3 ms·

Codesigning certs are a racket... the 'chain of trust' and documentation requirements mean they are expensive and hard to get as an individual, yet oh-so-essent

• gruez 8y ago
  >I kind of see them like taxi medallions Taxi medallions are pricey because there's limited supply and high demand. Code signing certificates have limited demand and unlimited supply, but are expensive because they require manual verification (like EV certificates) and has a bunch of startup costs (to get included as a root).
  • tomc1985 8y ago
    Factors keep both items expensive, and both are effectively required for doing certain types of business.
    • cwyers 8y ago
      Medallions are an artificial constraint on supply -- the point of them is to shrink the market. Code signing provides a benefit -- it's a way for a user to ensure they have the right installer and that it wasn't changed by a nefarious third party.
      • tomc1985 8y ago
        And are code-signing certs really so different? The reporting and regulatory requirements behind them make me think that they are an intentional barrier-to-entry for newcomers, amateurs, and startups, and the business student in me admires their moat-like quality. Code-signing certs lock a lot of people out of certain channels of software distribution
• ratling 8y ago
  The one place they have value is for people who have macbooks that are locked down to only allow app store/signed dmgs to run. TBH though since corp control of OSX is janky to begin with devs will usually figure out a workaround (or scream loud enough that this gets reverted, no one likes to pay for devs to sit around doing nothing).