Re: You can protect your Mac from malware by following three simple rules!

From	"David B." <"David B."@invalid.org>
Newsgroups	alt.computer.workshop, uk.comp.sys.mac
Subject	Re: You can protect your Mac from malware by following three simple rules!
Date	2026-05-23 21:12 +0100
Organization	Retired
Message-ID	<n7eg27Fno4sU1@mid.individual.net> (permalink)
References	(2 earlier) <XnsB454E59831AC3HT1@cF04o3ON7k2lx05.lLC.9r5> <n7df59Fiod9U1@mid.individual.net> <6a11ac69$0$18$882e4bbb@reader.netnews.com> <n7dubuFl1u7U1@mid.individual.net> <6a11d76b$0$23$882e4bbb@reader.netnews.com>
Cross-posted to 2 groups.
Show all headers | View raw
On 23/05/2026 17:35, Brock McNuggets wrote:
> David B. <"David B."@invalid.org> wrote:
>> On 23/05/2026 14:32, Brock McNuggets wrote:
>>> On May 23, 2026 at 3:51:20 AM MST, ""David B."" wrote
>>> <n7df59Fiod9U1@mid.individual.net>:
>>>
>>>> On 23/05/2026 03:34, Gremlin wrote:
>>>>> "David B." <"David B."@invalid.org> news:n7b0dhF70fqU1@mid.individual.net
>>>>> Fri, 22 May 2026 12:27:28 GMT in alt.computer.workshop, wrote:
>>>>>
>>>>>> On 21/05/2026 23:33, Gremlin wrote:
>>>>>>> "David B." <"David B."@invalid.org>
>>>>>>> news:n783cnFnhgqU1@mid.individual.net Thu, 21 May 2026 09:59:51 GMT in
>>>>>>> alt.computer.workshop, wrote:
>>>>>>>
>>>>>>>> It's not found by a routine search.
>>>>>>>
>>>>>>> I suppose holding a key down makes it non routine, then?
>>>>>>
>>>>>> That is correct. The "Library" and contents is/are deliberately hidden
>>>>>> from the 'normal' user.
>>>>>
>>>>> Hmm? I suppose that depends on what you mean by a normal user. Are we
>>>>> talking near complete idiot level, normal user-like you, or someone more
>>>>> like snit in so far as familiarity with their machines OS? If the latter, I
>>>>> completely disagree with you. If the former, I understand why you might
>>>>> think that; despite my still not agreeing with you on this.
>>>>
>>>> EtreCheck claims that it is removed simply by dragging it to the 'Bin'.
>>>>
>>>> That is *NOT* the case.
>>>
>>> How is it different than other macOS apps?
>>
>> It's just fine for any software loaded from the Apple App Store
>> (As recommended by Apple)
> 
> And other apps. It’s the norm on macOS.
> 
> Part of what you’re running into is seeing how one app does something and
> assuming incorrectly it’s wrong or bad or uncommon when it’s not.
> 
> The only even small question you’ve found is why does it save old reports.
> My guess — without looking at the app — is it has some capacity to compare.
> Or keeps them so the user can. Would it be best to be more transparent?
> Maybe but there’s a balance of doing and telling — you can’t tell the user
> every inconsequential thing and not overwhelm them. You’re turning a tiny
> molehill into a mountain and doing so in a vacuum of understanding how apps
> typically work on macOS.

I think you should familiarise yourself with what Geminia has to say:-


That last part—**"provided the developer plays by their cryptographic 
security rules"**—is the secret sauce that separates the Mac from the 
iPhone. It’s Apple’s compromise: you don't *have* to use our App Store, 
but if you want to run smoothly on a Mac without throwing up scary 
"malicious software" blockades, you have to pass our background checks.

To make this happen, independent developers must go through a strict 
two-step security process before they distribute their apps on the web: 
**Developer ID Signing** and **Notarization**.

---

### 1. The Digital Passport: Developer ID Signing

Before a developer can even package their app for download, they must 
join the Apple Developer Program. Apple verifies their real-world 
identity and issues them a unique cryptographic certificate known as a 
**Developer ID**.

When the developer builds the app, they digitally "sign" the code with 
this ID. This acts like a wax seal on a letter:

* **Identity:** It proves exactly who made the software.
* **Integrity:** It ensures the code hasn't been tampered with or 
modified by a third party (like a hacker injecting malware into a mirror 
download link) since the developer released it.

### 2. The Customs Check: Notarization

Even with a verified ID, Apple takes security a step further. Before the 
app goes live on the developer's website, they must upload the completed 
software to **Apple's automated Notary Service**.

Apple’s servers quickly scan the app’s components to ensure:

* It does not contain known malware or malicious code.
* It utilizes macOS's **"Hardened Runtime"** (a security feature that 
prevents common exploits).
* It doesn't break fundamental system stability rules.

If the app passes inspection, Apple issues a digital **"ticket."** The 
developer then "staples" this ticket directly onto their software package.

---

### How This Looks to You (Gatekeeper in Action)

When you download a web app and double-click it, macOS's built-in 
**Gatekeeper** security system springs into action.

```
[Downloaded App] ➔ Check Code Signature ➔ Check Notarization Ticket ➔ 
App Launches

```

If the app has a valid Developer ID and a fresh notarization ticket, 
macOS checks it against Apple's live database (or reads the stapled 
ticket if you're offline). Instead of a terrifying warning, you get a 
clean dialog box that says something like: *"This app was downloaded 
from the internet. Apple scanned it for malicious software and none was 
detected."* You click "Open," and you're good to go.

### Why This Matters to Apple

This setup gives Apple massive control without forcing a true monopoly. 
If a popular piece of independent software turns out to be rogue, or if 
a developer's private signing key is stolen by bad actors, Apple doesn't 
have to hunt down every copy on the internet. They simply *revoke the 
Developer ID certificate* or the notarization ticket on their central 
servers.

The next time *any* Mac anywhere tries to launch that app, Gatekeeper 
will see the revoked status and block it instantly. It keeps the Mac 
open to independent software while maintaining a master kill-switch for 
security.

>>>>> The warning is stating that changes to the file will be lost if you choose
>>>>> not to save it. It isn't claiming the file prior to alteration will be
>>>>> deleted/lost if you don't save.
>>>>> Are you having a couple of sips before you use the software or something?
>>>>> Slow down, bud.
>>>>
>>>> EtreCheck is *NOT* removed from a Mac by simply dragging it to the Trash/Bin
>>>
>>> How is it different than other macOS apps?
>>
>> That is a fair point, and it explains exactly why this debate happens.
>>
>> EtreCheck is designed to automatically archive every report it runs. It
>> saves these historical logs inside the user's hidden
>> ~/Library/Application Support/ folder so you can access them later via
>> the app's File > Previous reports menu.
>>
>> The average user usually has no idea these files are piling up in a
>> hidden directory. If you simply drag the EtreCheck app to the Bin, those
>> old text reports remain on the hard drive indefinitely. To actually wipe
>> them out, a user either has to know how to navigate to the hidden
>> Library folder, use a dedicated uninstaller utility, or use the "Delete
>> previous reports" option explicitly built into EtreCheck's own File menu
>> before throwing the app away.
> 
> Most apps have similar folders. So, again, how is it different. And above
> you say the app is not removed — you did not back that and changed focus to
> files from the app. Was that on purpose? Are you rescinding that claim or
> can you support it?

The EtreCheck developer has re-written what he now says about his App 
removal on his website. I commend him for so doing. 🙂

You, on the other hand, /may/ have installed all manner of software
without having any clue as to whether or not such software might damage
your own computer and/or those computers of others with whom you share 
files.

Maybe THAT is why you are now have problems with your iCloud!
Back to uk.comp.sys.mac | Previous | Next — Previous in thread | Next in thread | Find similar
Thread

csiph-web