After setting a record of 29 updates through the year, XProtect’s Yara rules have grown from about 195 in 167 KB of text to 328 in 921 KB. Here are other details for the other XProtects, Gatekeeper and more.
Notarization
iCloud is now used for key services including notarization checks. For XProtect updates, it should be quicker and simpler, so long as you mind the pinniped.
We want confidence that all executable code is exactly as was built by its developer, and if any is found to be malicious, we want macOS to be able to block its launch.
Recommendations for the ‘standard’ user for security and privacy protection from startup to shutdown. A broad overview of all key systems and how they fit together.
Notarization is now obligatory for developers, but at the same time, we’re still able to run our own apps that aren’t notarized. Here’s how that works, and why.
App launch security is built in multiple layers, and not all check are run on every launch of an app. Syspolicy plays a key role, CDHashes are now central, and XProtect scans can make checks on large apps slow.
Although macOS won’t tell, Apparency will, even down to launch constraints. Other alternatives, and how to check in the command line.
How is it going to be harder to run apps that haven’t been notarized in Sequoia, and does it bring any benefit in return for the inconvenience?
So is macOS slowly merging with iOS, and are our Macs going to be locked down, so they can only run notarized apps?
Ventura aims to improve app security by checking integrity of apps and command tools whenever they’re run. How can it do that without significant overhead?
