4 ms·
I'm a big fan of desktop sandboxing, so thanks for the hard work. I dreaded running the unsandboxed Office:mac 2011 with its constant stream of "critical" secur
by gurkendoktor 9y ago
I'm a big fan of desktop sandboxing, so thanks for the hard work. I dreaded running the unsandboxed Office:mac 2011 with its constant stream of "critical" security updates. That was definitely my worst experience using native apps.
On the other hand, I am not sure that code signing has been an all-around success. It seems to make life harder for the long tail of one-off apps and open source ports. And bad actors are only blacklisted after they've been caught. https://panic.com/blog/stolen-source-code/ https://panic.com/blog/stolen-source-code/ - related: https://github.com/HandBrake/HandBrake/issues/619 https://github.com/HandBrake/HandBrake/issues/619
I think I would prefer a security model were you could just download and start any .app, but upon first opening it, a dialog would inform you about its code-signing author and the permissions that the app has (with striking red/green color coding). Because right now, there is no way to tell which apps even use sandboxing without opening Activity Monitor, and there is no incentive for non-App-Store-apps to use sandboxing. (There is a dialog when opening a downloaded app for the first time, but it's grey and boring and not helpful at all.)
- galad87 9y agoThe only thing required to get a Developer ID signing certificate is a valid credit card (and I guess is not so hard o stole one) Tranmission malware was signed, Eltima Player malware was signed. I agree with the need of a better first launch dialog.
- blub 9y agoYes, many developers sign, and then fail to offer a secure way of verifying that the signature belongs to them. But it's still better than nothing, I'm sure they would offer unsigned HTTP downloads if Apple didn't force them to get their shit together.
- HHad3 9y agoI'd argue that Apple fails to offer a secure way of verifying the signature: Finder only shows me that an app is signed when I first run it. It does not provide me with a signer name or team ID that I can match with information I got from the developer. The information is available via command line by running "codesign -dvv", or by installing a Finder extension such as WhatsYourSign [0]. [0] https://objective-see.com/products/whatsyoursign.html https://objective-see.com/products/whatsyoursign.html
- gurkendoktor 9y agoIf the burden for authentication is on the developers anyway, then code-signing shouldn't require a 99€/year subscription. 99€ is a sum that doesn't help Apple, doesn't hinder criminals, but causes headaches for open-source projects and casual developers.
- blub 9y agoYeah, Apple could do a better job authenticating public companies, by publishing the company name, address, etc associated with a certificate. This would solve most of my complaints.