Thoughts on the Mac OS X Mountain Lion Developer Preview
by Andrew Cunningham & Anand Lal Shimpi on February 19, 2012 7:40 PM EST- Posted in
- Mountain Lion
- Mac
- macOS
Gatekeeper
Of the Mountain Lion announcements, Gatekeeper has been one of the most discussed. Apple has touted OS X as being a safer, more secure environment than Windows, offering its customers a relatively malware-free experience. In the early days this was often discounted by saying that OS X wasn't a likely target for malware simply because no one used it. Today Apple claims to have a Mac installed base of 63 million users. While there are far more Windows users, that's not an insignificant number. And it's growing.
As the likelihood for significant malware targeting OS X increases, Apple must do whatever it can to maintain its pristine image. In a sense, Apple made its bed by promising a more secure, virus/malware-free experience, and now it has to sleep in it. It's not a bad thing, but it's something that is going to require a lot of work.
The easiest and most obvious solution to the problem is the Mac App Store. Every app distributed through the Mac App Store is certified by Apple and thus no malware/viruses should ever make their way to a customer's Mac if they only run apps from the Store. That's a step in the wrong direction unfortunately. Companies like Adobe and Microsoft don't make their applications available in the Mac App Store (paying Apple 30% for every copy of Photoshop sold seems unlikely to happen), not to mention the tons of useful open source or other programs that aren't distributed through the MAS. While the iPhone can sell just fine as a platform that's more of an appliance, Macs (at least today) cannot.
The alternative is to heavily warn users that what they're running isn't exactly safe but allow applications, regardless of origin, to be run. This is what's done today in Lion. The first time you run an application that you downloaded you'll get a message that looks like this:
It's the everlasting debate between freedom and security. Give up one to get the other, but what's the right balance?
The compromise in Mountain Lion comes in the form of a tool called Gatekeeper. An innocuous little radio selection in the Security preference pane, Gatekeeper lets you choose what applications can be run on your Mac.
You can choose to only allow applications from the Mac App Store, allow all (the two extremes we discussed above) or pick an in-between option: allow anything downloaded from the MAS or anything by an identified developer.
This in-between setting is the compromise.
If a developer joins the Mac developer program ($99/year) it can become an officially identified developer with Apple. The developer can then sign its applications with a unique cryptographic key that Apple recognizes, without requiring that the apps be distributed through the Mac App Store. Unlike the Mac App Store, there's no approval process that the developer's signed apps need to go through. There's only one stipulation that goes along with the identified developer label: the apps distributed with that key cannot be malware.
Apps from identified developers will communicate with Apple's servers to verify the digital signature is intact and correct only upon install or the first run of the application. Subsequent runs do not phone home and there's no remote kill switch for these applications. Should Apple find out that a developer has been distributing malware Apple can revoke the developer's key, but that would only render those apps that have yet to be installed/run from working. Without a certification process for non-MAS apps there's still a degree of risk associated with this compromise. I don't believe the ideal solution is to force everyone to buy through the MAS, but Gatekeeper's compromise isn't an impervious solution.
Apple tells us the default Gatekeeper setting in Mountain Lion will be to allow apps from the Mac App Store or from identified developers to run. Hopefully by the time Mountain Lion ships many third party developers will be on-board and identified making the transition mostly seamless. If you don't change the default Gatekeeper setting there's another way around the protection: simply control-click (or right click) on the app you're trying to run and select open. Doing so will override the Gatekeeper setting and let you run an unsigned app.
Facebook
Twitter
RSS
96 Comments
View All Comments
solipsism - Sunday, February 19, 2012 - link
AT has plenty of articles about Win8.• http://www.anandtech.com/tag/windows-8
Keep in mind that Win8 was leaked, in pieces over a long time so AT had to mostly write blog-length statements about many of the new features as they dropped, while Apple dropped an entire OS update at once with a detailed webpage and reviews by famous journalists and bloggers who got a one-one-one.
ananduser - Monday, February 20, 2012 - link
Anand is a mac user nowadays. Of course he tends to give more attention to mac wares and mac software. That doesn't mean he ignores other platforms or is less fair.solinear - Tuesday, February 21, 2012 - link
Honestly, I couldn't disagree more. There is a huge amount of attention paid to every Apple product here now, almost like it's a "zealot lite" website. I love how they focused on the amazing improvements in the browser, talking about how the tabs worked and scaled now... I'm sorry, but I haven't seen a browser where the tabs didn't scale automatically as you opened more in ages, but Apple is the 'standard' that they compare everything else to?As a result, I tend to find myself going to the hardware (SSD mostly) reviews and ignoring a lot of the others. I might be largely alone, but I see a very heavy amount of coverage to the Apple products, particularly for their market share. If he's going to review Apple stuff all the time, maybe he should be reviewing various Linux distro GUI changes and so forth, if he wants to be fair. I can only remember one of those and it was a LONG time ago.
repoman27 - Wednesday, February 22, 2012 - link
If you're not interested in reading articles about Apple products, simply ignore them. If you want AnandTech to focus more on topics of interest to you, just ask, they seem pretty receptive to input.If Apple articles get a significant number of page views and generate decent revenue for the site, why should AnandTech stop posting them? Just because you're not interested in this type of content doesn't mean that other readers aren't. (Apple now has greater than 10% of US marketshare, and their customer base tends to be of a demographic group that is quite desirable to advertisers.)
KPOM - Monday, February 20, 2012 - link
I doubt it. If anything, iOS 6 would be more of the response to Windows 8 than Mountain Lion. The Mac is an important part of Apple, but it represents only 25% of its revenue. iOS represents about 50% of its revenue and about 70% of its profits.Apple always has had a faster release cycle for OS X than Microsoft had for Windows. Plus, they have for quite a while dropped support for older Macs and/or software with each new release. Leopard dropped the Classic mode. Snow Leopard dropped PowerPC. Lion dropped Rosetta and 32-bit Macs. Apple, unlike Microsoft, makes its money on hardware rather than software, and thus does not have an incentive to keep its new operating systems running on ancient hardware the way Microsoft does.
MonkeyPaw - Sunday, February 19, 2012 - link
"The last thing I wanted to talk about is something we've already touched on, but it bears repeating - Mountain Lion is dropping support for any Mac that is not capable of booting OS X's 32-bit kernel."Am I understanding that right, or should that read "64-bit kernel"?
jedivulcan - Sunday, February 19, 2012 - link
From what I've been reading and seeing elsewhere on the internet, AirPlay Mirroring does using the latest iOS 5 beta for Apple TV and a Sandy Bridge based Mac.solipsism - Sunday, February 19, 2012 - link
I'm not a fan of LaunchPad but it's perfect for those that aren't heavy or proficient computer users. It makes finding and executing an app simple while bringing a familiarity seen on iOS-based iDevices which far outnumber Macs.PS: Dashboard also gets the Launchpad-like displaying of widgets and it's much better than their previous model of having a single row at the bottom that scrolls off screen.
ltcommanderdata - Sunday, February 19, 2012 - link
Any word on new OpenCL (1.2) or OpenGL (4.x) support?With no QuickSync instead relying on CPUs, hopefully they at least are implementing extensive SSE4.x and AVX acceleration.
ananduser - Monday, February 20, 2012 - link
Apple is not really famous for up to date graphical driver support. And in a way I tend to side with them. The most recent OpenGL implementations are only needed for games and not for CAD.