Mountain Lion - Most Skippable OS X Upgrade Ever?

Mountain Lion - Most Skippable OS X Upgrade Ever?

OS X Mountain Lion

Mountain Lion: Most Skippable OS X Upgrade Ever?

Devin Coldewey:

And now here is Mountain Lion, a collection of iOS apps and features already available elsewhere. And a shady “security” feature that by default prevents you from getting apps from any source but the Mac App Store.

Coldewey is either misinformed (what?!) or is flat-out deceiving his readers. Either way, this is one of the stupidest things I’ve read in a while, and coming from TechCrunch that’s saying something.

As Gruber notes:

Users have three choices which type of apps can run on Mountain Lion:

  • Only those from the App Store

  • Only those from the App Store or which are signed by a developer ID

  • Any app, whether signed or unsigned

The default for this setting is, I say, exactly right: the one in the middle, disallowing only unsigned apps.

So Coldewey is absolutely wrong when he says that it “by default prevents you from getting apps from any source but the Mac App Store.” The default allows you to install apps from the Mac App Store or any app from anywhere provided it’s been signed by the developer.

From MacWorld:

Mac App Store and identified developers: This is the new default setting in Mountain Lion. In addition to Mac App Store apps, it also allows any third-party apps that have been signed by an identified developer to run.

Apple is implementing a mechanism that allows developers to sign their apps, whether those apps are in the Mac App Store or not. So if I have Program A that I distribute from my website, I can register with Apple and sign my application for free. And here’s the important part: I can keep distributing Program A from my website. There’s no requirement that I use the Mac App Store and only the Mac App Store. This is where Coldewey missed the boat.

If Program A turns out to be malware, Apple can revoke my signature and – boom – the application will no longer run on your computer.

This is smart security. It’s something that Microsoft should’ve implemented decades ago and I’d be surprised if we don’t see something similar from them in the future. This is where Coldewey turned disingenuous. There’s nothing shady about it. As a matter of fact, the only shady thing around here is Coldewey’s TechCrunch article.