6 ms·

> The Download Mirror Server is going to be completely rebuilt from scratch. Am I alone in thinking that this is irresponsible? Why not move releases to github

> The Download Mirror Server is going to be completely rebuilt from scratch. Am I alone in thinking that this is irresponsible? Why not move releases to github? Why aren't you going to start signing macOS binaries? I find this offensive. Thanks for potentially compromising users because you couldn't be arsed to pay for a certificate.

JohnTHaller 9y ago
Please feel free to donate the funds necessary to cover the Apple ID signup for multiple years as well as the potentially necessary Apple hardware to install the SDK on and sign the app (since Apple artificially restricts code signing to only run on their own hardware) as well as any necessary training hours to the team to setup said environment so that they can sign the software they're giving to you for free.
- symlinkk 9y ago
  It's $100 for the signing and $500 for a Mac Mini. Any professional software developer would make that kind of money in a few days. And I would bet that an open source project as big as this gets at least that amount in donations yearly. It's completely irresponsible to not sign releases after something like this happens.
  - JohnTHaller 9y ago
    And if they did get $600 in donations in the last year... they should dedicate all of that to the Mac build? Even if they've already spent those funds on hosting and other expenses? A user of a free product telling the developer of said free product how the developer should be spending the money that said user isn't giving them takes a special kind of entitlement.
    - comex 9y ago
      Hold on… your premise doesn't make sense. Apple's SDK only officially runs on Mac - but that applies to the entire build process, not just codesigning. Anyone who is already producing a Mac build either has access to a Mac build host, which they can also use to sign, or is using third party tools to cross-compile from another OS. In the latter case, there is also a third party tool capable of signing binaries: https://github.com/saucelabs/isign https://github.com/saucelabs/isign You do need to pay the $99/year for the certificate, but it shouldn't be necessary to buy hardware just to sign things.
      - JohnTHaller 9y ago
        It's worth noting that you need access to a Mac you can trust to setup your Apple developer credentials on as well as iSign and then export your credentials and certificate from each time you get a new certificate. It's likely you won't be able to do this in the Apple store. While you or I may have a colleague or trusted friend we could do this with, many developers will not.
        comex 9y ago
        It does say that in the readme, but I don't think it's actually necessary: you can get certificates and provisioning profiles through the web portal without going through Xcode. (For certificates, it has you upload a standard CSR file.) Though developers may not know that… Admittedly, if you don't have a Mac build machine, (a) you can't test your builds, and (b) you can't use the official SDK (including, e.g., system header files) without violating the terms of service. Not that many people care about that, but if you don't mind ToS violations you may as well just install pirated macOS in a VM (which is easy enough in practice). Perhaps Apple deserves blame for not having a legal way to run a macOS VM on non-Apple hardware; certainly it makes life harder for open-source developers that want to play by the rules. Still, these obstacles have nothing to do with signing.
    - h1d 9y ago
      A developer should feel a little responsible about the product if it has a large amount of users... It's simply gaining bad reputation for the developer with such news because of saving $100 a year. If the developers are all students or something and can't pay for that, please let me know if there's a page asking for it and I'll pay or any of the other 1000 users who can.
    - danieldk 9y ago
      A user of a free product telling the developer of said free product how the developer should be spending the money that said user isn't giving them takes a special kind of entitlement. There is a very simple solution. Get a dev program membership. Sign and sandbox the application and make it available in the Mac App store for $1.99. People who want a signed, sandboxed Handbrake pay the equivalent of a cup of coffee. People who want to play Russian roulette can download Handbrake for free on the web page. Given that Handbrake is extremely popular, that small fee will probably cover the $99 per year plus a Mac Pro (or two) within no time.
  - deleted 9y ago
    [deleted]
  - notgood 9y ago
    >It's $100 for the signing and $500 for a Mac Mini. Any professional software developer would make that kind of money in a few days Sorry but you are living in a bubble. There are thousands of software professionals who don't make that kind of money in India, South America and many other places.
    - CamperBob2 9y ago
      If the author of Handbrake is one of them, that can hardly be construed as the users' fault. Run some Google ads or something.
      - rglullis 9y ago
        Or you know, don't be a entitled jerk of an user who can't be bothered to support Free (as in Speech, NOT as in beer) Software. Come on, if every developer that uses any kind of Free Software decided to donate every hour the dollar amount of one HOUR of their work for the projects that THEY need, no one would be in this mess.
        CamperBob2 9y ago
        Or you know, don't be a entitled jerk of an user who can't be bothered to support Free (as in Speech, NOT as in beer) Software. (Shrug) I've authored a large amount of software that's free as in both. I sign my releases for my users' protection, and also to avoid looking like a careless dilettante. I expect others who are serious about their craft to do the same. If that makes me an "entitled jerk," well... meh. There's no way to respond to an accusation like that except to own it.
        JohnTHaller 9y ago
        While its great that you have a spare $100 a year and the money to invest in Apple hardware to digitally sign Mac builds, not every project will have those resources. Projects that don't have the resources will often publish hashes so that users will be able to check to ensure their download is legitimate before using it. Handbrake does this: https://handbrake.fr/checksums.php https://handbrake.fr/checksums.php
  - MarkMc 9y ago
    It's cheaper than that. I've let my Apple developer subscription lapse but I can still sign packages until my certificate expires. You can probably also get a reasonable second-hand Mac mini for $200. So you are looking at an up-front cost of $300 then around $25 per year.
    - ChairmanPao 9y ago
      Liar.
- mikewhy 9y ago
  Travis CI is free for open source projects, perhaps they could better invest their time into working with that then rebuilding. I'm assuming the price for hosting the mirrors isn't free, and probably more than $100/year. If they moved to github releases they could recoup some money.
  - JohnTHaller 9y ago
    Then they would be reliant on a commercial company's closed source infrastructure for hosting. This has its own risks.
    - Tinyyy 9y ago
      The risks are relatively insignificant.
- miles 9y ago
  Please feel free to donate the funds necessary to cover the Apple ID signup for multiple years Certs are free for apps published outside of the MAS: https://www.reddit.com/r/apple/comments/69n9ii/recent_version_of_handbrake_download_infected/dh87ff9/ https://www.reddit.com/r/apple/comments/69n9ii/recent_versio... https://www.reddit.com/r/apple/comments/69n9ii/recent_version_of_handbrake_download_infected/dh80irs/ https://www.reddit.com/r/apple/comments/69n9ii/recent_versio... as well as the potentially necessary Apple hardware It's a pretty safe bet that an OS X/macOS developer already has a Mac.
  - xwvvvvwx 9y ago
    You can sign builds on Travis CI [1] (free for open source), so no apple HW needed.... [1]: https://medium.com/juan-cruz-viotti/how-to-code-sign-os-x-electron-apps-in-travis-ci-6b6a0756c04a https://medium.com/juan-cruz-viotti/how-to-code-sign-os-x-el...
    - JohnTHaller 9y ago
      You still need access to Apple hardware. From my other comment on a similar tool: "It's worth noting that you need access to a Mac you can trust to setup your Apple developer credentials on as well as iSign and then export your credentials and certificate from each time you get a new certificate. It's likely you won't be able to do this in the Apple store. While you or I may have a colleague or trusted friend we could do this with, many developers will not."
  - JohnTHaller 9y ago
    The comment you linked to was "[deleted]" and countered by the followups.
    - miles 9y ago
      Thanks for correcting me. There were actually two comments by two different users (the links above appear identical since they have been shortened, but the full URLs are unique). I should have looked more deeply into the matter before posting the assertion and links - my apologies.
- deleted 9y ago
  [deleted]
- h1d 9y ago
  While users could help financially, a project should not delegate the responsibility of security down to users until they explicitly donate for that especially for a project of this amount of user base.
- Angostura 9y ago
  OK. I'll contribute. Where is the developer talking donations for this specific purpose?
askvictor 9y ago
You're welcome to compile, sign and release your own Mac binaries, and even charge a fee for them if you want in order to cover the costs. It's OSS after all. Or even make a polite request or ticket on the problem. But don't tell OSS devs what to do in a snarky voice.
- pyre 9y ago
  At the same time, when your project takes off past a certain point, don't you gain some amount of responsibility if you know that you have become an attack vector? If you don't want to take on that responsibility, then you could just quit hosting binary builds, and focus on the source. Then it becomes "someone else's problem" to deal with hosting binaries, and providing security.
  - askvictor 9y ago
    Good point; though approaching the problem in an indignant and righteous fashion doesn't achieve anything; offering to help with a solution is more in line with the (ideal) OSS ethos.
_pmf_ 9y ago
This guy ...
rixed 9y ago
Better ask here: https://github.com/HandBrake/HandBrake/issues/619 https://github.com/HandBrake/HandBrake/issues/619

JohnTHaller 9y ago

Please feel free to donate the funds necessary to cover the Apple ID signup for multiple years as well as the potentially necessary Apple hardware to install the SDK on and sign the app (since Apple artificially restricts code signing to only run on their own hardware) as well as any necessary training hours to the team to setup said environment so that they can sign the software they're giving to you for free.

symlinkk 9y ago
It's $100 for the signing and $500 for a Mac Mini. Any professional software developer would make that kind of money in a few days. And I would bet that an open source project as big as this gets at least that amount in donations yearly. It's completely irresponsible to not sign releases after something like this happens.
- JohnTHaller 9y ago
  And if they did get $600 in donations in the last year... they should dedicate all of that to the Mac build? Even if they've already spent those funds on hosting and other expenses? A user of a free product telling the developer of said free product how the developer should be spending the money that said user isn't giving them takes a special kind of entitlement.
  - comex 9y ago
    Hold on… your premise doesn't make sense. Apple's SDK only officially runs on Mac - but that applies to the entire build process, not just codesigning. Anyone who is already producing a Mac build either has access to a Mac build host, which they can also use to sign, or is using third party tools to cross-compile from another OS. In the latter case, there is also a third party tool capable of signing binaries: https://github.com/saucelabs/isign https://github.com/saucelabs/isign You do need to pay the $99/year for the certificate, but it shouldn't be necessary to buy hardware just to sign things.
    - JohnTHaller 9y ago
      It's worth noting that you need access to a Mac you can trust to setup your Apple developer credentials on as well as iSign and then export your credentials and certificate from each time you get a new certificate. It's likely you won't be able to do this in the Apple store. While you or I may have a colleague or trusted friend we could do this with, many developers will not.
      - comex 9y ago
        It does say that in the readme, but I don't think it's actually necessary: you can get certificates and provisioning profiles through the web portal without going through Xcode. (For certificates, it has you upload a standard CSR file.) Though developers may not know that… Admittedly, if you don't have a Mac build machine, (a) you can't test your builds, and (b) you can't use the official SDK (including, e.g., system header files) without violating the terms of service. Not that many people care about that, but if you don't mind ToS violations you may as well just install pirated macOS in a VM (which is easy enough in practice). Perhaps Apple deserves blame for not having a legal way to run a macOS VM on non-Apple hardware; certainly it makes life harder for open-source developers that want to play by the rules. Still, these obstacles have nothing to do with signing.
  - h1d 9y ago
    A developer should feel a little responsible about the product if it has a large amount of users... It's simply gaining bad reputation for the developer with such news because of saving $100 a year. If the developers are all students or something and can't pay for that, please let me know if there's a page asking for it and I'll pay or any of the other 1000 users who can.
  - danieldk 9y ago
    A user of a free product telling the developer of said free product how the developer should be spending the money that said user isn't giving them takes a special kind of entitlement. There is a very simple solution. Get a dev program membership. Sign and sandbox the application and make it available in the Mac App store for $1.99. People who want a signed, sandboxed Handbrake pay the equivalent of a cup of coffee. People who want to play Russian roulette can download Handbrake for free on the web page. Given that Handbrake is extremely popular, that small fee will probably cover the $99 per year plus a Mac Pro (or two) within no time.
- deleted 9y ago
  [deleted]
- notgood 9y ago
  >It's $100 for the signing and $500 for a Mac Mini. Any professional software developer would make that kind of money in a few days Sorry but you are living in a bubble. There are thousands of software professionals who don't make that kind of money in India, South America and many other places.
  - CamperBob2 9y ago
    If the author of Handbrake is one of them, that can hardly be construed as the users' fault. Run some Google ads or something.
    - rglullis 9y ago
      Or you know, don't be a entitled jerk of an user who can't be bothered to support Free (as in Speech, NOT as in beer) Software. Come on, if every developer that uses any kind of Free Software decided to donate every hour the dollar amount of one HOUR of their work for the projects that THEY need, no one would be in this mess.
      - CamperBob2 9y ago
        Or you know, don't be a entitled jerk of an user who can't be bothered to support Free (as in Speech, NOT as in beer) Software. (Shrug) I've authored a large amount of software that's free as in both. I sign my releases for my users' protection, and also to avoid looking like a careless dilettante. I expect others who are serious about their craft to do the same. If that makes me an "entitled jerk," well... meh. There's no way to respond to an accusation like that except to own it.
        JohnTHaller 9y ago
        While its great that you have a spare $100 a year and the money to invest in Apple hardware to digitally sign Mac builds, not every project will have those resources. Projects that don't have the resources will often publish hashes so that users will be able to check to ensure their download is legitimate before using it. Handbrake does this: https://handbrake.fr/checksums.php https://handbrake.fr/checksums.php
- MarkMc 9y ago
  It's cheaper than that. I've let my Apple developer subscription lapse but I can still sign packages until my certificate expires. You can probably also get a reasonable second-hand Mac mini for $200. So you are looking at an up-front cost of $300 then around $25 per year.
  - ChairmanPao 9y ago
    Liar.
mikewhy 9y ago
Travis CI is free for open source projects, perhaps they could better invest their time into working with that then rebuilding. I'm assuming the price for hosting the mirrors isn't free, and probably more than $100/year. If they moved to github releases they could recoup some money.
- JohnTHaller 9y ago
  Then they would be reliant on a commercial company's closed source infrastructure for hosting. This has its own risks.
  - Tinyyy 9y ago
    The risks are relatively insignificant.
miles 9y ago
Please feel free to donate the funds necessary to cover the Apple ID signup for multiple years Certs are free for apps published outside of the MAS: https://www.reddit.com/r/apple/comments/69n9ii/recent_version_of_handbrake_download_infected/dh87ff9/ https://www.reddit.com/r/apple/comments/69n9ii/recent_versio... https://www.reddit.com/r/apple/comments/69n9ii/recent_version_of_handbrake_download_infected/dh80irs/ https://www.reddit.com/r/apple/comments/69n9ii/recent_versio... as well as the potentially necessary Apple hardware It's a pretty safe bet that an OS X/macOS developer already has a Mac.
- xwvvvvwx 9y ago
  You can sign builds on Travis CI [1] (free for open source), so no apple HW needed.... [1]: https://medium.com/juan-cruz-viotti/how-to-code-sign-os-x-electron-apps-in-travis-ci-6b6a0756c04a https://medium.com/juan-cruz-viotti/how-to-code-sign-os-x-el...
  - JohnTHaller 9y ago
    You still need access to Apple hardware. From my other comment on a similar tool: "It's worth noting that you need access to a Mac you can trust to setup your Apple developer credentials on as well as iSign and then export your credentials and certificate from each time you get a new certificate. It's likely you won't be able to do this in the Apple store. While you or I may have a colleague or trusted friend we could do this with, many developers will not."
- JohnTHaller 9y ago
  The comment you linked to was "[deleted]" and countered by the followups.
  - miles 9y ago
    Thanks for correcting me. There were actually two comments by two different users (the links above appear identical since they have been shortened, but the full URLs are unique). I should have looked more deeply into the matter before posting the assertion and links - my apologies.
deleted 9y ago
[deleted]
h1d 9y ago
While users could help financially, a project should not delegate the responsibility of security down to users until they explicitly donate for that especially for a project of this amount of user base.
Angostura 9y ago
OK. I'll contribute. Where is the developer talking donations for this specific purpose?

askvictor 9y ago

You're welcome to compile, sign and release your own Mac binaries, and even charge a fee for them if you want in order to cover the costs. It's OSS after all. Or even make a polite request or ticket on the problem. But don't tell OSS devs what to do in a snarky voice.

pyre 9y ago
At the same time, when your project takes off past a certain point, don't you gain some amount of responsibility if you know that you have become an attack vector? If you don't want to take on that responsibility, then you could just quit hosting binary builds, and focus on the source. Then it becomes "someone else's problem" to deal with hosting binaries, and providing security.
- askvictor 9y ago
  Good point; though approaching the problem in an indignant and righteous fashion doesn't achieve anything; offering to help with a solution is more in line with the (ideal) OSS ethos.

_pmf_ 9y ago

This guy ...

rixed 9y ago

Better ask here: https://github.com/HandBrake/HandBrake/issues/619 https://github.com/HandBrake/HandBrake/issues/619