OS X Mountain Lion and Gatekeeper
February 17th, 2012 | by jz | Published in Future of the Internet | 4 Comments
This week, Apple announced that it was moving to a new, faster OS X operating system development cycle, starting with the release of Mountain Lion next summer. It previewed a number of features for the OS, and released some parts in beta.
Mountain Lion is slated to include a feature called Gatekeeper as part of the security and privacy settings. Gatekeeper allows administrators (those with full privileges on a Mac) to limit the applications that can run on the Mac. They can choose among allowing apps downloaded from the Mac App Store only, or apps from outside the Store so long as they are digitally signed to Apple’s satisfaction by their developers, or apps from anywhere. (The latter has been the way both Mac and Windows PCs have worked, for better or worse, since the introduction of the Apple II in 1977.)
We here at Future of the Internet will refrain from saying “I told you so” about the prospect of Macs only running applications from the Mac App Store. Instead, we will note that there are benefits for enterprise Mac fleet managers to limit apps to the App Store only. Most users on others’ (such as employers’) machines may not even miss the ability to “sideload” — there are plenty of Solitaire apps in the Mac App Store. Moreover, users who have administrative permission have the option to override Gatekeeper at any time by Control-clicking and affirming their intention to go “off roading.” MacWorld has more information about the way Gatekeeper interacts with the existing security measures.
The second option, allowing applications from both the App Store and signed developers, is where the meat of this story is. John Gruber of Daring Fireball, reporting on a private product briefing, stated that developers will now be able to get free-of-charge developer IDs to sign code with. If true, this is a great step forward for continued generativity on the platform. (So far the Apple Developer website has no mention of free options for signing code.) Signed code produced outside the App Store is excellent. It eliminates the concerns about App Store-pushed sandboxing (as expressed here) by allowing developers who write un-sandboxable programs to sign their code anyway, for verification purposes. It also means that developers who either don’t want to hand 30% of their revenue over to Apple (as a cost of entry to the App Store) or who want to produce applications with non-Apple approved content (like a comic by a Pulitzer Prize winner) can still signal to users that their work isn’t malware.
Will this help users make decisions about what kind of programs to install? The more that legitimate developers join the Developer ID program and start signing code, the more effective Gatekeeper will be at deterring users from installing malware. But if developers don’t sign up, it’s easy to see how Gatekeeper could turn into yet another click-through approval box, where users see so many warnings that they instantly click okay.
Gatekeeper in its current blueprint isn’t the end of Mac generativity. The middle ground of allowing non-App Store signed code may represent the best of both worlds. However, one small tweak — lose that Control-click for sideloading — and OS X could fully merge with iOS, both in functionality and in security methods. And that would be the worst of both worlds. Perhaps a successful launch of Mountain Lion in its current plan can pave the way for iOS to become a little more generative. That depends more on Apple’s desired business model for the app store than on maintaining security for the mobile platform.
–KA and JZ
February 17th, 2012 at 6:54 pm (#)
Thanks for this piece. In this iteration, I was pleasantly surprised to see Apple offer a good balance. It certainly makes me nervous though. What will future releases of the operating system bring?
Another concern though, is how this might become a new way to survey the security of a user’s computer. If this kind of division between applications on our computers becomes standard, it may eventually offer an easy way for technology staff at institutions to identify “risky” computers on their network.
While we have learned to live with the fact that Harvard computers, for example, cannot see eachother on the network (to prevent the spread of viruses etc.), and increasingly strong worded statements about operating firewalls in such and such a way or using virus protection software of a particular kind, they might one day decide, “It isn’t worth the hassle of allowing users with *wild* unsigned applications running on our network” – with that, what Cory Doctorow calls the “war on general purpose computation” will have taken a bold step forward.
February 18th, 2012 at 4:11 pm (#)
However, wouldn’t Apple have the power to revoke signing keys at any moment with a “security update” effectively locking out any undesired developers?
February 19th, 2012 at 1:06 pm (#)
[...] The Future of the Internet: OS X Mountain Lion and Gatekeeper [...]
February 23rd, 2012 at 11:12 am (#)
[...] developers time to integrate new permissions from an update, it does follow the announcement of Gatekeeper, which might be a partial substitute for [...]