4 ms·

Aren't the dmgs digitally signed?

• TillE 10y ago
  The legitimate version of Handbrake is not signed, at least not in the standard Apple way. I know a cert costs some money, but well, this is why they exist and why the latest versions of MacOS have hard-to-override warnings.
  • goodplay 10y ago
    Perhaps we need a letsencrypt for signing packages on walled-garden systems.
    • tonyedgecombe 10y ago
      Code signing requires some verification that you are who you say you are in the real world so there is an additional cost.
      • goodplay 10y ago
        Not necessarily. For issues like the one discussed in this thread, a simple ssh-style "trust initially" would have sufficed, and would have prevented the malicious installer from running. Note that I'm not proposing this as a replacement for the current cert system (which you pay into), but as a replacement for unsigned executables.