All posts in the ‘Company News’ category

Subscribe to the RSS feed for the 'Company News' category

How Apple’s security system broke some Mac apps

Thursday, February 23rd, 2017

Feb 28 2017 update

Apple has responded quickly to address this issue. Their Developer ID page, which I believe is brand new, specifically addresses provisioning profiles and their relationship to the Developer ID certificate. Here’s what they say (emphasis added):

For apps that utilize advanced capabilities with a Developer ID provisioning profile
Gatekeeper will evaluate the validity of your Developer ID certificate when your application is installed and will evaluate the validity of your Developer ID provisioning profile at every app launch. As long as your Developer ID certificate was valid when you compiled your app, then users can download and run your app, even after the expiration date of the certificate. However, if your Developer ID provisioning profile expires, the app will no longer launch.

That section addresses the crashes seen in PDFpenPro and 1Password: It is now documented that an expired provisioning profile will prevent your app from launching. That’s not necessarily good news…but the good news is that this will, going forward, be a much rarer event:

To simplify the management of your Developer ID apps and to ensure an uninterrupted experience for your users, Developer ID provisioning profiles generated after February 22, 2017 are valid for 18 years from the creation date, regardless of the expiration date of your Developer ID certificate.

So any app that uses a provisioning profile created after February 22nd of this year will not crash due to an expired provisioning profile—even if the developer does nothing and lets their Developer ID certificate expire—until February 22, 2035. That’s effectively forever in the world of a macOS app (it’s longer than macOS/OS X itself has existed, in fact.)

Thanks, Apple, for the quick response! We’re leaving the original article posted as a non-techie overview of the Developer ID system; keep reading if that’s of interest to you.


Recently, some well-known Mac apps, including 1Password, PDFpenPro, and Soulver, had a big problem: They all failed to launch. Nothing had changed with these apps (i.e. no updates had been released), and yet they simply stopped working.

So what happened? All three of these apps (and probably some others we haven’t heard from yet) contained an expired code signing certificate. That expired certificate prevented the apps from launching, though no developer would have expected that, based on Apple’s own documentation. And an expired code signing certificate can’t just be renewed to extend its expiration date (like you would a driver’s license); it needs to be replaced with a new non-expired certificate, which requires distributing an update to the app.

Follow me now, if you wish, for a somewhat deep dive into the world of code signing, as I attempt to explain—from a consumer’s perspective yet with a developer’s hat on—what is code signing, why these apps broke, why the breakage wasn’t expected, and other related questions and answers.

Update: AgileBits has a very detailed blog post that covers this issue in even more depth—well worth the reading time.

(more…)

The new Many Tricks’ end user license agreement

Thursday, April 28th, 2016

Ever since Peter and I relaunched Many Tricks in 2010, we’ve never had an official software license agreement. The closest thing we’ve had is this blog post, which explains limits on the use of our apps across multiple Macs (tl;dr: Use them on as many Macs as you personally use). However, we’ve never had an actual end user license agreement (EULA) that spells out the legal license you agree to when you purchase one of our apps.

Well, we have one now—it’s also permanently linked in the sidebar here, and will be accessible from within our apps. And a really big thanks to Rich Siegel at Bare Bones Software, who generously agreed to let us use his document as a starting point. I found the Bare Bones EULA to be well written, brief, and easily understood; hopefully our version, which has only minor changes, is still all of those things.

After six years, why did we suddenly need an EULA? The truth is we probably should have had one from day one, but never really felt the need. Recently, however, we’ve received inquiries from government agencies and larger companies interested in buying our apps … and many of these customers aren’t allowed to purchase our apps unless we have an actual legal license agreement. So now we do.

Note that this doesn’t change anything relative to the usage of our apps; we still allow you to use one license to install our apps on as many Macs as you personally use. We just needed to have a formal legal software license for larger customers and government agencies.

All direct apps updated to improve update security

Sunday, January 31st, 2016

Yes, that’s right, we’ve updated the updater in our direct apps. Our direct apps rely on Sparkle to inform you when there are new versions available. Over the weekend, we were made aware of a potential vulnerability in how we implemented Sparkle. Basically, if your network is already compromised by what’s called a Man in the Middle attack, then it’s possible an attacker could use the Sparkle update mechanism in our apps to remotely execute code on your Mac. That’s bad.

Although this is a relatively small exposure (as you must already be on a compromised network), we felt it was important to act on it right away, so we’ve updated all of our apps to use Sparkle over secure HTTP (HTTPS). Please update any directly-purchased Many Tricks apps immediately.

Important: There’s a bit of a Catch-22 here … in order to get you this update, it must come over insecure HTTP, because that’s how Sparkle in the app you’re using is configured. If you are concerned that you might be on a compromised network, please do not update using the in-app updater. Instead, just download the relevant app(s) directly from our site, which uses HTTPS.

If you have any questions on this update, please leave a comment or email us directly, and we’ll do our best to address your questions.

Note: Although our App Store apps don’t use Sparkle, we know they’re out of date with some of the other minor bug fixes that came with these releases. We’ll be submitting updates to the App Store next week to get App Store users current.

The Many Tricks holiday sale event and charity drive

Monday, December 14th, 2015

People ask us all the time, “When are your apps going on sale?” And we always reply “We don’t know,” because, generally, we don’t know. But we know now: Our apps—when you purchase directly from us—are on sale for the remainder of 2015, and there are two ways to take advantage of the sale.

Option One: Own Them All

First off, you can own them all for just $50—that’s $62 off the normal price of $112 for all 10. All ten apps, fifty bucks total. These are fully licensed versions, not some special one-off, so they’re all eligible for upgrade pricing when major new releases come out.

On the charity drive front, we will donate $10 for each bundle sold to the United Nation’s refugee fund, to help with the ongoing global refugee crisis. And to get things started, we’ve already donated $500 to the fund.

Option Two: Save Some Coin

If you don’t really want all our apps (we don’t understand such thinking, of course!), you’ll want to use option two: Every purchase is 30% off for the remainder of the year.

We will donate 10% of our net proceeds from any individual sales to that same UN refugee fund.

About the Mac App Store

You may have noticed that this sale is only available to customers who purchase directly from us; our App Store app pricing is unchanged, and we can’t create a bundle of apps there anyway.

So why aren’t the individual MAS versions on sale? Quite honestly, we feel Apple has ignored the MAS for too long, and as a result, the customer experience is not what it should be. Add in the recent snafu with certificates, and we would like to reward those who choose to purchase direct. That’s why this sale is for direct customers only.

So there you have it, the Many Tricks year-end sale event and charity drive.

All direct apps updated ahead of El Capitan’s release

Monday, September 28th, 2015

There are a couple of changes in the soon-to-be-released El Capitan that required us to update our direct-sales app update mechanism—an incredible open-source framework known as Sparkle. (App Store versions don’t have this update mechanism, because the App Store app handles app updates.)

Because of how we implemented Sparkle, we found that the updater wasn’t working properly in El Capitan. So we needed to fix this prior to El Capitan’s release. As a result, today we have updated every single direct app we sell (and even one we give away):

Butler, Desktop Curtain, Key Codes, Keymo, Leech, Moom, Name Mangler, Time Sink, Usher, and Witch

We have pushed all these updates live, so you should see them automatically (if you have our apps set to auto-update), or you can look in the Preferences > Updates section of a given app and manually check for updates. You can also download the complete new version from our site, if you prefer (just delete the old one and replace with the new; you won’t lose your settings.)

Our site has learned to speak securely

Monday, September 28th, 2015

Every year, we get a few inquiries about why our web site doesn’t use https (i.e. TLS/SSL) to encrypt communications between the user and our site. Our stock answer has been that SSL is slow, expensive, and complicated for a two-person company to manage—and that was true for many years.

However, when I received the latest inquiry about encryption on the site, I thought it was time to revisit the subject. What I found is that SSL is no longer slow or expensive—and the complexity level has dropped dramatically. So we did a bit of work to update our pages, installed our shiny new security certificate, and as of now, you can securely browse Many Tricks by using this URL:

Note that we have not made this the default—but if you load the https site, you won’t be able to load the http version (thanks to something called HTTP Strict Transport Security).

When you’re browsing our https site, you should see a small lock icon next to the site’s name, as seen below in Safari, Chrome, and Firefox:

We don’t collect any financial information here (all purchase details go through our processors, which have always used TLS/SSL encryption). But many people like the security of knowing that their interactions with a given site are encrypted. And now, they can be when you visit manytricks.com.

SHA-2 Hashes

The other thing we’ve done is create a page of SHA-2 hashes for all our apps. That page contains a list of SHA-2 hash values, and explains how to use these values to insure that what you download from us is the same as what we uploaded to the server. (Note that this is mostly useful for any potential download interceptions; if someone hacks our server such that they have full access, they could simply modify the SHA-2 values so that everything still looked right to a user.)

Please let us know if you have any troubles with either the https site (or our SHA-2 hash values)—we think we’ve tested everything, but it’s quite possible we’ve missed a page somewhere.

Welcome, Resolutionator

Tuesday, August 4th, 2015

Meet Resolutionator, the newest entry in Many Tricks’ stable of apps. Resolutionator makes it brain-dead-simple to switch the resolution on your display(s), and was developed with retina displays in mind (though it’s perfectly functional on non-retina displays, too).

Like many of our other apps, Resolutionator came about due to an internal need—I use a 13″ retina MacBook Pro, and as crisp and gorgeous as that 1280×800 ‘retinaized’ display is, that’s just not a lot of room when working with lots of windows. As a result, I found myself constantly switching resolutions—I’d use a higher resolution when working on complicated projects, then switch back to the default retina resolution when browsing the web or reading email.

In prior versions of the Mac OS, switching resolutions wasn’t a big deal—an optional menu bar icon provided quick access to any available resolution. But some years back, this feature vanished, never (at least so far) to be seen again. In its place is a convoluted process that requires launching System Preferences and clicking buttons. If you change resolutions once a week, it’s not too bad…but if you change multiple times a day, it gets old, and fast.

Switch via pop-up or menu barEnter Resolutionator, which recreates the old menu bar prompt to let you quickly change the resolution on any and all attached displays, as seen at right.

But Resolutionator goes well beyond the old stock resolution switcher.

You can assign a keyboard shortcut, and then switch resolutions via a pop-up menu. And whether you use a keyboard shortcut or the menu bar icon, Resolutionator lets you switch the resolution on all attached displays from the same location.

Want to conserve menu bar space? After assigning that keyboard shortcut, switch Resolutionator to faceless mode, and it runs completely invisibly, activated only when you press the assigned shortcut. (It can also run as a normal application, complete with Dock icon, if you prefer.)

Those features are useful, though not all that exciting. The exciting feature in Resolutionator is its secret superpower…

(more…)

Something different: The Many Tricks holiday sale

Monday, December 15th, 2014

As promised, today we’re announcing both something new and something different … and the something different is our holiday sale. We’ve tried to keep it as simple as possible:



From now through end-of-day (USA Pacific time) on December 31st, 2014, all of our applications are 50% off—whether you buy them from us or from the App Store.



Note: App Store prices are 50% off, except in cases where the price would wind up on a $.50 split (because the App Store forces all prices to end in $.99). So for those “fifty cent split” apps, the App Store versions of each app will be $0.49 more expensive than buying directly from us.

Also note: Upgrades are not on sale. If you’re an existing user of an old version of one of our apps, just buy the full version at the sale price. It will be cheaper than the upgrade!

Finally note: If you want to save even more, just buy four or more of our apps, and you’ll save another 20%. This deal only works on purchases from our site; the App Store doesn’t allow us to create multi-item discounts.

No coupon code, no secret handshake, no treasure hunt … everything’s just half off for the next couple of weeks.

Gift purchases: If you’d like to give one or more apps as a gift, here’s how to do it:

  1. Load the Gift Our Apps web page.
  2. Select which product you’d like to gift, enter the recipient’s name and email address, then click Add to Cart.
  3. Buy whatever else you want for yourself, or proceed to checkout if it’s just a gift. (To give more than one gift, click Continue Shopping on the pop-up cart window, then change the information on the gift page and click Add to Cart again.)

When you complete your purchase transaction, you’ll receive the usual confirmation about payment, but you’ll also receive license files for the gift recipients. The email will read “Hello [your name]: Here is your license file for [product], made out to:,” followed by the recipient’s name and email address and the rest of the license email (and attached license file, of course).

You can then copy and paste the license file email (make sure you include the attachment, and probably exclude the first line with your name in it) in a new email to the recipient, and they’ll get the gifted app directly from you.

Something new: Resolutionator

Monday, December 15th, 2014

resolutionator_iconThe “something new” portion of today’s promised “something different, something new” is a public beta of Resolutionator. And what is Resolutionator? As noted in our teaser last week, it’s a tool to help you with your resolutions in the new year.

resolutions1No, not those resolutions, but resolutions like those seen at right. That’s right; Resolutionator brings back the menu bar resolution switching feature that Apple saw fit to remove at some point in the past.

But as with all our apps, Resolutionator is capable of many additional tricks. You can…

  • Use more resolutions than those available in the Displays System Preferences panel.
  • Switch resolutions via an onscreen menu, accessed via a user-defined hot key.
  • On some Macs, use resolutions greater than the available pixels. For instance, you can set a 13″ Retina MacBook Pro to display at 2880×1800 pixels, greater than its 2560×1600 true resolution. It sounds like magic, but it’s real, and it works.
  • Set resolutions for any attached displays via either the menu bar or floating resolution switcher.

Who might find Resolutionator useful? Owners of Retina Macs who find themselves switching between “OMG it’s stunning!” retina mode and “I need to see more data” more space modes. Users with multiple displays who change resolutions on one or more of the connected displays. Users of Macs with smaller screens (11″ MacBook Air, anyone?) who occasionally wished they could see more data on their screen. And probably many other people who have usage scenarios we haven’t even thought of yet.

We’ve been using Resolutionator internally for a few months, and we think it’s nearly ready to go. But before we release version 1.0, we’d like to get some feedback from the real world…and that’s where you come in: If you’d like to help beta test Resolutionator, drop us a line and we’ll provide a download link and some “getting started” instructions.

Note: Resolutionator is just an app that uses APIs provided by OS X to get and set display resolutions; it can’t harm your display by putting it into a mode it can’t support (because the monitor tells OS X what it can do, and Resolutionator uses those values for its list of available resolutions).

So if you’d like to help us test, drop us a line and we’ll get you set up.

Coming Monday: Something new, something different

Friday, December 12th, 2014

The holiday season is in full swing, and come Monday (December 15th), we’ll be joining the festivities. How, exactly? Tune in Monday for the full details!

For now, let’s just say that the “something new” will help you with your resolutions in the new year, and the “something different” will directly affect your wallet this holiday season.

In other words, if you’re thinking of buying something from us soon, you may want to wait until Monday to see what we’ve got to say!