Human behaviour is full of paradoxical responses. One of the most puzzling of them all is sometimes seen in those suffering from hypothermia, who instead of trying to conserve body heat, do the exact opposite, in what’s known as paradoxical undressing. Some become quite punchy about it too, and have to be restrained by several burly blokes to stop them from dancing naked in a blizzard.

In trying to round up the significant ins and outs of Ventura this week, the third in which I have been largely immersed in Ventura’s features, I’ve come across equally paradoxical responses. They have explained one of the mysteries I see occasionally among SilentKnight users, those who discover that, at some time in the past, they have turned Gatekeeper checks off, and never turned them back on again. It seems the reason for this paradoxical behaviour is the advice they’ve been given on sites among the top hits on Google’s search.

In my case, I came across this advice when trying to discover whether other sites had covered changes to Gatekeeper in Ventura. To my horror, among the more popular recommendations given for dealing with apps being blocked by Gatekeeper from starting up, are stripping all extended attributes at the command line, and disabling Gatekeeper “temporarily”.

This reminds me of those unfortunate cases you read about. An intruder alarm goes off, annoying security staff, who turn it off and allow thieves to enter without any further trouble, and someone gets upset enough to disable automatic smoke alarms or sprinkler systems when there’s a real fire in progress.

Let’s say we have downloaded software from a developer’s site, installed it on our Mac, only to find that Gatekeeper won’t allow us to run it. I’m not referring here to problems occurring with app translocation, but a warning that the app is damaged and can’t be run. Most sites give the correct first response, of trying to download and install the app again. After some of the usual general panaceas like restarting and installing macOS updates, several then go on to recommend the user to disable Gatekeeper, or to strip extended attributes, among them presumably the quarantine flag, so effectively bypassing Gatekeeper’s first run checks on that app.

From time to time, developer’s sites are compromised, and one of the common tricks is to subvert them to deliver malicious software to innocent users who think they’re downloading genuine signed and notarized software instead. Well, you would, wouldn’t you? Who would ever suspect that you might download something not entirely wholesome?

Your best defence then is the hope that Gatekeeper’s first run checks will detect that malware. Stripping the quarantine flag or turning Gatekeeper checks off altogether disable your Mac’s primary defences, open the door, and welcome almost anything in, as paradoxically as stripping off in a blizzard, or turning intruder or smoke alarms off.

The only saving grace for those websites offering such dangerous advice is that they haven’t been brought up to date for Ventura, although several pretend to provide specific advice for it. This may in part explain why Apple is changing Gatekeeper behaviour in macOS 13 so that signatures and notarization are always checked on notarized apps, even after their first run, when they have got out of quarantine. However, I suspect that those crazy enough to turn Gatekeeper off altogether may still get everything they wished for, with a bonus of some added malware.

It was at this stage that another thought occurred to me: several of these sites offering this dangerous advice were also trying to get me to download and install software, generally housekeeping and clean-up utilities. What if their advice was carefully tailored to encourage visitors to download malware, then turn Gatekeeper off to ensure that it installed and ran undetected?

I can’t prove anything, and I’m afraid these products aren’t the sort I’d ever let loose on one of my Macs anyway, but what an ingenious deception.

All this brings me back to the issue of paradoxical behaviour. Why would anyone put blind trust in such websites urging us to turn off our Mac’s security defences? I’d rather dance naked in a blizzard, thank you.