[0]: https://ofek.dev/words/guides/2025-05-13-distributing-comman...
The author didn't mention Apple's contempt for backward compatibility. Apple like to regularly nuke their entire developer system from orbit. Try running an app developed 10 years ago on the latest version of macOS. It probably won't run.
Microsoft are much better at backward compatibility and they don't force you to join a developer program. But you get totally reamed every time you have to update your authenticode digital certificate for Windows. Just the digital certificate will cost you more than $99 per year. It is a total racket.
To be fair, compared to the prices of Certum and other providers if you ever want to sign something for Windows, perhaps Apple isn't uniquely overpriced (they all seem to be that way): https://www.certum.eu/en/code-signing-certificates/
Looking more into the Windows side of things, I also found Azure Artifact Signing which is supposedly affordable at 8.54 EUR per month, but unfortunately they don't actually support individual users in the EU (only in US & Canada, meanwhile EU only gets support for organizations). I'd probably have to set up a SIA (equivalent of Ltd.) here first - it was in the plans for later, but this is a bit of a roadblock for using Azure too: https://azure.microsoft.com/en-us/products/artifact-signing
My tone might have been frustrated, but I will absolutely say that the code signing industry needs to have a Let's Encrypt moment of some description - at least commoditize it like Azure Artifact Signing was trying to do, but also for individual developers, across all platforms! Sadly, that doesn't seem to be possible when the platforms are intentionally walled gardens.
I genuinely don't understand why so many developers are willing to compromise so much for a thin laptop.
laughs in Bundesdruckerei
sudo spctl —-master-disable
People will say, no, that’s too big a hammer, it’s not safe… but then, like, what do you actually want? Either you keep Gatekeeper because you like the friction it introduces, or you don’t like that friction and you should go turn it off. Pick one, you obviously can’t have both!Of course, you as the developer can’t make this choice for your users… but isn’t that as it should be? The user decides what code is allowed to run on their machines. And the default setting is restrictive because anyone who knows what they’re doing can easily change it.
P.S. Meanwhile, on iOS there’s no way to install unsigned software at all, and on Android (starting soon) the process takes 24 hours instead of ten seconds. That is actually ridiculous because it’s taking away user choice.
P.P.S. To be clear, modern macOS has plenty of other restrictions which can’t really be turned off and which I find super annoying. Gatekeeper just isn’t one of them.
Edit: I’ve just learned that as of Sequoia, you have to also tick a box in Settings after running the Terminal command. So maybe it takes 30 seconds instead of ten seconds. That’s mildly more annoying, but still doesn’t really seem like a big deal to me.
Free business idea: get an Apple developer account and then agree to sign code for other people in exchange for a small piece of their income. I'm surprised that doesn't exist yet (or does it?).
Serious question - Is it really true that Windows 11 will run an untrusted .exe without a warning?
Where do you have to show ID for that??
Annoying, but if you’re delivering your app to semi-technical users, not really a problem.
I agree that Apple is dumb of course.
On two occasions I've been completely dumbstruck when the software I was using was deleted out from under me. I'm not a fan of the overuse of "gaslight", but it sure felt like that when I had to restart Docker and the OS was like "what do you mean, Docker? You've never had Docker installed! What are you talking about? Are you feeling ok?"
If it is good for the end-user, it is usually also good for the ecosystem a a whole, trust is valuable.
But ffs, they are rich enough to make this a lot less painful and hostile for developers.
And this is not a new thing, I used to develop games for iOS, from the very beginning, and while the process somewhat simplified over time, it was a huge cortisol inducing process, not to mention the regular forced OS+SDK updates where the procedures changes almost every time and could fail in not-so-evident ways.
This has more to do with putting up a scary dialog for normies than it does protecting anyone. A non-technical user isn't going to go bypass this in the terminal, they're going to run back to the App Store where Apple can collect that sweet 30% and analytics.
Apparently Apple disagrees, Apple decides. Typical users aren’t going to find their hidden 5 step process to enable non-blessed apps and obviously they know that. Gatekeeper is an appropriate name considering the user themselves are on the outside of the gate. It’s the culimination of everything Stallman and the FSF warned everyone about for decades. By its logic we should install police officers in our living rooms for safety.
https://en.wikipedia.org/wiki/Age_restrictions_on_energy_dri...
Edit: currently a voluntary but widespread scheme by retailers, proposed to be law. TIL
The added friction feels more like a way to force developers to pay Apple an annual fee for distributing rather than for my safety. Not saying it doesn't help with safety, just that it's more weighed to the former.
macOS is slowly getting like Windows, where, on a fresh install you have to go through and turn off all sorts of unwanted software just to have a sane environment where you, the user, are actually controlling your computer.
And yes, you can turn all of that off.
I've run several PiHoles for several years, primarily on latest versions (up to v5; current is v6.4.x) – recently updating to v6 has been extremely frustrating [0], e.g: realizing that even when you tell the pi's/en0 ("internet") interface to use a specific DNS server (in GUI/network settings), it still uses the DNS-server recommended by your local DHCP server [1].
[0] I am aware that this is a joint-issue between RaspbianOS and Pi-Hole teams
[1] which requires TWO sudo nmcli which newbs have no business configuring – what happened to -simple- ?
----
If you ever want to consider how crazy DNS-capture is getting, realize that Firefox/&c are all dark-patterning the abilities to turn off "secure"-DNS. The latest Raspian/Pi-Hole defaults are terrifying... [2]
[2] another example: why doesn't v6 enable HTTPS localhost web-access, by default (like all previous versions?!)? Do the developers really expect us commoners to know how to generate localhost certificates – this is obviously behavior due to how the pihole useraccount behaves differently then the previously-root-blessed v5-behavior
----
Thankfully, I've kept a local copy of my favorite distro of Pihole v5, and it is readily-cloneable.
When I attempted to pass a --version tag during a freshinstall (requesting v5 from remote installer), it went ahead and installed latest v6 (so why even.?!).
People reflexively hit yes to these things.
With Gatekeeper turned off, you’ll still get a warning on first launch which you can easily click through. (Unless Apple changed something in the last few versions—let me know if that’s the case—but it would be out of character for them to remove a warning...)
The “security feature” you don’t want to disable is precisely the thing you are complaining about, so I don’t understand why you’d keep it around.
> The added friction feels more like a way to force developers to pay Apple an annual fee for distributing rather than for my safety.
I don’t imagine Apple makes a substantial amount of money from $99/year developer subscriptions. The App Store is another story of course.
“Press command space, no no hold down the command key - gosh it’s in the bottom left - okay, now type “privacy”, now scroll, no you scrolled too far …”
App certification doesn't solve that problem either.
2. The expected income is way less than the developer fee, much less the expensive hardware required.
Date: 2026-05-09
I'm creating a simple developer utility to make managing Claude Code profiles (e.g. running it with DeepSeek, or some OpenRouter models) a little bit easier.
Edit: I just did the first release, which you can check out on ccode.kronis.dev, or go directly to the Itch.io page to either download or buy the pre-built binaries or look at the source code. It's a simple utility and it's early on (consider getting it for free first and only paying later, if it feels useful), but currently the code is not signed.
The utility is written in the Go language, and the tooling there makes it really easy to compile for various platforms - I get a static executable that I can put anywhere I want. Even before the release, I wanted to see how easy it would be to ship it.
It works just fine for distributing Linux software (same deal, after chmod +x).
It works sort of fine for distributing Windows software (I get an .exe, SmartScreen might have a word or two, though you can click through it in the same pop-up).
It does not just work for macOS and my MacBook instead shows me this:

What you see is their quarantine kicking in for downloaded software, even if I share it with myself over Nextcloud.
Technically, you can ask your users to override it manually, in the terminal:

Most developers might be willing to do that. It is not, however, good user experience and might raise some eyebrows.
Doesn't seem like such a big deal, right? I'll just enroll in their Apple Developer Program, sign the executable and be on my way, right?

Wait, they want how much money for the account?

And it's a yearly subscription? My brother in Christ, I intend to release a utility maybe a dozen or two dozen people are going to download, tops, for like 7 USD on Itch.io with a pay-what-you-want model, meaning that most of those people will probably choose the price of 0 USD instead (since I don't intend to be like Apple, people have various circumstances).
That means that even if it works out that much, there's going to be VAT and Itch.io will also take a cut so out of those maybe 50 USD I'll get about 25 USD, which funds me about 3 months of that Apple Developer Program price. I guess the reason for it being priced like that lies somewhere between greed and wanting to gatekeep hobbyists out and only support Serious Users™, but it seems a bit stupid. Oh well, I already had to get the overpriced MacBook for another freelance thing, because they also won't let me compile macOS/iOS apps on Windows or Linux, so I guess this is just them spitting on me after slapping me in the face.
What I get from that is that articles like An app can be a home-cooked meal are cool but don't take the economics of wanting to release something publicly into account - unless you're developing something that you'll add a bunch of monetization to, you'll be losing money. For desktop software there is Homebrew but that also means that you couldn't charge a few bucks for it even if you wanted to (or that you'd need to add mac-homebrew-install-instructions.txt to the Itch.io downloads page when doing the pay-what-you-want approach, which would feel awkward).
I don't like that the economics are pushing software and app development in a direction where releasing a package (that might be non-open-source or just source-available, but you want to release binaries) costs money, though I also acknowledge that there would be other issues, like insane amounts of spam, with not doing that.
Then, we get to the actual verification process - it's understandable that they'd want to verify my ID. The problem is that on the MacBook they also expect me to use its webcam to take a picture. I will admit that my M1 MacBook Air is getting dated at this point, but regardless of what lighting I tried, I could just not get a good picture of the document. It's not like they were like "Oh hey, we've detected that your own iPhone is connected to the same local network as this MacBook, would you like to use it as a camera?", so for about 10 attempts, this is what I saw:

Eventually, I moved over to trying to use my main webcam for that, since their built in one just doesn't work:

Why they can't just let me upload a scan of the document eludes me. I mean, I guess I can imagine a few reasons why, but it'd probably be easier to forge my own ID so it's not as glossy rather than having to turn my small kitchen table into this. Pictured for maximum frustration, a dongle that I needed:

Even that wasn't good enough, because understandably it doesn't have autofocus for something that you hold close. Not only that, but every 2nd failure seemed to just give me a generic error and I'd have to start the whole enrollment process from the beginning again:

Luckily I realized that I can install the app on my iPhone directly. There, it worked on the first try. I guess it must really suck if you don't have an iPhone or a fancy webcam, better spend some more money so you can give them money! The payment went through okay, soon after I had an activated developer account.
Except of course I didn't, look, the app tells me to await an e-mail (which I seemingly already received?):

And the desktop app doesn't care at all either, it doesn't even know that I've tried the enrollment, and offers me to start the whole thing over again, despite me being signed into the exact same account:

It's probably a case of eventual consistency and some background processes or whatever, but it's also quite frustrating and, in a word, stupid.
Apple, I think you make hardware with pretty good build quality and the M-series chips made for pretty much the perfect notebook for me - and I'm sure they're great main dev machines for those that can afford the higher spec versions.
I think that's nice and I genuinely enjoy having the iPhone SE 2022, at least before learning that you killed off the budget series altogether (your new e-series are more expensive) and removed the nice silent mode toggle on the side and removed TouchID. That's before we even start talking about the 3.5mm jack and frankly all of that makes me question whether my next phone shouldn't just be an Android again.
I can deal with needing software like AutoRaise and Rectangle and DiscreteScroll alongside others to customize your OS to my liking because you won't let me do that myself like most Linux distros do. I can even deal with your window focus needing an extra click across multiple monitors and AutoRaise being nice but perhaps too aggressive, since the developers are at least trying to make the experience nicer!
I can deal with your keyboard shortcuts being odd and not even having a "Cut" option in your Finder program.
I can deal with your weird Control/Command button setup which even breaks remote desktop software.
I can deal with your weird "programs you close aren't actually closed" approach even though you sold me a MacBook with 8 GB of RAM just so I could develop software in your walled garden ecosystem.
But to first vendor lock me to your ecosystem for developing apps, then demanding a whole bunch of money so I can sign my software and it not get quarantined all while I'm not too well off financially, then refuse to let me submit my documents to you because your hardware produces pictures that are not good enough and make me have to install the app on a phone that's also expensive and that not even everyone has, then to still make me wait and have your apps not even show that I've submitted my application?
You know what? Apple, fuck you and your forsaken ecosystem. This sucks.
I can use SmartID to verify my ID (and age) in about 20 seconds when buying an energy drink at the local grocery store.
I can use eParaksts to digitally sign documents in about a minute, from either my PC with a card reader (using my government issued ID card), or my phone with their app, ending up with a proper cryptographic signature either attached to the EDOC container (ASIC-E) or a PDF file directly.
I'm sure that other countries also have plenty of similar services for ID and age verification, signing documents, and other digital services. I acknowledge that that's not all of them, and that things are all over the place in this regard (alongside the credit card mafia holding a lot of the world's payment infrastructure hostage), but come on, surely it's possible to create something that works better than my experience did.
Having a bunch of scrappy Baltic software packages working better than those by a multi-billion dollar company feels silly.
You know what, Apple isn't the only company where things are somewhat messed up.
If you want to sign some code for Windows, you can find Certum offering code signing, but that also costs around 209 EUR per year, all while they're supposed to be one of the affordable options out there! I'm not singling them out as much as acknowledging that they're one of the cheaper options and that many others out there are worse. What the fuck?
And then you look at Azure Artifact Signing noticing that their basic tier only costs 8.54 EUR per month and for a bit feel happy that someone has at least tried to disrupt the extortionate prices - until you set up your Azure account and notice that you cannot sign certificates as an individual if you're outside of US & Canada, in the EU only organizations can sign code through them.
This feels about as bad as getting TLS certs was before Let's Encrypt displaced most of that rent seeking behavior - the problem being that there aren't many alternatives or competitors to them, which on one hand means that we're moving towards a massive point of failure, and on the other hand means that if they ever decide to demand money, then a large part of the Internet will be straight up fucked.
I thought that maybe I'm overreacting a bit - since my previous issues were mostly about the Apple signup process being annoying and the way they've treated their users being worse than it could be, but no, I should be more angry - the whole code signing space is stupidly expensive for what it is. You have arguments in the opposite direction? Just know that they said the exact same kind of stuff about TLS before Let's Encrypt and how you have to pay 100 EUR a year for a cert that's not even a wildcard because of reasons™.
Just let me sign my code with my governmental ID card and be done with it, jeez.