNOME 40 looks to be pretty good too. Give it a
           | whirl, you might just like it.
        
           | qz2 wrote:
           | Grass is not greener on the windows and WSL side. It's
           | yellowed and littered with turds to stand in. I run both
           | platforms side by side and the Mac is by far the least
           | painful. Windows 10 on an average day is like gargling sand.
           | I mean for two months now alt-tab is broken on 20H2 release.
           | No fix incoming yet. Zero days unpatched for 90 days etc. On
           | WSL it's a networking and HyperV encrusted nightmare. Have
           | fun trying to get anything vaguely complicated to do anything
           | even remotely sane. Total shit show.
           | 
           | A fine comparison is the windows App Store which is genuinely
           | like playing Russian roulette with a gun made of butter. The
           | Mac App Store is much much much less crazy.
           | 
           | The Mac has its fair share of suck but my word at least they
           | actually tried to put something cohesive together.
           | 
           | Going to put it honestly but I don't think Microsoft are
           | earning my respect or attention, just shouting about how
           | wonderful their product is while it's falling to pieces in my
           | hands.
        
             | manderley wrote:
             | There are two versions of WSL, one is Hyper-V based, the
             | other isn't. If you have trouble with Hyper-V, simply
             | switch to WSL1.
        
       | fartcannon wrote:
       | Don't? For the sake of the future, don't use app stores that are
       | monopolies.
       | 
       | Do both, at the very least.
        
         | judge2020 wrote:
         | The Mac App Store is further from a monopoly than the Play
         | store is on Android. AFAIK even new Macs from Apple come with
         | the gatekeeper setting allowing apps from both the Mac App
         | Store and identified developers.
         | 
         | You could say that the developer account + notarization
         | requirement is still a way for Apple to have a monopoly, but
         | there aren't many stories of legitimate (ie. not adware)
         | applications getting their certificate revoked or being
         | rejected by notarization.
        
       | jbverschoor wrote:
       | Thank you!
        
       | tunesmith wrote:
       | Does the 15% have a shelf? Like... if a business makes
       | $1,000,001, do they owe 30% on the entire amount, or just the
       | extra dollar? In other words, is there a disincentive to go above
       | a million until you're above two million?
        
         | ghshephard wrote:
         | I've asked that question of five or six Apple/IOS developers,
         | some of them well known, and they've all just laughed at me.
         | 
         | Worrying about coming close to $1mm/annual sales is something
         | precisely zero of them were worried about.
         | 
         | The answer to your question is, according to what I've read,
         | yes - at $999,999 you owe $150K. At $1,000,001, you owe $300K.
         | But - if you can get to $1mm, it's highly likely that $1.5mm,
         | $2.0mm+, etc... are coming soon enough.
         | 
         | Many developers are focussing on $50k, $60k, type scenarios,
         | where the 30% to 15% means enough money in their pocket to
         | afford new development hardware, etc...
        
           | s3cur3 wrote:
           | As I understand it, if you make $1 more than $1M, it's not
           | that you suddenly owe an extra $150k in "back taxes," but
           | rather that going forward, you'll be in the 30% "tax
           | bracket." It's still a tax cliff, and therefore kind of
           | problematic (if it's November 2021 and you've made $950k,
           | you're strongly incentivized to shut down sales until the new
           | year!), but as you say, that's a problem 99% of devs would
           | love to have.
        
             | ummonk wrote:
             | How is it a tax cliff? My understanding is that after you
             | hit 1 million they will start taking 30% of money that
             | comes in after that for the rest of the year.
        
               | chongli wrote:
               | The issue is that if you cross the $1m threshold in the
               | current year then the next January you don't go back to
               | 15%, you stay at 30% for the whole next year.
               | 
               | So if next year your sales fall slightly below $1m, you
               | end up paying $150k in extra Apple tax. Then the
               | following year you go back to the 15% rate.
        
         | 908B64B197 wrote:
         | That's one thing MS got right.
         | 
         | If an App is found through external marketing they take a
         | minimal fee. But if it's discovered through the store they take
         | the full commission.
        
         | alextheparrot wrote:
         | If I recall the news release correctly it is:
         | 
         | a) If you currently make under 1$ million your rate will now be
         | 15%
         | 
         | b) If you to over 1 million you will be charged progressively,
         | so each additional dollar you now only get 70%
         | 
         | c) If you go over, the next year your starting rate will be 30%
         | for every dollar
        
           | ncw96 wrote:
           | Yep, this is how the program works. One thing I would add is
           | the $1 million threshold is based on your net proceeds after
           | Apple's cut, not your total sales.
           | 
           | https://developer.apple.com/app-store/small-business-
           | program...
        
         | [deleted]
        
         | [deleted]
        
         | dfabulich wrote:
         | https://developer.apple.com/app-store/small-business-program...
         | 
         | > _If a participating developer surpasses the 1 million USD
         | threshold, the standard commission rate will apply for the
         | remainder of the year._
         | 
         | If you make $999K from January to June, your July revenues will
         | be charged at 30%. That's pretty close to a progressive fee
         | structure, but not quite exactly progressive.
         | 
         | In no case will they claw back $150K from the money they
         | already paid out.
        
         | jasamer wrote:
         | Nitpick: you'd have a disincentive in the, roughly,
         | 1.000.001-1.220.000 range. Above that, you make more money
         | anyway.
        
           | 0xEFF wrote:
           | Isn't it just like a progressive tax and there's never a
           | disincentive to make more money?
        
         | Lt_Riza_Hawkeye wrote:
         | Just the extra dollar, the first year it happens. Starting next
         | year you will be paying 30% on everything.
        
           | john_alan wrote:
           | That's insane. It should be like taxes.
           | 
           | So you can make 1MM and keep 850k or make 1.001MM and keep
           | 660.001k?
        
             | [deleted]
        
             | lifeisstillgood wrote:
             | Agreed - that's going to have some very weirded unintended
             | consequences. It would be in someone's interest at 950k
             | sales that year to basically stop selling. You would need
             | to be sure you can make 150k of sales absolutely the next
             | year or you actually lose money.
             | 
             | I suppose it's a first class problem to have but it's odd
             | why Apple would make (a small number of companies
             | admittedly) have it all.
             | 
             | I suspect it's a policy that will change after Tim Cook
             | reads the viral blog post in 2022
        
             | quesera wrote:
             | That _would_ be insane, but it is not accurate.
             | 
             | Only the marginal fee goes to 30% -- there is no
             | retroactive application to the first $1MM of income. The
             | new rate applies to future income only.
             | 
             | And unfortunately, triggering the rate increase is
             | _sticky_. If you go over $1MM is 2021, the 30% rate will
             | apply to all of your income in 2022. (If you are under $1MM
             | in 2022, the rate will reset to 15% for 2023).
             | 
             | This is the actual confusing part. Surely Apple could just
             | apply the 15% rate to the first $1MM of every developer's
             | income in each year instead. It's simpler, and it doesn't
             | create the weird incentive to depress earnings at the end
             | of the calendar year if they are approaching $1MM.
        
         | bengale wrote:
         | Yeah it works like the sort of startup programs you can get
         | from a lot of providers. If you're income is under a threshold
         | for that year your rate is discounted. It's not a tax so
         | doesn't work in levels, if you no longer meet the requirements
         | for the program then the next year you're no longer on a
         | discount.
        
       | mmastrac wrote:
       | FWIW, I refuse to buy stuff from the Mac App Store because it's
       | just not compatible with my life. I don't have any i-devices. I
       | have a handful of iCloud/iTunes accounts of which I'm not sure
       | which is technically the one I want to use (one of them is even a
       | legacy pre-email one).
       | 
       | I never connect my OSX box with my personal email and I will not
       | in the future. I get it, but I just won't buy software from that
       | store, hands down.
       | 
       | Maybe I'm just in the dwindling minority of Mac users.
        
         | wlesieutre wrote:
         | What's a legacy pre-email one? Does that date back to before
         | iTools or something?
         | 
         | I'm pretty sure I'm on my original Apple account from back when
         | it was iTools and then .mac and finally iCloud. If one of those
         | transitions didn't carry over, then maybe it's from 2004ish
         | when I needed an account to redeem Pepsi caps for iTunes
         | downloads.
         | 
         | But I've heard the "I accidentally have purchases on 8
         | different Apple accounts" story from enough people that the
         | account/license management is clearly a problem that needs
         | dealing with.
        
           | mmastrac wrote:
           | I can (or at least could - haven't tested for a while) sign
           | in with my "apple username" that doesn't contain an @ sign at
           | all.
        
             | thewebcount wrote:
             | If you care about it, you should try again, as they
             | recently sent me an email about purging such usernames. I
             | don't recall what the deadline was, but it's coming up.
        
             | wlesieutre wrote:
             | Ah, perhaps mine was that way at once point and switched
             | over when I changed email addresses.
        
         | s3cur3 wrote:
         | Out of curiosity, do you buy software from small devs at all?
         | It seems like, whatever the privacy/security implications may
         | be when buying via Apple, they're worse when dealing with a
         | totally unknown party.
        
           | mmastrac wrote:
           | Yep. Bartender, DaisyDisk, NoCrash for my MBP, and a few
           | others.
        
             | s3cur3 wrote:
             | Huh. Cool! As I said elsewhere in the thread, my personal
             | intuition is that Apple is a significantly better steward
             | of my information (and credit card!) than a random small-
             | time dev on the internet, but I realize not everyone
             | agrees.
        
               | mmastrac wrote:
               | The security of my credit card is really up to Visa or
               | Mastercard to deal with. I'm more likely to have it
               | stolen by a random fast-food worker than entering it into
               | a PCI-compliant website (out of all the times it's been
               | compromised, they've nearly always been because it was
               | handed over to someone to scan in the USA).
        
               | xoa wrote:
               | FWIW, most small time devs aren't going to be "stewards
               | of information" to any significant degree unless they're
               | actively trying. Handling finance will be outsourced
               | either way, using Stripe or one of many other 3rd party
               | services, you wouldn't be processing any of that
               | yourself. I buy a ton of 3rd party indy software on my
               | Mac and always have, and nothing from the MAS, and
               | typically the only "personal info", kind of, is an email
               | and maybe my name (and it's not as if that's verified
               | somehow, I could just put in whatever). I also have
               | plenty of email accounts and can trivially make more, as
               | well as developer-specific aliases.
               | 
               | Plus there are other tools to further layer if it was
               | ever a problem, like virtual credit card numbers. In
               | practice the very nature of credit cards means it doesn't
               | seem to generally be a problem, has been less of a real
               | world risk than hacks of physical retailers. If I see a
               | bad charge, I just report it and get a new number.
               | 
               | Also FWIW, I've seen plenty of sites starting to offer
               | Apple Pay as an option at checkout, I assume it's getting
               | built into more payment systems now. That itself is solid
               | defense, at least as good as the MAS though sometimes the
               | checkout flows seem a bit wonky still.
        
           | jonpurdy wrote:
           | I, too, vastly prefer purchasing outside of the App Store to
           | the point where I'll often not bother if I don't absolutely
           | need the app.
           | 
           | Too many times I've tried to run App Store apps and been
           | bothered with my Apple ID. I prefer the decentralization and
           | not relying so much on Apple's cloud services.
           | 
           | Trivial to pull up old license info from 1Password or email
           | if necessary.
        
         | sneak wrote:
         | Fun fact: the modern NetworkExtension signed Apple entitlements
         | that are required to be a VPN app on the macOS are app-store-
         | only. (There is one root-based workaround to make VPNs work on
         | macOS without these entitlements, for now, which will likely be
         | removed in the near future.)
         | 
         | This is why you can download a wireguard installer from
         | wireguard.org for Windows, but have to provide your identity
         | (name, phone, email, address) and device hardware serial number
         | to Apple to get the Wireguard app on that platform.
         | 
         | Show ID for privacy software.
        
           | mmastrac wrote:
           | Yeah, and this is why I've been tempted to bootstrap a de-
           | Apple-ified OSX project. I'm getting sick of Apple's
           | intrusiveness.
           | 
           | I was staring at a red dot on the System Preferences because
           | Apple decided that logging in with iCloud was important
           | enough to remind me of daily.
        
             | sneak wrote:
             | Due to the signed system volume, doing so is now impossible
             | without disabling system integrity protection, one of the
             | main platform security features of macOS.
             | 
             | I made an effort to do this for Mojave, but macOS is not
             | designed to be modular, and after a week of chasing weird
             | bugs related to interdependencies of system services, I
             | stopped my efforts. If you'd like to collaborate, reach
             | out.
        
               | mmastrac wrote:
               | It would be a "respin"-style project without Apple's keys
               | at the root.
        
               | Wowfunhappy wrote:
               | I didn't realize you could actually leave SIP on but use
               | a different chain of trust! Would you be recompiling XNU
               | to do this?
        
               | comex wrote:
               | The chain of trust on macOS is... complicated. Too
               | complicated. Apple binaries are validated in at least
               | _three_ different ways:
               | 
               | 1. By the kernel using a root certificate hardcoded into
               | the CoreTrust kext;
               | 
               | 2. On Apple Silicon only, by the kernel using a trust
               | cache that's supplied to the kernel by the bootloader;
               | 
               | 3. By userland (amfid) using a root certificate hardcoded
               | into Security.framework.
               | 
               | You'd have to modify or intercept all of those things,
               | and key components aren't open source (e.g. the
               | AppleMobileFileIntegrity kext which is responsible for
               | querying CoreTrust, the trust cache, and amfid). Probably
               | best to do some targeted function hooking rather than
               | recompiling anything.
               | 
               | Of course, you would still have to turn off Secure Boot
               | in order to load a modified kernel in the first place.
               | But that's largely orthogonal to SIP.
        
               | Wowfunhappy wrote:
               | > Due to the signed system volume, doing so is now
               | impossible without disabling system integrity protection,
               | one of the main platform security features of macOS.
               | 
               | No, macOS is _fine_ without SIP! SIP just defines a set
               | of actions that Apple thinks no user, including root,
               | should _ever_ be able to perform. Consequently, disabling
               | SIP empowers root users to do whatever they want, which
               | is _exactly_ what root is supposed to mean! You 're still
               | protected by the standard UNIX permission system--just
               | don't grant root to software you don't _absolutely_
               | trust!
               | 
               | Security is all about layers--but in the case of SIP, the
               | security comes from delegating control away from the user
               | in favor of Apple. If you're a power user, I'm not
               | convinced this is necessarily good, because you're giving
               | Apple almost absolute trust. What if _they_ get
               | compromised?
               | 
               | And, if you're the sort of person who would want a de-
               | Apple-ified version of macOS, I would think you'd have
               | _already_ disabled SIP.
        
               | sneak wrote:
               | > _No, macOS is fine without SIP! SIP just defines a set
               | of actions that Apple thinks no user, including root,
               | should ever be able to perform._
               | 
               | I agree with Apple here.
               | 
               | > _Consequently, disabling SIP empowers root users to do
               | whatever they want, without Apple having a say in the
               | matter--but you 're still protected by the standard UNIX
               | permission system._
               | 
               | It also empowers malware. The Creative Cloud, for
               | example, installs as root and installs admin-permissioned
               | services. The standard POSIX permissions system is crap,
               | and SIP is a huge improvement and valuable tool against
               | malware.
        
               | Wowfunhappy wrote:
               | > The Creative Cloud, for example, installs as root and
               | installs admin-permissioned services.
               | 
               | So don't use apps that do that! Creative Cloud has no
               | business installing itself as root.
               | 
               | I realize that's probably not feasible if you e.g. need
               | Creative Cloud professionally, and that's a perfectly
               | valid reason to leave SIP on, if applicable. Although
               | Adobe and similar vendors still need to be yelled at.
               | 
               | I think SIP--like Gatekeeper--is a _great_ default
               | setting for novices, who _should_ trust Apple over
               | themselves. But if you 're a power user, turning off SIP
               | is not going to spell disaster. It leaves you with
               | equivalent security to most Linux distros like Debian.
               | 
               | More importantly, there's no way to have a feature like
               | SIP while also granting users full control. I get really
               | frustrated when I see people say they're switching to
               | Linux because macOS is too locked down. If you want to
               | switch to Linux, that's wonderful, Linux is great! But if
               | you otherwise prefer macOS, just go ahead and open it up
               | for yourself.
        
               | [deleted]
        
               | cercatrova wrote:
               | I actively disable SIP on every Mac I own.
        
           | my123 wrote:
           | You can add them for apps outside of the App Store. See: http
           | s://developer.apple.com/documentation/bundleresources/en...
           | 
           | > To add this entitlement to an iOS app or a Mac App Store
           | app, enable the Network Extensions capability in Xcode. and
           | 
           | > To add this entitlement to a macOS app distributed outside
           | of the Mac App Store, perform the following steps:
        
             | sneak wrote:
             | I'm told by people trying to do just that that that doesn't
             | work.
             | 
             | Did they change it recently? Have you tried it? I don't
             | have a developer subscription so I can't test it.
        
         | wlesieutre wrote:
         | I use it for free stuff when I have the option because it's
         | convenient to have the centralized install buttons and software
         | updates, and I've bought some software for actual money
         | (Affinity suite for example).
         | 
         | But given the option I'm perfectly happy to buy from devs. They
         | don't have to give Apple a cut, there's no "drag the whole hard
         | drive on to the window" sandbox workarounds, and they can
         | structure their upgrade pricing however they want instead of
         | not being allowed to do it.
        
           | mmastrac wrote:
           | To be honest, I don't use it for free stuff either. Why do I
           | need to provide an account to download something that's free?
           | If you're offering a free app, there's really no reason why
           | you shouldn't have it on your website as well.
           | 
           | IIRC there used to be a way to get things like Garageband and
           | Numbers from the store without providing credentials, but
           | sadly that appears to no longer be the case.
        
             | wlesieutre wrote:
             | I'm already in my account so I've never even considered
             | that as an issue for getting free apps from the app store.
             | You're right though, no other way to download Numbers, etc.
        
           | wlesieutre wrote:
           | Semi-related note for apps outside the store: please copy
           | paint.net's update prompt, which gives me the option to
           | install the update when I _close_ the app, instead of either
           | right now (while I 'm trying to use the app) or asking me
           | again next time I launch it (when I'll also be trying use the
           | app).
           | 
           | It's been 15+ years and this still hasn't caught on. Not
           | interrupting whatever I'm trying to get done with software
           | updates and relaunches is one of the major reasons I'd rather
           | just get things from the Mac App Store.
        
         | valuearb wrote:
         | Dwindling minority? Mac sales have grown to nearly 20% of
         | industry revenues. With the M1 it looks likely they will get
         | close to 10% of industry units, and blow by 20% of revenues.
         | 
         | Most independent software developers should not care about
         | units sold, because it comprises far too many $200-$400 PCs
         | that don't buy much software.
         | 
         | They should care about the $1,000+ PC market, those are your
         | best customers, and where Apples market share by units is at
         | least 25%, and surging higher with the M1.
        
           | mmastrac wrote:
           | Dwindling minority of Mac users that want a low Apple
           | experience
        
         | xoa wrote:
         | > _Maybe I 'm just in the dwindling minority of Mac users._
         | 
         | I mean, I'm sure you are, but you're not alone. Same boat here.
         | In principle Mac App Store could have been a really wonderful
         | thing, I think Apple in the 00s had a real opportunity to do a
         | great service to their users by creating a unified, solid and
         | flexible licensing system for all devs (and then offering a
         | fully optional vetted software store beyond that).
         | Unfortunately they didn't do that and the MAS sucks. There is
         | no upgrade system which is just absolutely fucking insanity.
         | There are huge restrictions on useful functionality, so it can
         | never be a one-stop place. The licensing and Apple ID
         | management is a total fucking mess too, can't consolidate or
         | transfer licenses like just about every previous Mac system in
         | existence, all sorts of normal concepts like vol or other
         | discounts are a pain/non-existent. I have an old iTools
         | account, and I'm not even allowed to change the primary email
         | address!
         | 
         | The MAS experience, and Apple's online service experience in
         | general over significant time, is just miserable, completely
         | unnecessarily too. Maybe they'll fix that someday, but it
         | doesn't seem to be a priority so here we are :(.
        
         | Razengan wrote:
         | FWIW, I love buying stuff from the Mac App Store and I wish all
         | my favorite Mac apps were available there. I love the automatic
         | updates, I feel safer with the sandboxing, and I appreciate the
         | convenience of visiting a single point to download almost
         | everything I want to put on a new Mac.
         | 
         | I also cherish having control over subscription renewals from
         | one list and the Apple's easy refund process in the event of a
         | third-party app not turning out to be worth the money (or an
         | outright scam).
         | 
         | And as a dev I like knowing that anything _I_ publish will be
         | available to all Mac users.
         | 
         | I do hate the crappy App Store.app UI though. Feels like
         | navigating a clunk web page, and why the fluff did they remove
         | the download progress stats?? You have to hit F4 to see the
         | actual size/downloaded numbers in the Launchpad (or in the
         | Applications folder I guess).
        
         | thewebcount wrote:
         | Yeah, that's definitely not the norm that I see among macOS
         | users. I do the same thing but with Steam. If I can find it
         | anywhere else, even for more money, I'll buy it elsewhere,
         | including the Mac App Store because the experience of using
         | Steam is so awful. So to each their own, I guess.
        
       | webwielder2 wrote:
       | I don't have much to say about the move to the App Store except
       | that given that there is apparently a market for a standalone
       | paid indie photo browser, the Mac market may be more vibrant than
       | popularly assumed.
        
         | s3cur3 wrote:
         | There are fives of lattes per month to be made in this market,
         | it's blowing up! ;)
        
         | Hamuko wrote:
         | Looks like more of an organizer than browser. There's
         | definitely a need for image browsers considering how bad
         | Apple's Preview is for that. I'm still using my old and trusted
         | Xee3 for any sort of image browsing on macOS because of that.
        
       ___________________________________________________________________
       (page generated 2020-12-23 23:00 UTC)