14 ms·

Apple revoked longtime Mac developer's code signing certificate with no warning

203 points by _qulr 6y ago

_qulr 6y ago
"We’re a small family business making apps for iOS and macOS." https://software.charliemonroe.net/ https://software.charliemonroe.net/
lqet 6y ago
I suspect this is why: > Ever wished you could save a video from the Internet? Search no more, Downie is what you're looking for. Easily download videos from thousands of different sites.
- jtbayly 6y ago
  Is there something wrong with downloading videos to my computer?
  - JOnAgain 6y ago
    Unfortunately
    - deleted 6y ago
      [deleted]
  - CodeWriter23 6y ago
    > Is there something wrong with downloading videos to my computer? Nope. Creating a tool perceived by those with enough lawyers to be a “copy protection circumvention device” however does run afoul of the DMCA.
    - raxxorrax 6y ago
      And platforms doing standing back flips to appease stupid legislation. Reminds me of YouTube blocking Blender videos... had other reasons though, don't remember exactly, but it had to do with them not monetizing their videos and really, really bad support.
      - judge2020 6y ago
        https://www.blender.org/media-exposure/youtube-blocks-blender-videos-worldwide/ https://www.blender.org/media-exposure/youtube-blocks-blende... https://news.ycombinator.com/item?id=17347560 https://news.ycombinator.com/item?id=17347560 Basically they needed to enable monetization since [I assume] Google was taking a non-negligible loss by hosting all of their content for free.
      - caymanjim 6y ago
        If you think the legislation is stupid, blame the legislators. Companies have to abide by laws, even stupid ones.
        rbecker 6y ago
        They have to abide by them, not enforce them (unless a court order makes them). There's no law against distributing operating systems that allow running of programs that break the law.
    - vbezhenar 6y ago
      Why does Apple care? It's none of their business.
      - selectodude 6y ago
        Because Apple is the one that will be party to a lawsuit if it ever came to pass. One of the negatives of being gatekeeper is you're no longer protected by "safe harbor" provisions. And I have to imagine Apple has enough money to be worth suing, even if it's frivolous nonsense.
      - jhasse 6y ago
        iTunes and Apple TV+?
    - the_af 6y ago
      So a re-hash of the old "audio tapes will kill the music industry" or "video tapes will kill cinema"?
      - OskarS 6y ago
        Nobody here thinks that the law is a good idea or will do anything to protect any content industries. The fact is that despite being enormously stupid, it is still the law.
        the_af 6y ago
        Yes, I know I'm preaching the choir here. My point is that with each advance in technology, established industry "actors" panic because they foresee their business will go bankrupt. Sometimes this panic is justified, but often it's not, or it's blown out of proportion. It's not necessarily the law, either. Panicky industry heavyweights may lobby to make it a law, or try to confuse a given tech with copyright infringement, but "downloading videos" is not against the law.
        CodeWriter23 6y ago
        Yep, the whole time they were focused on cassette tapes and Napster, the music industry completely missed the iPod/iTunes threat.
  - jabroni_salad 6y ago
    Personally I would say no but it does kind of depend. Tools like this do allow you to save copies of videos that weren't meant to be savable. The dev's website includes a screenshot of it downloading a bunch of Disney material. That is not a wasp nest I want to shake.
    - hunter2_ 6y ago
      Broadcast and cable TV wasn't meant to be savable, and then VCRs came out and courts decided that saving (time shifting) is absolutely fine. It doesn't in and of itself facilitate sharing. If it breaks actual encryption (a la DeCSS) then yes, it oversteps. But TV content stakeholders don't have much pull with convincing VCR manufacturers/distributors to stop supplying VCRs. Apple does clearly have the ability to affect the signing of software.
      - ballenf 6y ago
        > If it breaks actual encryption (a la DeCSS) then yes, it oversteps. I'd counter that if the audio and video get to your eyes and ears, then the content provider has already provided you a decrypted copy of the media and/or the instructions for how to decrypt. If you had an arms' length valid agreement with the company where you agree not to retain the media, then that's different issue.
      - justinclift 6y ago
        > If it breaks actual encryption (a la DeCSS) then yes, it oversteps. Don't some jurisdictions have provisions that allow for technical workarounds in order to make backups?
        duskwuff 6y ago
        Backups of your own physical media. Downloading videos on YouTube doesn't qualify.
    - the_af 6y ago
      > Tools like this do allow you to save copies of videos that weren't meant to be savable It's actually computers that allow you to do this. I think this is why there's a war (of sorts) against general purpose computers: they enable you, the user, to do all sorts of things publishers didn't envision or want.
  - tclancy 6y ago
    No, it's more that it's easy to guess the likely cause here: * a lawyer sends a DMCA request to Youtube * a Youtube bot looks at the offending request and finds a user agent * Kicks off automated warning to Apple bot * Apple bot shuts down developer account All that's really needed here is a bot to post these things to Twitter and HackerNews and then an API for the service bots to read the complaints and undo the action with a phony apology post
    - ballenf 6y ago
      The requests the app makes would not be coming from "Apple". The rest of the scenario is plausible, but it wouldn't be bots it would be humans connecting the dots and sending a manual claim to Apple.
  - yakz 6y ago
    It's against the YouTube terms of service. One characterization of this software is that it is designed to violate the YouTube terms of service. "The following restrictions apply to your use of the Service. You are not allowed to: access, reproduce, download, distribute, transmit, broadcast, display, sell, license, alter, modify or otherwise use any part of the Service or any Content except: (a) as expressly authorized by the Service; or (b) with prior written permission from YouTube and, if applicable, the respective rights holders;" - https://www.youtube.com/static?gl=CA&template=terms https://www.youtube.com/static?gl=CA&template=terms
    - AlexandrB 6y ago
      This doesn't really explain anything. Why is Apple enforcing YouTube's terms of service on a third-party application? Especially via a mechanism ostensibly designed to stop malware. Is the Transmission torrent client next because it could be used to download copyrighted content?
      - donarb 6y ago
        It's right here in the App Store guidelines: 5.2.3 Audio/Video Downloading: Apps should not facilitate illegal file sharing or include the ability to save, convert, or download media from third-party sources (e.g. Apple Music, YouTube, SoundCloud, Vimeo, etc.) without explicit authorization from those sources. Streaming of audio/video content may also violate Terms of Use, so be sure to check before your app accesses those services. Documentation must be provided upon request. https://developer.apple.com/app-store/review/guidelines/#intellectual-property https://developer.apple.com/app-store/review/guidelines/#int... As to the why, because Apple could be sued by third parties for allowing this behavior for apps that Apple has vetted.
        AlexandrB 6y ago
        The app in question, Downie, isn't in the App Store. Why would it be subject to the App Store ToS?
  - robterrell 6y ago
    Apple might think so! I had a popular YouTube downloader app for Mac OS and I spent a lot of time on a port for iOS, but it was rejected from the app store back in 2010. The app reviewer did call me on the phone to tell me -- in fact, she called twice, once to tell me that my app was going into an extended review, and then a few weeks later she called to tell me that my app had been rejected. When I asked what the reason was, she told me to check the review guidelines ("check them again now" she said) and lo and behold, they had added a new guideline about downloading media without explicit IP rights. Moving the goalposts, one app at a time!
    - manojlds 6y ago
      Well if they called in 2010 they lost definitely can't do it now with the volume of apps.
- luxuryballs 6y ago
  "downie"? could it just be the name? https://www.urbandictionary.com/define.php?term=Downie https://www.urbandictionary.com/define.php?term=Downie though if it was that you'd think they would just pull the app and ask him to rename it...
  - tonyedgecombe 6y ago
    Looking at his website I don't think it is even in the store. What he names it is really none of Apple's business unless it infringed on one of their trademarks.
    - elliekelly 6y ago
      I don’t disagree but we both know that’s not how Apple operates the app store. I can think of a ton of words I would absolutely expect Apple to deny as an app name.
    - toyg 6y ago
      > What he names it is really none of Apple's business In any AppStore app, everything is literally Apple's business, considering they get a cut of any money that changes hands and can reject your app for "looking at them wrong". That's why the whole model is (rightly) controversial.
      - epistasis 6y ago
        I think anything that Apple does will be controversial, as there's the anti-fans and fans that are at political war. But the true controversy is not a curated store, the controversy is that the curated store is the only way for people to load native code onto the device without compiling it themselves on a separate laptop.
      - tonyedgecombe 6y ago
        As I said it isn't in the app store.
- rasz 6y ago
  Is it by any chance a straight port of youtube-dl? This and >The developer's website (software.charliemonroe.net) is blocked by my ISP (Vodafone UK)'s adult content filter. This is strange as it does not appear to contain any adult content. would explain a lot. In order to download from a pr0n website you need to hardcode that websites domain name inside the program = pr0n filters pick it up = Apple bans it.
staplers 6y ago
I suspect it has something to do with Apple wading into content publishing and the alliances it would strengthen to suppress even suspected piracy.
- deleted 6y ago
  [deleted]
  - tastefulness 6y ago
    Is it a front end for youtube-dl?
pearjuice 6y ago
Sadly, this is what a walled garden results in. Please don't be surprised, shocked or even remotely discontent because by signing the ToS you have waived away any and all of your rights regarding the use and publishing of software in this walled garden. The only reason an issue like this will get "fixed" is when this (post/tweet) goes viral and the PR department will work extra hard to correct this.
- raxxorrax 6y ago
  Don't know why you are downvoted since you are completely correct. It is unfair to the developer but we wouldn't even have this discussion if people rejected app stores. I like that more developers just reject software certification processes. There is zero benefit aside from lock in.
  - coldcode 6y ago
    Other than open season on the users with malware out the wazoo. But who cares about security. Do you buy healthcare from the back of a pickup truck?
    - davidg109 6y ago
      App stores leave a lot to be desired when it comes to security. In fact it can give users a false sense of security. https://www.cbc.ca/amp/1.5351280 https://www.cbc.ca/amp/1.5351280
      - zepto 6y ago
        Sure but Apple is clearly continuing to move in the direction of more security. The argument that they could be better therefore they are worth nothing, is a clear fallacy.
        raxxorrax 6y ago
        Then the same is true for letting people just install apps without vendor lock in.
Tijdreiziger 6y ago
A few tweets down that thread: > Non-notarized versions will not work well on newer systems (https://appleinsider.com/articles/19/12/23/apple-will-enforce-app-notarization-for-macos-catalina-in-february https://appleinsider.com/articles/19/12/23/apple-will-enforc...) and mainly I can't currently even compile the application.
CubsFan1060 6y ago
Perhaps we should wait to get the whole story to discuss. Didn't we just go through this with the "Apple doesn't return 30% on refund" fiasco last week?
- gruez 6y ago
  Isn't silently revoking a longtime mac developer's certificate bad practice, regardless of the justification?
  - beervirus 6y ago
    Isn't keeping the 30% on refunded apps bad practice, regardless of the justification? Well, yes, if it's true, which it wasn't.
    - gruez 6y ago
      Okay, so what are the situations where it can be false? * apple actually did communicate to them, but it was via carrier pigeon or something and it got lost * apple is under gag order * the developer is actually a long time repeat offender and is trying to evade via sockpuppet accounts None of them seem plausible to me. Also, unlike with the apple 30% refund fiasco, we know for sure this is happening, because other users are tweeting that they're receiving error messages when trying to install his software.
      - hunter2_ 6y ago
        How does other users receiving errors prove that the developer received no warning? Your first bullet point seems entirely plausible, albeit the failure mode is likely less avian.
        charlieMonroe 6y ago
        Hi, I'm the developer. * No email in my spam box. * My contact address is still working and have received notifications about them approving my updates for the App Store yesterday (so saying that they have no way of contacting me is not true). * No known breach of account. * No accidental revocation (I was sleeping while this happened). * The certificates are revoked as you can verify via command line.
vaxman 6y ago
Apple also has the ability to remotely login to EVERYONE's Internet-connected Mac computers and monkey around (removing software etc.). Of course, they only use this when THEY feel it's really necessary. Does not matter if you subscribe to any of their paid services, does not matter if you bought a used MacMini for 50 dollars or paid 50,000 dollars for a MacPro7. Some would say "great, wish we could do it to real viruses" but others would say "what if they make a mistake trying to fix things, or if this awesome power is misused like Twitter credentials".
- digi59404 6y ago
  Pretty sure Apple doesn’t have this capability. What you’re referring too is functionality inside GateKeeper or near GateKeeper. Which is where Apple marks an application with a specific signature to be malware or dangerous and the OS automatically removes it. This is similar to an antivirus software removing it. There’s no login functionality, Apple doesn’t see your data and doesn’t do anything on your machine other than remove the offending application. In addition, I’ve only see it used once.
  - ballenf 6y ago
    Apple's first wish from the genie in a bottle was for unlimited wishes. So it doesn't really make sense to argue over whether Apple only has x-ray vision or also the ability to walk through walls yet. Gatekeeper is our benevolent dictator that consolidates power with every update because our connectedness increases the potential for widespread damage from our attackers. And I'm ok with that, but worry we'll regret things later.
    - vaxman 6y ago
      oh look, but one source located with 10 seconds of Googling... https://techcrunch.com/2019/07/10/apple-silent-update-zoom-app/ https://techcrunch.com/2019/07/10/apple-silent-update-zoom-a...
  - vaxman 6y ago
    Pretty sure you are completely wrong. It's well documented they have done it in the past and publicly made statements about it --but downvote away idiots!
mkathuri 6y ago
From the page: https://developer.apple.com/documentation/xcode/notarizing_macos_software_before_distribution https://developer.apple.com/documentation/xcode/notarizing_m... > Notarization is not App Review. The Apple notary service is an automated system that scans your software for malicious content, checks for code-signing issues, and returns the results to you quickly. If there are no issues, the notary service generates a ticket for you to staple to your software; the notary service also publishes that ticket online where Gatekeeper can find it. Perhaps the software connected to a website that was flagged as malicious by Apple. That’s one way I could see it getting flagged.
- Reason077 6y ago
  The developer's website (software.charliemonroe.net) is blocked by my ISP (Vodafone UK)'s adult content filter. This is strange as it does not appear to contain any adult content. I don't think it's related to it being a "YouTube downloader" app either. There are many apps with this functionality and, so far as I can tell, none of the others are blocked.
  - gowld 6y ago
    Could also be caught sharing an IP range with a banned website :-|
  - blibble 6y ago
    most of the internet is blocked by those mobile carrier content filters
    - reaperducer 6y ago
      In 20ish years of using the mobile internet, going back to WAP days, I've never visited a site that was blocked by a mobile carrier content filter.
      - Reason077 6y ago
        I've come across a few strange blocks. Recently when researching bread knives I found that the website of the French knife company, Opinel, is blocked by at least two UK mobile carrier's content filters. (www.opinel.com, blocked by Three and Vodafone. Not blocked by O2.) Their US site (www.opinel-usa.com) is not blocked, however, nor are the many online retailers which sell their knives.
sschueller 6y ago
How long until you will no longer be able to install unsigned apps on your mac?
auganov 6y ago
Original tweet: > "Hello everyone, today I woke up to my developer account being suspended without a single letter why which is why the apps are crashing. Please bear with me while I try to get this fixed with Apple. Thank you for understanding." Not being a Mac developer, the wording about revoking the certificate makes it sound a little more unusual than just their account being banned. Although not nice, I assume that's something that happens a lot.
- simonh 6y ago
  The developer's account is liked to the certificates used to sign their app binaries. If MacOS is set to only allow signed binaries to run, that means this developer's app binaries won't run. Their customers can work around this by disabling the requirement for signed binaries, but of course that's not desirable and in corporate environments might not be allowed.
  - auganov 6y ago
    I understand that. Just saying that when you word it as the certificate being revoked it's not immediately obvious that's a consequence of the developer account being banned. If the headline was "longtime Apple developer suspended" quite frankly I'd be much less interested, thinking it's a common occurrence.
veidr 6y ago
I feel bad for the developer. But every time I see stories like this, I also feel a little jolt of validation regarding my choice as a developer to leave the Apple ecosystem in 2008. At the time, the App Store (iOS) was new, and I was working on porting our SSH-based encrypted remote access tool[1] from Mac to iPhone. I had been doing mainly Mac OS X development for almost 10 years. I had the proof-of-concept port from Mac to iOS working, but the amount of insane hoops I had to jump through (because it used "strong encryption" (we forked PuTTY SSH)) seemed, initially, like a trip the DMV. It gradually started feeling more like the movie Brazil. I remember going directly from WWDC to the local office of (searches old files) the "Bureau of Industry and Security" (wat) and talking to some guy who had NO idea what I was talking about when I told him my company was trying to make an iPhone app that used encryption and that Apple had told me I needed to get his agency's approval. (Nice guy, though.) Ultimately, working through the Apple documentation, I learned I had to do a bunch of weird stuff, like sign up for antique government systems that only worked on Windows XP, and provide personal info, and make a PIN, and submit an application to SNAP-R, and submit a "BIS-748P supporting document: how the Product meets the criteria of the Cryptography Note as mass market encryption software" along with a "BIS-748P supporting document: additional information to supplement our application for review and commodity classification request, in accordance with Supplement No. 6 to Part 742 of the EAR" along with "BIS-748P supporting document: sample marketing copy and brochure text" and a "BIS-748P supporting document: illustrations depicting the software in operation" and then finally a "BIS-748P supporting document: source code listings for all encryption-related source code used in the product"... that last was a ridiculous 500-page or so hard copy printout of the source code to PuTTY with the few dozen places we'd changed it (to make it multithreaded to fit better with our app architecture, haha, because I was young and dumb then). And, while I forget a lot of the details (I've just copy-pasted those now, after finding the relevant old files), I remember vividly the moment, sitting there in a Tokyo hotel business center assembling this heavy paper package to FedEx to BIS and just suddenly thinking... wait though — maybe this isn't a game I want to play. We didn't have to do any of this to ship a Mac app — any risk of legal noncompliance was ours, of course, but in reality there was no actual risk. This was all for Apple to cover their ass. If some government bureaucrat didn't like my application, my app wouldn't ship and the past year of work would be for nothing. And somehow that made me acutely aware that the same thing would be true if Apple for some reason didn't like my app. Like... what if they were planning to roll out similar rich, Mac-centric remote access features in the next OS update. Or, even if they approved it, but later just didn't want to deal some issue that arose around it — they could just revoke my app any time they pleased. (As seems to be the case with the app in this thread.) I thought about this for a couple more weeks, and then I took a corporate job doing internal systems development. The app was never finished. The lack of my app obviously didn't hurt Apple. But looking back, I do feel like the lack of having to deal Apple — and that whole weird power imbalance, of being a peasant plowing fields owned by Apple, hoping to receive some part of the fruits of my labor — probably helped me live a more serene, untroubled life. [1]: iGet Touch (phone apps were still called "blah blah Touch" then, just like many Mac apps from the early 2000s were idiotically prefixed with "i" (^_^); back then) was never finished — but it was basically a native iOS version of the Mac version, long dead but still archived here: http://nakahara-informatics.com/iget http://nakahara-informatics.com/iget
swiley 6y ago
In other words: you can’t depend on signed mac apps for anything important as a user even if they keep everything local to your computer. The developer could do something completely unrelated and your app will suddenly stop working with no warning.
- ashtonkem 6y ago
  And you can flip a single switch and keep running it? So?
- ben509 6y ago
  Which it should. If Apple detects that there's a problem with a cert, they should revoke it. Presumably, there's a known problem and something isn't working, even if it looks like it is. Arguably, it'd be nice to have a facility (assuming it doesn't already exist) to override the revocation list, but designing that it isn't bypassed by social engineering is tough.
Reason077 6y ago
The developer's website (software.charliemonroe.net) is also blocked by my ISP (Vodafone UK)'s adult content filter. This is strange as it does not appear to contain any adult content. I wonder if these things are related?
- dmix 6y ago
  It has an app for downloading videos off YouTube and other video sites. Not sure how much influence media companies have in the UK but maybe that's why? I know YouTube downloading services have struggled in the past to stay operational.
  - Reason077 6y ago
    I don't think so. There are many "YouTube downloader" type apps, and none of the others are blocked as far as I can tell.
    - dmix 6y ago
      I guess I'm too used to Android where you need to install a 3rd party APK.
  - acomjean 6y ago
    Apple is a media company now. They aren't just distributing (like apple music) but are creating TV shows like Amazon and Netflix. See Apple TV I suspect this will bring about conflicts in the company between content creation and the hardware/software divisions.
    - kps 6y ago
      Remember “Rip. Mix. Burn.”? Apple thinks different now.
      - throwaway12757 6y ago
        When you are trying to capture a new market, it's best to be open. After you have the market, you want to close the gates so no one else can have it. The hypocrisy is real and why I no longer buy apple products.
kogir 6y ago
Interesting that a few of the apps were also (voluntarily?) pulled from the developer’s website, so we can’t inspect them.
kenferry 6y ago
This seems relevant. “MPlayerX hasn’t been working for almost a year now. Also they still offer my apps on the App Store, they revoked my (direct) distribution certificate...” https://twitter.com/charliemonroe/status/1290629792430280704?s=21 https://twitter.com/charliemonroe/status/1290629792430280704...
- HeavenFox 6y ago
  MPlayerX was caught bundling installer with malware: https://www.reddit.com/r/apple/comments/3bhvh9/psa_do_not_install_mplayerx_the_official_site/ https://www.reddit.com/r/apple/comments/3bhvh9/psa_do_not_in... So this could be justified
  - floatingatoll 6y ago
    (5 years ago)
planb 6y ago
Another possible explanation: The developer‘s certificate leaked and was really used to sign malware. Or his github repo was hacked and something evil was added to his code without him noticing. Maybe I’m just rationalizing, because if Apple is really going down the road that most commenters here suspect, then there will be no arm macbook for me unfortunately... :(
- _qulr 6y ago
  When this actually happened in the past, Apple worked closely with the developer: https://panic.com/blog/stolen-source-code/ https://panic.com/blog/stolen-source-code/
- ben509 6y ago
  So, that's plausible, and I'm trying to wrap my head around the operational model of signed software. Apple has plenty of docs about it [1] [2] [3] but never really get into "how does this work in the long run when things fail" beyond blithely noting that users won't be able to run your stuff and a host of services will start to fail. A CRL / OSCP makes sense, more or less, for websites as they can simply abandon a cert. If the cert leaks, is the remedy really to completely blacklist the certificate? Because that means that anyone who is able to steal the cert can effectively blackmail an author. I'd definitely want to revoke it, but if there's a set of valid releases, it seems like you'd want to do a partial revocation, e.g. "valid until YYMMDD." Or have a blacklist / whitelist and mark known good releases. I can't imagine how they don't have a separation of concerns given that app certificates must expire. [1]: https://developer.apple.com/support/certificates/ https://developer.apple.com/support/certificates/ [2]: https://help.apple.com/developer-account/#/dev138c9fac7 https://help.apple.com/developer-account/#/dev138c9fac7 [3]: https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/AboutCS/AboutCS.html https://developer.apple.com/library/archive/documentation/Se...
  - _qulr 6y ago
    > I'd definitely want to revoke it, but if there's a set of valid releases, it seems like you'd want to do a partial revocation, e.g. "valid until YYMMDD." Or have a blacklist / whitelist and mark known good releases. Yes, this is definitely possible, and why Developer ID signing has a secure timestamp, as specified by the --timestamp flag to the /usr/bin/codesign tool. When Panic's code signing cert was stolen, they revoked it after a certain date, but old versions of their apps continued to be valid and pass Gatekeeper.
_qulr 6y ago
Update from the developer: https://blog.charliemonroe.net/a-day-without-business/ https://blog.charliemonroe.net/a-day-without-business/ "after almost 24 hours after 10PM, I got my account re-instated. Apple has called and apologized for the complications. The issue was caused by my account being erroneously flagged by automated processes as malicious and was put on hold."

203 points by _qulr 6y ago

"We’re a small family business making apps for iOS and macOS." https://software.charliemonroe.net/ https://software.charliemonroe.net/

lqet 6y ago

I suspect this is why: > Ever wished you could save a video from the Internet? Search no more, Downie is what you're looking for. Easily download videos from thousands of different sites.

jtbayly 6y ago
Is there something wrong with downloading videos to my computer?
- JOnAgain 6y ago
  Unfortunately
  - deleted 6y ago
    [deleted]
- CodeWriter23 6y ago
  > Is there something wrong with downloading videos to my computer? Nope. Creating a tool perceived by those with enough lawyers to be a “copy protection circumvention device” however does run afoul of the DMCA.
  - raxxorrax 6y ago
    And platforms doing standing back flips to appease stupid legislation. Reminds me of YouTube blocking Blender videos... had other reasons though, don't remember exactly, but it had to do with them not monetizing their videos and really, really bad support.
    - judge2020 6y ago
      https://www.blender.org/media-exposure/youtube-blocks-blender-videos-worldwide/ https://www.blender.org/media-exposure/youtube-blocks-blende... https://news.ycombinator.com/item?id=17347560 https://news.ycombinator.com/item?id=17347560 Basically they needed to enable monetization since [I assume] Google was taking a non-negligible loss by hosting all of their content for free.
    - caymanjim 6y ago
      If you think the legislation is stupid, blame the legislators. Companies have to abide by laws, even stupid ones.
      - rbecker 6y ago
        They have to abide by them, not enforce them (unless a court order makes them). There's no law against distributing operating systems that allow running of programs that break the law.
  - vbezhenar 6y ago
    Why does Apple care? It's none of their business.
    - selectodude 6y ago
      Because Apple is the one that will be party to a lawsuit if it ever came to pass. One of the negatives of being gatekeeper is you're no longer protected by "safe harbor" provisions. And I have to imagine Apple has enough money to be worth suing, even if it's frivolous nonsense.
    - jhasse 6y ago
      iTunes and Apple TV+?
  - the_af 6y ago
    So a re-hash of the old "audio tapes will kill the music industry" or "video tapes will kill cinema"?
    - OskarS 6y ago
      Nobody here thinks that the law is a good idea or will do anything to protect any content industries. The fact is that despite being enormously stupid, it is still the law.
      - the_af 6y ago
        Yes, I know I'm preaching the choir here. My point is that with each advance in technology, established industry "actors" panic because they foresee their business will go bankrupt. Sometimes this panic is justified, but often it's not, or it's blown out of proportion. It's not necessarily the law, either. Panicky industry heavyweights may lobby to make it a law, or try to confuse a given tech with copyright infringement, but "downloading videos" is not against the law.
        CodeWriter23 6y ago
        Yep, the whole time they were focused on cassette tapes and Napster, the music industry completely missed the iPod/iTunes threat.
- jabroni_salad 6y ago
  Personally I would say no but it does kind of depend. Tools like this do allow you to save copies of videos that weren't meant to be savable. The dev's website includes a screenshot of it downloading a bunch of Disney material. That is not a wasp nest I want to shake.
  - hunter2_ 6y ago
    Broadcast and cable TV wasn't meant to be savable, and then VCRs came out and courts decided that saving (time shifting) is absolutely fine. It doesn't in and of itself facilitate sharing. If it breaks actual encryption (a la DeCSS) then yes, it oversteps. But TV content stakeholders don't have much pull with convincing VCR manufacturers/distributors to stop supplying VCRs. Apple does clearly have the ability to affect the signing of software.
    - ballenf 6y ago
      > If it breaks actual encryption (a la DeCSS) then yes, it oversteps. I'd counter that if the audio and video get to your eyes and ears, then the content provider has already provided you a decrypted copy of the media and/or the instructions for how to decrypt. If you had an arms' length valid agreement with the company where you agree not to retain the media, then that's different issue.
    - justinclift 6y ago
      > If it breaks actual encryption (a la DeCSS) then yes, it oversteps. Don't some jurisdictions have provisions that allow for technical workarounds in order to make backups?
      - duskwuff 6y ago
        Backups of your own physical media. Downloading videos on YouTube doesn't qualify.
  - the_af 6y ago
    > Tools like this do allow you to save copies of videos that weren't meant to be savable It's actually computers that allow you to do this. I think this is why there's a war (of sorts) against general purpose computers: they enable you, the user, to do all sorts of things publishers didn't envision or want.
- tclancy 6y ago
  No, it's more that it's easy to guess the likely cause here: * a lawyer sends a DMCA request to Youtube * a Youtube bot looks at the offending request and finds a user agent * Kicks off automated warning to Apple bot * Apple bot shuts down developer account All that's really needed here is a bot to post these things to Twitter and HackerNews and then an API for the service bots to read the complaints and undo the action with a phony apology post
  - ballenf 6y ago
    The requests the app makes would not be coming from "Apple". The rest of the scenario is plausible, but it wouldn't be bots it would be humans connecting the dots and sending a manual claim to Apple.
- yakz 6y ago
  It's against the YouTube terms of service. One characterization of this software is that it is designed to violate the YouTube terms of service. "The following restrictions apply to your use of the Service. You are not allowed to: access, reproduce, download, distribute, transmit, broadcast, display, sell, license, alter, modify or otherwise use any part of the Service or any Content except: (a) as expressly authorized by the Service; or (b) with prior written permission from YouTube and, if applicable, the respective rights holders;" - https://www.youtube.com/static?gl=CA&template=terms https://www.youtube.com/static?gl=CA&template=terms
  - AlexandrB 6y ago
    This doesn't really explain anything. Why is Apple enforcing YouTube's terms of service on a third-party application? Especially via a mechanism ostensibly designed to stop malware. Is the Transmission torrent client next because it could be used to download copyrighted content?
    - donarb 6y ago
      It's right here in the App Store guidelines: 5.2.3 Audio/Video Downloading: Apps should not facilitate illegal file sharing or include the ability to save, convert, or download media from third-party sources (e.g. Apple Music, YouTube, SoundCloud, Vimeo, etc.) without explicit authorization from those sources. Streaming of audio/video content may also violate Terms of Use, so be sure to check before your app accesses those services. Documentation must be provided upon request. https://developer.apple.com/app-store/review/guidelines/#intellectual-property https://developer.apple.com/app-store/review/guidelines/#int... As to the why, because Apple could be sued by third parties for allowing this behavior for apps that Apple has vetted.
      - AlexandrB 6y ago
        The app in question, Downie, isn't in the App Store. Why would it be subject to the App Store ToS?
- robterrell 6y ago
  Apple might think so! I had a popular YouTube downloader app for Mac OS and I spent a lot of time on a port for iOS, but it was rejected from the app store back in 2010. The app reviewer did call me on the phone to tell me -- in fact, she called twice, once to tell me that my app was going into an extended review, and then a few weeks later she called to tell me that my app had been rejected. When I asked what the reason was, she told me to check the review guidelines ("check them again now" she said) and lo and behold, they had added a new guideline about downloading media without explicit IP rights. Moving the goalposts, one app at a time!
  - manojlds 6y ago
    Well if they called in 2010 they lost definitely can't do it now with the volume of apps.
luxuryballs 6y ago
"downie"? could it just be the name? https://www.urbandictionary.com/define.php?term=Downie https://www.urbandictionary.com/define.php?term=Downie though if it was that you'd think they would just pull the app and ask him to rename it...
- tonyedgecombe 6y ago
  Looking at his website I don't think it is even in the store. What he names it is really none of Apple's business unless it infringed on one of their trademarks.
  - elliekelly 6y ago
    I don’t disagree but we both know that’s not how Apple operates the app store. I can think of a ton of words I would absolutely expect Apple to deny as an app name.
  - toyg 6y ago
    > What he names it is really none of Apple's business In any AppStore app, everything is literally Apple's business, considering they get a cut of any money that changes hands and can reject your app for "looking at them wrong". That's why the whole model is (rightly) controversial.
    - epistasis 6y ago
      I think anything that Apple does will be controversial, as there's the anti-fans and fans that are at political war. But the true controversy is not a curated store, the controversy is that the curated store is the only way for people to load native code onto the device without compiling it themselves on a separate laptop.
    - tonyedgecombe 6y ago
      As I said it isn't in the app store.
rasz 6y ago
Is it by any chance a straight port of youtube-dl? This and >The developer's website (software.charliemonroe.net) is blocked by my ISP (Vodafone UK)'s adult content filter. This is strange as it does not appear to contain any adult content. would explain a lot. In order to download from a pr0n website you need to hardcode that websites domain name inside the program = pr0n filters pick it up = Apple bans it.

staplers 6y ago

I suspect it has something to do with Apple wading into content publishing and the alliances it would strengthen to suppress even suspected piracy.

deleted 6y ago
[deleted]
- tastefulness 6y ago
  Is it a front end for youtube-dl?

pearjuice 6y ago

Sadly, this is what a walled garden results in. Please don't be surprised, shocked or even remotely discontent because by signing the ToS you have waived away any and all of your rights regarding the use and publishing of software in this walled garden. The only reason an issue like this will get "fixed" is when this (post/tweet) goes viral and the PR department will work extra hard to correct this.

raxxorrax 6y ago
Don't know why you are downvoted since you are completely correct. It is unfair to the developer but we wouldn't even have this discussion if people rejected app stores. I like that more developers just reject software certification processes. There is zero benefit aside from lock in.
- coldcode 6y ago
  Other than open season on the users with malware out the wazoo. But who cares about security. Do you buy healthcare from the back of a pickup truck?
  - davidg109 6y ago
    App stores leave a lot to be desired when it comes to security. In fact it can give users a false sense of security. https://www.cbc.ca/amp/1.5351280 https://www.cbc.ca/amp/1.5351280
    - zepto 6y ago
      Sure but Apple is clearly continuing to move in the direction of more security. The argument that they could be better therefore they are worth nothing, is a clear fallacy.
      - raxxorrax 6y ago
        Then the same is true for letting people just install apps without vendor lock in.

Tijdreiziger 6y ago

A few tweets down that thread: > Non-notarized versions will not work well on newer systems (https://appleinsider.com/articles/19/12/23/apple-will-enforce-app-notarization-for-macos-catalina-in-february https://appleinsider.com/articles/19/12/23/apple-will-enforc...) and mainly I can't currently even compile the application.

CubsFan1060 6y ago

Perhaps we should wait to get the whole story to discuss. Didn't we just go through this with the "Apple doesn't return 30% on refund" fiasco last week?

gruez 6y ago
Isn't silently revoking a longtime mac developer's certificate bad practice, regardless of the justification?
- beervirus 6y ago
  Isn't keeping the 30% on refunded apps bad practice, regardless of the justification? Well, yes, if it's true, which it wasn't.
  - gruez 6y ago
    Okay, so what are the situations where it can be false? * apple actually did communicate to them, but it was via carrier pigeon or something and it got lost * apple is under gag order * the developer is actually a long time repeat offender and is trying to evade via sockpuppet accounts None of them seem plausible to me. Also, unlike with the apple 30% refund fiasco, we know for sure this is happening, because other users are tweeting that they're receiving error messages when trying to install his software.
    - hunter2_ 6y ago
      How does other users receiving errors prove that the developer received no warning? Your first bullet point seems entirely plausible, albeit the failure mode is likely less avian.
      - charlieMonroe 6y ago
        Hi, I'm the developer. * No email in my spam box. * My contact address is still working and have received notifications about them approving my updates for the App Store yesterday (so saying that they have no way of contacting me is not true). * No known breach of account. * No accidental revocation (I was sleeping while this happened). * The certificates are revoked as you can verify via command line.

vaxman 6y ago

Apple also has the ability to remotely login to EVERYONE's Internet-connected Mac computers and monkey around (removing software etc.). Of course, they only use this when THEY feel it's really necessary. Does not matter if you subscribe to any of their paid services, does not matter if you bought a used MacMini for 50 dollars or paid 50,000 dollars for a MacPro7. Some would say "great, wish we could do it to real viruses" but others would say "what if they make a mistake trying to fix things, or if this awesome power is misused like Twitter credentials".

digi59404 6y ago
Pretty sure Apple doesn’t have this capability. What you’re referring too is functionality inside GateKeeper or near GateKeeper. Which is where Apple marks an application with a specific signature to be malware or dangerous and the OS automatically removes it. This is similar to an antivirus software removing it. There’s no login functionality, Apple doesn’t see your data and doesn’t do anything on your machine other than remove the offending application. In addition, I’ve only see it used once.
- ballenf 6y ago
  Apple's first wish from the genie in a bottle was for unlimited wishes. So it doesn't really make sense to argue over whether Apple only has x-ray vision or also the ability to walk through walls yet. Gatekeeper is our benevolent dictator that consolidates power with every update because our connectedness increases the potential for widespread damage from our attackers. And I'm ok with that, but worry we'll regret things later.
  - vaxman 6y ago
    oh look, but one source located with 10 seconds of Googling... https://techcrunch.com/2019/07/10/apple-silent-update-zoom-app/ https://techcrunch.com/2019/07/10/apple-silent-update-zoom-a...
- vaxman 6y ago
  Pretty sure you are completely wrong. It's well documented they have done it in the past and publicly made statements about it --but downvote away idiots!

mkathuri 6y ago

From the page: https://developer.apple.com/documentation/xcode/notarizing_macos_software_before_distribution https://developer.apple.com/documentation/xcode/notarizing_m... > Notarization is not App Review. The Apple notary service is an automated system that scans your software for malicious content, checks for code-signing issues, and returns the results to you quickly. If there are no issues, the notary service generates a ticket for you to staple to your software; the notary service also publishes that ticket online where Gatekeeper can find it. Perhaps the software connected to a website that was flagged as malicious by Apple. That’s one way I could see it getting flagged.

Reason077 6y ago
The developer's website (software.charliemonroe.net) is blocked by my ISP (Vodafone UK)'s adult content filter. This is strange as it does not appear to contain any adult content. I don't think it's related to it being a "YouTube downloader" app either. There are many apps with this functionality and, so far as I can tell, none of the others are blocked.
- gowld 6y ago
  Could also be caught sharing an IP range with a banned website :-|
- blibble 6y ago
  most of the internet is blocked by those mobile carrier content filters
  - reaperducer 6y ago
    In 20ish years of using the mobile internet, going back to WAP days, I've never visited a site that was blocked by a mobile carrier content filter.
    - Reason077 6y ago
      I've come across a few strange blocks. Recently when researching bread knives I found that the website of the French knife company, Opinel, is blocked by at least two UK mobile carrier's content filters. (www.opinel.com, blocked by Three and Vodafone. Not blocked by O2.) Their US site (www.opinel-usa.com) is not blocked, however, nor are the many online retailers which sell their knives.

sschueller 6y ago

How long until you will no longer be able to install unsigned apps on your mac?

auganov 6y ago

Original tweet: > "Hello everyone, today I woke up to my developer account being suspended without a single letter why which is why the apps are crashing. Please bear with me while I try to get this fixed with Apple. Thank you for understanding." Not being a Mac developer, the wording about revoking the certificate makes it sound a little more unusual than just their account being banned. Although not nice, I assume that's something that happens a lot.

simonh 6y ago
The developer's account is liked to the certificates used to sign their app binaries. If MacOS is set to only allow signed binaries to run, that means this developer's app binaries won't run. Their customers can work around this by disabling the requirement for signed binaries, but of course that's not desirable and in corporate environments might not be allowed.
- auganov 6y ago
  I understand that. Just saying that when you word it as the certificate being revoked it's not immediately obvious that's a consequence of the developer account being banned. If the headline was "longtime Apple developer suspended" quite frankly I'd be much less interested, thinking it's a common occurrence.

veidr 6y ago

I feel bad for the developer. But every time I see stories like this, I also feel a little jolt of validation regarding my choice as a developer to leave the Apple ecosystem in 2008. At the time, the App Store (iOS) was new, and I was working on porting our SSH-based encrypted remote access tool[1] from Mac to iPhone. I had been doing mainly Mac OS X development for almost 10 years. I had the proof-of-concept port from Mac to iOS working, but the amount of insane hoops I had to jump through (because it used "strong encryption" (we forked PuTTY SSH)) seemed, initially, like a trip the DMV. It gradually started feeling more like the movie Brazil. I remember going directly from WWDC to the local office of (searches old files) the "Bureau of Industry and Security" (wat) and talking to some guy who had NO idea what I was talking about when I told him my company was trying to make an iPhone app that used encryption and that Apple had told me I needed to get his agency's approval. (Nice guy, though.) Ultimately, working through the Apple documentation, I learned I had to do a bunch of weird stuff, like sign up for antique government systems that only worked on Windows XP, and provide personal info, and make a PIN, and submit an application to SNAP-R, and submit a "BIS-748P supporting document: how the Product meets the criteria of the Cryptography Note as mass market encryption software" along with a "BIS-748P supporting document: additional information to supplement our application for review and commodity classification request, in accordance with Supplement No. 6 to Part 742 of the EAR" along with "BIS-748P supporting document: sample marketing copy and brochure text" and a "BIS-748P supporting document: illustrations depicting the software in operation" and then finally a "BIS-748P supporting document: source code listings for all encryption-related source code used in the product"... that last was a ridiculous 500-page or so hard copy printout of the source code to PuTTY with the few dozen places we'd changed it (to make it multithreaded to fit better with our app architecture, haha, because I was young and dumb then). And, while I forget a lot of the details (I've just copy-pasted those now, after finding the relevant old files), I remember vividly the moment, sitting there in a Tokyo hotel business center assembling this heavy paper package to FedEx to BIS and just suddenly thinking... wait though — maybe this isn't a game I want to play. We didn't have to do any of this to ship a Mac app — any risk of legal noncompliance was ours, of course, but in reality there was no actual risk. This was all for Apple to cover their ass. If some government bureaucrat didn't like my application, my app wouldn't ship and the past year of work would be for nothing. And somehow that made me acutely aware that the same thing would be true if Apple for some reason didn't like my app. Like... what if they were planning to roll out similar rich, Mac-centric remote access features in the next OS update. Or, even if they approved it, but later just didn't want to deal some issue that arose around it — they could just revoke my app any time they pleased. (As seems to be the case with the app in this thread.) I thought about this for a couple more weeks, and then I took a corporate job doing internal systems development. The app was never finished. The lack of my app obviously didn't hurt Apple. But looking back, I do feel like the lack of having to deal Apple — and that whole weird power imbalance, of being a peasant plowing fields owned by Apple, hoping to receive some part of the fruits of my labor — probably helped me live a more serene, untroubled life. [1]: iGet Touch (phone apps were still called "blah blah Touch" then, just like many Mac apps from the early 2000s were idiotically prefixed with "i" (^_^); back then) was never finished — but it was basically a native iOS version of the Mac version, long dead but still archived here: http://nakahara-informatics.com/iget http://nakahara-informatics.com/iget

swiley 6y ago

In other words: you can’t depend on signed mac apps for anything important as a user even if they keep everything local to your computer. The developer could do something completely unrelated and your app will suddenly stop working with no warning.

ashtonkem 6y ago
And you can flip a single switch and keep running it? So?
ben509 6y ago
Which it should. If Apple detects that there's a problem with a cert, they should revoke it. Presumably, there's a known problem and something isn't working, even if it looks like it is. Arguably, it'd be nice to have a facility (assuming it doesn't already exist) to override the revocation list, but designing that it isn't bypassed by social engineering is tough.

Reason077 6y ago

The developer's website (software.charliemonroe.net) is also blocked by my ISP (Vodafone UK)'s adult content filter. This is strange as it does not appear to contain any adult content. I wonder if these things are related?

dmix 6y ago
It has an app for downloading videos off YouTube and other video sites. Not sure how much influence media companies have in the UK but maybe that's why? I know YouTube downloading services have struggled in the past to stay operational.
- Reason077 6y ago
  I don't think so. There are many "YouTube downloader" type apps, and none of the others are blocked as far as I can tell.
  - dmix 6y ago
    I guess I'm too used to Android where you need to install a 3rd party APK.
- acomjean 6y ago
  Apple is a media company now. They aren't just distributing (like apple music) but are creating TV shows like Amazon and Netflix. See Apple TV I suspect this will bring about conflicts in the company between content creation and the hardware/software divisions.
  - kps 6y ago
    Remember “Rip. Mix. Burn.”? Apple thinks different now.
    - throwaway12757 6y ago
      When you are trying to capture a new market, it's best to be open. After you have the market, you want to close the gates so no one else can have it. The hypocrisy is real and why I no longer buy apple products.

kogir 6y ago

Interesting that a few of the apps were also (voluntarily?) pulled from the developer’s website, so we can’t inspect them.

kenferry 6y ago

This seems relevant. “MPlayerX hasn’t been working for almost a year now. Also they still offer my apps on the App Store, they revoked my (direct) distribution certificate...” https://twitter.com/charliemonroe/status/1290629792430280704?s=21 https://twitter.com/charliemonroe/status/1290629792430280704...

HeavenFox 6y ago
MPlayerX was caught bundling installer with malware: https://www.reddit.com/r/apple/comments/3bhvh9/psa_do_not_install_mplayerx_the_official_site/ https://www.reddit.com/r/apple/comments/3bhvh9/psa_do_not_in... So this could be justified
- floatingatoll 6y ago
  (5 years ago)

planb 6y ago

Another possible explanation: The developer‘s certificate leaked and was really used to sign malware. Or his github repo was hacked and something evil was added to his code without him noticing. Maybe I’m just rationalizing, because if Apple is really going down the road that most commenters here suspect, then there will be no arm macbook for me unfortunately... :(

_qulr 6y ago
When this actually happened in the past, Apple worked closely with the developer: https://panic.com/blog/stolen-source-code/ https://panic.com/blog/stolen-source-code/
ben509 6y ago
So, that's plausible, and I'm trying to wrap my head around the operational model of signed software. Apple has plenty of docs about it [1] [2] [3] but never really get into "how does this work in the long run when things fail" beyond blithely noting that users won't be able to run your stuff and a host of services will start to fail. A CRL / OSCP makes sense, more or less, for websites as they can simply abandon a cert. If the cert leaks, is the remedy really to completely blacklist the certificate? Because that means that anyone who is able to steal the cert can effectively blackmail an author. I'd definitely want to revoke it, but if there's a set of valid releases, it seems like you'd want to do a partial revocation, e.g. "valid until YYMMDD." Or have a blacklist / whitelist and mark known good releases. I can't imagine how they don't have a separation of concerns given that app certificates must expire. [1]: https://developer.apple.com/support/certificates/ https://developer.apple.com/support/certificates/ [2]: https://help.apple.com/developer-account/#/dev138c9fac7 https://help.apple.com/developer-account/#/dev138c9fac7 [3]: https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/AboutCS/AboutCS.html https://developer.apple.com/library/archive/documentation/Se...
- _qulr 6y ago
  > I'd definitely want to revoke it, but if there's a set of valid releases, it seems like you'd want to do a partial revocation, e.g. "valid until YYMMDD." Or have a blacklist / whitelist and mark known good releases. Yes, this is definitely possible, and why Developer ID signing has a secure timestamp, as specified by the --timestamp flag to the /usr/bin/codesign tool. When Panic's code signing cert was stolen, they revoked it after a certain date, but old versions of their apps continued to be valid and pass Gatekeeper.

_qulr 6y ago

Update from the developer: https://blog.charliemonroe.net/a-day-without-business/ https://blog.charliemonroe.net/a-day-without-business/ "after almost 24 hours after 10PM, I got my account re-instated. Apple has called and apologized for the complications. The issue was caused by my account being erroneously flagged by automated processes as malicious and was put on hold."