3 ms·
The only thing required to get a Developer ID signing certificate is a valid credit card (and I guess is not so hard o stole one) Tranmission malware was signed
by galad87 9y ago
The only thing required to get a Developer ID signing certificate is a valid credit card (and I guess is not so hard o stole one)
Tranmission malware was signed, Eltima Player malware was signed.
I agree with the need of a better first launch dialog.
- blub 9y agoYes, many developers sign, and then fail to offer a secure way of verifying that the signature belongs to them. But it's still better than nothing, I'm sure they would offer unsigned HTTP downloads if Apple didn't force them to get their shit together.
- HHad3 9y agoI'd argue that Apple fails to offer a secure way of verifying the signature: Finder only shows me that an app is signed when I first run it. It does not provide me with a signer name or team ID that I can match with information I got from the developer. The information is available via command line by running "codesign -dvv", or by installing a Finder extension such as WhatsYourSign [0]. [0] https://objective-see.com/products/whatsyoursign.html https://objective-see.com/products/whatsyoursign.html
- gurkendoktor 9y agoIf the burden for authentication is on the developers anyway, then code-signing shouldn't require a 99€/year subscription. 99€ is a sum that doesn't help Apple, doesn't hinder criminals, but causes headaches for open-source projects and casual developers.
- blub 9y agoYeah, Apple could do a better job authenticating public companies, by publishing the company name, address, etc associated with a certificate. This would solve most of my complaints.