7 ms·

No, they don't contact the app store to approve each launch. Apple has a root CA that expired, during this "event" apps wouldn't launch because they couldn't ve

No, they don't contact the app store to approve each launch. Apple has a root CA that expired, during this "event" apps wouldn't launch because they couldn't verify the code signing certificate. Apple updated their certificate, and all apps started working again. See: https://news.ycombinator.com/item?id=10560634 https://news.ycombinator.com/item?id=10560634

dkonofalski 11y ago
I already responded to you in another thread here, but this isn't true. The apps wouldn't launch because they were using an old, outdated version of OpenSSL that's been updated since 2005. They were referencing an old, out of date root certificate, not the current one.
thesimon 11y ago
But as the top comment says: The actual issue was that some developers used an old version of OpenSSL, which couldn't handle the SHA2 cert. Apple apparently "deprecated" their SHA1 cert and started to use an SHA2 cert. IIRC some apps were still working because they used the right OpenSSL version. I guess Apple didn't communicate enough with the developers that they'll start using SHA2.
- mikeash 11y ago
  > I guess Apple didn't communicate enough with the developers that they'll start using SHA2. Understatement of the year right there. Apple didn't communicate this at all. The first time anybody outside of Apple found out about this was when apps started failing to launch. If Apple had merely told developers a month ahead of time, "Hey, we're switching to SHA-2 certificates, make sure your receipt validation code handles it," this whole thing could have been avoided. In a crazy hypothetical world where Apple's app store team actually gives a shit about third party developers, they could have even tested SHA-2 certificates against the apps in the store, and directly contacted affected developers to tell them to get stuff fixed.
- X-Istence 11y ago
  SHA-1 deprecation has been on the table for a long time now.
SyneRyder 11y ago
Not all apps, some older apps (e.g. Tweetbot 1.xx) stopped working permanently & can't be fixed, because Apple doesn't allow old versions to be re-downloaded from the Mac App Store. It's convinced me to stop using the MAS and I've been re-buying my MAS apps direct from the developer wherever possible. I commented more fully over here: https://news.ycombinator.com/item?id=10562030 https://news.ycombinator.com/item?id=10562030
- oneeyedpigeon 11y ago
  Thanks for this info. I don't think I fully appreciated this aspect of the MAS before, although I'm sure all the pieces were lodged in the back of my mind, nagging away. I'm not going to buy any software from the MAS ever again.
kalleboo 11y ago
> and all apps started working again Some apps are still broken for me, and I'm not sure how to fix them aside from deleting and reinstalling

dkonofalski 11y ago

I already responded to you in another thread here, but this isn't true. The apps wouldn't launch because they were using an old, outdated version of OpenSSL that's been updated since 2005. They were referencing an old, out of date root certificate, not the current one.

thesimon 11y ago

But as the top comment says: The actual issue was that some developers used an old version of OpenSSL, which couldn't handle the SHA2 cert. Apple apparently "deprecated" their SHA1 cert and started to use an SHA2 cert. IIRC some apps were still working because they used the right OpenSSL version. I guess Apple didn't communicate enough with the developers that they'll start using SHA2.

mikeash 11y ago
> I guess Apple didn't communicate enough with the developers that they'll start using SHA2. Understatement of the year right there. Apple didn't communicate this at all. The first time anybody outside of Apple found out about this was when apps started failing to launch. If Apple had merely told developers a month ahead of time, "Hey, we're switching to SHA-2 certificates, make sure your receipt validation code handles it," this whole thing could have been avoided. In a crazy hypothetical world where Apple's app store team actually gives a shit about third party developers, they could have even tested SHA-2 certificates against the apps in the store, and directly contacted affected developers to tell them to get stuff fixed.
X-Istence 11y ago
SHA-1 deprecation has been on the table for a long time now.

SyneRyder 11y ago

Not all apps, some older apps (e.g. Tweetbot 1.xx) stopped working permanently & can't be fixed, because Apple doesn't allow old versions to be re-downloaded from the Mac App Store. It's convinced me to stop using the MAS and I've been re-buying my MAS apps direct from the developer wherever possible. I commented more fully over here: https://news.ycombinator.com/item?id=10562030 https://news.ycombinator.com/item?id=10562030

oneeyedpigeon 11y ago
Thanks for this info. I don't think I fully appreciated this aspect of the MAS before, although I'm sure all the pieces were lodged in the back of my mind, nagging away. I'm not going to buy any software from the MAS ever again.

kalleboo 11y ago

> and all apps started working again Some apps are still broken for me, and I'm not sure how to fix them aside from deleting and reinstalling