3 ms·
Yes, many developers sign, and then fail to offer a secure way of verifying that the signature belongs to them. But it's still better than nothing, I'm sure th
by blub 9y ago
Yes, many developers sign, and then fail to offer a secure way of verifying that the signature belongs to them.
But it's still better than nothing, I'm sure they would offer unsigned HTTP downloads if Apple didn't force them to get their shit together.
- HHad3 9y agoI'd argue that Apple fails to offer a secure way of verifying the signature: Finder only shows me that an app is signed when I first run it. It does not provide me with a signer name or team ID that I can match with information I got from the developer. The information is available via command line by running "codesign -dvv", or by installing a Finder extension such as WhatsYourSign [0]. [0] https://objective-see.com/products/whatsyoursign.html https://objective-see.com/products/whatsyoursign.html
- gurkendoktor 9y agoIf the burden for authentication is on the developers anyway, then code-signing shouldn't require a 99€/year subscription. 99€ is a sum that doesn't help Apple, doesn't hinder criminals, but causes headaches for open-source projects and casual developers.
- blub 9y agoYeah, Apple could do a better job authenticating public companies, by publishing the company name, address, etc associated with a certificate. This would solve most of my complaints.