If you choose Allow, OS X signs the application and automatically adds it to the firewall list. If you run an unsigned app that is not listed in the firewall list, a dialog appears with options to Allow or Deny connections for the app. Apps included in OS X are signed by Apple and are allowed to receive incoming connections when this setting is enabled. For example, since iTunes is already signed by Apple, it is automatically allowed to receive incoming connections through the firewall. Applications that are signed by a valid certificate authority are automatically added to the list of allowed apps, rather than prompting the user to authorize them.
