Thoughts on the Mac OS X Mountain Lion Developer Preview
by Andrew Cunningham & Anand Lal Shimpi on February 19, 2012 7:40 PM EST- Posted in
- Mountain Lion
- Mac
- macOS
Gatekeeper
Of the Mountain Lion announcements, Gatekeeper has been one of the most discussed. Apple has touted OS X as being a safer, more secure environment than Windows, offering its customers a relatively malware-free experience. In the early days this was often discounted by saying that OS X wasn't a likely target for malware simply because no one used it. Today Apple claims to have a Mac installed base of 63 million users. While there are far more Windows users, that's not an insignificant number. And it's growing.
As the likelihood for significant malware targeting OS X increases, Apple must do whatever it can to maintain its pristine image. In a sense, Apple made its bed by promising a more secure, virus/malware-free experience, and now it has to sleep in it. It's not a bad thing, but it's something that is going to require a lot of work.
The easiest and most obvious solution to the problem is the Mac App Store. Every app distributed through the Mac App Store is certified by Apple and thus no malware/viruses should ever make their way to a customer's Mac if they only run apps from the Store. That's a step in the wrong direction unfortunately. Companies like Adobe and Microsoft don't make their applications available in the Mac App Store (paying Apple 30% for every copy of Photoshop sold seems unlikely to happen), not to mention the tons of useful open source or other programs that aren't distributed through the MAS. While the iPhone can sell just fine as a platform that's more of an appliance, Macs (at least today) cannot.
The alternative is to heavily warn users that what they're running isn't exactly safe but allow applications, regardless of origin, to be run. This is what's done today in Lion. The first time you run an application that you downloaded you'll get a message that looks like this:
It's the everlasting debate between freedom and security. Give up one to get the other, but what's the right balance?
The compromise in Mountain Lion comes in the form of a tool called Gatekeeper. An innocuous little radio selection in the Security preference pane, Gatekeeper lets you choose what applications can be run on your Mac.
You can choose to only allow applications from the Mac App Store, allow all (the two extremes we discussed above) or pick an in-between option: allow anything downloaded from the MAS or anything by an identified developer.
This in-between setting is the compromise.
If a developer joins the Mac developer program ($99/year) it can become an officially identified developer with Apple. The developer can then sign its applications with a unique cryptographic key that Apple recognizes, without requiring that the apps be distributed through the Mac App Store. Unlike the Mac App Store, there's no approval process that the developer's signed apps need to go through. There's only one stipulation that goes along with the identified developer label: the apps distributed with that key cannot be malware.
Apps from identified developers will communicate with Apple's servers to verify the digital signature is intact and correct only upon install or the first run of the application. Subsequent runs do not phone home and there's no remote kill switch for these applications. Should Apple find out that a developer has been distributing malware Apple can revoke the developer's key, but that would only render those apps that have yet to be installed/run from working. Without a certification process for non-MAS apps there's still a degree of risk associated with this compromise. I don't believe the ideal solution is to force everyone to buy through the MAS, but Gatekeeper's compromise isn't an impervious solution.
Apple tells us the default Gatekeeper setting in Mountain Lion will be to allow apps from the Mac App Store or from identified developers to run. Hopefully by the time Mountain Lion ships many third party developers will be on-board and identified making the transition mostly seamless. If you don't change the default Gatekeeper setting there's another way around the protection: simply control-click (or right click) on the app you're trying to run and select open. Doing so will override the Gatekeeper setting and let you run an unsigned app.
Facebook
Twitter
RSS
96 Comments
View All Comments
ananduser - Monday, February 20, 2012 - link
Your description fits W8 entirely.steven75 - Monday, February 20, 2012 - link
Or... Mountain Lion, since you CAN install apps from the internet willy-nilly or drop down to the terminal if you really want to.ananduser - Monday, February 20, 2012 - link
The Metro interface that W8 sports is much more dramatic than the effect some features from ios integrated in OSX might have.The Metro/Classic duality is also much more akin to ying/yang than the OSX interface which is technically a mash-up.
Scannall - Monday, February 20, 2012 - link
My mom is in her 70's. About a year and a half ago I finally talked her into ditching her Windows ME (Yes, the hated ME) computer. Got her a 27 inch iMac, transferred all her photos and other documents for her. And she has just been thrilled. She has since purchased an iPad 2 and an Apple TV box to go with it.And, since setting it up initially, she hasn't needed ANY tech support from me.
But for the more hard core, and those that like to tinker the Terminal program is still there, with all the command line goodness (Or destruction...).
Also, it's pretty easy to add either Windows and Linux to your iMac. I have both on mine. Most days anymore I just want to get things done, so I boot into OS X. On the days I feel like tinkering more there is Windows and Linux there for me to play with.
bji - Monday, February 20, 2012 - link
I had a similar experience with my 65 year old mother. After 10+ years of supporting her on Windows computers, I finally bought her a mac mini after her most recent Windows virus infection. It's been the smoothest 6 months of her computer life so far, and the amount of tech support I've had to provide has been much lower. She even figured out how to resize pictures and email them, on her own, something that for some reason after 10+ years of Windows use she still hand't figured out.This is just anecdotal evidence of course, and someone else's mother may find the Windows way of doing things comprehensible, but my mom didn't, and given how many similar comments I've read, I have a feeling there is something to Apple's UI design that works well for novice users.
As a software developer, I have no problem with Apple's approach, as long as they leave the door open for third party applications that don't go through their app store, which so far, they are.
I personally have never owned a Macintosh, but have alread set aside the money for a 15 inch Macbook Air, just waiting for them to come out. It will be nice to finally be able to port my software to OS X.
cyabud - Monday, February 20, 2012 - link
"I feel Apple as well as all others should provide a simple switch to disable to 'walled garden' "This switch you talk of is called Terminal.app
And I suppose on iOS it's called a jailbreak, but we're talking about OS X here.
solipsism - Monday, February 20, 2012 - link
Andrew and Anand describe the Gatekeeper controls in System Preferences and how you can bypass them at anytime by holding down a couple keys.Apple has no reason to force you to only buy Mac App Store apps otherwise they would not have offered code signing for external apps which make non-App Store apps safer. They also don't get so much profit from apps that it makes sense to limit to the number of potential Mac buyers.
Apple is by far the most profitable PC maker in the business and they plan to stay that way, hence their move to faster OS X updates and trying to make OS X as familiar as their more popular iOS platform without negatively impacting usability. So far they are doing a good job of it.
Conficio - Tuesday, February 21, 2012 - link
Terminal.app is not an open field (as opposed to a walled garden). It's more like the trenches of the [battle of the] somme.Really, while a terminal window is nice, the functionality it opens up is undocumented, unsupported and mostly hidden from view. and if you start the app from the terminal it still bitches about "being downloaded from ....", scaring the daylight out of "ordinary" users.
Really why I give credit to Apple to break the walled prisons of the cell phone carriers (mostly the US variety) on phones, they only did in order to replace it with their own walled garden. At least they allow different producers of the same kind of apps to compete, as they profit from all of them equally, where cell phone carriers pick and choose.
TEAMSWITCHER - Monday, February 20, 2012 - link
Just because you can buy the individual parts for a computer and assemble them doesn't make you an expert - you're more like a mechanic.Your entire argument is based on a false assumption, that Mac's are simple computers for simple people - a "walled garden". While that is true for those who like it that way, Mac's also include many high knowledge tools that Windows does not. Terminal provides access to these tools that have been a foundation for computers since the early Days of the C programming language and the UNIX operating system. Sorry, the MSDOS box is not even close to comparable.
Windows is more like a "Theme Park", you can ride all the attractions, but remember you are only a park visitor, and cannot go into areas marked "Authorized Personnel Only." They made damn sure of this by not providing the same tools that are included in each and every MAC OS X installation.
cjs150 - Monday, February 20, 2012 - link
Interesting comments to my post even if one (Tim) is obviously Mr Angry.I would not ask my 70+ year old mother to build a computer, I would buy her an Ipad because she does not need to understand how is works merely use it.
But my 10 year old needs to understand computers properly and best way is to start by making her build one (OS will probably by Linux). Maybe that makes her a mechanic (Teamswitcher) but it will also give her a better appreciation of how computers work.
Yes W8 worries me, it is supposed to be a more mature OS but looks like it was designed by someone whose only previous experience was an Ipad and kids cartoons.
The problem is that as the computing market matures a lot of assumptions are being made about how people should use the computer. I do not want someone else making assumptions about how I should work, what I want is the software to allow me to work the way I want to.
Please understand my original post was that the Apple philosphy does not work for me not that I hate Apple.