The default setting is to only allow apps from the first two categories: the Mac App Store and from identified developers. Apple considers these the least secure, but it doesn’t mean an app is untrustworthy–after all, Mac apps that haven’t been updated in years may not be properly signed.

Apps from anywhere else: Apps that aren’t acquired from the Mac App Store and aren’t signed with a developer ID fall into this last category.

In this way, Gatekeeper ensures only applications created by legitimate developers who have gone through the trouble of getting a developer ID and are in good standing can run on your computer. If it’s discovered that a developer is abusing their developer ID–or it was acquired by hackers who are using it to sign malicious apps–the developer ID can then be revoked.

For example, when you install Google Chrome on your Mac, it’s signed with Google’s developer ID so Apple allows it to run. This digital signature ensures the application was actually created by that specific developer.

Apps from Identified Developers: Mac app developers can acquire a unique developer ID from Apple and use it to sign their applications.

They’re also sandboxed, although this is a reason why many app developers don’t use the Mac App Store.

Apps from the Mac App Store: Applications you install from the Mac App Store are considered the most trustworthy, as they’ve gone through an Apple vetting process and are hosted by Apple themselves.

Gatekeeper knows about three different types of apps: RELATED: How to Install Applications On a Mac: Everything You Need to Know (You may also want to bypass this and run an unsigned app if you’re developing your own apps.) That’s why Apple offers a way to bypass Gatekeeper. Maybe they haven’t been updated in a while, or maybe the developer just didn’t bother. Some apps available on the web–particularly older ones–just aren’t signed, even if they’re trustworthy.

If it’s not, you’ll see a warning message and your Mac will prevent the application from running.īut not every Mac app is signed.

If the application is signed with a valid signature, it’s allowed to run. Whenever you launch a new application on your Mac, Gatekeeper checks to see that it’s signed with a valid signature.

Why do developers use mac reddit