AppLocker is an open-source macOS application locker that enforces per-app access at the kernel/Endpoint Security level without modifying binaries or breaking code signatures. It registers a privileged System Extension daemon that intercepts NOTIFY_EXEC events, immediately suspends newly launched target processes with SIGSTOP before any UI appears, and notifies the user interface to request biometric or password authentication via LocalAuthentication. Approved launches are resumed with SIGCONT; rejected or timed-out launches are terminated with SIGKILL. It groups simultaneous locked app launches for a single batch authentication, protects its daemon and configuration from external SIGCONT/SIGKILL/SIGSTOP attacks, and verifies binary integrity using CDHash checks. XPC communication between the GUI and daemon uses mutual ECDSA P-256 challenge-response, and various performance and UX optimizations (in-memory app icon caching, debounced Spotlight queries, SwiftUI/AppKit UI, Dark Mode, localization) are included.
The project is organized into three decoupled layers: a main SwiftUI/AppKit user app, a root ESExtension handling kernel events and anti-tamper logic, and a shared core containing XPC contracts, cryptographic helpers, CDHash verification, and logging. It requires macOS 14 (Sonoma)+ and supports Apple Silicon and Intel; obtaining the com.apple.developer.endpoint-security.client entitlement requires an Apple Developer Program account, and local development may require disabling SIP or reduced security. Users can install a prebuilt .dmg or build from source in Xcode. The code is Apache-2.0 licensed and credits Google’s Santa project as a reference.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
A U.S. immigration advocate sued the government after a border agent searched his phone without a warrant and copied data. He believes the government targeted him due to his activism and political work on immigration rights. (arstechnica.com)
Over 44,000 legal objections have been filed against Palantir's NHS data platform, demanding it be blocked from handling medical data. The campaign follows backlash over the company's involvement with the Israeli military and US immigration enforcement. (theguardian.com)
OpenAI claims that a Chinese AI model stole its intellectual property. The company alleges that it had previously appropriated IP from other sources. (theregister.com)
Android developers face new requirements to publish apps, including a $25 verification fee and identity verification, even for small-scale projects. These policies have caused frustration among developers who want to share their apps freely without extensive registration processes. (twitter.com)
Christa Pike, the only woman on Tennessee's death row, was reportedly still alive after receiving two lethal injections. Her lawyers are seeking to halt her execution, citing that she remained conscious and had a heartbeat despite the injections. (nbcnews.com)
Sandboxing alone may not be enough to contain rogue agents, as advanced attackers can find ways to bypass these security measures. Additional cryptographic and security strategies are necessary to effectively limit malicious activities. (blog.cryptographyengineering.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.