@SupportTech: If Open Safe Files is off, they're closer, but .dmg is still messier. We've seen many users who run apps off .dmgs, and keep the .dmg around, forever (mounting it every time). That doesn't happen with .zip.

@Greg, @Oliver: As others have noted, installers have many issues. Being required to run an installer is a deterrent for anyone trialing an app, for starters.

@Vince: .dmgs are not at all the “standard”. .zip is more prevalent, and we've found it to be far simpler for users. We've distributed via both .dmg and .zip, and with a sample size of tens of thousands of users, .zip is much more preferable.

As for an installer, see the above note.

@Seriously?: This safety feature provides literally no protection from apps which do not load external resources. Developers should absolutely be able to opt out of it (or better yet, Apple should implement a better solution to the problem, which affects a tiny percentage of apps).

@Anon: Indeed! Thanks.

@Peter N Lewis: Spot on on all points regarding installers and .dmg. As for the plist entry, it would require an active effort by developers to turn it on. That same effort could/should be applied to securing any insecure app. There may be a low likelihood of this happening, but it's worth a shot. Frankly, we'd prefer they scrapped this poor implementation, and went back to the drawing board, but this is an easy workaround that still provides benefit against vulnerable apps that are already out there.

@Rosyna: What we've found matches what @Anon has found - .xip doesn't seem to solve the issue in our tests. You'll also note that Apple doesn't mention xips in its code signing tech note. Perhaps our tests were incorrect? But with nearly non-existent documentation on .xip, it's tough to tell. It's also not a stellar solution, as it would require updating Sparkle to understand .xips.