3 ms·
The legitimate version of Handbrake is not signed, at least not in the standard Apple way. I know a cert costs some money, but well, this is why they exist and
by TillE 10y ago
The legitimate version of Handbrake is not signed, at least not in the standard Apple way. I know a cert costs some money, but well, this is why they exist and why the latest versions of MacOS have hard-to-override warnings.
- goodplay 10y agoPerhaps we need a letsencrypt for signing packages on walled-garden systems.
- tonyedgecombe 10y agoCode signing requires some verification that you are who you say you are in the real world so there is an additional cost.
- goodplay 10y agoNot necessarily. For issues like the one discussed in this thread, a simple ssh-style "trust initially" would have sufficed, and would have prevented the malicious installer from running. Note that I'm not proposing this as a replacement for the current cert system (which you pay into), but as a replacement for unsigned executables.