Ghostmoon.app – The Swiss Army Knife for your macOS menu bar

https://www.mgrunwald.com/ghostmoon/

Ghostmoon.app - The essential powertool for macOS.

Every feature you need. Two clicks away. The essential powertool for macOS.

This looks cool enough, but it’s starting to drive me crazy how people are in such a rush to put out their macOS apps they can’t be bothered to get a developer account and run a one line command. It’s not hard.

I used to be sympathetic to complaints about not wanting to pay the developer account fee. But when you’re vibe coding, you’re probably paying a good chunk of change to your LLM supplier of choice every month, and the yearly developer account fee seems minor in comparison

Also, it’s just such a bad security precedent. This page describes the error you get as “the typical macOS Gatekeeper warning”, as though it were just another piece of corporate silliness, like clicking through a EULA.

The truth is that Gatekeeper should go the way of the devil.

It is my machine and I paid for it, why does the OS care about what I do with it? The only thing this leads to is making sure your customers grow into good little lemmings.

I want to be a power user on my Mac, I don’t want my mom’s Mac to function like my devbox.

People like and need the apple sandbox. Others need an unlocked *nix machines

It's fine as long as both exist and third parties are not allowed to know which one you're running.

Otherwise, you have banks and MAFIAA and others off-loading their own security and compliance costs to users by flat out discriminating based on the status of the sandbox.

So that you don't accidentally run malware. MacOS is not iOS, you can run unsigned code if you really want to, but it will make you jump through a few hoops.
How is this better than trying to eliminate the problem between the keyboard and the computer? The user won't learn if the computer handholds them through everything.
Because the vast majority of users have no interest in learning how to safely vet apps and just want to easily use their computers and not worry about malware.

> The user won't learn

Full stop. I still talk to people every working day who don't realize that rebooting a computer is actually a real troubleshooting step. They seem to think it's bunk tech support mumbo jumbo rather than a genuinely useful step. It's 2026 and they're still surprised when that works.

You can do whatever you want if you are a power user, the tools are there to get around Gatekeeper.

For everyone else it's probably sane to have it, works as a decent filter so someone not tech-savvy don't get hurt by installing malware disguised as an app, one would just need to state incredible features that almost any normal user would like to have, and make them click to install. Gatekeeper diminishes that risk by a lot unless you learn how to bypass it, which requires you having decent skills and probably wouldn't fall for the bullshit that malware apps try to bait people with.

If you don't want your name, address, phone number on public display you need to either set up a company or set up some forwarding. If you set up a company, you'll need to get a DUNS number. If you haven't done it before and don't know about the secret shortcut way to do that, it is very annoying to get one.

Anyway, I don't see a problem with getting it out the door. People can just choose not to install it if they don't like it. I mean that's the whole idea of being early anyway, isn't it? Don't like a crappy bodged together UI? Don't like a lack of support? Don't like an unsigned app? You can wait until it has those things according to your preferences. In the meantime, the creator gets real users and feedback ASAP.

It's free so why not just publish it on github then so that people could read the code and compile it themselves.

Right now it's closed source binary with a big fat "DOWNLOAD FOR FREE" button and instructions casually telling you to disable the last barrier between your system and persistent malware. Nobody should recommend this to anybody

Well, depends what the author's plans are for the future. Maybe it's not always going to be free as in beer, either.
Secret shortcut?!?
I don't know how obvious it is these days, but the default path through D&B's website is the terrible one. They will try to extract money from you and harass you forever. You had to find Apple's own embedded form for it by using their search and going through some flow.
Thank you for saying this! As stated on the website, this is a pre-release. Those who are not sure, absolutely do not have to install this and can wait for the official, notarized release. In the meantime, the app gets tested in the real world.

>secret shortcut

I see vagueposting has found its way into HN.

I haven't done it in a while, so didn't want to give out possibly wrong directions, but:

> I don't know how obvious it is these days, but the default path through D&B's website is the terrible one. They will try to extract money from you and harass you forever. You had to find Apple's own embedded form for it by using their search and going through some flow.

You don't need to do any of that to sign and notarize an app that you are distributing yourself.
Gatekeeper and notarization are not silliness. They exist for a reason. I thought it would be a good idea to release the app during development when I am sure that it works correctly and then maybe get some feedback from early users.
I guess OP's point is still pretty valid though, what's the harm in signing and notarizing it?

Ex-Apple macOS/Xcode dev here.

I just downloaded your app and ran it through hopper. There is a LOT of embedded Apple Script. I would never run an app like this with SIP disabled or without an active network blocker.

Your app requires direct access to major OS components: code signing, even during alpha should be a requirement.

Totally agree. There are significantly more new apps being released. I've been visiting the /r/macapps subreddit and they're having trouble filtering new submissions. I generally like the direction that they're taking https://www.reddit.com/r/macapps/comments/1ryaeex/rmacapps_m...

Even though it's more troublesome to submit apps to App Store, it's one signal that the app is not a malware.

Except it is just another piece of corporate silliness.

Why don’t you purchase your own developer account and sign it yourself if you trust it? Like you presumably do for open source apps you build yourself?