> Is there any automatic way to tell your software apart from malware?
There is no universally agreed-upon definition of malware. One man's operating system is another man's malware. For me, an operating system that "calls home" for each new executable you compile is a crystal clear case of malware. In the case of this article, then, the only malware in question is macOS.
If an Apple engineer were to compile a variant of Apple’s notarization algorithm where ok means no and no means ok, would the resulting binary notarize its own source fed into it?
Well, if the mechanism is e.g. a blacklist of APIs that shouldn't be used, and a blacklist of known malware hashes (as is the case), then Apple's "is this malware" routine could trivially print "no" for itself.
Sorry to the grandparent, but this is nothing like the halting problem...
This already exists and it is called XProtect. My question through these threads has been "why does notarization exist" and I am still trying to understand why it does, because every answer I have been given simplifies down to "here is a reason that it should exist…wait, that's just what code signing or Apple's built-in MRT does already".
Nothing is calling home when you run a new executable. You're not understanding how gatekeeper works. It works entirely offline without network access.
Close your browser and monitor your network traffic. Compile a hello world with a unique text string. Run it. It calls home the first time you run it. Then it doesn't.
If you are not connected to the internet, it does not call home indeed.
>There is no universally agreed-upon definition of malware.
Doesn't have to be. Just the common user's definition is OK.
>For me, an operating system that "calls home" for each new executable you compile is a crystal clear case of malware. In the case of this article, then, the only malware in question is macOS.
There is no universally agreed-upon definition of malware. One man's operating system is another man's malware. For me, an operating system that "calls home" for each new executable you compile is a crystal clear case of malware. In the case of this article, then, the only malware in question is macOS.